[DLA 4241-1] ffmpeg security update
ELA-1481-1 redis security update
[SECURITY] [DLA 4241-1] ffmpeg security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4241-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
July 14, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : ffmpeg
Version : 7:4.3.9-0+deb11u1
CVE ID : CVE-2023-6601 CVE-2023-6602 CVE-2023-6604 CVE-2023-6605
Multiple vulnerabilities have been fixed in the multimedia framework FFmpeg.
CVE-2023-6601
Triggering arbitrary demuxers via base64 data URIs
CVE-2023-6602
Improper parsing of input files in HLS playlists
CVE-2023-6604
Demuxing of arbitrary data as XBIN-formatted data
CVE-2023-6605
Arbitrary HTTP GET requests via crafted DASH playlist
For Debian 11 bullseye, these problems have been fixed in version
7:4.3.9-0+deb11u1.
We recommend that you upgrade your ffmpeg packages.
For the detailed security status of ffmpeg please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ffmpeg
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1481-1 redis security update
Package : redis
Version : 3:3.2.6-3+deb9u16 (stretch), 5:5.0.14-1+deb10u9 (buster)
Related CVEs :
CVE-2025-32023
CVE-2025-48367
Two issues were discovered in Redis, the key-value database:
CVE-2025-32023: An authenticated user may have used a
specially-crafted string to trigger a stack/heap out-of-bounds write during
hyperloglog operations, potentially leading to a remote code execution
vulnerability. Installations that used Redis’ ACL system to restrict
hyperloglog HLL commands are unaffected by this issue.
CVE-2025-48367: An unauthenticated connection could have caused
repeated IP protocol errors, leading to client starvation and ultimately
become a Denial of Service (DoS) attack.
ELA-1481-1 redis security update
