Debian 10251 Published by

Debian GNU/Linux has received a number of upgrades, including ELA-1211-1 libheif, DSA 5797-1 twisted, DSA 5796-1 libheif, DLA 3936-1 activemq, and ELA-1214-1 distro-info-data database update:

Debian GNU/Linux 8 (Jessie), 9 (Stretch), and 10 (Buster) Extended LTS:
ELA-1214-1 distro-info-data database update

Debian GNU/Linux 10 (Buster) Extended LTS:
ELA-1211-1 libheif security update

Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 3936-1] activemq security update

Debian GNU/Linux 12 (Bookworm):
[DSA 5797-1] twisted security update
[DSA 5796-1] libheif security update




ELA-1211-1 libheif security update

Package : libheif
Version : 1.3.2-2+deb10u2 (buster)

Related CVEs :
CVE-2024-41311

It was discovered that there was a potential out-of-bounds read vulnerability
in libheif, a decoder and encoder for
the HEIF and AVIF image formats.
Insufficient checks in ImageOverlay::parse() could have been exploited by an
overlay image with forged offsets which could in turn have led to undefined
behaviour.

ELA-1211-1 libheif security update


[SECURITY] [DSA 5797-1] twisted security update


- -------------------------------------------------------------------------
Debian Security Advisory DSA-5797-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 25, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : twisted
CVE ID : CVE-2023-46137 CVE-2024-41671 CVE-2024-41810

Multiple security issues were found in Twisted, an event-based framework
for internet applications, which could result in incorrect ordering of
HTTP requests or cross-site scripting.

For the stable distribution (bookworm), these problems have been fixed in
version 22.4.0-4+deb12u1.

We recommend that you upgrade your twisted packages.

For the detailed security status of twisted please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twisted

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/


[SECURITY] [DSA 5796-1] libheif security update


- -------------------------------------------------------------------------
Debian Security Advisory DSA-5796-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 25, 2024 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libheif
CVE ID : CVE-2023-29659 CVE-2023-49462 CVE-2024-41311

Multiple security issues were found in libheif, a library to parse HEIF
and AVIF files, which could result in denial of service or potentially
the execution of arbitrary code.

For the stable distribution (bookworm), these problems have been fixed in
version 1.15.1-1+deb12u1.

We recommend that you upgrade your libheif packages.

For the detailed security status of libheif please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libheif

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/


[SECURITY] [DLA 3936-1] activemq security update


-------------------------------------------------------------------------
Debian LTS Advisory DLA-3936-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Santiago Ruano Rincón
October 25, 2024 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : activemq
Version : 5.16.1-1+deb11u1
CVE ID : CVE-2022-41678 CVE-2023-46604
Debian Bug : 1054909

Two vulnerabilities were found in Apache ActiveMQ, a Java-based message broker.

CVE-2022-41678

Deserialization vulnerability on Jolokia that allows authenticated users to
perform arbitrary code execution.

CVE-2023-46604

The Java OpenWire protocol marshaller is vulnerable to arbitrary code
execution. This vulnerability may allow a remote attacker with network
access to run arbitrary shell commands by manipulating serialized class
types in either a Java-based OpenWire broker or client.

For Debian 11 bullseye, these problems have been fixed in version
5.16.1-1+deb11u1.

We recommend that you upgrade your activemq packages.

For the detailed security status of activemq please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/activemq

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



ELA-1214-1 distro-info-data database update

Package : distro-info-data
Version : 0.36~bpo8+6 (jessie), 0.41+deb10u2~bpo9+6 (stretch), 0.41+deb10u10 (buster)

This is a routine update of the distro-info-data database for Debian
ELTS users.
It adds Ubuntu 25.04.

ELA-1214-1 distro-info-data database update