Debian GNU/Linux 10 (Buster) Extended LTS:
ELA-1555-1 request-tracker4 security update
ELA-1556-1 openjdk-11 security update
Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4349-1] request-tracker4 security update
[DLA 4350-1] tika security update
Debian GNU/Linux 12 (Bookworm) and 13 (Trixie):
[DSA 6040-1] thunderbird security update
Debian GNU/Linux 13 (Trixie):
[DSA 6039-1] openjdk-25 security update
ELA-1555-1 request-tracker4 security update
Package : request-tracker4
Version : 4.4.3-2+deb10u5 (buster)
Related CVEs :
CVE-2025-61873
It was discovered that Request Tracker, an extensible trouble-ticket
tracking system is prone to a CSV injection via ticket values with
special characters that are exported to a TSV from search results.ELA-1555-1 request-tracker4 security update
[SECURITY] [DLA 4349-1] request-tracker4 security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4349-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Thorsten Alteholz
October 26, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : request-tracker4
Version : 4.4.4+dfsg-2+deb11u5
CVE ID : CVE-2025-61873
It was discovered that Request Tracker, an extensible trouble-ticket
tracking system, is prone to a CSV injection via ticket values with
special characters that are exported to a TSV from search results.
For Debian 11 bullseye, this problem has been fixed in version
4.4.4+dfsg-2+deb11u5.
We recommend that you upgrade your request-tracker4 packages.
For the detailed security status of request-tracker4 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/request-tracker4
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DLA 4350-1] tika security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4350-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Paride Legovini
October 26, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : tika
Version : 1.22-2+deb11u1
CVE ID : CVE-2025-54988
A vulnerability has been fixed in the tika package, which distributes the
Apache Tika content analysis toolkit. The vulnerability affects the
tika-parser-pdf-module component and allows an attacker to carry out XML
External Entity injection via a crafted XFA file inside of a PDF. An attacker
may be able to read sensitive data or trigger malicious requests to internal
resources or third-party servers.
For Debian 11 bullseye, this problem has been fixed in version
1.22-2+deb11u1.
We recommend that you upgrade your tika packages.
For the detailed security status of tika please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tika
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
[SECURITY] [DSA 6040-1] thunderbird security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6040-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 26, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : thunderbird
CVE ID : CVE-2025-11708 CVE-2025-11709 CVE-2025-11710
CVE-2025-11711 CVE-2025-11712 CVE-2025-11714
CVE-2025-11715
Multiple security issues were discovered in Thunderbird, which could
result in the execution of arbitrary code.
For the oldstable distribution (bookworm), these problems have been fixed
in version 1:140.4.0esr-1~deb12u1.
For the stable distribution (trixie), these problems have been fixed in
version 1:140.4.0esr-1~deb13u1.
We recommend that you upgrade your thunderbird packages.
For the detailed security status of thunderbird please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/thunderbird
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
[SECURITY] [DSA 6039-1] openjdk-25 security update
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6039-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
October 26, 2025 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : openjdk-25
CVE ID : CVE-2025-53057 CVE-2025-53066 CVE-2025-61748
Several vulnerabilities have been discovered in the OpenJDK Java
runtime, which may result in incorrect string equality checks, XML
XXE/XEE attacks or incorrect certificate validation.
For the stable distribution (trixie), these problems have been fixed in
version 25.0.1+8-1~deb13u1.
We recommend that you upgrade your openjdk-25 packages.
For the detailed security status of openjdk-25 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openjdk-25
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
ELA-1556-1 openjdk-11 security update
Package : openjdk-11
Version : 11.0.29+6-1~deb10u1 (buster)
Related CVEs :
CVE-2025-53057
CVE-2025-53066
Two vulnerabilities have been discovered in the OpenJDK Java runtime,
which may result in XML external entity injection attacks or incorrect
certificate validation.ELA-1556-1 openjdk-11 security update
