NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

Remediation

Upgrade Debian:10 curl to version 7.64.0-4+deb10u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-27533
• https://hackerone.com/reports/1891474
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
• https://security.netapp.com/advisory/ntap-20230420-0011/
• https://lists.debian.org/debian-lts-announce/2023/04/msg00025.html
• https://security.gentoo.org/glsa/202310-12
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde () character to be wrongly replaced when used as a prefix in the first path element, in addition to its intended use as the first element to indicate a path relative to the user's home directory. Attackers can exploit this flaw to bypass filtering or execute arbitrary code by crafting a path like /2/foo while accessing a server with a specific user.

Remediation

Upgrade Debian:10 curl to version 7.64.0-4+deb10u9 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-27534
• https://hackerone.com/reports/1892351
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
• https://security.netapp.com/advisory/ntap-20230420-0012/
• https://security.gentoo.org/glsa/202310-12
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36NBD5YLJXXEDZLDGNFCERWRYJQ6LAQW/
• https://lists.debian.org/debian-lts-announce/2024/03/msg00016.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream cyrus-sasl2 package and not the cyrus-sasl2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.

Remediation

Upgrade Debian:10 cyrus-sasl2 to version 2.1.27+dfsg-1+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-24407
• http://www.openwall.com/lists/oss-security/2022/02/23/4
• https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst
• https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28
• https://www.debian.org/security/2022/dsa-5087
• https://lists.debian.org/debian-lts-announce/2022/03/msg00002.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.netapp.com/advisory/ntap-20221007-0003/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4FIXU75Q6RBNK6UYM7MQ3TCFGXR7AX4U/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H26R4SMGM3WHXX4XYNNJB4YGFIL5UNF4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZZC6BMPI3V3MC2IGNLN377ETUWO7QBIH/

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-45960
• https://bugzilla.mozilla.org/show_bug.cgi?id=1217609
• https://github.com/libexpat/libexpat/issues/531
• https://github.com/libexpat/libexpat/pull/534
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://security.netapp.com/advisory/ntap-20220121-0004/
• https://www.tenable.com/security/tns-2022-05
• https://www.debian.org/security/2022/dsa-5073
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22825
• https://github.com/libexpat/libexpat/pull/539
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://www.tenable.com/security/tns-2022-05
• https://www.debian.org/security/2022/dsa-5073
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22827
• https://github.com/libexpat/libexpat/pull/539
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://www.tenable.com/security/tns-2022-05
• https://www.debian.org/security/2022/dsa-5073
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22826
• https://github.com/libexpat/libexpat/pull/539
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://www.tenable.com/security/tns-2022-05
• https://www.debian.org/security/2022/dsa-5073
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24

NVD Description

Note: Versions mentioned in the description apply only to the upstream gzip package and not the gzip package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Debian:10 gzip to version 1.9-3+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-1271
• https://bugzilla.redhat.com/show_bug.cgi?id=2073310
• https://access.redhat.com/security/cve/CVE-2022-1271
• https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
• https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch
• https://www.openwall.com/lists/oss-security/2022/04/07/8
• https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
• https://security.gentoo.org/glsa/202209-01
• https://security.netapp.com/advisory/ntap-20220930-0006/
• https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Remediation

Upgrade Debian:10 krb5 to version 1.17-3+deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-42898
• https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
• https://bugzilla.samba.org/show_bug.cgi?id=15203
• https://web.mit.edu/kerberos/advisories/
• https://www.samba.org/samba/security/CVE-2022-42898.html
• https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
• https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
• https://web.mit.edu/kerberos/krb5-1.19/
• https://security.netapp.com/advisory/ntap-20230216-0008/
• https://security.netapp.com/advisory/ntap-20230223-0001/
• https://security.gentoo.org/glsa/202309-06
• https://security.gentoo.org/glsa/202310-06

NVD Description

Note: Versions mentioned in the description apply only to the upstream libwebp package and not the libwebp package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Remediation

Upgrade Debian:10 libwebp to version 0.6.1-2+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-4863
• https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
• https://crbug.com/1479274
• https://bugzilla.suse.com/show_bug.cgi?id=1215231
• https://en.bandisoft.com/honeyview/history/
• https://github.com/webmproject/libwebp/commit/902bc9190331343b2017211debcec8d2ab87e17a
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-4863
• https://news.ycombinator.com/item?id=37478403
• https://stackdiary.com/critical-vulnerability-in-webp-codec-cve-2023-4863/
• https://www.bleepingcomputer.com/news/google/google-fixes-another-chrome-zero-day-bug-exploited-in-attacks/
• https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
• https://www.debian.org/security/2023/dsa-5496
• https://www.debian.org/security/2023/dsa-5497
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OZDGWWMJREPAGKWCJKSCM4WYLANSKIFX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYYKLG6CRGEDTNRBSU26EEWAO6D6U645/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PYZV7TMKF4QHZ54SFJX54BDN52VHGGCX/
• https://lists.debian.org/debian-lts-announce/2023/09/msg00015.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WHOLML7N2G5KCAZXFWC5IDFFHSQS5SDB/
• https://security.gentoo.org/glsa/202309-05
• https://www.debian.org/security/2023/dsa-5498
• https://lists.debian.org/debian-lts-announce/2023/09/msg00016.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6T655QF7CQ3DYAMPFV7IECQYGDEUIVVT/
• https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
• https://github.com/webmproject/libwebp/releases/tag/v1.3.2
• https://lists.debian.org/debian-lts-announce/2023/09/msg00017.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KUQ7CTX3W372X3UY56VVNAHCH6H2F4X3/
• http://www.openwall.com/lists/oss-security/2023/09/21/4
• https://blog.isosceles.com/the-webp-0day/
• http://www.openwall.com/lists/oss-security/2023/09/22/1
• http://www.openwall.com/lists/oss-security/2023/09/22/3
• http://www.openwall.com/lists/oss-security/2023/09/22/4
• http://www.openwall.com/lists/oss-security/2023/09/22/5
• http://www.openwall.com/lists/oss-security/2023/09/22/6
• http://www.openwall.com/lists/oss-security/2023/09/22/7
• http://www.openwall.com/lists/oss-security/2023/09/22/8
• http://www.openwall.com/lists/oss-security/2023/09/26/1
• http://www.openwall.com/lists/oss-security/2023/09/26/7
• http://www.openwall.com/lists/oss-security/2023/09/28/1
• http://www.openwall.com/lists/oss-security/2023/09/28/2
• http://www.openwall.com/lists/oss-security/2023/09/28/4
• https://security.netapp.com/advisory/ntap-20230929-0011/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WTRUIS3564P7ZLM2S2IH4Y4KZ327LI4I/
• https://sethmlarson.dev/security-developer-in-residence-weekly-report-16
• https://www.bentley.com/advisories/be-2023-0001/
• https://security.gentoo.org/glsa/202401-10
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.

Remediation

Upgrade Debian:10 libxml2 to version 2.9.4+dfsg1-7+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3518
• https://security.netapp.com/advisory/ntap-20210625-0002/
• https://support.apple.com/kb/HT212601
• https://support.apple.com/kb/HT212602
• https://support.apple.com/kb/HT212604
• https://support.apple.com/kb/HT212605
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
• http://seclists.org/fulldisclosure/2021/Jul/54
• http://seclists.org/fulldisclosure/2021/Jul/55
• http://seclists.org/fulldisclosure/2021/Jul/58
• http://seclists.org/fulldisclosure/2021/Jul/59
• https://security.gentoo.org/glsa/202107-05
• https://bugzilla.redhat.com/show_bug.cgi?id=1954242
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxpm package and not the libxpm package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable.

Remediation

Upgrade Debian:10 libxpm to version 1:3.5.12-1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-4883
• https://bugzilla.redhat.com/show_bug.cgi?id=2160213
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff91669
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
• https://lists.x.org/archives/xorg-announce/2023-January/003312.html
• https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Remediation

Upgrade Debian:10 libxslt to version 1.1.32-2.2~deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-30560
• https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html
• https://crbug.com/1219209
• https://www.debian.org/security/2022/dsa-5216
• https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html
• https://security.gentoo.org/glsa/202310-23

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

Upgrade Debian:10 ncurses to version 6.1+20181013-2+deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-39537
• http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup
• https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html
• https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html
• https://support.apple.com/kb/HT213488
• https://support.apple.com/kb/HT213443
• https://support.apple.com/kb/HT213444
• http://seclists.org/fulldisclosure/2022/Oct/41
• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/43
• http://seclists.org/fulldisclosure/2022/Oct/45
• https://security.netapp.com/advisory/ntap-20230427-0012/
• https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

libtiff 4.5.0 is vulnerable to Buffer Overflow via extractContigSamplesBytes() at /libtiff/tools/tiffcrop.c:3215.

Remediation

Upgrade Debian:10 tiff to version 4.1.0+git191117-2~deb10u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-25434
• https://gitlab.com/libtiff/libtiff/-/issues/519

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The manipulation leads to integer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 227500897dfb07fb7d27f7aa570050e62617e3be. It is recommended to apply a patch to fix this issue. The identifier VDB-213549 was assigned to this vulnerability.

Remediation

Upgrade Debian:10 tiff to version 4.1.0+git191117-2~deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-3970
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53137
• https://gitlab.com/libtiff/libtiff/-/commit/227500897dfb07fb7d27f7aa570050e62617e3be
• https://vuldb.com/?id.213549
• https://oss-fuzz.com/download?testcase_id=5738253143900160
• https://security.netapp.com/advisory/ntap-20221215-0009/
• https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html
• https://support.apple.com/kb/HT213843
• https://support.apple.com/kb/HT213841

NVD Description

Note: Versions mentioned in the description apply only to the upstream xz-utils package and not the xz-utils package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.

Remediation

Upgrade Debian:10 xz-utils to version 5.2.4-1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-1271
• https://bugzilla.redhat.com/show_bug.cgi?id=2073310
• https://access.redhat.com/security/cve/CVE-2022-1271
• https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html
• https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch
• https://www.openwall.com/lists/oss-security/2022/04/07/8
• https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
• https://security.gentoo.org/glsa/202209-01
• https://security.netapp.com/advisory/ntap-20220930-0006/
• https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Remediation

Upgrade Debian:10 libxml2 to version 2.9.4+dfsg1-7+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3517
• https://security.netapp.com/advisory/ntap-20210625-0002/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
• https://security.gentoo.org/glsa/202107-05
• https://bugzilla.redhat.com/show_bug.cgi?id=1954232
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
• https://security.netapp.com/advisory/ntap-20211022-0004/
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).

Remediation

Upgrade Debian:10 curl to version 7.64.0-4+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-22576
• https://hackerone.com/reports/1526328
• https://security.netapp.com/advisory/ntap-20220609-0008/
• https://www.debian.org/security/2022/dsa-5197
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-40674
• https://github.com/libexpat/libexpat/pull/629
• https://github.com/libexpat/libexpat/pull/640
• https://www.debian.org/security/2022/dsa-5236
• https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html
• https://security.gentoo.org/glsa/202209-24
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/
• https://security.netapp.com/advisory/ntap-20221028-0008/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/
• https://security.gentoo.org/glsa/202211-06
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/

NVD Description

Note: Versions mentioned in the description apply only to the upstream gcc-8 package and not the gcc-8 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction sequences when targeting ARM targets that spill the address of the stack protector guard, which allows an attacker to bypass the protection of -fstack-protector, -fstack-protector-all, -fstack-protector-strong, and -fstack-protector-explicit against stack overflow by controlling what the stack canary is compared against.

Remediation

There is no fixed version for Debian:10 gcc-8.

References

• https://gcc.gnu.org/viewcvs/gcc/trunk/gcc/config/arm/arm-protos.h?revision=266379&view=markup
• https://security-tracker.debian.org/tracker/CVE-2018-12886
• https://www.gnu.org/software/gcc/gcc-8/changes.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Remediation

Upgrade Debian:10 glibc to version 2.28-10+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-6096
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/
• https://security.gentoo.org/glsa/202101-20
• https://sourceware.org/bugzilla/show_bug.cgi?id=25620
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server.

Remediation

Upgrade Debian:10 libssh2 to version 1.8.0-2.1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-17498
• https://lists.debian.org/debian-lts-announce/2019/11/msg00010.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/
• https://github.com/kevinbackhouse/SecurityExploits/tree/8cbdbbe6363510f7d9ceec685373da12e6fc752d/libssh2/out_of_bounds_read_disconnect_CVE-2019-17498
• https://github.com/libssh2/libssh2/pull/402/commits/1c6fa92b77e34d089493fe6d3e2c6c8775858b94
• https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/
• https://github.com/libssh2/libssh2/blob/42d37aa63129a1b2644bf6495198923534322d64/src/packet.c#L480
• https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00026.html
• https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html
• https://security.netapp.com/advisory/ntap-20220909-0004/
• http://packetstormsecurity.com/files/172835/libssh2-1.9.0-Out-Of-Bounds-Read.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/22H4Q5XMGS3QNSA7OCL3U7UQZ4NXMR5O/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TY7EEE34RFKCTXTMBQQWWSLXZWSCXNDB/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In libssh2 before 1.9.0, kex_method_diffie_hellman_group_exchange_sha256_key_exchange in kex.c has an integer overflow that could lead to an out-of-bounds read in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to disclose sensitive information or cause a denial of service condition on the client system when a user connects to the server. This is related to an _libssh2_check_length mistake, and is different from the various issues fixed in 1.8.1, such as CVE-2019-3855.

Remediation

Upgrade Debian:10 libssh2 to version 1.8.0-2.1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-13115
• https://security.netapp.com/advisory/ntap-20190806-0002/
• https://support.f5.com/csp/article/K13322484
• https://support.f5.com/csp/article/K13322484?utm_source=f5support&utm_medium=RSS
• https://lists.debian.org/debian-lts-announce/2019/07/msg00024.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/
• https://github.com/libssh2/libssh2/compare/02ecf17...42d37aa
• https://github.com/libssh2/libssh2/pull/350
• https://blog.semmle.com/libssh2-integer-overflow/
• https://libssh2.org/changes.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13115
• https://lists.debian.org/debian-lts-announce/2021/12/msg00013.html
• http://packetstormsecurity.com/files/172834/libssh2-1.8.2-Out-Of-Bounds-Read.html
• https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LUNHPW64IGCASZ4JQ2J5KDXNZN53DWW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M7IF3LNHOA75O4WZWIHJLIRMA5LJUED3/
• https://support.f5.com/csp/article/K13322484?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream nettle package and not the nettle package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

Remediation

Upgrade Debian:10 nettle to version 3.4.1-1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-20305
• https://www.debian.org/security/2021/dsa-4933
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/
• https://security.gentoo.org/glsa/202105-31
• https://bugzilla.redhat.com/show_bug.cgi?id=1942533
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
• https://security.netapp.com/advisory/ntap-20211022-0002/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-46143
• https://github.com/libexpat/libexpat/issues/532
• https://github.com/libexpat/libexpat/pull/538
• http://www.openwall.com/lists/oss-security/2022/01/17/3
• https://security.netapp.com/advisory/ntap-20220121-0006/
• https://www.tenable.com/security/tns-2022-05
• https://www.debian.org/security/2022/dsa-5073
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Remediation

Upgrade Debian:10 glibc to version 2.28-10+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3999
• https://www.openwall.com/lists/oss-security/2022/01/24/4
• https://access.redhat.com/security/cve/CVE-2021-3999
• https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
• https://sourceware.org/bugzilla/show_bug.cgi?id=28769
• https://bugzilla.redhat.com/show_bug.cgi?id=2024637
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://security.netapp.com/advisory/ntap-20221104-0001/
• https://access.redhat.com/errata/RHSA-2022:0896
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e

NVD Description

Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.

Remediation

Upgrade Debian:10 libx11 to version 2:1.6.7-1+deb10u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-43787
• https://access.redhat.com/security/cve/CVE-2023-43787
• https://bugzilla.redhat.com/show_bug.cgi?id=2242254
• https://security.netapp.com/advisory/ntap-20231103-0006/
• http://www.openwall.com/lists/oss-security/2024/01/24/9
• https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-two/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

Remediation

Upgrade Debian:10 libxml2 to version 2.9.4+dfsg1-7+deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-40304
• https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/1b41ec4e9433b05bb0376be4725804c54ef1d80b
• https://gitlab.gnome.org/GNOME/libxml2/-/tags
• https://security.netapp.com/advisory/ntap-20221209-0003/
• https://support.apple.com/kb/HT213534
• https://support.apple.com/kb/HT213535
• https://support.apple.com/kb/HT213536
• https://support.apple.com/kb/HT213531
• https://support.apple.com/kb/HT213533
• http://seclists.org/fulldisclosure/2022/Dec/21
• http://seclists.org/fulldisclosure/2022/Dec/25
• http://seclists.org/fulldisclosure/2022/Dec/24
• http://seclists.org/fulldisclosure/2022/Dec/26
• http://seclists.org/fulldisclosure/2022/Dec/27

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

There's a flaw in libxml2's xmllint in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by xmllint could trigger a use-after-free. The greatest impact of this flaw is to confidentiality, integrity, and availability.

Remediation

Upgrade Debian:10 libxml2 to version 2.9.4+dfsg1-7+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3516
• https://security.netapp.com/advisory/ntap-20210716-0005/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/
• https://security.gentoo.org/glsa/202107-05
• https://bugzilla.redhat.com/show_bug.cgi?id=1954225
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/1358d157d0bd83be1dfe356a69213df9fac0b539
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/230
• https://lists.debian.org/debian-lts-announce/2021/05/msg00008.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZOMV5J4PMZAORVT64BKLV6YIZAFDGX6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QVM4UJ3376I6ZVOYMHBNX4GY3NIV52WV/

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Remediation

Upgrade Debian:10 ncurses to version 6.1+20181013-2+deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-29491
• http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commit;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
• https://www.openwall.com/lists/oss-security/2023/04/12/5
• https://www.openwall.com/lists/oss-security/2023/04/13/4
• http://www.openwall.com/lists/oss-security/2023/04/19/10
• http://www.openwall.com/lists/oss-security/2023/04/19/11
• https://security.netapp.com/advisory/ntap-20230517-0009/
• https://support.apple.com/kb/HT213843
• https://support.apple.com/kb/HT213844
• https://support.apple.com/kb/HT213845
• http://ncurses.scripts.mit.edu/?p=ncurses.git%3Ba=commit%3Bh=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
• https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the "systemctl status" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output.

Remediation

Upgrade Debian:10 systemd to version 241-7~deb10u9 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-26604
• https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/
• https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340
• https://medium.com/@zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
• https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html
• https://security.netapp.com/advisory/ntap-20230505-0009/
• http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html
• https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7
• https://www.exploit-db.com/exploits/51674

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (--ssl-reqd on the command line orCURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations withoutTLS contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network.

Remediation

Upgrade Debian:10 curl to version 7.64.0-4+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-22946
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/
• https://hackerone.com/reports/1334111
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.debian.org/debian-lts-announce/2021/09/msg00022.html
• https://security.netapp.com/advisory/ntap-20211029-0003/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
• https://security.netapp.com/advisory/ntap-20220121-0008/
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://support.apple.com/kb/HT213183
• http://seclists.org/fulldisclosure/2022/Mar/29
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.debian.org/security/2022/dsa-5197
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APOAK4X73EJTAPTSVT7IRVDMUWVXNWGD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWLEC6YVEM2HWUBX67SDGPSY4CQB72OE/

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH settings were left out from the configuration match checks, making themmatch too easily.

Remediation

Upgrade Debian:10 curl to version 7.64.0-4+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27782
• https://hackerone.com/reports/1555796
• https://security.netapp.com/advisory/ntap-20220609-0009/
• https://www.debian.org/security/2022/dsa-5197
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01
• http://www.openwall.com/lists/oss-security/2023/03/20/6

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

libcurl provides the CURLOPT_CERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an erroneous function, a malicious server could make libcurl built withNSS get stuck in a never-ending busy-loop when trying to retrieve thatinformation.

Remediation

Upgrade Debian:10 curl to version 7.64.0-4+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27781
• https://hackerone.com/reports/1555441
• https://security.netapp.com/advisory/ntap-20220609-0009/
• https://www.debian.org/security/2022/dsa-5197
• https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html
• https://security.gentoo.org/glsa/202212-01

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-23990
• https://github.com/libexpat/libexpat/pull/551
• https://www.tenable.com/security/tns-2022-05
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7FF2UH7MPXKTADYSJUAHI2Y5UHBSHUH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/34NXVL2RZC2YZRV74ZQ3RNFB7WCEUP7D/
• https://www.debian.org/security/2022/dsa-5073
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/34NXVL2RZC2YZRV74ZQ3RNFB7WCEUP7D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7FF2UH7MPXKTADYSJUAHI2Y5UHBSHUH/

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-25314
• https://github.com/libexpat/libexpat/pull/560
• http://www.openwall.com/lists/oss-security/2022/02/19/1
• https://www.debian.org/security/2022/dsa-5085
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/
• https://security.netapp.com/advisory/ntap-20220303-0008/
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdf
• https://security.gentoo.org/glsa/202209-24
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3UFRBA3UQVIQKXTBUQXDWQOVWNBKLERU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y27XO3JMKAOMQZVPS3B4MJGEAHCZF5OM/

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-52425
• https://github.com/libexpat/libexpat/pull/789
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/
• https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

Remediation

Upgrade Debian:10 expat to version 2.2.6-2+deb10u6 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-43680
• https://github.com/libexpat/libexpat/pull/650
• https://github.com/libexpat/libexpat/pull/616
• https://github.com/libexpat/libexpat/issues/649
• https://lists.debian.org/debian-lts-announce/2022/10/msg00033.html
• https://www.debian.org/security/2022/dsa-5266
• https://security.gentoo.org/glsa/202210-38
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/
• https://security.netapp.com/advisory/ntap-20221118-0007/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DPQVIF6TOJNY2T3ZZETFKR4G34FFREBQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FFCOMBSOJKLIKCGCJWHLJXO4EVYBG7AR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XG5XOOB7CD55CEE6OJYKSACSIMQ4RWQ6/
• http://www.openwall.com/lists/oss-security/2023/12/28/5
• http://www.openwall.com/lists/oss-security/2024/01/03/5

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.

Remediation

Upgrade Debian:10 freetype to version 2.9.1-3+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27405
• http://freetype.com
• https://gitlab.freedesktop.org/freetype/freetype/-/issues/1139
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://security.gentoo.org/glsa/202402-06

NVD Description

Note: Versions mentioned in the description apply only to the upstream freetype package and not the freetype package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.

Remediation

Upgrade Debian:10 freetype to version 2.9.1-3+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-27406
• http://freetype.com
• https://gitlab.freedesktop.org/freetype/freetype/-/issues/1140
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFPNRKDLCXHZVYYQLQMP44UHLU32GA6Z/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FDU2FOEMCEF6WVR6ZBIH5MT5O7FAK6UP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IWQ7IB2A75MEHM63WEUXBYEC7OR5SGDY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYVC2NPKKXKP3TWJWG4ONYWNO6ZPHLA5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCEMWCM46PKM4U5ENRASPKQD6JDOLKRU/
• https://security.gentoo.org/glsa/202402-06

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

Remediation

Upgrade Debian:10 glibc to version 2.28-10+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3326
• https://security.netapp.com/advisory/ntap-20210304-0007/
• https://sourceware.org/bugzilla/show_bug.cgi?id=27256
• https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
• http://www.openwall.com/lists/oss-security/2021/01/28/2
• https://security.gentoo.org/glsa/202107-07
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888

NVD Description

Note: Versions mentioned in the description apply only to the upstream gmp package and not the gmp package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.

Remediation

Upgrade Debian:10 gmp to version 2:6.1.2+dfsg-4+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-43618
• https://bugs.debian.org/994405
• https://gmplib.org/list-archives/gmp-bugs/2021-September/005077.html
• https://gmplib.org/repo/gmp-6.2/rev/561a9c25298e
• https://lists.debian.org/debian-lts-announce/2021/12/msg00001.html
• http://www.openwall.com/lists/oss-security/2022/10/13/3
• http://seclists.org/fulldisclosure/2022/Oct/8
• https://security.netapp.com/advisory/ntap-20221111-0001/
• https://security.gentoo.org/glsa/202309-13

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

Remediation

Upgrade Debian:10 gnutls28 to version 3.6.7-4+deb10u9 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-2509
• https://access.redhat.com/security/cve/CVE-2022-2509
• https://lists.gnupg.org/pipermail/gnutls-help/2022-July/004746.html
• https://www.debian.org/security/2022/dsa-5203
• https://lists.debian.org/debian-lts-announce/2022/08/msg00002.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FL27JS3VM74YEQU7PGB62USO3KSBYZX/

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981.

Remediation

Upgrade Debian:10 gnutls28 to version 3.6.7-4+deb10u12 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2024-0553
• https://access.redhat.com/security/cve/CVE-2024-0553
• https://bugzilla.redhat.com/show_bug.cgi?id=2258412
• https://gitlab.com/gnutls/gnutls/-/issues/1522
• https://lists.gnupg.org/pipermail/gnutls-help/2024-January/004841.html
• http://www.openwall.com/lists/oss-security/2024/01/19/3
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNXKVR5YNUEBNHAHM5GSYKBZX4W2HMN2/
• https://access.redhat.com/errata/RHSA-2024:0533
• https://access.redhat.com/errata/RHSA-2024:0627
• https://security.netapp.com/advisory/ntap-20240202-0011/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7ZEIOLORQ7N6WRPFXZSYDL2MC4LP7VFV/
• https://access.redhat.com/errata/RHSA-2024:0796
• https://lists.debian.org/debian-lts-announce/2024/02/msg00010.html
• https://access.redhat.com/errata/RHSA-2024:1082
• https://access.redhat.com/errata/RHSA-2024:1108

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An issue was discovered in GnuTLS before 3.6.15. A server can trigger a NULL pointer dereference in a TLS 1.3 client if a no_renegotiation alert is sent with unexpected timing, and then an invalid second handshake occurs. The crash happens in the application's error handling path, where the gnutls_deinit function is called after detecting a handshake failure.

Remediation

Upgrade Debian:10 gnutls28 to version 3.6.7-4+deb10u7 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-24659
• https://security.netapp.com/advisory/ntap-20200911-0006/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62BUAI4FQQLG6VTKRT7SUZPGJJ4NASQ3/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AWN56FDLQQXT2D2YHNI4TYH432TDMQ7N/
• https://security.gentoo.org/glsa/202009-01
• https://gitlab.com/gnutls/gnutls/-/issues/1071
• https://www.gnutls.org/security-new.html#GNUTLS-SA-2020-09-04
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00054.html
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00060.html
• https://usn.ubuntu.com/4491-1/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62BUAI4FQQLG6VTKRT7SUZPGJJ4NASQ3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWN56FDLQQXT2D2YHNI4TYH432TDMQ7N/

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.

Remediation

Upgrade Debian:10 krb5 to version 1.17-3+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-36222
• https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
• https://www.debian.org/security/2021/dsa-4944
• https://github.com/krb5/krb5/releases
• https://web.mit.edu/kerberos/advisories/
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://security.netapp.com/advisory/ntap-20211022-0003/
• https://security.netapp.com/advisory/ntap-20211104-0007/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgd2 package and not the libgd2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

gdImageClone in gd.c in libgd 2.1.0-rc2 through 2.2.5 has a NULL pointer dereference allowing attackers to crash an application via a specific function call sequence. Only affects PHP when linked with an external libgd (not bundled).

Remediation

Upgrade Debian:10 libgd2 to version 2.2.5-5.2+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-14553
• https://lists.debian.org/debian-lts-announce/2020/02/msg00014.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
• https://github.com/libgd/libgd/commit/a93eac0e843148dc2d631c3ba80af17e9c8c860f
• https://github.com/libgd/libgd/pull/580
• https://bugzilla.redhat.com/show_bug.cgi?id=1599032
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00020.html
• https://usn.ubuntu.com/4316-1/
• https://usn.ubuntu.com/4316-2/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-14553
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3CZ2QADQTKRHTGB2AHD7J4QQNDLBEMM6/
• https://lists.debian.org/debian-lts-announce/2024/04/msg00003.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libssh2 package and not the libssh2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An issue was discovered in function _libssh2_packet_add in libssh2 1.10.0 allows attackers to access out of bounds memory.

Remediation

Upgrade Debian:10 libssh2 to version 1.8.0-2.1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-22218
• https://github.com/libssh2/libssh2/pull/476
• https://lists.debian.org/debian-lts-announce/2023/09/msg00006.html
• https://security.netapp.com/advisory/ntap-20231006-0002/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libwebp package and not the libwebp package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encoder, the pointer is still assigned to trial and the AddressSanitizer will attempt a double free. 

Remediation

Upgrade Debian:10 libwebp to version 0.6.1-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-1999
• https://chromium.googlesource.com/webm/libwebp
• https://security.gentoo.org/glsa/202309-05

NVD Description

Note: Versions mentioned in the description apply only to the upstream libwebp package and not the libwebp package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A flaw was found in libwebp in versions before 1.0.1. When reading a file libwebp allocates an excessive amount of memory. The highest threat from this vulnerability is to the service availability.

Remediation

Upgrade Debian:10 libwebp to version 0.6.1-2+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-36332
• https://www.debian.org/security/2021/dsa-4930
• https://bugzilla.redhat.com/show_bug.cgi?id=1956868
• https://security.netapp.com/advisory/ntap-20211104-0004/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libx11 package and not the libx11 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

Remediation

Upgrade Debian:10 libx11 to version 2:1.6.7-1+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-3138
• https://access.redhat.com/security/cve/CVE-2023-3138
• https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c
• https://lists.x.org/archives/xorg-announce/2023-June/003406.html
• https://lists.x.org/archives/xorg-announce/2023-June/003407.html
• https://security.netapp.com/advisory/ntap-20231208-0008/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

Remediation

Upgrade Debian:10 libxml2 to version 2.9.4+dfsg1-7+deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-40303
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0
• https://gitlab.gnome.org/GNOME/libxml2/-/tags/v2.10.3
• https://security.netapp.com/advisory/ntap-20221209-0003/
• https://support.apple.com/kb/HT213534
• https://support.apple.com/kb/HT213535
• https://support.apple.com/kb/HT213536
• https://support.apple.com/kb/HT213531
• https://support.apple.com/kb/HT213533
• http://seclists.org/fulldisclosure/2022/Dec/26
• http://seclists.org/fulldisclosure/2022/Dec/21
• http://seclists.org/fulldisclosure/2022/Dec/25
• http://seclists.org/fulldisclosure/2022/Dec/24
• http://seclists.org/fulldisclosure/2022/Dec/27

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxml2 package and not the libxml2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.

Remediation

Upgrade Debian:10 libxml2 to version 2.9.4+dfsg1-7+deb10u3 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-23308
• https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.9.13/NEWS
• https://github.com/GNOME/libxml2/commit/652dd12a858989b14eed4e84e453059cd3ba340e
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/
• https://security.netapp.com/advisory/ntap-20220331-0008/
• https://lists.debian.org/debian-lts-announce/2022/04/msg00004.html
• https://support.apple.com/kb/HT213253
• https://support.apple.com/kb/HT213255
• https://support.apple.com/kb/HT213256
• https://support.apple.com/kb/HT213257
• https://support.apple.com/kb/HT213258
• https://support.apple.com/kb/HT213254
• http://seclists.org/fulldisclosure/2022/May/33
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/34
• http://seclists.org/fulldisclosure/2022/May/37
• http://seclists.org/fulldisclosure/2022/May/36
• http://seclists.org/fulldisclosure/2022/May/38
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.gentoo.org/glsa/202210-03
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LA3MWWAYZADWJ5F6JOUBX65UZAMQB7RF/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxpm package and not the libxpm package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A flaw was found in libXpm. This issue occurs when parsing a file with a comment not closed; the end-of-file condition will not be detected, leading to an infinite loop and resulting in a Denial of Service in the application linked to the library.

Remediation

Upgrade Debian:10 libxpm to version 1:3.5.12-1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-46285
• https://bugzilla.redhat.com/show_bug.cgi?id=2160092
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d7650148
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
• https://lists.x.org/archives/xorg-announce/2023-January/003312.html
• https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
• http://www.openwall.com/lists/oss-security/2023/10/03/1
• http://www.openwall.com/lists/oss-security/2023/10/03/10

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxpm package and not the libxpm package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.

Remediation

Upgrade Debian:10 libxpm to version 1:3.5.12-1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-44617
• https://bugzilla.redhat.com/show_bug.cgi?id=2160193
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28
• https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9
• https://lists.x.org/archives/xorg-announce/2023-January/003312.html
• https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxslt package and not the libxslt package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

Type confusion in xsltNumberFormatGetMultipleLevel prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.

Remediation

Upgrade Debian:10 libxslt to version 1.1.32-2.2~deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2019-5815
• https://bugs.chromium.org/p/chromium/issues/detail?id=930663
• https://gitlab.gnome.org/GNOME/libxslt/commit/08b62c25871b38d5d573515ca8a065b4b8f64f6b
• https://lists.debian.org/debian-lts-announce/2022/09/msg00010.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream nettle package and not the nettle package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A flaw was found in the way nettle's RSA decryption functions handled specially crafted ciphertext. An attacker could use this flaw to provide a manipulated ciphertext leading to application crash and denial of service.

Remediation

Upgrade Debian:10 nettle to version 3.4.1-1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3580
• https://bugzilla.redhat.com/show_bug.cgi?id=1967983
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.html
• https://security.netapp.com/advisory/ntap-20211104-0006/
• https://security.gentoo.org/glsa/202401-24

NVD Description

Note: Versions mentioned in the description apply only to the upstream nghttp2 package and not the nghttp2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

Remediation

Upgrade Debian:10 nghttp2 to version 1.36.0-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2020-11080
• https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr
• https://www.debian.org/security/2020/dsa-4696
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/
• https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090
• https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html
• https://www.oracle.com//security-alerts/cpujul2021.html
• http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/

NVD Description

Note: Versions mentioned in the description apply only to the upstream nghttp2 package and not the nghttp2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Remediation

Upgrade Debian:10 nghttp2 to version 1.36.0-2+deb10u2 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-44487
• https://aws.amazon.com/security/security-bulletins/AWS-2023-011/
• https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/
• https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack/
• https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/
• https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack
• https://news.ycombinator.com/item?id=37831062
• https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/
• https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack
• https://chaos.social/@icing/111210915918780532
• https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764
• https://github.com/alibaba/tengine/issues/1872
• https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2
• https://github.com/bcdannyboy/CVE-2023-44487
• https://github.com/caddyserver/caddy/issues/5877
• https://github.com/eclipse/jetty.project/issues/10679
• https://github.com/envoyproxy/envoy/pull/30055
• https://github.com/haproxy/haproxy/issues/2312
• https://github.com/hyperium/hyper/issues/3337
• https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61
• https://github.com/nghttp2/nghttp2/pull/1961
• https://news.ycombinator.com/item?id=37830987
• https://news.ycombinator.com/item?id=37830998
• https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records/
• https://github.com/grpc/grpc-go/pull/6703
• https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244
• https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0
• https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html
• https://my.f5.com/manage/s/article/K000137106
• https://bugzilla.proxmox.com/show_bug.cgi?id=4988
• https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9
• https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2/
• https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve
• https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088
• https://github.com/advisories/GHSA-vx74-f528-fxqg
• https://github.com/apache/trafficserver/pull/10564
• https://github.com/dotnet/announcements/issues/277
• https://github.com/facebook/proxygen/pull/466
• https://github.com/golang/go/issues/63417
• https://github.com/h2o/h2o/pull/3291
• https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf
• https://github.com/micrictor/http2-rst-stream
• https://github.com/microsoft/CBL-Mariner/pull/6381
• https://github.com/nodejs/node/pull/50121
• https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487
• https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response/
• https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q
• https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected
• https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14
• https://www.openwall.com/lists/oss-security/2023/10/10/6
• https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73
• https://github.com/advisories/GHSA-xpw8-rcwv-8f8p
• https://github.com/kubernetes/kubernetes/pull/121120
• https://github.com/opensearch-project/data-prepper/issues/3474
• https://github.com/oqtane/oqtane.framework/discussions/3367
• https://netty.io/news/2023/10/10/4-1-100-Final.html
• https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487
• https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack
• https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113
• https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1
• https://github.com/kazu-yamamoto/http2/issues/93
• https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html
• https://news.ycombinator.com/item?id=37837043
• https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• https://www.debian.org/security/2023/dsa-5521
• https://www.debian.org/security/2023/dsa-5522
• https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday/
• https://access.redhat.com/security/cve/cve-2023-44487
• https://blog.vespa.ai/cve-2023-44487/
• https://bugzilla.redhat.com/show_bug.cgi?id=2242803
• https://bugzilla.suse.com/show_bug.cgi?id=1216123
• https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125
• https://github.com/advisories/GHSA-qppj-fm5r-hxr3
• https://github.com/etcd-io/etcd/issues/16740
• https://github.com/junkurihara/rust-rpxy/issues/97
• https://github.com/ninenines/cowboy/issues/1615
• https://github.com/tempesta-tech/tempesta/issues/1986
• https://github.com/varnishcache/varnish-cache/issues/3996
• https://istio.io/latest/news/security/istio-security-2023-004/
• https://ubuntu.com/security/CVE-2023-44487
• https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event
• https://github.com/apache/httpd-site/pull/10
• https://github.com/line/armeria/pull/5232
• https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632
• https://github.com/projectcontour/contour/pull/5826
• https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty/
• https://github.com/Azure/AKS/issues/3947
• https://github.com/Kong/kong/discussions/11741
• https://github.com/akka/akka-http/issues/4323
• https://github.com/apache/apisix/issues/10320
• https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487
• https://github.com/openresty/openresty/issues/930
• https://security.paloaltonetworks.com/CVE-2023-44487
• https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487/
• https://github.com/caddyserver/caddy/releases/tag/v2.7.5
• https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html
• http://www.openwall.com/lists/oss-security/2023/10/13/4
• http://www.openwall.com/lists/oss-security/2023/10/13/9
• https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size/
• https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
• https://linkerd.io/2023/10/12/linkerd-cve-2023-44487/
• https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html
• https://security.netapp.com/advisory/ntap-20231016-0001/
• https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html
• http://www.openwall.com/lists/oss-security/2023/10/18/4
• http://www.openwall.com/lists/oss-security/2023/10/18/8
• http://www.openwall.com/lists/oss-security/2023/10/19/6
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/
• http://www.openwall.com/lists/oss-security/2023/10/20/8
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
• https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
• https://www.debian.org/security/2023/dsa-5540
• https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html
• https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/
• https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html
• https://www.debian.org/security/2023/dsa-5549
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4/
• https://www.debian.org/security/2023/dsa-5558
• https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html
• https://security.gentoo.org/glsa/202311-09
• https://www.debian.org/security/2023/dsa-5570
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case PEM_read_bio_ex() will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.

The functions PEM_read_bio() and PEM_read() are simple wrappers around PEM_read_bio_ex() and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL functions including PEM_X509_INFO_read_bio_ex() and SSL_CTX_use_serverinfo_file() which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if PEM_read_bio_ex() returns a failure code. These locations include the PEM_read_bio_TYPE() functions as well as the decoders introduced in OpenSSL 3.0.

The OpenSSL asn1parse command line application is also impacted by this issue.

Remediation

Upgrade Debian:10 openssl to version 1.1.1n-0+deb10u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-4450
• https://www.openssl.org/news/secadv/20230207.txt
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=63bcf189be73a9cc1264059bed6f57974be74a83
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=bbcf509bd046b34cca19c766bbddc31683d0858b
• https://security.gentoo.org/glsa/202402-08

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A security vulnerability has been identified in all supported versions

of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems.

Policy processing is disabled by default but can be enabled by passing the -policy' argument to the command line utilities or by calling the X509_VERIFY_PARAM_set1_policies()' function.

Remediation

Upgrade Debian:10 openssl to version 1.1.1n-0+deb10u5 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-0464
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2017771e2db3e2b96f89bbe8766c3209f6a99545
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2dcd4f1e3115f38cefa43e3efbe9b801c27e642e
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=959c59c7a0164117e7f8366466a32bb1f8d77ff1
• https://www.openssl.org/news/secadv/20230322.txt
• https://www.debian.org/security/2023/dsa-5417
• https://lists.debian.org/debian-lts-announce/2023/06/msg00011.html
• https://www.couchbase.com/alerts/
• https://security.gentoo.org/glsa/202402-08

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Remediation

Upgrade Debian:10 openssl to version 1.1.1d-0+deb10u8 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2022-0778
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=380085481c64de749a6dd25cdf0bcf4360b30f83
• https://www.openssl.org/news/secadv/20220315.txt
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a466912611aa6cbdf550cd10601390e587451246
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=3118eb64934499d93db3230748a452351d1d9a65
• https://www.debian.org/security/2022/dsa-5103
• https://lists.debian.org/debian-lts-announce/2022/03/msg00024.html
• https://lists.debian.org/debian-lts-announce/2022/03/msg00023.html
• https://security.netapp.com/advisory/ntap-20220321-0002/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0002
• https://www.tenable.com/security/tns-2022-06
• https://www.tenable.com/security/tns-2022-07
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/
• https://www.tenable.com/security/tns-2022-08
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.tenable.com/security/tns-2022-09
• https://security.netapp.com/advisory/ntap-20220429-0005/
• https://support.apple.com/kb/HT213256
• https://support.apple.com/kb/HT213255
• https://support.apple.com/kb/HT213257
• http://seclists.org/fulldisclosure/2022/May/38
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/33
• http://packetstormsecurity.com/files/167344/OpenSSL-1.0.2-1.1.1-3.0-BN_mod_sqrt-Infinite-Loop.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-712929.pdf
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.gentoo.org/glsa/202210-02
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=3118eb64934499d93db3230748a452351d1d9a65
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=380085481c64de749a6dd25cdf0bcf4360b30f83
• https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a466912611aa6cbdf550cd10601390e587451246
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/323SNN6ZX7PRJJWP2BUAFLPUAE42XWLZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GDB3GQVJPXJE7X5C5JN6JAA4XUDWD6E6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W6K3PR542DXWLEFFMFIDMME4CWMHJRMG/

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssl package and not the openssl package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter BIO onto the front of it to form a BIO chain, and then returns the new head of the BIO chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter BIO is freed and the function returns a NULL result indicating a failure. However, in this case, the BIO chain is not properly cleaned up and the BIO passed by the caller still retains internal pointers to the previously freed filter BIO. If the caller then goes on to call BIO_pop() on the BIO then a use-after-free will occur. This will most likely result in a crash.

This scenario occurs directly in the internal function B64_write_ASN1() which may cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on the BIO. This internal function is in turn called by the public API functions PEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream, SMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.

Other public API functions that may be impacted by this include i2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and i2d_PKCS7_bio_stream.

The OpenSSL cms and smime command line applications are similarly affected.

Remediation

Upgrade Debian:10 openssl to version 1.1.1n-0+deb10u4 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-0215
• https://www.openssl.org/news/secadv/20230207.txt
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=8818064ce3c3c0f1b740a5aaba2a987e75bfbafd
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9816136fe31d92ace4037d5da5257f763aeeb4eb
• https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c3829dd8825c654652201e16f8a0a0c46ee3f344
• https://security.netapp.com/advisory/ntap-20230427-0007/
• https://security.netapp.com/advisory/ntap-20230427-0009/
• https://security.gentoo.org/glsa/202402-08

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Remediation

There is no fixed version for Debian:10 systemd.

References

• https://security-tracker.debian.org/tracker/CVE-2023-50387
• https://datatracker.ietf.org/doc/html/rfc4035
• https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2024-01.html
• https://kb.isc.org/docs/cve-2023-50387
• https://news.ycombinator.com/item?id=39367411
• https://nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/
• https://www.athene-center.de/aktuelles/key-trap
• https://www.isc.org/blogs/2024-bind-security-release/
• https://www.securityweek.com/keytrap-dns-attack-could-disable-large-parts-of-internet-researchers/
• https://www.theregister.com/2024/02/13/dnssec_vulnerability_internet/
• https://news.ycombinator.com/item?id=39372384
• https://gitlab.nic.cz/knot/knot-resolver/-/releases/v5.7.1
• https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2024q1/017430.html
• https://access.redhat.com/security/cve/CVE-2023-50387
• https://bugzilla.suse.com/show_bug.cgi?id=1219823
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-50387
• https://www.athene-center.de/fileadmin/content/PDF/Technical_Report_KeyTrap.pdf
• http://www.openwall.com/lists/oss-security/2024/02/16/2
• http://www.openwall.com/lists/oss-security/2024/02/16/3
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVYA42BLXUCIDLD35YIJPJSHDIADNYMP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BUIP7T7Z4T3UHLXFWG6XIVDP4GYPD3AI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNNHZSZPG2E7NBMBNYPGHCFI4V4XRWNQ/
• https://lists.debian.org/debian-lts-announce/2024/02/msg00006.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TEXGOYGW7DBS3N2QSSQONZ4ENIRQEAPG/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UQESRWMJCF4JEYJEAKLRM6CT55GLJAB7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVRDSJVZKMCXKKPP6PNR62T7RWZ3YSDZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RGS7JN6FZXUSTC2XKQHH27574XOULYYJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6FV5O347JTX7P5OZA6NGO4MKTXRXMKOZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IGSLGKUAQTW5JPPZCMF5YPEYALLRUZZ6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZDZFMEKQTZ4L7RY46FCENWFB5MDT263R/
• https://security.netapp.com/advisory/ntap-20240307-0007/

NVD Description

Note: Versions mentioned in the description apply only to the upstream tiff package and not the tiff package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.

Remediation

Upgrade Debian:10 tiff to version 4.1.0+git191117-2~deb10u9 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2023-52356
• https://access.redhat.com/security/cve/CVE-2023-52356
• https://bugzilla.redhat.com/show_bug.cgi?id=2251344
• https://gitlab.com/libtiff/libtiff/-/issues/622
• https://gitlab.com/libtiff/libtiff/-/merge_requests/546
• https://lists.debian.org/debian-lts-announce/2024/03/msg00011.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream zlib package and not the zlib package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Remediation

Upgrade Debian:10 zlib to version 1:1.2.11.dfsg-1+deb10u1 or higher.

References

• https://security-tracker.debian.org/tracker/CVE-2018-25032
• https://www.openwall.com/lists/oss-security/2022/03/24/1
• https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531
• http://www.openwall.com/lists/oss-security/2022/03/25/2
• http://www.openwall.com/lists/oss-security/2022/03/26/1
• https://www.openwall.com/lists/oss-security/2022/03/28/1
• https://github.com/madler/zlib/compare/v1.2.11...v1.2.12
• https://www.openwall.com/lists/oss-security/2022/03/28/3
• https://github.com/madler/zlib/issues/605
• https://www.debian.org/security/2022/dsa-5111
• https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/
• https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html
• https://support.apple.com/kb/HT213255
• https://support.apple.com/kb/HT213256
• https://support.apple.com/kb/HT213257
• http://seclists.org/fulldisclosure/2022/May/33
• http://seclists.org/fulldisclosure/2022/May/35
• http://seclists.org/fulldisclosure/2022/May/38
• https://security.netapp.com/advisory/ntap-20220526-0009/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.netapp.com/advisory/ntap-20220729-0004/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/
• https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html
• https://security.gentoo.org/glsa/202210-42
• https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/