[DSA 6441-1] python-httplib2 security update
[DSA 6440-1] unzip security update
[DSA 6439-1] zip security update
ELA-1809-1 ca-certificates-java bugfix update (by )
[DSA 6442-1] util-linux security update
[DLA 4740-1] postgresql-15 security update
[SECURITY] [DSA 6441-1] python-httplib2 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6441-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
August 14, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : python-httplib2
CVE ID : CVE-2026-59939
A flaw was discovered in python-httplib2, a comprehensive Python HTTP
client library. Unbounded decompression of HTTP response bodies encoded
with gzip or deflate Content-Encoding could result in denial of service.
For the stable distribution (trixie), this problem has been fixed in
version 0.22.0-1+deb13u1.
We recommend that you upgrade your python-httplib2 packages.
For the detailed security status of python-httplib2 please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/python-httplib2
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 6440-1] unzip security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6440-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
August 14, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : unzip
CVE ID : not yet available
Debian Bug : 1142906
Akhil Koul discovered a vulnerability in the Info-ZIP unzip program,
which could result in the execution of arbitrary code if a specially
crafted file is processed.
For the stable distribution (trixie), this problem has been fixed in
version 6.0-29+deb13u1.
We recommend that you upgrade your unzip packages.
For the detailed security status of unzip please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/unzip
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 6439-1] zip security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6439-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
August 14, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : zip
CVE ID : not yet available
Debian Bug : 1143866
Harry Sintonen discovered that the Info-ZIP zip program is prone to a
command injection vulnerability if a specially crafted filename is
processed.
For the stable distribution (trixie), this problem has been fixed in
version 3.0-15+deb13u1.
We recommend that you upgrade your zip packages.
For the detailed security status of zip please refer to its security
tracker page at:
https://security-tracker.debian.org/tracker/zip
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
ELA-1809-1 ca-certificates-java bugfix update (by )
Package : ca-certificates-java
Version : 20230710~deb12u1~deb11u1~deb10u2~deb9u1 (stretch), 20230710~deb12u1~deb11u1~deb10u2 (buster)
The ca-certificates-java package needs to be upgraded.
For Debian 10 buster, this is a minor update to make sure that the Java keystore isn’t modified in case the default Java runtime is GCJ (GNU Java runtime).
For Debian 9 stretch, this is an upgrade to resolve a circular dependency between Java packages and ca-certificates, which would otherwise prevent the system certificates from being updated (this was applied to Debian buster in ELA-1514-1). We also make sure that that the Java keystore isn’t modified in case the default Java runtime is GCJ (GNU Java runtime).ELA-1809-1 ca-certificates-java bugfix update (by )
[SECURITY] [DSA 6442-1] util-linux security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6442-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
August 14, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : util-linux
CVE ID : CVE-2026-13595 CVE-2026-27456 CVE-2026-53612 CVE-2026-53613
CVE-2026-53614
Debian Bug : 1140194 1140195 1140196
Several vulnerabilities were discovered in util-linux which could result
in privilege escalation.
For the stable distribution (trixie), these problems have been fixed in
version 2.41.5-0+deb13u1.
We recommend that you upgrade your util-linux packages.
For the detailed security status of util-linux please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/util-linux
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DLA 4740-1] postgresql-15 security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4740-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Carlos Henrique Lima Melara
August 14, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : postgresql-15
Version : 15.19-0+deb12u1
CVE ID : CVE-2025-8714 CVE-2026-6464 CVE-2026-6469 CVE-2026-6470
CVE-2026-6471 CVE-2026-6473 CVE-2026-14662 CVE-2026-14663
CVE-2026-14664 CVE-2026-14666 CVE-2026-14668 CVE-2026-14669
CVE-2026-14670 CVE-2026-14671 CVE-2026-14673 CVE-2026-14677
CVE-2026-14678 CVE-2026-14679 CVE-2026-14680 CVE-2026-15741
CVE-2026-15742 CVE-2026-16239 CVE-2026-16241 CVE-2026-18024
CVE-2026-18408 CVE-2026-19385
Multiple security issues were discovered in PostgreSQL, which may
result in execution of arbitrary code, incorrect authentication,
information disclosure, or privilege escalation.
The upstream fix to address CVE-2026-6471 requires additional
changes to the configuration if some extensions are used. This
affects the postgresql-15-wal2json and postgresql-15-decoderbufs
extensions included in Debian. Quoting from the changelog:
| Restrict logical decoding output plugins to the set specified by
| a new server parameter `output_plugin_libraries` (Jacob
| Champion)
| Previously, a replication user could select any loadable library
|
| Restrict logical decoding output plugins to the set specified by
| a new server parameter `output_plugin_libraries` (Jacob
| Champion)
| Previously, a replication user could select any loadable library
| for logical decoding, allowing exploits of various sorts. To
| allow locking this down without breaking setups that worked
| before, introduce a whitelist of allowed output plugins.
|
| By default, only the output plugins shipped as part of
| PostgreSQL (`pgoutput` and `test_decoding`) are included in
|`output_plugin_libraries`. Installations that rely on other
| output plugins must add them after updating the server, for
| example
|
| output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder'
For Debian 12 bookworm, these problems have been fixed in version
15.19-0+deb12u1.
We recommend that you upgrade your postgresql-15 packages.
For the detailed security status of postgresql-15 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-15
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
