Debian LTS Linux Security is the community’s central source for information on Linux and open source security. We follow the open source trends as they affect the community. We produce content that appeals to administrators, developers, home users, and security professionals.
Stay Vigilant with Timely Linux Security Advisories LinuxSecurity.com is the community’s central source for information on Linux and open source security. We follow the open source trends as they affect the commu
- Debian 11: Firefox-ESR Critical Issues Fixed DLA-4439-1
on January 15, 2026 at 7:39 pmMultiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, information disclosure or spoofing. For Debian 11 bullseye, these problems have been fixed in version 140.7.0esr-1~deb11u1.
- Debian 11: Linux-6.1 Privilege Escalation Denial of Service DLA-4436-1on January 14, 2026 at 2:50 pm
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For Debian 11 bullseye, these problems have been fixed in version 6.1.159-1~deb11u1. This update also fixes several bugs reported to
- Debian 11: DLA-4434-1 SOGo XSS Threats CVE-2024-34462 CVE-2025-63499on January 10, 2026 at 1:46 pm
Several XSS vulnerabiltiies have been found in SOGo, a groupware server. CVE-2024-34462 XSS during attachment preview. CVE-2025-63499 Cross Site Scripting (XSS) via the theme parameter.
- Debian: Important Fix for Arbitrary Code Execution in pdfminer DLA-4374-2on January 8, 2026 at 12:07 pm
It was previously discovered that there was a potential arbitrary code execution in pdfminer, a tool for extracting information from PDF documents. A malicious, zipped pickle file might have contained code that might have been executed when the PDF was processed. Although a fix for this was released in pdfminer version
- Debian 11: Important Fix for libsodium’s Critical EC Issue DLA-4435-1on January 7, 2026 at 9:18 pm
It was discovered that the crypto_core_ed25519_is_valid_point() function of the Sodium cryptography library mishandled checks for valid elliptic curve points. For Debian 11 bullseye, this problem has been fixed in version 1.0.18-1+deb11u1.
- Debian 11: ruby-rmagick High Memory Leak DoS DLA-4433-1 CVE-2023-5349on January 5, 2026 at 9:36 pm
A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion. For Debian 11 bullseye, this problem has been fixed in version 2.16.0-7+deb11u1.
- Debian 11: Curl Important Memory Crash Issue DLA-4432-1 CVE-2025-9086on January 4, 2026 at 10:04 pm
A vulnerability was found in Curl, an easy-to-use client-side URL transfer library and command line tool. It can cause a crash or potentially a memory out of bounds read. For Debian 11 bullseye, this problem has been fixed in version 7.74.0-1.3+deb11u16.
- Debian 11: GIMP Critical Buffer Overflow & Remote Code Exec DLA-4431-1on January 2, 2026 at 4:46 pm
Several vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in buffer overflows and potentially the execution of arbitrary code if malformed XCF, PNM and JP2 files are opened. CVE-2022-30067
- Debian 11: net-snmp Important Buffer Overflow Fix DLA-4430-1 CVE-2025-68615on January 1, 2026 at 2:09 pm
net-snmp is a SNMP application library, tools and daemon. A specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and the daemon to crash. (SNMP ports should never be open to public networks. There is no mitigation available other than ensuring ports to snmptrapd are
