Debian 12 (Bookworm)

OpenSSH

authorized_keys restrict does not apply to tunnel forwarding

Sin parche todavía.

Kubernetes

A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod…

Corregida en Debian 12, Debian 13 y Debian 14.

PHP

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in…

Corregida en Debian 12, Debian 13, Debian 14, Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04 y Ubuntu 26.10.

PHP

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may…

Corregida en Debian 12, Debian 13, Debian 14, Ubuntu 14.04, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 20.04, Ubuntu 22.04, Ubuntu 24.04, Ubuntu 26.04 y Ubuntu 26.10.

BIND

In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of…

Corregida en Debian 13 y Debian 14.

BIND

Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still…

Corregida en Debian 13 y Debian 14.