[DLA 4354-1] pypy3 security update
[DLA 4355-1] mediawiki security update
[DLA 4356-1] ublock-origin security update
[SECURITY] [DLA 4354-1] pypy3 security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4354-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Andrej Shadura
October 31, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : pypy3
Version : 7.3.5+dfsg-2+deb11u5
CVE ID : CVE-2024-6232 CVE-2024-6923 CVE-2024-7592 CVE-2024-11168
CVE-2025-0938 CVE-2025-1795 CVE-2025-6069 CVE-2025-8291
This upload fixes a few of security issues in the Python standard library
included with PyPy, an alternative implementation of the Python 3 language.
CVE-2024-6232
The tarfile module used to parse tar parsed header values with regular
expressions that allowed for backtracking, which could be used to cause
denial of service via specifically-crafted tar archives (ReDoS). Since
tar headers have a well-known format that doesn't require backtracking
to parse reliably, the new method of parsing only requires a single pass
over a byte stream.
CVE-2024-6923
The email module didn’t properly quote newlines when serialising
email messages, which could be used to inject newlines that would
affect the interpretation of the email headers. An attacker could
cause some email headers to be completely skipped or potentially
hide malicious headers within other headers.
CVE-2024-7592
The http.cookies, when parsing cookies that contained backslashes
for quoted characters in the cookie value, would use an algorithm
with quadratic complexity, resulting in excess CPU resources being
used while parsing the value. E.g. parsing a 20000+ byte cookie
would take about a second (ReDoS).
CVE-2024-11168 and CVE-2025-0938
The urllib.parse.urlsplit and urlparse functions improperly validated
domain names that included square brackets allowing hosts that
weren't IPv6 or IPvFuture.
CVE-2025-1795
In the email module, during an address list folding, when a separating
comma ended up on a folded line and that line is to be Unicode-encoded,
then the separator itself was also Unicode-encoded. Expected behavior
is that the separating comma remains a plan comma. This could result
in the address header being misinterpreted by some mail servers.
CVE-2025-6069
The html.parser.HTMLParser class had worse-case quadratic complexity
when processing certain crafted malformed inputs potentially leading
to amplified denial-of-service.
CVE-2025-8291
The zipfile module would not check the validity of the ZIP64 End of
Central Directory (EOCD).
Locator record offset value would not be used to locate the ZIP64
EOCD record, but instead the ZIP64 EOCD record would be assumed
to be the previous record in the ZIP archive. This could be abused
to create ZIP archives that are handled differently by the zipfile
module compared to other ZIP implementations. Remediation maintains
this behavior, but checks that the offset specified in the ZIP64
EOCD Locator record matches the expected value.
For Debian 11 bullseye, these problems have been fixed in version
7.3.5+dfsg-2+deb11u5.
We recommend that you upgrade your pypy3 packages.
For the detailed security status of pypy3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pypy3
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4355-1] mediawiki security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4355-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
October 31, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : mediawiki
Version : 1:1.35.13-1+deb11u5
CVE ID : CVE-2025-11173 CVE-2025-11261 CVE-2025-61635 CVE-2025-61638
CVE-2025-61639 CVE-2025-61640 CVE-2025-61641 CVE-2025-61643
CVE-2025-61646 CVE-2025-61653 CVE-2025-61655 CVE-2025-61656
Multiple security vulnerabilities were found in mediawiki, a website
engine for collaborative work, that could lead to information
disclosure, denial of service or privilege escalation.
CVE-2025-11173
OATHAuth extension: Reauthentication for enabling 2FA can be
bypassed by submitting a form in Special:OATHManage.
CVE-2025-11261
Stored i18n Cross-site scripting (XSS) vulnerability in
mw.language.listToText.
CVE-2025-61635
ConfirmEdit extension: Missing rate limiting in
ApiFancyCaptchaReload.
CVE-2025-61638
Parsoid: Validation bypass for `data-` attributes.
CVE-2025-61639
Log entries which are hidden from the creation of the entry may be
disclosed to the public recent change entry.
CVE-2025-61640
Stored i18n Cross-site scripting (XSS) vulnerability in
Special:RecentChangesLinked.
CVE-2025-61641
DDoS vulnerability in QueryAllPages API in miser mode. The
`maxsize` value is now ignored in that mode.
CVE-2025-61643
Suppressed recent changes may be disclosed to the public RCFeeds.
CVE-2025-61646
Public Watchlist/RecentChanges pages may disclose hidden usernames
when an individual editor makes consecutive revisions on a single
page, and only some are marked as hidden username.
CVE-2025-61653
TextExtracts extension: Information disclosure vulnerability in the
extracts API action endpoint due to missing read permission check.
CVE-2025-61655
VisualEditor extension: Stored i18n Cross-site scripting (XSS)
vulnerability in `lastModifiedAt` system messages.
CVE-2025-61656
VisualEditor extension: Missing attribute validation for attributes
unwrapped from `data-ve-attributes`.
For Debian 11 bullseye, these problems have been fixed in version
1:1.35.13-1+deb11u5.
We recommend that you upgrade your mediawiki packages.
For the detailed security status of mediawiki please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4356-1] ublock-origin security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4356-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
October 31, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : ublock-origin
Version : 1.67.0+dfsg-1~deb11u1
Debian Bug : 1108878
Ublock-origin is a lightweight and efficient ads, malware and trackers blocker.
The new upstream version improves the user experience and ad / malware filter
capabilities of this popular browser addon. It also fixes a bug in the Filter
lists page which prevented it from rendering normal.
For Debian 11 bullseye, this problem has been fixed in version
1.67.0+dfsg-1~deb11u1.
We recommend that you upgrade your ublock-origin packages.
For the detailed security status of ublock-origin please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ublock-origin
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
