Section
Advisories
Vendor PSIRT bulletins, CERT notes, CISA and partner-agency alerts, and distribution security notices.
47 matching records.
-
nss - security update
It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated nss packages are provided to remove the "eMudhra emSign Root CA - G3", "eMudhra emSign Root CA - C1" and "emSign ECC Root CA - C3"…
-
thunderbird - security update
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure https://security-tracker.debian.org/tracker/DSA-6598-1
-
varnish - security update
Several vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could result in cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing…
-
unbound - security update
Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. CVE-2026-35501 (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an…
-
nginx - security update
Several vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory corruption, denial of service, injection of requests to backend…
-
pdns - security update
It was discovered that incorrect parsing of packets with compression pointers in the PowerDNS DNS server could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6587-1
-
thunderbird - regression update
The update for thunderbird in DSA-6585-1 introduced a regression in the supported for PGP-encrypted emails. Updated packages are now available to correct this issue. https://security-tracker.debian.org/tracker/DSA-6585-2
-
thunderbird - security update
Multiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure Debian follows the Thunderbird upstream releases. Support for the 140.x series has ended, so…
-
roundcube - security update
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in IMAP command injection, cross-site scripting, SSRF bypass, email header injection, css…
-
firefox-esr - security update
This update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for…
-
bind9 - security update
Several vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution. https://security-tracker.debian.org/tracker/DSA-6576-1
-
ca-certificates - security update
It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates.…
-
haproxy - security update
Two vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6570-1
-
xen - security update
Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, information disclosure or denial of service. https://security-tracker.debian.org/tracker/DSA-6571-1
-
dpdk - security update
Several vulnerabilities were discovered in DPDK, a set of libraries for fast packet processing. Depending on enabled functionality, crafted packets or malicious guest requests could cause denial of service or memory corruption.…
-
webkit2gtk - regression update
The webkit2gtk update released as DSA-6534-1 introduced a regression that prevents Evolution from displaying images embedded in HTML emails. https://security-tracker.debian.org/tracker/DSA-6534-3
-
tor - security update
Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6595-1
-
wordpress - security update
Several vulnerabilities were discovered in wordpress, a web blogging tool, which could result in denial of service, cross-site scripting, SQL injection, information disclosure, privilege escalation or remote code execution.…
-
imagemagick - security update
Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code…
-
python-git - security update
Multiple security issues were discovered in GitPython, a Python library to interact with Git repositories, which could result in information disclosure, directory traversal, execution of arbitrary code or denial of service.…
-
chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6592-1
-
openjdk-25 - security update
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox breakout, incomplete certificate checks or information disclosure.…
-
firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, bypass of the same-origin policy, privilege escalation, information…
-
php-mongodb - security update
Multiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6589-1
-
openjdk-21 - security update
Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox bypass, incomplete certificate checks or information disclosure.…
-
valkey - security update
Several vulnerabilities were discovered in Valkey, an in-memory key-value database. These issues could cause denial of service and, in some cases, potentially allow arbitrary code execution.…
-
brotli - security update
A vulnerability was discovered in Brotli, a generic-purpose lossless compression suite, which could result in denial of service, or potentially the execution of arbitrary code.…
-
erlang - security update
Several vulnerabilities were discovered in Erlang/OTP, a programming language and runtime environment. These issues could result in denial of service, HTTP request smuggling, or bypass of authentication and access restrictions…
-
aide - security update
Two vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files. https://security-tracker.debian.org/tracker/DSA-6578-1
-
chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6577-1
-
php8.4 - security update
It was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6574-1
-
cifs-utils - regression update
The update for cifs-utils announced in DSA 6567-1 introduced a regression when using the sec=krb5 and cruid mount options. Updated packages are now available to correct this issue.…
-
cifs-utils - security update
Two vulnerabilities were discovered in cifs-utils, the Common Internet File System utilities, which could result in privilege escalation. https://security-tracker.debian.org/tracker/DSA-6567-1
-
expat - security update
Several vulnerabilities have been discovered in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed.…
-
apache2 - security update
Multiple vulnerabilities have been discovered in the Apache HTTP server, which may result in denial of service, information disclosure, authentication bypass or HTTP request smuggling.…
-
linux - security update
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6568-1
-
spip - security update
A vulnerability was discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. https://security-tracker.debian.org/tracker/DSA-6565-1
-
jpeg-xl - security update
It was discovered that missing input sanitising in the APNG parser in the reference code implementation of the JPEG XL format could result in denial of service or information disclosure if malformed images are processed.…
-
chromium - security update
Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6562-1
-
mutt - security update
It was discovered that incorrect parsing of Content-Type headers in the Mutt mail user agent could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6563-1
-
curl - security update
It was discovered that the cURL URL transfer library, is prone to a use-after-free vulnerability when handling a HTTP/2 RST_STREAM received by a server during an upload, which could result in remote code execution.…
-
buildstream - security update
It was discovered that missing validation of tar sources in the Buildstream software integration tool could allow to write files on the build host. https://security-tracker.debian.org/tracker/DSA-6559-1
-
firefox-esr - security update
Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, information disclosure, mitigation bypass or privilege escalation.…
-
sogo - security update
Multiple security vulnerabilities were discovered in the SOGo groupware server, which could result in cross-site scripting, shell injection, password reset poisoning or SQL injection.…
-
nagios4 - security update
Multiple security vulnerabilities were discovered in the Nagios monitoring system, which could result in cross-site request forgery, cross-site scripting or the execution of arbitrary commands.…
-
ntfs-3g - security update
Several vulnerabilities were discovered in NTFS-3G, a read-write NTFS driver for FUSE, which could result in denial of service, information leak or potentially local root privilege escalation.…
-
libheif - security update
Multiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images. Processing specially crafted images could result in denial of service through excessive resource consumption or crashes…
Reuse this view
Same filters as JSON: /api/items?category=advisory&window=30d&vendor=Debian&limit=100. RSS for this section: feed.xml.