Debian system administrators should upgrade policykit-1 on bullseye to fix a file descriptor leak that causes unprivileged processes to crash unexpectedly. The OpenJDK runtime also needs immediate attention since multiple flaws can generate broken cryptographic keys or expose sensitive information through flawed Kerberos validation logic. Firefox ESR users must install the updated browser package to prevent potential sandbox escapes and arbitrary code execution vulnerabilities.

[DLA 4553-1] policykit-1 security update
[DSA 6237-1] openjdk-17
[DSA 6236-1] firefox-esr security update

[SECURITY] [DLA 4553-1] policykit-1 security update

-------------------------------------------------------------------------
Debian LTS Advisory DLA-4553-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Andreas Henriksson
April 29, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : policykit-1
Version : 0.105-31+deb11u2
CVE ID : CVE-2021-4115 CVE-2026-4897
Debian Bug : 1005784 1132234

Multiple vulnerabilities where identified in polkit, a toolkit for defining
and handling the policy that allows unprivileged processes to speak to
privileged processes.

CVE-2021-4115

Kevin Backhouse of GitHub Security Lab (GHSL) found that there is a
file descriptor leak in polkit, which can enable an unprivileged
user to cause polkit to crash, due to file descriptor exhaustion.
This could lead to currently ongoing authentication attempts to fail
to authenticate resulting in a Denial of Service (DoS).

CVE-2026-4897

Pavel Kohout, Aisle Research found that a local user provide a specially
crafted, excessively long input to the `polkit-agent-helper-1` setuid binary
via standard input (stdin).
This unbounded input can lead to an out-of-memory (OOM) condition,
resulting in a Denial of Service (DoS) for the system.

For Debian 11 bullseye, these problems have been fixed in version
0.105-31+deb11u2.

We recommend that you upgrade your policykit-1 packages.

For the detailed security status of policykit-1 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/policykit-1

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[SECURITY] [DSA 6237-1] openjdk-17

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6237-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
April 29, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openjdk-17
CVE ID : CVE-2026-22007 CVE-2026-22013 CVE-2026-22016
CVE-2026-22018 CVE-2026-22021 CVE-2026-34268
CVE-2026-34282

Several vulnerabilities have been discovered in the OpenJDK Java
runtime, which may result in incorrect generation of cryptographic
keys, denial of service, information disclosure, XEE/XEE attacks
or incorrect validation of Kerberos credentials.

For the oldstable distribution (bookworm), these problems have been fixed
in version 17.0.19+10-1~deb12u2.

We recommend that you upgrade your openjdk-17 packages.

For the detailed security status of openjdk-17 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openjdk-17

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[SECURITY] [DSA 6236-1] firefox-esr security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6236-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
April 29, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : firefox-esr
CVE ID : CVE-2026-7320 CVE-2026-7321 CVE-2026-7322 CVE-2026-7323

Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code, information disclosure or sandbox escape.

For the oldstable distribution (bookworm), these problems have been fixed
in version 140.10.1esr-1~deb12u1.

For the stable distribution (trixie), these problems have been fixed in
version 140.10.1esr-1~deb13u1.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/firefox-esr

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/