Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4418-1] python-mechanize security update
[DLA 4417-1] usbmuxd security update
Debian GNU/Linux 12 (Bookworm) and 13 (Trixie):
[DSA 6089-1] chromium security update
[DSA 6090-1] rails security update
Debian GNU/Linux 13 (Trixie):
[DSA 6088-1] php8.4 security update
[DSA 6091-1] wordpress security update
[SECURITY] [DSA 6089-1] chromium security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6089-1 security@debian.org
https://www.debian.org/security/ Andres Salomon
December 21, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : chromium
CVE ID : CVE-2025-14765 CVE-2025-14766
Security issues were discovered in Chromium which could result
in the execution of arbitrary code, denial of service, or information
disclosure.
For the oldstable distribution (bookworm), these problems have been fixed
in version 143.0.7499.169-1~deb12u1.
For the stable distribution (trixie), these problems have been fixed in
version 143.0.7499.169-1~deb13u1.
We recommend that you upgrade your chromium packages.
For the detailed security status of chromium please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/chromium
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 6088-1] php8.4 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6088-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 21, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : php8.4
CVE ID : CVE-2025-14177 CVE-2025-14178 CVE-2025-14180
Multiple security issues were found in PHP, a widely-used open source
general purpose scripting language which could result in denial of
service or memory disclosure.
For the stable distribution (trixie), these problems have been fixed in
version 8.4.16-1~deb13u1.
We recommend that you upgrade your php8.4 packages.
For the detailed security status of php8.4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php8.4
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 6091-1] wordpress security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6091-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 21, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : wordpress
CVE ID : CVE-2025-58246 CVE-2025-58674
Multiple security issues were discovered in the WordPress blogging tool,
which could result in cross-site scripting or information disclosure.
For the stable distribution (trixie), these problems have been fixed in
version 6.8.3+dfsg1-0+deb13u1.
We recommend that you upgrade your wordpress packages.
For the detailed security status of wordpress please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/wordpress
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 4418-1] python-mechanize security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4418-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Daniel Leidert
December 22, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : python-mechanize
Version : 1:0.4.5-2+deb11u1
CVE ID : CVE-2021-32837
Erik Krogh Kristensen and Rasmus Petersen from the GitHub Security Lab
discovered a ReDoS (Regular Expression Denial of Service) vulnerability
in python-mechanize, a library to automate interaction with websites
modeled after the Perl module WWW::Mechanize, which could lead to
Denial of Service when parsing a malformed authentication header.
For Debian 11 bullseye, this problem has been fixed in version
1:0.4.5-2+deb11u1.
We recommend that you upgrade your python-mechanize packages.
For the detailed security status of python-mechanize please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/python-mechanize
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4417-1] usbmuxd security update
- -----------------------------------------------------------------------
Debian LTS Advisory DLA-4417-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Utkarsh Gupta
December 21, 2025 https://wiki.debian.org/LTS
- -----------------------------------------------------------------------
Package : usbmuxd
Version : 1.1.1-2+deb11u1
CVE ID : CVE-2025-66004
Debian Bug : 1122507
It was discovered that usbmuxd, USB multiplexor daemon for iPhone and
iPod Touch devices, incorrectly handled certain paths received with
the SavePairRecord command. A local attacker could possibly use this
issue to delete and write files named *.plist in arbitrary locations.
For Debian 11 bullseye, this problem has been fixed in version
1.1.1-2+deb11u1.
We recommend that you upgrade your usbmuxd packages.
For the detailed security status of usbmuxd please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/usbmuxd
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DSA 6090-1] rails security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6090-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
December 21, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : rails
CVE ID : CVE-2025-24293 CVE-2025-55193
Multiple security issues were discovered in the Rails web framework
which could result in command injection or logging of unescaped ANSI
sequences.
For the oldstable distribution (bookworm), these problems have been fixed
in version 2:6.1.7.10+dfsg-1~deb12u2.
For the stable distribution (trixie), these problems have been fixed in
version 2:7.2.2.2+dfsg-2~deb13u1.
We recommend that you upgrade your rails packages.
For the detailed security status of rails please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/rails
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
