Debian 10249 Published by

The eight point release for Debian GNU/Linux 11 is now available.



Updated Debian 11: 11.8 released

The Debian project is pleased to announce the eighth update of its oldstable distribution Debian 11 (codename bullseye). This point release mainly adds corrections for security issues, along with a few adjustments for serious problems. Security advisories have already been published separately and are referenced where available.

Please note that the point release does not constitute a new version of Debian 11 but only updates some of the packages included. There is no need to throw away old bullseye media. After installation, packages can be upgraded to the current versions using an up-to-date Debian mirror.

Those who frequently install updates from security.debian.org won't have to update many packages, and most such updates are included in the point release.

New installation images will be available soon at the regular locations.

Upgrading an existing installation to this revision can be achieved by pointing the package management system at one of Debian's many HTTP mirrors. A comprehensive list of mirrors is available at:

Gnome_shell_screenshot_ko3w60

Miscellaneous Bugfixes

This oldstable update adds a few important corrections to the following packages:

PackageReason
adduserFix command injection vulnerability in deluser
aideFix handling of extended attributes on symlinks
amd64-microcodeUpdate included microcode, including fixes for AMD Inception on AMD Zen4 processors [CVE-2023-20569]
appstream-glibHandle <em> and <code> tags in metadata
asmtoolsBackport to bullseye for future openjdk-11 builds
autofsFix missing mutex unlock; do not use rpcbind for NFS4 mounts; fix regression determining reachability on dual-stack hosts
base-filesUpdate for the 11.8 point release
batikFix Server Side Request Forgery issues [CVE-2022-44729 CVE-2022-44730]
bmakeConflict with bsdowl (<< 2.2.2-1.2~) to ensure smooth upgrades
boxer-dataBackport thunderbird compatibility fixes
ca-certificates-javaWork around unconfigured jre during new installations
cairosvgHandle data: URLs in safe mode
cargo-mozillaNew upstream version, to support building newer firefox-esr versions
clamavNew upstream stable release; fix denial of service vulnerability via HFS+ parser [CVE-2023-20197]
cpioFix arbitrary code execution issue [CVE-2021-38185]; replace Suggests: on libarchive1 with libarchive-dev
cryptmountFix memory-initialization in command-line parser
cupsFix heap-based buffer overflow issues [CVE-2023-4504 CVE-2023-32324], unauthenticated access issue [CVE-2023-32360], use-after-free issue [CVE-2023-34241]
curlFix code execution issues [CVE-2023-27533 CVE-2023-27534], information disclosure issues [CVE-2023-27535 CVE-2023-27536 CVE-2023-28322], inappropriate connection re-use issue [CVE-2023-27538], improper certificate validation issue [CVE-2023-28321]
dbusNew upstream stable release; fix denial of service issue [CVE-2023-34969]
debian-designRebuild using newer boxer-data
debian-installerIncrease Linux kernel ABI to 5.10.0-26; rebuild against proposed-updates
debian-installer-netboot-imagesRebuild against proposed-updates
debian-parlRebuild using newer boxer-data
debian-security-supportSet DEB_NEXT_VER_ID=12 as bookworm is the next release; security-support-limited: add gnupg1
distro-info-dataAdd Debian 14 forky; correct Ubuntu 23.04 release date; add Ubuntu 23.10 Mantic Minotaur; add the planned release date for Debian bookworm
dkimpyNew upstream bugfix release
dpdkNew upstream stable release
dpkgAdd support for loong64 CPU; handle missing Version when formatting source:Upstream-Version; fix varbuf memory leak in pkg_source_version()
flameshotDisable uploads to imgur by default; fix name of d/NEWS file in previous upload
ghostscriptFix buffer overflow issue [CVE-2023-38559]; try and secure the IJS server startup [CVE-2023-43115]
gititRebuild against new pandoc
gruntFix race condition in symlink copying [CVE-2022-1537]
gssAdd Breaks+Replaces: libgss0 (<< 0.1)
haskell-hakyllRebuild against new pandoc
haskell-pandoc-citeprocRebuild against new pandoc
hnswlibFix double free in init_index when the M argument is a large integer [CVE-2023-37365]
horizonFix open redirect issue [CVE-2022-45582]
inetutilsCheck return values for set*id() functions, avoiding potential security issues [CVE-2023-40303]
krb5Fix free of uninitialised pointer [CVE-2023-36054]
kscreenlockerFix authentication error when using PAM
lacmeHandle CA ready, processing and valid states correctly
lapackFix eigenvector matrix
lemonldap-ngFix open redirection when OIDC RP has no redirect URIs; fix Server Side Request Forgery issue [CVE-2023-44469]; fix open redirection due to incorrect escape handling
libapache-mod-jkRemove implicit mapping functionality, which could lead to unintended exposure of the status worker and/or bypass of security constraints [CVE-2023-41081]
libbsdFix infinite loop in MD5File
libclamunrarNew upstream stable release
libpreludeMake Python module usable
libreswanFix denial of service issue [CVE-2023-30570]
libsignal-protocol-cFix integer overflow issue [CVE-2022-48468]
linuxNew upstream stable release
linux-signed-amd64New upstream stable release
linux-signed-arm64New upstream stable release
linux-signed-i386New upstream stable release
logrotateAvoid replacement of /dev/null with a regular file if used for the state file
ltspAvoid using mv on init symlink in order to work around overlayfs issue
lttng-modulesFix build issues with newer kernel versions
lua5.3Fix use after free in lua_upvaluejoin (lapi.c) [CVE-2019-6706]; fix segmentation fault in getlocal and setlocal (ldebug.c) [CVE-2020-24370]
mariadb-10.5New upstream bugfix release [CVE-2022-47015]
mujsSecurity fix
ncursesDisallow loading of custom terminfo entries in setuid/setgid programs [CVE-2023-29491]
node-css-whatFix regular expression-based denial of service issue [CVE-2022-21222 CVE-2021-33587]
node-json5Fix prototype pollution issue [CVE-2022-46175]
node-tough-cookieSecurity fix: prototype pollution [CVE-2023-26136]
nvidia-graphics-driversNew upstream release [CVE-2023-25515 CVE-2023-25516]; improve compatibility with recent kernels
nvidia-graphics-drivers-tesla-450New upstream release [CVE-2023-25515 CVE-2023-25516]
nvidia-graphics-drivers-tesla-470New upstream bugfix release [CVE-2023-25515 CVE-2023-25516]
openblasFix results of DGEMM on AVX512-capable hardware, when the package has been built on pre-AVX2 hardware
opensshFix remote code execution issue via a forwarded agent socket [CVE-2023-38408]
opensslNew upstream stable release; fix denial of service issues [CVE-2023-3446 CVE-2023-3817]
org-modeFix command injection vulnerability [CVE-2023-28617]
pandocFix arbitrary file write issues [CVE-2023-35936 CVE-2023-38745]
pevFix buffer overflow issue [CVE-2021-45423]
php-guzzlehttp-psr7Fix improper input validation [CVE-2023-29197]
php-nyholm-psr7Fix improper input validation issue [CVE-2023-29197]
postgisFix axis order regression
protobufSecurity fixes: DoS in Java [CVE-2021-22569]; NULL pointer dereference [CVE-2021-22570]; memory DoS [CVE-2022-1941]
python2.7Fix parameter cloaking issue [CVE-2021-23336], URL injection issue [CVE-2022-0391], use-after-free issue [CVE-2022-48560], XML External Entity issue [CVE-2022-48565]; improve constant-time comparisons in compare_digest() [CVE-2022-48566]; improve URL parsing [CVE-2023-24329]; prevent reading unauthenticated data on an SSLSocket [CVE-2023-40217]
qemuFix infinite loop [CVE-2020-14394], NULL pointer dereference issue [CVE-2021-20196], integer overflow issue [CVE-2021-20203], buffer overflow issues [CVE-2021-3507 CVE-2023-3180], denial of service issues [CVE-2021-3930 CVE-2023-3301], use-after-free issue [CVE-2022-0216], possible stack overflow and use-after-free issues [CVE-2023-0330], out-of-bounds read issue [CVE-2023-1544]
rarNew upstream release; fix directory traversal issue [CVE-2022-30333]; fix arbitrary code execution issue [CVE-2023-40477]
rhonabwyFix aesgcm buffer overflow [CVE-2022-32096]
roundcubeNew upstream stable release; fix cross-site scripting issue [CVE-2023-43770]; Enigma: Fix initial synchronization of private keys
rust-cbindgenNew upstream version, to support building newer firefox-esr versions
rustc-mozillaNew upstream version, to support building newer firefox-esr versions
schleuderAdd versioned dependency on ruby-activerecord
sgt-puzzlesFix various security issues in game loading [CVE-2023-24283 CVE-2023-24284 CVE-2023-24285 CVE-2023-24287 CVE-2023-24288 CVE-2023-24291]
spipSeveral security fixes; security fix for extended authentification data filtering
spyderFix broken patch in previous update
systemdUdev: fix creating /dev/serial/by-id/ symlinks for USB devices; fix memory leak on daemon-reload; fix a calendar spec calculation hang on DST change if TZ=Europe/Dublin
tangFix race condition when creating/rotating keys; assert restrictive permissions on key directory [CVE-2023-1672]; make tangd-rotate-keys executable
testng7Backport to oldstable for future openjdk-17 builds
tinysshWork around incoming packets which don't honour max packet length
unrar-nonfreeFix file overwrite issue [CVE-2022-48579]; fix remote code execution issue [CVE-2023-40477]
xenNew upstream stable release; fix security issues [CVE-2023-20593 CVE-2023-20569 CVE-2022-40982]
yajlMemory leak security fix; security fixes: potential denial of service with crafted JSON file [CVE-2017-16516]; heap memory corruption when dealing with large (~2GB) inputs [CVE-2022-24795]; fix incomplete patch for CVE-2023-33460

Security Updates

This revision adds the following security updates to the oldstable release. The Security Team has already released an advisory for each of these updates:

Advisory IDPackage
DSA-5394 ffmpeg
DSA-5395 nodejs
DSA-5396 evolution
DSA-5396 webkit2gtk
DSA-5397 wpewebkit
DSA-5398 chromium
DSA-5399 odoo
DSA-5400 firefox-esr
DSA-5401 postgresql-13
DSA-5402 linux-signed-amd64
DSA-5402 linux-signed-arm64
DSA-5402 linux-signed-i386
DSA-5402 linux
DSA-5403 thunderbird
DSA-5404 chromium
DSA-5405 libapache2-mod-auth-openidc
DSA-5406 texlive-bin
DSA-5407 cups-filters
DSA-5408 libwebp
DSA-5409 libssh
DSA-5410 sofia-sip
DSA-5411 gpac
DSA-5412 libraw
DSA-5413 sniproxy
DSA-5414 docker-registry
DSA-5415 libreoffice
DSA-5416 connman
DSA-5417 openssl
DSA-5418 chromium
DSA-5419 c-ares
DSA-5420 chromium
DSA-5421 firefox-esr
DSA-5422 jupyter-core
DSA-5423 thunderbird
DSA-5424 php7.4
DSA-5426 owslib
DSA-5427 webkit2gtk
DSA-5428 chromium
DSA-5430 openjdk-17
DSA-5431 sofia-sip
DSA-5432 xmltooling
DSA-5433 libx11
DSA-5434 minidlna
DSA-5435 trafficserver
DSA-5436 hsqldb1.8.0
DSA-5437 hsqldb
DSA-5438 asterisk
DSA-5439 bind9
DSA-5440 chromium
DSA-5441 maradns
DSA-5442 flask
DSA-5443 gst-plugins-base1.0
DSA-5444 gst-plugins-bad1.0
DSA-5445 gst-plugins-good1.0
DSA-5446 ghostscript
DSA-5447 mediawiki
DSA-5449 webkit2gtk
DSA-5450 firefox-esr
DSA-5451 thunderbird
DSA-5452 gpac
DSA-5453 linux-signed-amd64
DSA-5453 linux-signed-arm64
DSA-5453 linux-signed-i386
DSA-5453 linux
DSA-5455 iperf3
DSA-5456 chromium
DSA-5457 webkit2gtk
DSA-5459 amd64-microcode
DSA-5461 linux-signed-amd64
DSA-5461 linux-signed-arm64
DSA-5461 linux-signed-i386
DSA-5461 linux
DSA-5463 thunderbird
DSA-5464 firefox-esr
DSA-5465 python-django
DSA-5467 chromium
DSA-5468 webkit2gtk
DSA-5470 python-werkzeug
DSA-5471 libhtmlcleaner-java
DSA-5472 cjose
DSA-5473 orthanc
DSA-5474 intel-microcode
DSA-5475 linux-signed-amd64
DSA-5475 linux-signed-arm64
DSA-5475 linux-signed-i386
DSA-5475 linux
DSA-5476 gst-plugins-ugly1.0
DSA-5478 openjdk-11
DSA-5479 chromium
DSA-5480 linux-signed-amd64
DSA-5480 linux-signed-arm64
DSA-5480 linux-signed-i386
DSA-5480 linux
DSA-5481 fastdds
DSA-5482 tryton-server
DSA-5483 chromium
DSA-5484 librsvg
DSA-5485 firefox-esr
DSA-5486 json-c
DSA-5487 chromium
DSA-5489 file
DSA-5490 aom
DSA-5491 chromium
DSA-5493 open-vm-tools
DSA-5494 mutt
DSA-5495 frr
DSA-5497 libwebp
DSA-5500 flac
DSA-5502 xorgxrdp
DSA-5502 xrdp
DSA-5503 netatalk
DSA-5504 bind9
DSA-5505 lldpd
DSA-5507 jetty9
DSA-5510 libvpx

Removed packages

The following packages were removed due to circumstances beyond our control:

PackageReason
atlas-cppunstable upstream, unsuitable for Debian
ember-mediaunstable upstream, unsuitable for Debian
erisunstable upstream, unsuitable for Debian
libwfutunstable upstream, unsuitable for Debian
mercatorunstable upstream, unsuitable for Debian
nomadsecurity fixes no longer available
nomad-driver-lxcdepends on to-be-removed nomad
skstreamunstable upstream, unsuitable for Debian
varconfunstable upstream, unsuitable for Debian
wfmathunstable upstream, unsuitable for Debian

Debian Installer

The installer has been updated to include the fixes incorporated into oldstable by the point release.

URLs

The complete lists of packages that have changed with this revision:

The current oldstable distribution:

Proposed updates to the oldstable distribution:

oldstable distribution information (release notes, errata etc.):

Security announcements and information: