[DLA 4644-1] libmatio security update
ELA-1755-1 libhttp-daemon-perl security update (by )
[DLA 4645-1] cloud-init - correct sources.list generation
[DLA 4646-1] postgresql-13 security update
[DLA 4647-1] yelp security update
[SECURITY] [DLA 4644-1] libmatio security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4644-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Andreas Henriksson
June 24, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : libmatio
Version : 1.5.23-2+deb12u1
CVE ID : CVE-2025-2337 CVE-2025-2338 CVE-2025-50343
Debian Bug : 1100992 1104247 1124797
Multiple vulnerabilities has been discovered in libmatio, a MAT File I/O
Library.
CVE-2025-2337
A vulnerability, which was classified as critical, has been found in
libmatio Mat_VarPrint function. The manipulation leads to heap-based buffer
overflow. The attack may be initiated remotely. The exploit has been
disclosed to the public and may be used.
CVE-2025-2338
A Denial of Service (DoS) and head-based buffer overflow was found, which
could potentially lead to remote code execution if libmatio is embedded in
services that accepts user-supplied .mat files.
CVE-2025-50343
A Denial of Service (DoS) and in certain cases heap corruption vulnerability
was found, which could lead to potential remote code execution if libmatio is
embedded in services that accepts user-supplied .mat files.
For Debian 12 bookworm, these problems have been fixed in version
1.5.23-2+deb12u1.
For Debian 11 bullseye, see separate DLA-4459-1.
We recommend that you upgrade your libmatio packages.
For the detailed security status of libmatio please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libmatio
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1755-1 libhttp-daemon-perl security update (by )
Package : libhttp-daemon-perl
Version : 6.01-1+deb9u2 (stretch), 6.01-3+deb10u2 (buster)
Related CVEs :
CVE-2026-8450
A flaw was discovered in libhttp-daemon-perl, a simple http server class
for Perl, which may result in the execution of arbitrary shell commands
or file overwrite when processing specially crafted input.ELA-1755-1 libhttp-daemon-perl security update (by )
[SECURITY] [DLA 4645-1] cloud-init - correct sources.list generation
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4645-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Noah Meyerhans
June 24, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : cloud-init
Version : 20.4.1-2+deb11u2
Debian Bug : 1110240
Cloud-init, an initialization system for provisioning cloud instances
and other virtual machines, has the ability to generate apt sources
when provisioning a system. The version currently in bullseye
generates incorrect sources.list entries for the security repository,
resulting in VMs that do not download security updates as expected,
and also references the defunct bullseye-backports repository.
For Debian 11 bullseye, this problem has been fixed in version
20.4.1-2+deb11u2.
We recommend that you upgrade your cloud-init packages.
For the detailed security status of cloud-init please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/cloud-init
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4646-1] postgresql-13 security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4646-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emmanuel Arias
June 24, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : postgresql-13
Version : 13.23-0+deb11u4
CVE ID : CVE-2026-6473 CVE-2026-6474 CVE-2026-6475 CVE-2026-6477
CVE-2026-6478 CVE-2026-6479 CVE-2026-6637
Debian Bug :
Brief introduction
CVE-2026-6473
Integer wraparound in multiple PostgreSQL server features allows an
application input provider to cause the server to undersize an allocation
and write out-of-bounds.
CVE-2026-6474
Externally-controlled format string in PostgreSQL timeofday() function
allows an attacker to retrieve portions of server memory, via crafted
timezone zones
CVE-2026-6475
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind
allows an origin superuser to overwrite local files, that hijack the
operating system account. It will remain the case that starting the server
after these commands implicitly trusts the origin superuser, due to features
like shared_preload_libraries.
CVE-2026-6477
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in
PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64()
functions allows the server superuser to overwrite a client stack buffer
with an arbitrarily-large response.
CVE-2026-6478
Covert timing channel in comparison of MD5-hashed password in PostgreSQL
authentication allows an attacker to recover user credentials sufficient to
authenticate. This does not affect scram-sha-256 passwords, the default in
all supported releases. However, current databases may have MD5-hashed
passwords originating in upgrades from PostgreSQL 13 or earlier.
CVE-2026-6479
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an
attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained
denial of service. If SSL and GSS are both disabled, an attacker can do the
same via access to a PostgreSQL TCP socket
CVE-2026-6637
Stack buffer overflow in PostgreSQL module refint allows an unprivileged
database user to execute arbitrary code as the operating system user running
the database. A distinct attack is possible if the application declares a
user-controlled column as a refint cascade primary key and facilitates
user-controlled updates to that column. In that case, a SQL injection allows
a primary key update value provider to execute arbitrary SQL as the database
user performing the primary key update.
For Debian 11 bullseye, these problems have been fixed in version
13.23-0+deb11u4.
We recommend that you upgrade your postgresql-13 packages.
For the detailed security status of postgresql-13 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-13
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4647-1] yelp security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4647-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Daniel Leidert
June 25, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : yelp
Version : 3.38.3-1+deb11u2
CVE ID : not assigned
Debian Bug : 1136299
A vulnerability was discovered in yelp, the GNOME help browser, that
allows a crafted help document to read files accessible to the user and
exfiltrate them to a remote server through resources loaded by the
embedded web view. When yelp is launched from a sandboxed application
(for example via the Flatpak OpenURI portal), this also enables a
sandbox escape.
For Debian 11 bullseye, this problem has been fixed in version
3.38.3-1+deb11u2.
We recommend that you upgrade your yelp packages.
For the detailed security status of yelp please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/yelp
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
