[DLA 4691-1] rtpengine security update
[DSA 6393-1] linux security update
[DLA 4692-1] samba security update
ELA-1777-1 tomcat8 security update (by )
[DLA 4693-1] roundcube security update
[DLA 4690-1] xz-utils security update
ELA-1779-1 samba security update (by )
ELA-1778-1 imagemagick security update (by )
[SECURITY] [DLA 4691-1] rtpengine security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4691-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
July 20, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : rtpengine
Version : 10.5.3.5-1+deb12u1
CVE ID : CVE-2025-53399
Debian Bug : 1110316
It was discovered that there was a origin-validation error in
rtpengine, an open-source media proxy for real-time audio and video
traffic.
CVE-2025-53399
The endpoint-learning logic of the media-relay core could have
allowed an remote attacker to inject or intercept media streams
via malicious RTP packets.
For Debian 12 bookworm, this problem has been fixed in version
10.5.3.5-1+deb12u1.
We recommend that you upgrade your rtpengine packages.
For the detailed security status of rtpengine please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/rtpengine
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DSA 6393-1] linux security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6393-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 21, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : linux
CVE ID : CVE-2025-21807 CVE-2026-46093 CVE-2026-53027 CVE-2026-53226
CVE-2026-53392 CVE-2026-53399 CVE-2026-53402 CVE-2026-63815
CVE-2026-63816 CVE-2026-63818 CVE-2026-64187 CVE-2026-64189
Several vulnerabilities have been discovered in the Linux kernel that
may lead to a privilege escalation, denial of service or information
leaks.
For the stable distribution (trixie), these problems have been fixed in
version 6.12.96-1.
We recommend that you upgrade your linux packages.
For the detailed security status of linux please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/linux
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 4692-1] samba security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4692-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
July 21, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : samba
Version : 2:4.13.13+dfsg-1~deb11u8
CVE ID : CVE-2026-2340 CVE-2026-3012 CVE-2026-3238 CVE-2026-4408
CVE-2026-4480
Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix, which might result in bypass of access
checks, overwrite of files in unintended situations using the WORM vfs
module, installing CA certificates over http without verification when
auto-enrollment GPO is enabled, denial of service or remote code
execution.
For Debian 11 bullseye, these problems have been fixed in version
2:4.13.13+dfsg-1~deb11u8.
We recommend that you upgrade your samba packages.
For the detailed security status of samba please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/samba
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1777-1 tomcat8 security update (by )
Package : tomcat8
Version : 8.5.54-0+deb9u19 (stretch)
Related CVEs :
CVE-2025-48976
CVE-2025-48988
CVE-2025-48989
CVE-2025-49125
CVE-2025-52520
CVE-2025-53506
CVE-2025-55668
Several security vulnerabilities were found in Tomcat 8, a Java web server,
servlet and JSP engine. A remote attacker may use those flaws to cause a denial
of service by allocating system resources with insufficient limits or by
circumventing security constraints.ELA-1777-1 tomcat8 security update (by )
[SECURITY] [DLA 4693-1] roundcube security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4693-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
July 22, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : roundcube
Version : 1.4.15+dfsg.1-1+deb11u10 1.6.5+dfsg-1+deb12u10
CVE ID : CVE-2026-54432 CVE-2026-54433 CVE-2026-62641 CVE-2026-62642
CVE-2026-62643 CVE-2026-62644
Debian Bug : 1138086 1141495
Multiple vulnerabilities were discovered in Roundcube, a skinnable AJAX
based webmail solution for IMAP servers, which could result in
cross-site scripting, server-side request forgery, information
disclosure, denial of service, or potentially account takeover.
CVE-2026-54432
Bohdan Kurinnoy discovered that attachment MIME types were neither
sanitized nor escaped on the attachment-validation warning page,
yielding a stored XSS vulnerability.
CVE-2026-54433
Bohdan Kurinnoy discovered that plain-text rendering was subject to
a zero-click stored XSS vulnerability via crafted mailto: URIs.
CVE-2026-62641
It was discovered that the TNEF decoder was subject to Denial of
Service via crafted compressed-RTF size in the winmail.dat
attachment file.
CVE-2026-62642
An infinite loop was discovered in the TNEF decoder, which may lead
to denial of service upon opening an email with a TNEF attachment.
CVE-2026-62643
It was discovered that the CSS sanitization fixes for CVE-2026-35540 and
CVE-2026-48843 were insufficient, allowing a malicious embedded
stylesheet in an HTML email to lead to SSRF or information
disclosure.
CVE-2026-62644
It was discovered that the password plugin was subject to username
spoofing via session data, which could potentially lead to account
takeover.
For Debian 11 bullseye, these problems have been fixed in version
1.4.15+dfsg.1-1+deb11u10.
For Debian 12 bookworm, these problems have been fixed in version
1.6.5+dfsg-1+deb12u10.
We recommend that you upgrade your roundcube packages.
For the detailed security status of roundcube please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/roundcube
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4690-1] xz-utils security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4690-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
July 20, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : xz-utils
Version : 5.2.5-2.1~deb11u2
CVE ID : CVE-2026-34743
Debian Bug : 1132497
It was discovered that there was a potential buffer overflow in
xz-utils, a popular data-compression utility and library.
CVE-2026-34743
If the lzma_index_decoder function was used to decode an index
that contained no records, the resulting lzma_index was left in a
state where where a subsequent lzma_index_append would allocate
too little memory and a buffer overflow would therefore occur.
For Debian 11 bullseye, this problem has been fixed in version
5.2.5-2.1~deb11u2;
We recommend that you upgrade your xz-utils packages.
For the detailed security status of xz-utils please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xz-utils
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1779-1 samba security update (by )
Package : samba
Version : 2:4.9.5+dfsg-5+deb10u7 (buster)
Related CVEs :
CVE-2026-2340
CVE-2026-3012
CVE-2026-3238
CVE-2026-4408
CVE-2026-4480
Several vulnerabilities have been discovered in Samba, a SMB/CIFS file,
print, and login server for Unix, which might result in bypass of access
checks, overwrite of files in unintended situations using the WORM vfs
module, installing CA certificates over http without verification when
auto-enrollment GPO is enabled, denial of service or remote code
execution.ELA-1779-1 samba security update (by )
ELA-1778-1 imagemagick security update (by )
Package : imagemagick
Version : 8:6.9.7.4+dfsg-11+deb9u31 (stretch)
Related CVEs :
CVE-2026-53466
CVE-2026-53467
CVE-2026-55595
CVE-2026-55597
CVE-2026-56361
CVE-2026-56363
CVE-2026-56365
CVE-2026-56366
CVE-2026-56373
Multiple security vulnerabilities were discovered in imagemagick, a
software suite used for editing and manipulating digital images, which
could lead to denial of service, information disclosure or potentially
arbitrary code execution if malformed images are processed.ELA-1778-1 imagemagick security update (by )
