Debian GNU/Linux 9 (Stretch) Extended LTS:
ELA-1654-1 python-tornado security update
Debian GNU/Linux 9 (Stretch) and 10 (Buster) Extended LTS:
ELA-1652-1 glib2.0 security update
Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4494-1] orthanc security update
[DLA 4495-1] thunderbird security update
Debian GNU/Linux 12 (Bookworm) and 13 (Trixie):
[DSA 6152-1] thunderbird security update
ELA-1652-1 glib2.0 security update
Package : glib2.0
Version : 2.50.3-2+deb9u9 (stretch), 2.58.3-2+deb10u10 (buster)
Related CVEs :
CVE-2026-0988
CVE-2026-1484
CVE-2026-1485
CVE-2026-1489
Multiple issues were found in GLib, a general-purpose, portable utility
library, that could lead to denial of service, memory corruption or
potentially arbitrary code execution if maliciously crafted data is
processed.
CVE-2026-0988
Codean Labs found missing validation of offset and count parameters in the
g_buffered_input_stream_peek() function can lead to an integer overflow
during length calculation. When specially crafted values are provided, this
overflow results in an incorrect size being passed to memcpy(), triggering
a buffer overflow. This can cause application crashes, leading to a Denial
of Service (DoS).
CVE-2026-1484
treeplus, with additional thanks to Sovereign Tech Resilience program of the
Sovereign Tech Agency, found a flaw in the GLib Base64 encoding routine when
processing very large input data. Due to incorrect use of integer types
during length calculation, the library may miscalculate buffer boundaries.
This can cause memory writes outside the allocated buffer. Applications
that process untrusted or extremely large Base64 input using GLib may crash
or behave unpredictably.
CVE-2026-1485
treeplus, with additonal thanks to Sovereign Tech Resilience program of the
Sovereign Tech Agency, found a flaw in Glib’s content type parsing logic.
This buffer underflow vulnerability occurs because the length of a header
line is stored in a signed integer, which can lead to integer wraparound
for very large inputs. This results in pointer underflow and out-of-bounds
memory access. Exploitation requires a local user to install or
process a specially crafted treemagic file, which can lead to local
denial of service or application instability.
CVE-2026-1489
treeplus, with additional thanks to Sovereign Tech Resilience program of the
Sovereign Tech Agency, found a flaw in GLib. An integer overflow
vulnerability in its Unicode case conversion implementation can lead to
memory corruption. By processing specially crafted and extremely large
Unicode strings, an attacker could trigger an undersized memory allocation,
resulting in out-of-bounds writes. This could cause applications utilizing
GLib for string conversion to crash or become unstable.
ELA-1652-1 glib2.0 security update
[SECURITY] [DLA 4494-1] orthanc security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4494-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Paride Legovini
February 28, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : orthanc
Version : 1.9.2+really1.9.1+dfsg-1+deb11u2
CVE ID : CVE-2025-15581
Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in
the application's HTTP Basic Authentication implementation. Successful
exploitation could result in Privilege Escalation, potentially allowing full
administrative access.
For Debian 11 bullseye, this problem has been fixed in version
1.9.2+really1.9.1+dfsg-1+deb11u2.
We recommend that you upgrade your orthanc packages.
For the detailed security status of orthanc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/orthanc
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DSA 6152-1] thunderbird security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6152-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
February 28, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : thunderbird
CVE ID : CVE-2026-2757 CVE-2026-2758 CVE-2026-2759 CVE-2026-2761
CVE-2026-2762 CVE-2026-2763 CVE-2026-2764 CVE-2026-2765
CVE-2026-2766 CVE-2026-2767 CVE-2026-2768 CVE-2026-2769
CVE-2026-2770 CVE-2026-2771 CVE-2026-2772 CVE-2026-2773
CVE-2026-2774 CVE-2026-2775 CVE-2026-2776 CVE-2026-2777
CVE-2026-2778 CVE-2026-2779 CVE-2026-2780 CVE-2026-2781
CVE-2026-2782 CVE-2026-2783 CVE-2026-2784 CVE-2026-2785
CVE-2026-2786 CVE-2026-2787 CVE-2026-2788 CVE-2026-2789
CVE-2026-2790 CVE-2026-2791 CVE-2026-2792 CVE-2026-2793
Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code or information disclosure.
For the oldstable distribution (bookworm), these problems have been fixed
in version 1:140.8.0esr-1~deb12u1.
For the stable distribution (trixie), these problems have been fixed in
version 1:140.8.0esr-1~deb13u1.
We recommend that you upgrade your thunderbird packages.
For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 4495-1] thunderbird security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4495-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
February 28, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : thunderbird
Version : 1:140.8.0esr-1~deb11u1
CVE ID : CVE-2026-2757 CVE-2026-2758 CVE-2026-2759 CVE-2026-2761
CVE-2026-2762 CVE-2026-2763 CVE-2026-2764 CVE-2026-2765
CVE-2026-2766 CVE-2026-2767 CVE-2026-2768 CVE-2026-2769
CVE-2026-2770 CVE-2026-2771 CVE-2026-2772 CVE-2026-2773
CVE-2026-2774 CVE-2026-2775 CVE-2026-2776 CVE-2026-2777
CVE-2026-2778 CVE-2026-2779 CVE-2026-2780 CVE-2026-2781
CVE-2026-2782 CVE-2026-2783 CVE-2026-2784 CVE-2026-2785
CVE-2026-2786 CVE-2026-2787 CVE-2026-2788 CVE-2026-2789
CVE-2026-2790 CVE-2026-2791 CVE-2026-2792 CVE-2026-2793
Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code or information disclosure.
For Debian 11 bullseye, these problems have been fixed in version
1:140.8.0esr-1~deb11u1.
We recommend that you upgrade your thunderbird packages.
For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1654-1 python-tornado security update
Package : python-tornado
Version : 4.4.3-1+deb9u2 (stretch)
Related CVEs :
CVE-2025-47287
CVE-2025-67724
CVE-2025-67725
CVE-2025-67726
Multiple vulnerabilities were discovered in python-tornado, a scalable,
non-blocking Python web framework and asynchronous networking library.
CVE-2025-47287
When Tornado's 'multipart/form-data' parser encounters certain errors,
it logs a warning but continues trying to parse the remainder of the
data. This allows remote attackers to generate an extremely high volume
of logs, constituting a DoS attack. This DoS is compounded by the fact
that the logging subsystem is synchronous.
CVE-2025-67724
Custom reason phrases can cause multiple vulnerabilities (like XSS,
header injection, ...) due to being used unescaped in HTTP headers.
CVE-2025-67725
A single maliciously crafted HTTP request can cause a possible DoS
due to quadratic performance of repeated header lines.
CVE-2025-67726
An inefficient algorithm when parsing parameters for HTTP header
values can potentially cause a DoS.ELA-1654-1 python-tornado security update
