Security fixes
- DLA-4543-1 simpleeval for Debian 11 "Bullseye" . Byambadalai Sumiya discovered that SimpleEval, didn't fully restrict some module references, resulting in sandbox bypass. Fixed in
0.9.10-1+deb11u1. - DSA-6221-1 ntfs-3g for Debian 13 "Trixie" and Debian 12 "Bookworm" . Andrea Bocchetti discovered a heap-based buffer overflow in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of this flaw for local root privilege escalation. Fixed in Trixie
1:2022.10.3-5+deb13u1, Bookworm1:2022.10.3-1+deb12u3. - DLA-4544-1 ntfs-3g for Debian 11 "Bullseye" . Andrea Bocchetti discovered a heap-based buffer overflow in NTFS-3G, a read-write NTFS driver for FUSE. A local user can take advantage of this flaw for local root privilege escalation. Fixed in
1:2017.3.23AR.3-4+deb11u5. - DLA-4523-1 python-geopandas for Debian 11 "Bullseye" . There was a potential SQL vulnerability in python-geopandas, a tool for working with geographic/geospatial data in the Pandas data analysis suite. Fixed in
0.8.2-1+deb11u1. - DSA-6222-1 ngtcp2 for Debian 13 "Trixie" and Debian 12 "Bookworm" . Zou Dikai discovered a buffer overflow in ngtcp2, this problem has been fixed in version 0. Fixed in Trixie
1.11.0-1+deb13u1, Bookworm0.12.1+dfsg-1+deb12u1. - DLA-4540-1 mupdf for Debian 11 "Bullseye" . Bugs in mupdf could lead to denial of service or the execution of arbitrary code if malformed documents are opened. Fixed in
1.17.0+ds1-2+deb11u2. - DLA-4541-1 opam for Debian 11 "Bullseye" . Andrew Nesbitt discovered that .install file directives were insufficiently restricted in OPAM, a package manager for OCaml. This could result in directory traversal out of the package area. Fixed in
2.0.8-1+deb11u1. - DLA-4542-1 xdg-dbus-proxy for Debian 11 "Bullseye" . Incorrect parsing of policy rules in the xdg-dbus-proxy (a filtering proxy for D-Bus connections) allowed the bypass of eavesdrop restrictions, which could result in information disclosure. Fixed in
0.1.2-2+deb11u1.
Announcements and releases
- (A short) Bits from the new DPL on debian-devel-announce .
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).