Debian released DLA-4716-1 to patch four vulnerabilities in ruby2.7, including a DNS decompression flaw that triggers denial of service and an ERB deserialization bug that allows arbitrary code execution on untrusted data. The botan3 advisory addresses CVE-2026-44378 by upgrading the C++ cryptography library to version 3.12.0, which resolves certificate validation and authentication bypass flaws while renaming the shared library package from libbotan-3-7 to libbotan-3-12.

[DLA 4716-1] ruby2.7 security update
[DSA 6412-1] botan3 security update
[DSA 6411-1] aom security update

[SECURITY] [DLA 4716-1] ruby2.7 security update

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4716-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Abhijith PA
August 04, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : ruby2.7
Version : 2.7.4-1+deb11u6 $bookworm_VERSION
CVE ID : CVE-2025-24294 CVE-2025-61594 CVE-2026-27820
CVE-2026-41316

Ruby a popular language was affected by multiple vulnerabilities

CVE-2025-24294

The vulnerability is caused by an insufficient check on the length
of a decompressed domain name within a DNS packet. An attacker can
craft a malicious DNS packet containing a highly compressed domain
name. When the resolv library parses such a packet, the name
decompression process consumes a large amount of CPU resources, as
the library does not limit the resulting length of the name. This
resource consumption can cause the application thread to become
unresponsive, resulting in a Denial of Service condition.

CVE-2025-61594

Using the + operator to combine URIs, sensitive information like
passwords from the original URI can be leaked, violating RFC3986
and making applications vulnerable to credential exposure. URI is
a module providing classes to handle Uniform Resource
Identifiers.

CVE-2026-27820

A buffer overflow vulnerability in the Zlib::GzipReader. The
zstream_buffer_ungets function prepends caller-provided bytes
ahead of previously produced output but fails to guarantee the
backing Ruby string has enough capacity before the memmove shifts
the existing data. This can lead to memory corruption when the
buffer length exceeds capacity.

CVE-2026-41316

A deserialization vulnerability exists in ERB. Any Ruby
application that calls Marshal.load on untrusted data AND has both
erb and activesupport loaded is vulnerable to arbitrary code
execution.

For Debian 11 bullseye, these problems have been fixed in version
2.7.4-1+deb11u6.

We recommend that you upgrade your ruby2.7 packages.

For the detailed security status of ruby2.7 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby2.7

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

[SECURITY] [DSA 6412-1] botan3 security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6412-1 security@debian.org
https://www.debian.org/security/ Aron Xu
August 05, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : botan3
CVE ID : CVE-2026-44378
Debian Bug :

Multiple security issues were discovered in Botan, a C++ cryptography
library, which could result in denial of service, certificate validation
bypass or authentication bypass.

These issues have been addressed by updating botan3 to the new upstream
release 3.12.0. As a consequence this update changes the SONAME of the
shared library, and the runtime library package is renamed from
libbotan-3-7 to libbotan-3-12. No package in the stable distribution links
against the library, so no other packages in trixie are affected by this
change.

The libbotan-3-7 package is no longer built and will not be removed
automatically on upgrade if it had been installed manually. Locally built
or third-party software linking against libbotan-3-7 needs to be rebuilt
against libbotan-3-12, after which the old library package can be removed.

For the stable distribution (trixie), this problem has been fixed in
version 3.12.0+dfsg-2~deb13u1.

We recommend that you upgrade your botan3 packages.

For the detailed security status of botan3 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/botan3

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

[SECURITY] [DSA 6411-1] aom security update

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6411-1 security@debian.org
https://www.debian.org/security/ Aron Xu
August 05, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : aom
CVE ID : CVE-2026-56208 CVE-2026-56209 CVE-2026-56210 CVE-2026-56211
Debian Bug : 1140428

Multiple vulnerabilities were discovered in aom, the reference
implementation of the AV1 video codec. All of them affect the encoder;
applications that only decode AV1 video are not affected.

CVE-2026-56208

In look-ahead processing (LAP) mode the first-pass statistics buffer
was sized from the configured lag-in-frames alone, leaving it shorter
than the longest group of pictures the encoder may analyse. Together
with an off-by-one in the number of frames considered, this allowed
the encoder to read and write outside the allocation, resulting in
denial of service or potentially the execution of arbitrary code.

CVE-2026-56209, CVE-2026-56210, CVE-2026-56211

The AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec
controls did not validate the supplied scalable video coding (SVC)
layer identifiers against the number of layers actually configured.
A negative or too large identifier led to an out-of-bounds read of
the layer context array, an out-of-bounds write through the cyclic
refresh map pointer, and potentially the execution of arbitrary
code. Exploitation requires an application that allows an attacker
to influence the encoder's SVC configuration.

Additionally this update validates the configured number of spatial and
temporal layers, which the affected version accepted without any range
check.

For the stable distribution (trixie), these problems have been fixed in
version 3.12.1-1+deb13u1.

We recommend that you upgrade your aom packages.

For the detailed security status of aom please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/aom

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/