-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6498-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 14, 2026 https://www.debian.org/security/faq - -------------------------------------------------------------------------
Package : network-manager-l2tp CVE ID : CVE-2026-19624 CVE-2026-75131 CVE-2026-75883 Andres Berbescu discovered two vulnerabilities in the L2TP connection plugin for Network Manager which allowed a local user with permissions to create/activate personal VPN connections to escalate their privileges to root. For the stable distribution (trixie), these problems have been fixed in version 1.20.20-2+deb13u1. We recommend that you upgrade your network-manager-l2tp packages. For the detailed security status of network-manager-l2tp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/network-manager-l2tp Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: [email protected] -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmqoPvMACgkQEMKTtsN8 TjZgJQ/+LsCjgKNGbQUrws7aFl6cemH7zMk1z3JLI4nEvic1TXQwCdZJFgAveu87 8/Gc136066SP914x+88gZAE4RDnT4G8hMfzVEcTaq92uxctHPV9vCTGBV+itbTK6 inh9IPqUTQ+vKJ0BpHOpodXMZRNd7ZF7IJkF/Azjnj98z/+0Ig4AR439WGb+H/md vpAczU+mCO6D96A2fMK/pbjXK9V4mFOpSkI+4u9/WCIrvbHPZmeqr6MFDf7Ay8DD nbqkC0/gIQS5V3S/MwnL15UAm/1q3y7EP9iAy6O10aUCwtfnWKxHSXBYe0J9xNmu NOhEOv+zvzYxbFnd274vUjdCCkjpiNftB4NHXnJTaFsie7oenHyQmQjfePlydZkn 5OCcAUhnvrJpDuIOOWN8NmKsqSD01pMUPsE7QlVbMUgpx49mFHhmb1HJ5KOkiz8x IwgeUTlnq4sUHFy/E98s6AIltr3OtsbVPVkLKZVXEYht3G4A2VKYLfMB75DjRFD+ pm3nEKMRf06gIzGd5MOK6MIfaO3dfuxKCvFnHu3nrYdAwNJjtO55iWcFWZI/6vuO 9Sn4Ot1DRs8j1u5j2HFVqeBJ8b/w+EJlacPtAzqp0d0pawzx1G1tLRe0y0FSP3Ii DjA3pVAtJQ6v6VDlYusuDBOWb9Fk5JT3/QzjJrRdqoGbv4joax4= =GpLM -----END PGP SIGNATURE-----
