ELA-1723-1 php7.0 security update
ELA-1722-1 php7.3 security update
[DSA 6279-1] redis security update
ELA-1720-1 openssh security update
ELA-1721-1 openssh security update
ELA-1726-1 linux-5.10 security update
ELA-1725-1 libpng1.6 security update
ELA-1724-1 libpng1.6 security update
ELA-1727-1 linux-6.1 security update
ELA-1723-1 php7.0 security update (by )
Package : php7.0
Version : 7.0.33-0+deb9u23 (stretch)
Related CVEs :
CVE-2026-6722
CVE-2026-6735
CVE-2026-7258
CVE-2026-7261
CVE-2026-7262
CVE-2026-7568
Multiple security issues were found in PHP, a widely-used open source
general purpose scripting language, which could result in remote code
execution, information disclosure, denial of service.
CVE-2026-6722
A use-after-free issue was discovered in the SOAP extension which
may lead to remote code execution when an apache:Map node contains
duplicate keys.
CVE-2026-6735
Conrad Draper discovered that the request URI within the PHP-FPM
status page was improperly sanitized, thereby allowing cross-site
scripting (XSS).
CVE-2026-7258
An out-of-bounds read issue was discovered in urldecode(), which
may lead to denial of service on some platforms.
CVE-2026-7261
Ilia Alshanetsky discovered a use-after-free issue after header
parsing failure when SoapServer is configured with
SOAP_PERSISTENCE_SESSION, which may lead to denial of service.
CVE-2026-7262
Ilia Alshanetsky discovered a NULL pointer deference issue in SOAP
apache:Map decoder with a missing element, which may
lead to denial of service.
CVE-2026-7568
Aleksey Solovev discovered a signed integer overflow in the
metaphone() function from the PHP standard library.
ELA-1723-1 php7.0 security update (by )
ELA-1722-1 php7.3 security update (by )
Package : php7.3
Version : 7.3.31-1~deb10u13 (buster)
Related CVEs :
CVE-2026-6722
CVE-2026-6735
CVE-2026-7258
CVE-2026-7261
CVE-2026-7262
CVE-2026-7568
Multiple security issues were found in PHP, a widely-used open source
general purpose scripting language, which could result in remote code
execution, information disclosure, denial of service.
CVE-2026-6722
A use-after-free issue was discovered in the SOAP extension which
may lead to remote code execution when an apache:Map node contains
duplicate keys.
CVE-2026-6735
Conrad Draper discovered that the request URI within the PHP-FPM
status page was improperly sanitized, thereby allowing cross-site
scripting (XSS).
CVE-2026-7258
An out-of-bounds read issue was discovered in urldecode(), which
may lead to denial of service on some platforms.
CVE-2026-7261
Ilia Alshanetsky discovered a use-after-free issue after header
parsing failure when SoapServer is configured with
SOAP_PERSISTENCE_SESSION, which may lead to denial of service.
CVE-2026-7262
Ilia Alshanetsky discovered a NULL pointer deference issue in SOAP
apache:Map decoder with a missing element, which may
lead to denial of service.
CVE-2026-7568
Aleksey Solovev discovered a signed integer overflow in the
metaphone() function from the PHP standard library.
ELA-1722-1 php7.3 security update (by )
[SECURITY] [DSA 6279-1] redis security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6279-1 security@debian.org
https://www.debian.org/security/ Aron Xu
May 17, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : redis
CVE ID : CVE-2025-67733 CVE-2026-21863
Debian Bug :
Brief introduction
CVE-2025-67733
A flaw in the Lua scripting error path allowed an authenticated user
to embed CR/LF byte sequences in an error reply produced via
redis.error_reply() or the Lua error() function. Because RESP uses
CRLF as a frame delimiter, an injected sequence could be interpreted
by the client as the start of an unrelated reply, allowing an
attacker to inject arbitrary content into the response stream and
tamper with data read by other commands on the same connection.
CVE-2026-21863
The cluster bus packet validation in clusterProcessPacket() did not
verify that the gossip-section count and per-extension header
declared by an incoming PING, PONG or MEET message actually fit
within the received packet. A peer with access to the cluster bus
port could send a specially crafted message whose declared lengths
exceed the packet size, causing the server to read out of bounds and
potentially crash, resulting in a denial of service.
For the oldstable distribution (bookworm), these problems have been fixed
in version 5:7.0.15-1~deb12u7.
For the stable distribution (trixie), these problems have been fixed in
version 8.0.2-3+deb13u2.
We recommend that you upgrade your redis packages.
For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
ELA-1720-1 openssh security update (by )
Package : openssh
Version : 1:7.9p1-10+deb10u7 (buster)
Related CVEs :
CVE-2025-61984
CVE-2025-61985
CVE-2026-3497
CVE-2026-35385
CVE-2026-35386
CVE-2026-35387
CVE-2026-35388
CVE-2026-35414
Several vulnerabilities have been discovered in OpenSSH, an implementation of
the SSH protocol suite.
CVE-2025-61984
ssh allows control characters in usernames that originate from certain
possibly untrusted sources, potentially leading to code execution when a
ProxyCommand is used.
CVE-2025-61985
ssh allows the '\0' character in an ssh:// URI, potentially leading to code
execution when a ProxyCommand is used.
CVE-2026-3497
Jeremy Brown discovered a flaw in the GSSAPI Key Exchange patch applied
in Debian to OpenSSH, an implementation of the SSH protocol suite,
affecting non-default configurations with the GSSAPIKeyExchange setting
enabled. A remote attacker can take advantage of this flaw to cause a
denial of service, or potentially the execution of arbitrary code.
This update properly initialize some GSS-API variables out of caution,
although most of this vulnerability does not apply to this version.
CVE-2026-35385
When downloading files as root in legacy (-O) mode and without the -p
(preserve modes) flag set, scp did not clear setuid/setgid bits from
downloaded files as one might typically expect. This bug dates back to the
original Berkeley rcp program. Reported by Christos Papakonstantinou of
Cantina and Spearbit.
CVE-2026-35386
Validation of shell metacharacters in user names supplied on the
command-line was performed too late to prevent some situations where they
could be expanded from %-tokens in ssh_config. For certain configurations,
such as those that use a "%u" token in a "Match exec" block, an attacker
who can control the user name passed to ssh(1) could potentially execute
arbitrary shell commands. Reported by Florian Kohnhäuser.
OpenSSH developers continue to recommend against directly exposing ssh(1)
and other tools' command-lines to untrusted input. Mitigations as the one
addressing this issue can not be absolute given the variety of shells and
user configurations in use.
CVE-2026-35387
ssh can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in
PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted
to mean all ECDSA algorithms. Reported by Christos Papakonstantinou of
Cantina and Spearbit.
CVE-2026-35388
Connection multiplexing confirmation (requested using "ControlMaster
ask/autoask") was not being tested for proxy mode multiplexing sessions (i.e.
"ssh -O proxy ..."). Reported by Michalis Vasileiadis.
CVE-2026-35414
When matching an authorized_keys principals="" option against a list of
principals in a certificate, an incorrect algorithm was used that could
allow inappropriate matching in cases where a principal name in the
certificate contains a comma character. Exploitation of the condition requires
an authorized_keys principals="" option that lists more than one principal
*and* a CA that will issue a certificate that encodes more than one of
these principal names separated by a comma (typical CAs strongly constrain
which principal names they will place in a certificate). This condition
only applies to user- trusted CA keys in authorized_keys, the main
certificate authentication path
(TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported by
Vladimir Tokarev.ELA-1720-1 openssh security update (by )
ELA-1721-1 openssh security update (by )
Package : openssh
Version : 1:7.4p1-10+deb9u12 (stretch)
Related CVEs :
CVE-2025-61984
CVE-2026-3497
CVE-2026-35385
CVE-2026-35386
CVE-2026-35387
CVE-2026-35388
CVE-2026-35414
Several vulnerabilities have been discovered in OpenSSH, an implementation of
the SSH protocol suite.
CVE-2025-61984
ssh allows control characters in usernames that originate from certain
possibly untrusted sources, potentially leading to code execution when a
ProxyCommand is used.
CVE-2026-3497
Jeremy Brown discovered a flaw in the GSSAPI Key Exchange patch applied
in Debian to OpenSSH, an implementation of the SSH protocol suite,
affecting non-default configurations with the GSSAPIKeyExchange setting
enabled. A remote attacker can take advantage of this flaw to cause a
denial of service, or potentially the execution of arbitrary code.
This update properly initialize some GSS-API variables out of caution,
although most of this vulnerability does not apply to this version.
CVE-2026-35385
When downloading files as root in legacy (-O) mode and without the -p
(preserve modes) flag set, scp did not clear setuid/setgid bits from
downloaded files as one might typically expect. This bug dates back to the
original Berkeley rcp program. Reported by Christos Papakonstantinou of
Cantina and Spearbit.
CVE-2026-35386
Validation of shell metacharacters in user names supplied on the
command-line was performed too late to prevent some situations where they
could be expanded from %-tokens in ssh_config. For certain configurations,
such as those that use a "%u" token in a "Match exec" block, an attacker
who can control the user name passed to ssh(1) could potentially execute
arbitrary shell commands. Reported by Florian Kohnhäuser.
OpenSSH developers continue to recommend against directly exposing ssh(1)
and other tools' command-lines to untrusted input. Mitigations as the one
addressing this issue can not be absolute given the variety of shells and
user configurations in use.
CVE-2026-35387
ssh can use unintended ECDSA algorithms. Listing of any ECDSA algorithm in
PubkeyAcceptedAlgorithms or HostbasedAcceptedAlgorithms is misinterpreted
to mean all ECDSA algorithms. Reported by Christos Papakonstantinou of
Cantina and Spearbit.
CVE-2026-35388
Connection multiplexing confirmation (requested using "ControlMaster
ask/autoask") was not being tested for proxy mode multiplexing sessions (i.e.
"ssh -O proxy ..."). Reported by Michalis Vasileiadis.
CVE-2026-35414
When matching an authorized_keys principals="" option against a list of
principals in a certificate, an incorrect algorithm was used that could
allow inappropriate matching in cases where a principal name in the
certificate contains a comma character. Exploitation of the condition requires
an authorized_keys principals="" option that lists more than one principal
*and* a CA that will issue a certificate that encodes more than one of
these principal names separated by a comma (typical CAs strongly constrain
which principal names they will place in a certificate). This condition
only applies to user- trusted CA keys in authorized_keys, the main
certificate authentication path
(TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported by
Vladimir Tokarev.ELA-1721-1 openssh security update (by )
ELA-1726-1 linux-5.10 security update (by )
Package : linux-5.10
Version : 5.10.251-5~deb9u1 (stretch), 5.10.251-5~deb10u1 (buster)
Related CVEs :
CVE-2026-46333
A vulnerability has been discovered in the Linux kernel that may
lead to information leaks or local privilege escalation.ELA-1726-1 linux-5.10 security update (by )
ELA-1725-1 libpng1.6 security update (by )
Package : libpng1.6
Version : 1.6.36-6+deb10u4 (buster)
Related CVEs :
CVE-2026-34757
CVE-2026-40930
Two security vulnerabilities has been discovered in libpng, a library implementing an interface for reading and writing PNG (Portable Network Graphics) files, which could leading to corrupted chunk data and potential heap information disclosure.
CVE-2026-34757
Passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct).
CVE-2026-40930
Three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to png_process_data. The practical impact depends on the application's CRC error handling configuration and may be denial of service (image fails to load - this is the default configuration) or if an application explictly chooses relaxed CRC handling the rendered image contains attacker-chosen content. A crafted fake length that exceeds the carrier chunk body would cause cascading desynchronization beyond the carrier chunk boundary.
The attack requires a malicious PNG delivered over the network and opened by a push-mode application. Sequential-mode reading is not affected.
Additionally this update fixes an upstream regression for CVE-2026-33416,
released with ELA-1674-1, where when a transform modifying the palette were the
only transform, a stale palette data has been used.ELA-1725-1 libpng1.6 security update (by )
ELA-1724-1 libpng1.6 security update (by )
Package : libpng1.6
Version : 1.6.28-1+deb9u5 (stretch)
Related CVEs :
CVE-2026-34757
A security vulnerability has been discovered in libpng, a library
implementing an interface for reading and writing PNG (Portable Network
Graphics) files, which could leading to corrupted chunk data and potential
heap information disclosure.
CVE-2026-34757
Passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct).
Additionally this update fixes an upstream regression for CVE-2026-33416,
released with ELA-1674-1, where when a transform modifying the palette were the
only transform, a stale palette data has been used.ELA-1724-1 libpng1.6 security update (by )
ELA-1727-1 linux-6.1 security update (by )
Package : linux-6.1
Version : 6.1.172-1~deb9u1 (stretch), 6.1.172-1~deb10u1 (buster)
Related CVEs :
CVE-2026-46333
A vulnerability has been discovered in the Linux kernel that may
lead to information leaks or local privilege escalation.ELA-1727-1 linux-6.1 security update (by )
