Debian has released three security advisories to address vulnerabilities in various packages. The first advisory (DSA-6018-1) fixes a buffer overflow vulnerability in gegl, a graph-based image processing library, which could lead to denial of service or arbitrary code execution. The second advisory (DSA-6017-1) addresses a denial-of-service vulnerability in HAProxy, a load-balancing reverse proxy, when parsing JSON numbers. A third advisory (DLA-4321-1) fixes an out-of-bounds read and write issue in OpenSSL, which could allow attackers to access sensitive information.

Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4321-1] openssl security update

Debian GNU/Linux 12 (Bookworm) and 13 (Trixie):
[DSA 6018-1] gegl security update
[DSA 6017-1] haproxy security update

[SECURITY] [DSA 6018-1] gegl security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6018-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 03, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : gegl
CVE ID : CVE-2025-10921

A buffer overflow was discovered in the RGBE/HDR parser of GEGL, a
graph-based image processing library, which could result in denial of
service or the execution of arbitrary code if malformed files are
processed.

For the oldstable distribution (bookworm), this problem has been fixed
in version 1:0.4.42-2+deb12u1.

For the stable distribution (trixie), this problem has been fixed in
version 1:0.4.62-2+deb13u1.

We recommend that you upgrade your gegl packages.

For the detailed security status of gegl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/gegl

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[SECURITY] [DSA 6017-1] haproxy security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6017-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
October 03, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : haproxy
CVE ID : CVE-2025-11230

Oula Kivalo reported that HAProxy, a fast and reliable load balancing
reverse proxy, is prone to a denial of service vulnerability when
parsing JSON numbers.

For the oldstable distribution (bookworm), this problem has been fixed
in version 2.6.12-1+deb12u3.

For the stable distribution (trixie), this problem has been fixed in
version 3.0.11-1+deb13u1.

We recommend that you upgrade your haproxy packages.

For the detailed security status of haproxy please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/haproxy

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[SECURITY] [DLA 4321-1] openssl security update

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4321-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
October 03, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : openssl
Version : 1.1.1w-0+deb11u4
CVE ID : CVE-2025-9230

Stanislav Fort discovered an out of bounds read and write issue when
decrypting CMS messages that were encrypted using password based
encryption.

For Debian 11 bullseye, this problem has been fixed in version
1.1.1w-0+deb11u4.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS