Multiple security updates have been released for Debian GNU/Linux systems, including iperf3, unbound, and firebird3.0, to address vulnerabilities such as heap buffer overflows, shell code injection, and denial of service attacks via specially timed DNS queries and answers. The affected versions include 3.9-1+deb11u3deb9u1 for iperf3 and 1.9.0-2+deb10u2deb9u6 for unbound, both for Debian 9 (Stretch) ELTS; 1.9.0-2+deb10u6 for unbound on Debian 10 (Buster) ELTS; and 3.0.7.33374.ds4-2+deb11u1 for firebird3.0 on Debian 11 (Bullseye) LTS:

ELA-1505-1 iperf3 security update
ELA-1504-1 unbound1.9 security update
ELA-1503-1 unbound security update
[DLA 4282-1] firebird3.0 security update

ELA-1505-1 iperf3 security update

Package : iperf3
Version : 3.9-1+deb11u3~deb9u1 (stretch), 3.9-1+deb11u3~deb10u1 (buster)

Related CVEs :
CVE-2025-54349
CVE-2025-54350

Two vulnerabilities have been fixed in the IP bandwidth measuring tool iperf3.

CVE-2025-54349
heap buffer overflow

CVE-2025-54350
reachable assert

ELA-1505-1 iperf3 security update

ELA-1504-1 unbound1.9 security update

Package : unbound1.9
Version : 1.9.0-2+deb10u2~deb9u6 (stretch)

Related CVEs :
CVE-2019-18934
CVE-2024-33655
CVE-2025-5994

CVE-2025-5994

Resolvers supporting ECS need to segregate outgoing queries to
accommodate for different outgoing ECS information. This re-opens
up resolvers to a birthday paradox attack (Rebirthday Attack) that
tries to match the DNS transaction ID in order to cache non-ECS
poisonous replies.
Unbound now includes a fix that disregards replies that came back
without ECS when ECS was expected.

CVE-2024-33655

The DNSBomb attack, via specially timed DNS queries and answers, can
cause a Denial of Service on resolvers and spoofed targets.
While Unbound itself is not vulnerable for DoS, it can be used to
take part in a pulsing DoS amplification attack.
Configuration options have been added to help mitigate the impact by
trying to shrink the DNSBomb window so that the impact of the DoS
from Unbound is significantly lower than it used to be:

discard-timeout (default value: 1900)

After 1900 ms a reply to the client will be dropped. Unbound
would still work on the query but refrain from replying in order
to not accumulate a huge number of “old” replies. Legitimate
clients retry on timeouts.

wait-limit (default value: 1000)

Limits the amount of client queries that require recursion
(cache-hits are not counted) per IP address. More recursive
queries than the allowed limit are dropped.
Use `wait-limit: 0` in order to disable all wait limits.

wait-limit-netblock

These do not have a default value but they can fine grain
configuration for specific netblocks.

CVE-2019-18934

Shell code injection vulnerability after receiving a specially
crafted answer. This issue can only be triggered if unbound was
compiled with --enable-ipsecmod support, and ipsecmod is enabled
and used in the configuration.
Debian binary packages are not built with --enable-ipsecmod, and
therefore unaffected. Still, the fix is included in the source
package for users building their own packages.

In addition, this version includes follow-up upstream fixes and
improvements for CVE-2024-43167.

ELA-1504-1 unbound1.9 security update

ELA-1503-1 unbound security update

Package : unbound

Version : 1.9.0-2+deb10u6 (buster)

Related CVEs :

CVE-2019-18934
CVE-2019-25031
CVE-2019-25032
CVE-2019-25033
CVE-2019-25034
CVE-2019-25035
CVE-2019-25036
CVE-2019-25037
CVE-2019-25038
CVE-2019-25039
CVE-2019-25040
CVE-2019-25041
CVE-2019-25042
CVE-2024-33655
CVE-2025-5994

CVE-2025-5994

Resolvers supporting ECS need to segregate outgoing queries to
accommodate for different outgoing ECS information. This re-opens
up resolvers to a birthday paradox attack (Rebirthday Attack) that
tries to match the DNS transaction ID in order to cache non-ECS
poisonous replies.
Unbound now includes a fix that disregards replies that came back
without ECS when ECS was expected.

CVE-2024-33655

The DNSBomb attack, via specially timed DNS queries and answers, can
cause a Denial of Service on resolvers and spoofed targets.
While Unbound itself is not vulnerable for DoS, it can be used to
take part in a pulsing DoS amplification attack.
Configuration options have been added to help mitigate the impact by
trying to shrink the DNSBomb window so that the impact of the DoS
from Unbound is significantly lower than it used to be:

discard-timeout (default value: 1900)

After 1900 ms a reply to the client will be dropped. Unbound
would still work on the query but refrain from replying in order
to not accumulate a huge number of “old” replies. Legitimate
clients retry on timeouts.

wait-limit (default value: 1000)

Limits the amount of client queries that require recursion
(cache-hits are not counted) per IP address. More recursive
queries than the allowed limit are dropped.
Use `wait-limit: 0` in order to disable all wait limits.

wait-limit-netblock

These do not have a default value but they can fine grain
configuration for specific netblocks.

CVE-2019-25031

Configuration injection in create_unbound_ad_servers.sh upon a
successful man-in-the-middle attack against a cleartext HTTP
session.

CVE-2019-25032

Integer overflow in the regional allocator via regional_alloc.

CVE-2019-25033

Integer overflow in the regional allocator via the ALIGN_UP macro.

CVE-2019-25034

Integer overflow in sldns_str2wire_dname_buf_origin() leading to
an out-of-bounds write.

CVE-2019-25035

Out-of-bounds write in sldns_bget_token_par().

CVE-2019-25036

Assertion failure and denial of service in synth_cname().

CVE-2019-25037

Assertion failure and denial of service in dname_pkt_copy() via an
invalid packet.

CVE-2019-25038

Integer overflow in a size calculation in dnscrypt/dnscrypt.c.

CVE-2019-25039

Integer overflow in a size calculation in respip/respip.c.

CVE-2019-25040

Infinite loop via a compressed name in dname_pkt_copy().

CVE-2019-25041

Assertion failure via a compressed name in dname_pkt_copy().

CVE-2019-25042

Out-of-bounds write via a compressed name in rdata_copy().

CVE-2019-18934

Shell code injection vulnerability after receiving a specially
crafted answer. This issue can only be triggered if unbound was
compiled with --enable-ipsecmod support, and ipsecmod is enabled
and used in the configuration.
Debian binary packages are not built with --enable-ipsecmod, and
therefore unaffected. Still, the fix is included in the source
package for users building their own packages.

In addition, this version includes follow-up upstream fixes and
improvements for CVE-2024-43167.

ELA-1503-1 unbound security update

[SECURITY] [DLA 4282-1] firebird3.0 security update

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4282-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
August 25, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : firebird3.0
Version : 3.0.7.33374.ds4-2+deb11u1
CVE ID : CVE-2025-54989
Debian Bug : 1111321

An XDR message parsing NULL pointer dereference has been fixed in the
Firebird database.

For Debian 11 bullseye, this problem has been fixed in version
3.0.7.33374.ds4-2+deb11u1.

We recommend that you upgrade your firebird3.0 packages.

For the detailed security status of firebird3.0 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/firebird3.0

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS