Debian GNU/Linux 11.5 → 11.7

2 releases · 0 breaking changes · 66 security fixes · 0 advisories fixed

66security0breaking0deprecated0feature14fix

Is 11.5 affected? · What changed up to 13.7

Breaking changes

None in the release notes.

Security changes

security 99 security advisories included: DSA-5170 nodejs, DSA-5237 firefox-esr, DSA-5238 thunderbird, DSA-5259 firefox-esr, DSA-5262 thunderbird, DSA-5282 firefox-esr, DSA-5284 thunderbird, DSA-5300 pngcheck, DSA-5301 firefox-esr, DSA-5302 chromium, DSA-5303 thunderbird, DSA-5304 xorg-server, … in 11.7
security avahi: Fix local denial of service issue [CVE-2021-3468] in 11.7
security c-ares: Prevent stack overflow and denial of service [CVE-2022-4904] in 11.7
security clamav: New upstream stable release; fix possible remote code execution issue in the HFS+ file parser [CVE-2023-20032], possible information leak in the DMG file parser [CVE-2023-20052] in 11.7
security containerd: Fix denial of service issue [CVE-2023-25153]; fix possible privilege escalation via incorrect setup of supplementary groups [CVE-2023-25173] in 11.7
security crun: Fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27650] in 11.7
security duktape: Fix crash issue [CVE-2021-46322] in 11.7
security erlang: Fix client authentication bypass issue [CVE-2022-37026]; use -O1 optimization for armel because -O2 makes erl segfault on certain platforms, e.g. Marvell in 11.7
security exiv2: Security fixes [CVE-2021-29458 CVE-2021-29463 CVE-2021-29464 CVE-2021-29470 CVE-2021-29473 CVE-2021-29623 CVE-2021-32815 CVE-2021-34334 CVE-2021-34335 CVE-2021-3482 CVE-2021-37615 CVE-2021-37616 CVE-2021-37618 CVE-2021-37619 CVE-2021-37620 CVE-2021-37621 CVE-2021-37622 CVE-2021-37623] in 11.7
security flask-security: Fix open redirect vulnerability [CVE-2021-23385] in 11.7
security flatpak: New upstream stable release; escape special characters when displaying permissions and metadata [CVE-2023-28101]; don't allow copy/paste via the TIOCLINUX ioctl when running in a Linux virtual console [CVE-2023-28100] in 11.7
security golang-github-containers-psgo: Do not enter the process user namespace [CVE-2022-1227] in 11.7
security golang-github-containers-storage: Make previously internal functions publicly accessible, required to allow fixing CVE-2022-1227 in other packages in 11.7
security golang-github-prometheus-exporter-toolkit: Patch tests to avoid race condition; fix authentication cache poisoning issue [CVE-2022-46146] in 11.7
security joblib: Fix arbitrary code execution issue [CVE-2022-21797] in 11.7
security lemonldap-ng: Fix URL validation bypass issue; fix 2FA issue when using AuthBasic handler [CVE-2023-28862] in 11.7
security libapache2-mod-auth-openidc: Fix open redirect issue [CVE-2022-23527] in 11.7
security libapreq2: Fix buffer overflow issue [CVE-2022-22728] in 11.7
security libgit2: Enable SSH key verification by default [CVE-2023-22742] in 11.7
security libpod: Fix privilege escalation issue [CVE-2022-1227]; fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27649]; fix parsing of DBUS_SESSION_BUS_ADDRESS in 11.7
security libreoffice: Change Croatia's default currency to Euro; avoid empty -Djava.class.path= [CVE-2022-38745] in 11.7
security libxpm: Fix infinite loop issues [CVE-2022-44617 CVE-2022-46285]; fix double free issue in error handling code; fix compression commands depend on PATH [CVE-2022-4883] in 11.7
security libzen: Fix null pointer dereference issue [CVE-2020-36646] in 11.7
security lxc: Fix file existence oracle [CVE-2022-47952] in 11.7
security ncurses: Guard against corrupt terminfo data [CVE-2022-29458]; fix tic crash on very long tc/use clauses in 11.7
security node-cookiejar: Guard against maliciously-sized cookies [CVE-2022-25901] in 11.7
security node-webpack: Avoid cross-realm object access [CVE-2023-28154] in 11.7
security nvidia-graphics-drivers: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199] in 11.7
security nvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199] in 11.7
security nvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199] in 11.7
security postgresql-13: New upstream stable release; fix client memory disclosure issue [CVE-2022-41862] in 11.7
security snakeyaml: Fix denial of service issues [CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751]; add documentation regarding security support / issues in 11.7
security symfony: Remove private headers before storing responses with HttpCache [CVE-2022-24894]; remove CSRF tokens from storage on successful login [CVE-2022-24895] in 11.7
security systemd: Fix information leak issue [CVE-2022-4415], denial of service issue [CVE-2022-3821]; ata_id: fix getting Response Code from SCSI Sense Data; logind: fix getting property OnExternalPower via D-Bus; fix crash in systemd-machined in 11.7
security unbound: Fix Non-Responsive Delegation Attack [CVE-2022-3204]; fix ghost domain names issue [CVE-2022-30698 CVE-2022-30699] in 11.7
security w3m: Fix out-of-bounds write issue [CVE-2022-38223] in 11.7
security 72 security advisories included: DSA-5212 chromium, DSA-5223 chromium, DSA-5224 poppler, DSA-5225 chromium, DSA-5226 pcs, DSA-5227 libgoogle-gson-java, DSA-5228 gdk-pixbuf, DSA-5229 freecad, DSA-5230 chromium, DSA-5231 connman, DSA-5232 tinygltf, DSA-5233 e17, DSA-5234 fish, … in 11.6
security awstats: Fix cross site scripting issue [CVE-2022-46391] in 11.6
security clickhouse: Fix out-of-bounds read issues [CVE-2021-42387 CVE-2021-42388], buffer overflow issues [CVE-2021-43304 CVE-2021-43305] in 11.6
security containerd: CRI plugin: Fix goroutine leak during Exec [CVE-2022-23471] in 11.6
security dojo: Fix prototype pollution issue [CVE-2021-23450] in 11.6
security g810-led: Control device access with uaccess instead of making everything world-writable [CVE-2022-46338] in 11.6
security lemonldap-ng: Improve session destroy propagation [CVE-2022-37186] in 11.6
security leptonlib: Fix divide-by-zero [CVE-2022-38266] in 11.6
security libapache2-mod-auth-mellon: Fix open redirect issue [CVE-2021-3639] in 11.6
security libconfuse: Fix a heap-based buffer over-read in cfg_tilde_expand [CVE-2022-40320] in 11.6
security libtasn1-6: Fix out-of-bounds read issue [CVE-2021-46848] in 11.6
security libvncserver: Fix memory leak [CVE-2020-29260]; support larger screen sizes in 11.6
security mariadb-10.5: New upstream stable release; security fixes [CVE-2018-25032 CVE-2021-46669 CVE-2022-27376 CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 CVE-2022-27380 CVE-2022-27381 CVE-2022-27382 CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 CVE-2022-27387 CVE-2022-27444 CVE-2022-27445 CVE-2022-27446… in 11.6
security mod-wsgi: Drop X-Client-IP header when it is not a trusted header [CVE-2022-2255] in 11.6
security mplayer: Fix several security issues [CVE-2022-38850 CVE-2022-38851 CVE-2022-38855 CVE-2022-38858 CVE-2022-38860 CVE-2022-38861 CVE-2022-38863 CVE-2022-38864 CVE-2022-38865 CVE-2022-38866] in 11.6
security node-hawk: Parse URLs using stdlib [CVE-2022-29167] in 11.6
security node-loader-utils: Fix prototype pollution issue [CVE-2022-37599 CVE-2022-37601], regular expression-based denial of service issue [CVE-2022-37603] in 11.6
security node-minimatch: Improve protection against regular expression-based denial of service [CVE-2022-3517]; fix regression in patch for CVE-2022-3517 in 11.6
security node-qs: Fix prototype pollution issue [CVE-2022-24999] in 11.6
security node-xmldom: Fix prototype pollution issue [CVE-2022-37616]; prevent insertion of non-well-formed nodes [CVE-2022-39353] in 11.6
security nvidia-graphics-drivers: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261… in 11.6
security nvidia-graphics-drivers-legacy-390xx: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34680 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259] in 11.6
security nvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261 CVE-2022-42262… in 11.6
security nvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261… in 11.6
security onionshare: Fix denial of service issue [CVE-2022-21689], HTML injection issue [CVE-2022-21690] in 11.6
security powerline-gitstatus: Fix command injection via malicious repository config [CVE-2022-42906] in 11.6
security tinyexr: Fix heap overflow issues [CVE-2022-34300 CVE-2022-38529] in 11.6
security tinyxml: Fix infinite loop [CVE-2021-42260] in 11.6
security virglrenderer: Fix out-of-bounds write issue [CVE-2022-0135] in 11.6
security xfig: Fix buffer overflow issue [CVE-2021-40241] in 11.6

Every release in between

11.7 Apr 29, 2023 Release notes ↗

security99 security advisories included: DSA-5170 nodejs, DSA-5237 firefox-esr, DSA-5238 thunderbird, DSA-5259 firefox-esr, DSA-5262 thunderbird, DSA-5282 firefox-esr, DSA-5284 thunderbird, DSA-5300 pngcheck, DSA-5301 firefox-esr, DSA-5302 chromium, DSA-5303 thunderbird, DSA-5304 xorg-server, …

fixakregator: Fix validity checks, including fixing deletion of feeds and folders

fixapache2: Don't automatically enable apache2-doc.conf; fix regressions in http2 and mod_rewrite introduced in 2.4.56

fixat-spi2-core: Set stop timeout to 5 seconds, so as not to needlessly block system shutdowns

securityavahi: Fix local denial of service issue [CVE-2021-3468]

fixbase-files: Update for the 11.7 point release

securityc-ares: Prevent stack overflow and denial of service [CVE-2022-4904]

securityclamav: New upstream stable release; fix possible remote code execution issue in the HFS+ file parser [CVE-2023-20032], possible information leak in the DMG file parser [CVE-2023-20052]

securitycontainerd: Fix denial of service issue [CVE-2023-25153]; fix possible privilege escalation via incorrect setup of supplementary groups [CVE-2023-25173]

securitycrun: Fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27650]

securityduktape: Fix crash issue [CVE-2021-46322]

securityerlang: Fix client authentication bypass issue [CVE-2022-37026]; use -O1 optimization for armel because -O2 makes erl segfault on certain platforms, e.g. Marvell

securityexiv2: Security fixes [CVE-2021-29458 CVE-2021-29463 CVE-2021-29464 CVE-2021-29470 CVE-2021-29473 CVE-2021-29623 CVE-2021-32815 CVE-2021-34334 CVE-2021-34335 CVE-2021-3482 CVE-2021-37615 CVE-2021-37616 CVE-2021-37618 CVE-2021-37619 CVE-2021-37620 CVE-2021-37621 CVE-2021-37622 CVE-2021-37623]

securityflask-security: Fix open redirect vulnerability [CVE-2021-23385]

securityflatpak: New upstream stable release; escape special characters when displaying permissions and metadata [CVE-2023-28101]; don't allow copy/paste via the TIOCLINUX ioctl when running in a Linux virtual console [CVE-2023-28100]

securitygolang-github-containers-psgo: Do not enter the process user namespace [CVE-2022-1227]

securitygolang-github-containers-storage: Make previously internal functions publicly accessible, required to allow fixing CVE-2022-1227 in other packages

securitygolang-github-prometheus-exporter-toolkit: Patch tests to avoid race condition; fix authentication cache poisoning issue [CVE-2022-46146]

securityjoblib: Fix arbitrary code execution issue [CVE-2022-21797]

securitylemonldap-ng: Fix URL validation bypass issue; fix 2FA issue when using AuthBasic handler [CVE-2023-28862]

securitylibapache2-mod-auth-openidc: Fix open redirect issue [CVE-2022-23527]

securitylibapreq2: Fix buffer overflow issue [CVE-2022-22728]

securitylibgit2: Enable SSH key verification by default [CVE-2023-22742]

securitylibpod: Fix privilege escalation issue [CVE-2022-1227]; fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27649]; fix parsing of DBUS_SESSION_BUS_ADDRESS

securitylibreoffice: Change Croatia's default currency to Euro; avoid empty -Djava.class.path= [CVE-2022-38745]

securitylibxpm: Fix infinite loop issues [CVE-2022-44617 CVE-2022-46285]; fix double free issue in error handling code; fix compression commands depend on PATH [CVE-2022-4883]

securitylibzen: Fix null pointer dereference issue [CVE-2020-36646]

securitylxc: Fix file existence oracle [CVE-2022-47952]

securityncurses: Guard against corrupt terminfo data [CVE-2022-29458]; fix tic crash on very long tc/use clauses

securitynode-cookiejar: Guard against maliciously-sized cookies [CVE-2022-25901]

securitynode-webpack: Avoid cross-realm object access [CVE-2023-28154]

securitynvidia-graphics-drivers: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199]

securitynvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199]

securitynvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199]

securitypostgresql-13: New upstream stable release; fix client memory disclosure issue [CVE-2022-41862]

securitysnakeyaml: Fix denial of service issues [CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751]; add documentation regarding security support / issues

securitysymfony: Remove private headers before storing responses with HttpCache [CVE-2022-24894]; remove CSRF tokens from storage on successful login [CVE-2022-24895]

securitysystemd: Fix information leak issue [CVE-2022-4415], denial of service issue [CVE-2022-3821]; ata_id: fix getting Response Code from SCSI Sense Data; logind: fix getting property OnExternalPower via D-Bus; fix crash in systemd-machined

securityunbound: Fix Non-Responsive Delegation Attack [CVE-2022-3204]; fix ghost domain names issue [CVE-2022-30698 CVE-2022-30699]

securityw3m: Fix out-of-bounds write issue [CVE-2022-38223]

+53 more items in the release notes

11.6 Dec 17, 2022 Release notes ↗

security72 security advisories included: DSA-5212 chromium, DSA-5223 chromium, DSA-5224 poppler, DSA-5225 chromium, DSA-5226 pcs, DSA-5227 libgoogle-gson-java, DSA-5228 gdk-pixbuf, DSA-5229 freecad, DSA-5230 chromium, DSA-5231 connman, DSA-5232 tinygltf, DSA-5233 e17, DSA-5234 fish, …

securityawstats: Fix cross site scripting issue [CVE-2022-46391]

fixbase-files: Update /etc/debian_version for the 11.6 point release

fixbinfmt-support: Run binfmt-support.service after systemd-binfmt.service

securityclickhouse: Fix out-of-bounds read issues [CVE-2021-42387 CVE-2021-42388], buffer overflow issues [CVE-2021-43304 CVE-2021-43305]

securitycontainerd: CRI plugin: Fix goroutine leak during Exec [CVE-2022-23471]

fixcore-async-clojure: Fix build failures in test suite

fixdcfldd: Fix SHA1 output on big-endian architectures

fixdebian-installer: Rebuild against proposed-updates; increase Linux kernel ABI to 5.10.0-20

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdebmirror: Add non-free-firmware to the default section list

fixdistro-info-data: Add Ubuntu 23.04, Lunar Lobster; update Debian ELTS end dates; correct Debian 8 (jessie) release date

securitydojo: Fix prototype pollution issue [CVE-2021-23450]

fixdovecot-fts-xapian: Generate dependency on dovecot ABI version in use during build

fixefitools: Fix intermittent build failure due to incorrect dependency in makefile

securityg810-led: Control device access with uaccess instead of making everything world-writable [CVE-2022-46338]

securitylemonldap-ng: Improve session destroy propagation [CVE-2022-37186]

securityleptonlib: Fix divide-by-zero [CVE-2022-38266]

securitylibapache2-mod-auth-mellon: Fix open redirect issue [CVE-2021-3639]

securitylibconfuse: Fix a heap-based buffer over-read in cfg_tilde_expand [CVE-2022-40320]

securitylibtasn1-6: Fix out-of-bounds read issue [CVE-2021-46848]

securitylibvncserver: Fix memory leak [CVE-2020-29260]; support larger screen sizes

securitymariadb-10.5: New upstream stable release; security fixes [CVE-2018-25032 CVE-2021-46669 CVE-2022-27376 CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 CVE-2022-27380 CVE-2022-27381 CVE-2022-27382 CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 CVE-2022-27387 CVE-2022-27444 CVE-2022-27445 CVE-2022-27446…

securitymod-wsgi: Drop X-Client-IP header when it is not a trusted header [CVE-2022-2255]

securitymplayer: Fix several security issues [CVE-2022-38850 CVE-2022-38851 CVE-2022-38855 CVE-2022-38858 CVE-2022-38860 CVE-2022-38861 CVE-2022-38863 CVE-2022-38864 CVE-2022-38865 CVE-2022-38866]

securitynode-hawk: Parse URLs using stdlib [CVE-2022-29167]

securitynode-loader-utils: Fix prototype pollution issue [CVE-2022-37599 CVE-2022-37601], regular expression-based denial of service issue [CVE-2022-37603]

securitynode-minimatch: Improve protection against regular expression-based denial of service [CVE-2022-3517]; fix regression in patch for CVE-2022-3517

securitynode-qs: Fix prototype pollution issue [CVE-2022-24999]

securitynode-xmldom: Fix prototype pollution issue [CVE-2022-37616]; prevent insertion of non-well-formed nodes [CVE-2022-39353]

securitynvidia-graphics-drivers: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261…

securitynvidia-graphics-drivers-legacy-390xx: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34680 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259]

securitynvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261 CVE-2022-42262…

securitynvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261…

securityonionshare: Fix denial of service issue [CVE-2022-21689], HTML injection issue [CVE-2022-21690]

securitypowerline-gitstatus: Fix command injection via malicious repository config [CVE-2022-42906]

securitytinyexr: Fix heap overflow issues [CVE-2022-34300 CVE-2022-38529]

securitytinyxml: Fix infinite loop [CVE-2021-42260]

securityvirglrenderer: Fix out-of-bounds write issue [CVE-2022-0135]

securityxfig: Fix buffer overflow issue [CVE-2021-40241]

+30 more items in the release notes