ELA-1772-1 dnsmasq security update (by )
[DLA 4684-1] opam security update
[DLA 4683-1] wolfssl security update
ELA-1772-1 dnsmasq security update (by )
Package : dnsmasq
Version : 2.76-5+deb9u6 (stretch), 2.80-1+deb10u4 (buster)
Related CVEs :
CVE-2026-2291
CVE-2026-4890
CVE-2026-4891
CVE-2026-4892
CVE-2026-4893
Several vulnerabilities have been discovered in dnsmasq, a caching DNS
proxy and DHCP/TFTP server.
CVE-2026-2291
dnsmasqs extract_name() function can be abused to cause a heap buffer
overflow, allowing an attacker to inject false DNS cache entries,
which could result in DNS lookups to redirect to an
attacker-controlled IP address, or to cause a DoS.
CVE-2026-4890
A Denial of Service (DoS) vulnerability in the DNSSEC validation of
dnsmasq allows remote attackers to cause a denial of service via a
crafted DNS packet.
Debian Stretch has not been affected by this, due to disabled DNSSEC.
CVE-2026-4891
A heap-based out-of-bounds read vulnerability in the DNSSEC validation
of dnsmasq allows remote attackers to cause a denial of service via a
crafted DNS packet.
Debian Stretch has not been affected by this, due to disabled DNSSEC.
CVE-2026-4892
A heap-based out-of-bounds write vulnerability in the DHCPv6
implementation of dnsmasq allows local attackers to execute arbitrary
code with root privileges via a crafted DHCPv6 packet.
CVE-2026-4893
An information disclosure vulnerability in dnsmasq allows remote
attackers to bypass source checks via a crafted DNS packet with RFC
7871 client subnet information.ELA-1772-1 dnsmasq security update (by )
[SECURITY] [DLA 4684-1] opam security update
- -----------------------------------------------------------------------
Debian LTS Advisory DLA-4684-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Utkarsh Gupta
July 15, 2026 https://wiki.debian.org/LTS
- -----------------------------------------------------------------------
Package : opam
Version : 2.1.2-1+deb12u2
CVE ID : CVE-2026-57825
Kate Deplaix reported that .install file directives were insufficiently
restricted in OPAM, a package manager for OCaml. Installing files
through .install files did not check symlinks resolution on the target
path, which could result in directory traversal out of the package area.
For Debian 12 bookworm, this problem has been fixed in version
2.1.2-1+deb12u2.
We recommend that you upgrade your opam packages.
For the detailed security status of opam please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/opam
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4683-1] wolfssl security update
- -----------------------------------------------------------------------
Debian LTS Advisory DLA-4683-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Utkarsh Gupta
July 15, 2026 https://wiki.debian.org/LTS
- -----------------------------------------------------------------------
Package : wolfssl
Version : 5.5.4-2+deb12u3
CVE ID : CVE-2026-5194 CVE-2026-6092 CVE-2026-6094 CVE-2026-6325
CVE-2026-6329 CVE-2026-6331 CVE-2026-6450 CVE-2026-6678
CVE-2026-6681 CVE-2026-6731 CVE-2026-7511 CVE-2026-55961
CVE-2026-55962 CVE-2026-55967
Multiple vulnerabilities were discovered in wolfSSL, a lightweight,
portable, C-language-based SSL/TLS library, which could result in
signature forgery, authentication bypass, information disclosure, or
denial of service.
CVE-2026-5194
Missing hash/digest size and OID checks allowed digests smaller
than appropriate for the relevant key type to be accepted during
ECDSA certificate signature verification, weakening ECDSA
certificate-based authentication when EdDSA or ML-DSA support was
also enabled.
CVE-2026-6092
When configured with HAVE_ENCRYPT_THEN_MAC, the TLS resumption path
could fall back to MAC-then-Encrypt instead of enforcing
Encrypt-then-MAC.
CVE-2026-6094
A heap buffer over-read in wc_PKCS7_DecodeEnvelopedData when parsing
crafted PKCS#7 EnvelopedData could be triggered by attacker-supplied
data delivered via S/MIME or CMS.
CVE-2026-6325
An out-of-bounds write in SetSuitesHashSigAlgo when processing an
oversized signature algorithms list allowed a write past the bounds
of the destination buffer.
CVE-2026-6329
PKCS#12 MAC verification compared the computed HMAC against the
stored MAC using an attacker-controlled length, allowing a truncated
or zero-length MAC to be accepted and defeating the integrity
protection of the MAC.
CVE-2026-6331
An HMAC zero-length tag forgery in EVP_DigestVerifyFinal allowed a
truncated or empty tag to be accepted as a valid signature, because
the supplied length was only checked not to exceed the MAC length.
CVE-2026-6450
A CRL critical extension bypass in ParseCRL_Extensions allowed a
crafted CRL carrying an unhandled critical extension to be accepted.
This only affects builds with CRL support enabled.
CVE-2026-6678
An integer underflow in wc_PKCS7_DecryptOri when handling crafted
OtherRecipientInfo led to incorrect length handling during
decryption.
CVE-2026-6681
The PKCS#7 decode path ignored the caller-supplied output buffer
size (outputSz), allowing decoded content to be written past the
bounds of the provided buffer.
CVE-2026-6731
An X.509 name constraint bypass allowed a certificate whose Subject
Common Name violated an issuing CA's DNS name constraints to be
accepted when the CN was treated as a DNS-type name.
CVE-2026-7511
A PKCS7_verify signer confusion issue meant the signer associated
with a signature was not correctly bound, permitting a forged
signature to be accepted.
CVE-2026-55961
wolfSSL_PKCS7_verify() returned success for a degenerate
(certs-only) PKCS#7 object containing no signer, so a bundle
carrying no valid signature could be reported as verified. This
only affects OpenSSL compatibility builds.
CVE-2026-55962
A TLS 1.3 post-handshake authentication issue allowed a server to
accept a client's Finished message without the client having sent a
Certificate and CertificateVerify. This only affects TLS 1.3
servers configured with and actively using post-handshake
authentication.
CVE-2026-55967
AES-GCM encryption/decryption with extremely large cumulative single
message sizes (>64 GiB) were not properly rejected by the streaming
APIs, allowing counter wrap, keystream reuse and consequent
plaintext recovery.
For Debian 12 bookworm, these problems have been fixed in version
5.5.4-2+deb12u3.
We recommend that you upgrade your wolfssl packages.
For the detailed security status of wolfssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/wolfssl
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
