-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6386-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 10, 2026 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : opam CVE ID : CVE-2026-57825 Kate Deplaix reported that .install file directives were insufficiently restricted in OPAM, a package manager for OCaml. Installing files through .install files did not check symlinks resolution on the target path, which could result in directory traversal out of the package area. For the stable distribution (trixie), this problem has been fixed in version 2.3.0-1+deb13u2. We recommend that you upgrade your opam packages. For the detailed security status of opam please refer to its security tracker page at: https://security-tracker.debian.org/tracker/opam Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: [email protected] -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmpRQRdfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0S54A/+IrZ3eJLQ4fnJUa0Gsb+Ol/BsXCU7id6f1AH7ND/gtB2D+vB7DbGH8G6x iVqdabk72K2GPUH+UsVL/UYbqlGvAUu0YAjHDdcWbgIggRyFpde43jjCwRQ+WbgG b1Sq8sRnUd0jBRT+I77EvJ1cHwZIksSLxXIjAbovfxl8MQEf2YElcNEBi582xA+t b6W45rte7yc+Kj6qHceKHvjwXFnvi9kd1c+P1SXdDePMxsJDpxvktbmOZlkTOoqk XekgEys5n8dIyLFDDDHc5YjPYDGoQJ2KTG+bGW0c7yFmJIFES+EzZDL6VatfsMIp sp9lTOLOybSlgDqtDDPZvqkRg7VVgDWXFeHeNfonxXC+y/uz7karhFYHRJWbcwVv 847+LEiyyMuYnfUs77/L6xOHAL0jfiWwpRKwI01N6G+6QhOqHNUL1lK5uJUzt6SI RIMT+0HPTm//67xwjDs2aVGfP5MQEjEEt677qHjUnjv4fNrk3ejhwfdBrEPL9JSe MT0gU2YmUymNDMTgB3lxHVMNxIYy235Fpatih0xciiR8dQU4BzTPEyE/O83nFGA1 jari+aejd+sQkTLHgawOmWrE45vWc1JKAuPElWjwlJk+7sIsz3vOKsx4nwuiDm9w +wNYeaY3e1ser9+MqWE02lfoV5+dYHdXw8csd7/7QUz4Ab5zaJQ= =/2FX -----END PGP SIGNATURE-----
