Debian GNU/Linux 8 (Buster) Extended LTS:
ELA-1462-1 roundcube security update
ELA-1347-2 python2.7 regression update
Debian GNU/Linux 9 (Stretch) Extended LTS:
ELA-1348-2 python2.7 regression update
Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4218-1] webkit2gtk security update
[SECURITY] [DLA 4218-1] webkit2gtk security update
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4218-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Emilio Pozuelo Monfort
June 16, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : webkit2gtk
Version : 2.48.3-1~deb11u1
CVE ID : CVE-2024-44192 CVE-2024-54467 CVE-2024-54551 CVE-2025-24201
CVE-2025-24208 CVE-2025-24209 CVE-2025-24213 CVE-2025-24216
CVE-2025-24223 CVE-2025-24264 CVE-2025-30427 CVE-2025-31204
CVE-2025-31205 CVE-2025-31206 CVE-2025-31215 CVE-2025-31257
The following vulnerabilities have been discovered in the WebKitGTK
web engine:
CVE-2024-44192
Tashita Software Security discovered that processing maliciously
crafted web content may lead to an unexpected process crash.
CVE-2024-54467
Narendra Bhati discovered that a malicious website may exfiltrate
data cross-origin.
CVE-2024-54551
ajajfxhj discovered that processing web content may lead to a
denial-of-service.
CVE-2025-24201
Apple discovered that maliciously crafted web content may be able
to break out of Web Content sandbox.
CVE-2025-24208
Muhammad Zaid Ghifari and Kalimantan Utara discovered that loading
a malicious iframe may lead to a cross-site scripting attack.
CVE-2025-24209
Francisco Alonso and an anonymous researcher discovered that
processing maliciously crafted web content may lead to an
unexpected process crash.
CVE-2025-24213
The Google V8 Security Team discovered that a type confusion issue
could lead to memory corruption. Note that this CVE is fixed only
on ARM architectures. x86_64 is not vulnerable, x86 is not
vulnerable when the SSE2 instruction set is enabled; but other
architectures remain vulnerable.
CVE-2025-24216
Paul Bakker discovered that processing maliciously crafted web
content may lead to an unexpected Safari crash.
CVE-2025-24223
rheza and an anonymous researcher discovered that processing
maliciously crafted web content may lead to memory corruption.
CVE-2025-24264
Gary Kwong and an anonymous researcher discovered that processing
maliciously crafted web content may lead to an unexpected crash.
CVE-2025-30427
rheza discovered that processing maliciously crafted web content
may lead to an unexpected crash.
CVE-2025-31204
Nan Wang discovered that processing maliciously crafted web
content may lead to memory corruption.
CVE-2025-31205
Ivan Fratric discovered that a malicious website may exfiltrate
data cross-origin.
CVE-2025-31206
An anonymous researcher discovered that processing maliciously
crafted web content may lead to an unexpected process crash.
CVE-2025-31215
Jiming Wang and Jikai Ren discovered that processing maliciously
crafted web content may lead to an unexpected process crash.
CVE-2025-31257
Juergen Schmied discovered that processing maliciously crafted web
content may lead to an unexpected process crash.
For Debian 11 bullseye, these problems have been fixed in version
2.48.3-1~deb11u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
ELA-1462-1 roundcube security update
Package : roundcube
Version : 1.3.17+dfsg.1-1~deb10u8 (buster)
Related CVEs :
CVE-2025-49113
Kirill Firsov discovered that Roundcube, a skinnable AJAX based webmail
solution for IMAP servers, was performing PHP Object deserialization on
unvalidated input, which could lead to remote code execution by an
authenticated attacker.ELA-1462-1 roundcube security update
ELA-1348-2 python2.7 regression update
Package : python2.7
Version : 2.7.13-2+deb9u11 (stretch)
The fix for CVE-2023-27043 made the email.utils.getaddresses function
return result with an additional conversion from Python string object
(str) to Unicode object (unicode). This can lead to a change in
corner-case situations, as spotted in the Mercurial test suite. The
fix was adapted to restore the previous behavior.ELA-1348-2 python2.7 regression update
ELA-1347-2 python2.7 regression update
Package : python2.7
Version : 2.7.16-2+deb10u6 (buster)
The fix for CVE-2023-27043 made the email.utils.getaddresses function
return result with an additional conversion from Python string object
(str) to Unicode object (unicode). This can lead to a change in
corner-case situations, as spotted in the Mercurial test suite. The
fix was adapted to restore the previous behavior.ELA-1347-2 python2.7 regression update
