Debian GNU/Linux 9 (Stretch) and 10 (Buster) ELTS:
ELA-1660-1 evolution-data-server security update
Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4505-1] ruby-rack security update
Debian GNU/Linux 12 (Bookworm) and 13 (Trixie):
[DSA 6175-1] libyaml-syck-perl security update
Debian GNU/Linux 13 (Trixie):
[DSA 6174-1] spip security update
[SECURITY] [DSA 6174-1] spip security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6174-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 22, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : spip
CVE ID : CVE-2026-33549
Jul Blobul discovered that SPIP, a website engine for publishing, is
prone to a privilege escalation vulnerability.
For the stable distribution (trixie), this problem has been fixed in
version 4.4.13+dfsg-0+deb13u1.
We recommend that you upgrade your spip packages.
For the detailed security status of spip please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/spip
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
ELA-1660-1 evolution-data-server security update
Package : evolution-data-server
Version : 3.22.7-1+deb9u3 (stretch), 3.30.5-1+deb10u3 (buster)
Related CVEs :
CVE-2026-2604
An issue has been found in evolution-data-server, an evolution database backend server. A Flatpak application with D-Bus access to the addressbook service can delete arbitrary files on the host, potentially including Flatpak override files. This fix canonicalizes the file path before performing a prefix comparison, ensuring that ../ sequences are resolved.ELA-1660-1 evolution-data-server security update
[SECURITY] [DLA 4505-1] ruby-rack security update
- -----------------------------------------------------------------------
Debian LTS Advisory DLA-4505-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Utkarsh Gupta
March 23, 2026 https://wiki.debian.org/LTS
- -----------------------------------------------------------------------
Package : ruby-rack
Version : 2.1.4-3+deb11u5
CVE ID : CVE-2026-22860 CVE-2026-25500
Debian Bug : 1128479 1128480
Two vulnerabilities were discovered in ruby-rack, a modular Ruby
webserver interface.
CVE-2026-22860
Rack::Directory's path check used a string prefix match on the
expanded path. A request like /../root_example/ could escape the
configured root if the target path started with the root string,
allowing directory listing outside the intended root.
CVE-2026-25500
Rack::Directory generated an HTML directory index where each file
entry was rendered as a clickable link. If a file existed on disk
whose basename started with the javascript: scheme, the generated
index contained an anchor whose href executed JavaScript in the
browser, resulting in a stored XSS vulnerability.
For Debian 11 bullseye, these problems have been fixed in version
2.1.4-3+deb11u5.
We recommend that you upgrade your ruby-rack packages.
For the detailed security status of ruby-rack please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-rack
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DSA 6175-1] libyaml-syck-perl security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6175-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
March 22, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libyaml-syck-perl
CVE ID : CVE-2026-4177
Several vulnerabilities were discovered in libyaml-syck-perl, a Perl
module providing a fast, lightweight YAML loader and dumper, which may
result in denial of service and potentially arbitrary code execution.
For the oldstable distribution (bookworm), this problem has been fixed
in version 1.34-2+deb12u2.
For the stable distribution (trixie), this problem has been fixed in
version 1.34-2+deb13u2.
We recommend that you upgrade your libyaml-syck-perl packages.
For the detailed security status of libyaml-syck-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libyaml-syck-perl
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
