El 20/08/26 a las 22:17, Arnox escribió: > To be specific, the KDE incident occurred on June 4th, 2026. I had spotted > on the KDE security advisories page > (https://kde.org/info/security/#advisories) that there was at least five > critical security holes in Okular reported in the middle of May, also that > year. Here are the exact advisories in question: > > https://kde.org/info/security/advisory-20260511-5.txt > https://kde.org/info/security/advisory-20260511-4.txt > https://kde.org/info/security/advisory-20260511-3.txt > https://kde.org/info/security/advisory-20260511-2.txt > https://kde.org/info/security/advisory-20260511-1.txt > > A patch had already been shipped out by the KDE team for the issues named: > > https://commits.kde.org/okular/49cccdec814b2ddb0a403b63994114f09b007a2c > > But checking with the Debian security patches at the time, it was not > backported whatsoever, nor was it patched even in Debian Sid. ...
Security status of the Debian packages is tracked in the security tracker; okular's can be found here: https://security-tracker.debian.org/tracker/source-package/okular. The security team released updates for the above mentioned issues on 9 June 2026, for both trixie and bookworm, as DSA 6332-1 on 9 June 2026. Those were fixed in sid with https://tracker.debian.org/news/1762989/accepted-okular-426042-1-source-into-unstable/ Interested users may read the information available at https://www.debian.org/security/. Best, -- Santiago
