-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4684-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 15, 2026 https://wiki.debian.org/LTS - -----------------------------------------------------------------------
Package : opam Version : 2.1.2-1+deb12u2 CVE ID : CVE-2026-57825 Kate Deplaix reported that .install file directives were insufficiently restricted in OPAM, a package manager for OCaml. Installing files through .install files did not check symlinks resolution on the target path, which could result in directory traversal out of the package area. For Debian 12 bookworm, this problem has been fixed in version 2.1.2-1+deb12u2. We recommend that you upgrade your opam packages. For the detailed security status of opam please refer to its security tracker page at: https://security-tracker.debian.org/tracker/opam Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmpW3DMACgkQgj6WdgbD S5Z7JA//XPQjWIDJ/RC03Tyc8lgPDlxRlKZmttCKI5GhTaYPoqXNelf0/ycwKaqc TDqDfeBBCGW33MzQL65tB9vpU3qLEvIKWbt/OWByjXhUvhYCbhJl9yqHi6ZO4Ud9 JXSQBbjJ4x0LNLy6nJ8fOygmYefi/VyTAhfQ6I+zo7YJFQzgc54HWjEkFUVw8U7A FafD55JSBP6vYXAKz6ZV+4x/QIYwB2A+M5wxc3g7ov62R58P21c3pRmnB9fh+Oqz y7sSYSBxGJztObsv+j4aKwE8H8jxaKaPyw1cOpq67WshgUYP3I+WdNzSmOEWi1Aw 4wx9hB7ft3BQfn+uIufHz5NENR5WWIwlj0gUPYWZ5J1HNA0bcfQL6Si4kBYrzWLE rh1zS0AiixaLkSS5LaDdUZq1dAEOZibpQDCoBtrpCSNL0mEC51AjLa/sD19NHRWn 0I1eZTJdiLhQuH3FeuU08KcOMuug/siCogVT+Hsl1A6cvx6bVp9jtYtA9ln2TfN9 v8NISXD0jTHkjgjS9+ZmQgiKSu8EBG3lIhua3vUaEqN2qj+bW0LSlNOqlNtY05U/ ZNo5HTIGNOeHIwVzI0rFmMd8WmEGCxlqoxanY0t+P2FGpf426NQOwkxUzGUA/IJf YYAGv4YGbPCU2drortjIUEx9BZEdYnsu/VrE365+EGiAVG3wEJ0= =uwMh -----END PGP SIGNATURE-----
