Debian 10324 Published by

Debian GNU/Linux has received several security updates, including tiff, redis, libtar, and hplip updates for Debian ELTS as well as tiff, redis, poco, 389-ds-base, and libebml for Debian 11 LTS:

ELA-1298-1 tiff security update
ELA-1297-1 redis security update
ELA-1296-1 libtar security update
ELA-1295-1 hplip security update
[DLA 4026-1] tiff security update
[DLA 4025-1] redis security update
[DLA 4024-1] poco security update
[DLA 4021-1] 389-ds-base security update
[DLA 4023-1] libebml security update




[SECURITY] [DLA 4026-1] tiff security update


- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4026-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
January 20, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : tiff
Version : 4.2.0-1+deb11u6
CVE ID : CVE-2023-2908 CVE-2023-3316 CVE-2023-3618 CVE-2023-25433
CVE-2023-26965 CVE-2023-26966 CVE-2023-52356 CVE-2024-7006
Debian Bug :

Multiple vulnerabilities were fixed in tiff, a library and tools
providing support for the Tag Image File Format (TIFF).

CVE-2023-2908

NULL pointer dereference in tif_dir.c

CVE-2023-3316

NULL pointer dereference in TIFFClose()

CVE-2023-3618

Buffer overflow in tiffcrop

CVE-2023-25433

Buffer overflow in tiffcrop

CVE-2023-26965

Use after free in tiffcrop

CVE-2023-26966

Buffer overflow in uv_encode()

CVE-2023-52356

segfault in TIFFReadRGBAStrip()/TIFFReadRGBATile()

CVE-2024-7006

NULL pointer dereference in TIFFReadDirectory()/TIFFReadCustomDirectory()

For Debian 11 bullseye, these problems have been fixed in version
4.2.0-1+deb11u6.

We recommend that you upgrade your tiff packages.

For the detailed security status of tiff please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/tiff

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



[SECURITY] [DLA 4025-1] redis security update


- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4025-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
January 20, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : redis
Version : 5:6.0.16-1+deb11u5
CVE ID : CVE-2024-46981
Debian Bug : 1092370

Possible code execution with Lua scripting due to a missing call to the
garbage collector has been fixed in the key–value database Redis.

For Debian 11 bullseye, this problem has been fixed in version
5:6.0.16-1+deb11u5.

We recommend that you upgrade your redis packages.

For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



[SECURITY] [DLA 4024-1] poco security update


- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4024-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
January 20, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : poco
Version : 1.10.0-6+deb11u2
CVE ID : CVE-2023-52389

An integer overflow in Poco::UTF32Encoding() hase been fixed in the POCO
C++ libraries for building network-based applications.

For Debian 11 bullseye, this problem has been fixed in version
1.10.0-6+deb11u2.

We recommend that you upgrade your poco packages.

For the detailed security status of poco please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/poco

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



[SECURITY] [DLA 4021-1] 389-ds-base security update


- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4021-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Andrej Shadura
January 19, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : 389-ds-base
Version : 1.4.4.11-2+deb11u1
CVE ID : CVE-2021-3652 CVE-2021-4091 CVE-2022-0918 CVE-2022-0996
CVE-2022-2850 CVE-2024-2199 CVE-2024-3657 CVE-2024-5953
CVE-2024-8445

This update fixes multiple vulnerabilities in 389-ds-base LDAP server.

CVE-2021-3652

If an asterisk is imported as password hashes, either accidentally
or maliciously, then instead of being inactive, any password will
successfully match during authentication. This flaw allows an attacker
to successfully authenticate as a user whose password was disabled.

CVE-2021-4091

A double-free was found in the way 389-ds-base handles virtual
attributes context in persistent searches. An attacker could send a
series of search requests, forcing the server to behave unexpectedly,
and crash.

CVE-2022-0918

A vulnerability allows an unauthenticated attacker with network
access to the LDAP port to cause a denial of service. The denial of
service is triggered by a single message sent over a TCP connection,
no bind or other authentication is required. The message triggers
a segmentation fault that results in slapd crashing.

CVE-2022-0996

A vulnerability allows expired passwords to access the database to
cause improper authentication.

CVE-2022-2850

When the content synchronization plugin is enabled, an authenticated
user can reach a NULL pointer dereference using a specially
crafted query. This flaw allows an authenticated attacker to cause
a denial of service. This CVE is assigned against an incomplete fix
of CVE-2021-3514.

CVE-2024-2199

A denial of service vulnerability that may allow an authenticated
user to cause a server crash while modifying `userPassword` using
malformed input.

CVE-2024-3657

A specially-crafted LDAP query can potentially cause a failure on
the directory server, leading to a denial of service.

CVE-2024-5953

This issue may allow an authenticated user to cause a server denial
of service while attempting to log in with a user with a malformed
hash in their password.

CVE-2024-8445

The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover
all scenarios. In certain product versions, an authenticated user
may cause a server crash while modifying `userPassword` using
malformed input.

For Debian 11 bullseye, these problems have been fixed in version
1.4.4.11-2+deb11u1.

We recommend that you upgrade your 389-ds-base packages.

For the detailed security status of 389-ds-base please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/389-ds-base

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS



ELA-1298-1 tiff security update


Package : tiff
Version : 4.0.3-12.3+deb8u18 (jessie), 4.0.8-2+deb9u13 (stretch), 4.1.0+git191117-2~deb10u10 (buster)

Related CVEs :
CVE-2024-7006

NULL pointer dereference in TIFFReadDirectory()/TIFFReadCustomDirectory() has been fixed in tiff, a library and tools providing support for the Tag Image File Format (TIFF).
Additionally, issues with the earlier fixes for CVE-2023-52356 and CVE-2023-25433 have been resolved.


ELA-1298-1 tiff security update



ELA-1297-1 redis security update


Package : redis
Version : 2:2.8.17-1+deb8u14 (jessie), 3:3.2.6-3+deb9u14 (stretch), 5:5.0.14-1+deb10u7 (buster)

Related CVEs :
CVE-2024-46981

Possible code execution with Lua scripting due to a missing call to the
garbage collector has been fixed in the key–value database Redis.


ELA-1297-1 redis security update



ELA-1296-1 libtar security update


Package : libtar
Version : 1.2.20-7+deb10u1 (buster)

Related CVEs :
CVE-2021-33643
CVE-2021-33644
CVE-2021-33645
CVE-2021-33646

Multiple vulnerabilities have been fixed in libtar, a library for manipulating tar archives.
CVE-2021-33643
out-of-bounds read in gnu_longlink()

CVE-2021-33644
out-of-bounds read in gnu_longname()

CVE-2021-33645
memory leak in th_read()

CVE-2021-33646
memory leak in th_read()


ELA-1296-1 libtar security update



ELA-1295-1 hplip security update


Package : hplip
Version : 3.16.11+repack0-3+deb9u1 (stretch), 3.18.12+dfsg0-2+deb10u1 (buster)

Related CVEs :
CVE-2020-6923

MDNS buffer issues have been fixed in HPLIP, the HP Linux Imaging and Printing system.


ELA-1295-1 hplip security update



[SECURITY] [DLA 4023-1] libebml security update


- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4023-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Adrian Bunk
January 20, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package : libebml
Version : 1.4.2-1+deb11u1
CVE ID : CVE-2023-52339

An integer overflow in MemIOCallback::read() has been fixed in libebml,
a library for the EBML (Extensible Binary Meta Language) format.

For Debian 11 bullseye, this problem has been fixed in version
1.4.2-1+deb11u1.

We recommend that you upgrade your libebml packages.

For the detailed security status of libebml please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libebml

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS