Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4248-1] openjdk-11 security update
[DLA 4249-1] mediawiki security update
Debian GNU/Linux 12 (Bookworm):
[DSA 5964-1] firefox-esr security update
[SECURITY] [DLA 4248-1] openjdk-11 security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4248-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
July 23, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : openjdk-11
Version : 11.0.28+6-1~deb11u1
CVE ID : CVE-2025-30749 CVE-2025-30754 CVE-2025-30761 CVE-2025-50059
CVE-2025-50106
Several vulnerabilities have been discovered in the OpenJDK Java
runtime, which may result in denial of service, information disclosure
or bypass of sandbox restrictions.
For Debian 11 bullseye, these problems have been fixed in version
11.0.28+6-1~deb11u1.
We recommend that you upgrade your openjdk-11 packages.
For the detailed security status of openjdk-11 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openjdk-11
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DSA 5964-1] firefox-esr security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5964-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
July 23, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : firefox-esr
CVE ID : CVE-2025-8027 CVE-2025-8028 CVE-2025-8029 CVE-2025-8030
CVE-2025-8031 CVE-2025-8032 CVE-2025-8033 CVE-2025-8034
CVE-2025-8035
Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code.
For the stable distribution (bookworm), these problems have been fixed in
version 128.13.0esr-1~deb12u1.
We recommend that you upgrade your firefox-esr packages.
For the detailed security status of firefox-esr please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/firefox-esr
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 4249-1] mediawiki security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4249-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
July 23, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : mediawiki
Version : 1:1.35.13-1+deb11u4
CVE ID : CVE-2025-3469 CVE-2025-6590 CVE-2025-6591 CVE-2025-6593
CVE-2025-6594 CVE-2025-6595 CVE-2025-6597 CVE-2025-6926
CVE-2025-32072 CVE-2025-32696 CVE-2025-32698 CVE-2025-32699
Multiple security vulnerabilities were found in mediawiki, a website
engine for collaborative work, that could lead to information
disclosure or privilege escalation.
CVE-2025-3469
User input was not properly sanitized during web page generation,
which could lead to information disclosure or privilege escalation
via Cross-site Scripting.
CVE-2025-6590
User input was not sanitized in the password reset form, which could lead
to information disclosure for private pages via transclusion.
CVE-2025-6591
HTML injection in API `action=feedcontributions` output from i18n
messages.
CVE-2025-6593
"{{SITENAME}} registered email address has been changed" email was
sent to unverified email addresses, which could lead to information
disclosure.
CVE-2025-6594
XSS in Special:ApiSandbox. While the known issue is not exploitable
in ≤1.39, the backported changes provide some security hardening
just in case.
CVE-2025-6595
Stored XSS through system messages in MultimediaViewer.
CVE-2025-6597
Autocreation was treated as login for the purposes of security
reauthentication. However it doesn't necessarily involve real-time
user identification, as it can be based on some provider identifying
the user based on a session cookie or similar low-fidelity
information. An attacker who got hold of a CentralAuth session
cookie (valid on any wiki) could just visit a wiki where the user
has no local account yet, get an account autocreated, and then
change credentials or perform other sensitive operations.
CVE-2025-6926
Allow extensions to suppress the reauth flag on login. This is a
workaround for extensions with some sort of "autologin" implemented
via the login page to indicate that the login flow didn't involve
the user actually logging in, it merely copied some central login
state, and so isn't appropriate for the reauthentication flag.
CVE-2025-32072
HTML injection in feed output from i18n message.
CVE-2025-32696
"reupload-own" restriction could be bypassed by reverting file.
CVE-2025-32698
Improper enforcing of suppression restrictions in LogPager.php.
CVE-2025-32699
Potential javascript injection attack enabled by Unicode
normalization in Action API.
For Debian 11 bullseye, these problems have been fixed in version
1:1.35.13-1+deb11u4.
We recommend that you upgrade your mediawiki packages.
For the detailed security status of mediawiki please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
