[SECURITY] [DLA 3292-1] sofia-sip security update
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian LTS Advisory DLA-3292-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Adrian Bunk January 29, 2023 https://wiki.debian.org/LTS - - Package: sofia-sip Version: 1.12.11+20110422.1-2.1+deb10u2 CVE ID : CVE-2023-22741 Debian Bug : 1029654 Missing message length and attributes length checks when handling STUN packages have been fixed in sofia-sip, a SIP (Session Initiation Protocol) User-Agent library. For Debian 10 buster, this problem has been fixed in version 1.12.11+20110422.1-2.1+deb10u2. We recommend that you upgrade your sofia-sip packages. For the detailed security status of sofia-sip please refer to its security tracker page at: https://security-tracker.debian.org/tracker/sofia-sip Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -BEGIN PGP SIGNATURE- iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmPW35QACgkQiNJCh6LY mLEZTRAArYLhMDrxRQ7OFWIhUP7EAk74GGRvVk+qn7D6EAPOLsYxFWaTjQhdAwha absf8/YiQOwEAOrEeOYGvOwH0QPN7NGwrkrfl7MnZAwyMUuIhmt1fxptdcvfCMI2 VTo8iONYgVHooY5VSPUUWbMp1O409vrzoCpcsiVRQvhrjJefg4wq5Va28YA9IpVp kzTmLhNMocFc+qEKyfHWgIKS2AZECoWczmagi8AQC2wWzVfiNcUmQI7sJzn70Clr +CwlI+RIIEkeZ/MRni7MBJavnJ0XdIlv+4sHjhl4ok1VOIpxdDojFjfNE2cUF2XB bnY8tN3NmLVi7X0xdbzsOgaznRTE80I3Y8oHjMlbPBtCH9D+viqYiumqdiDYLCCa 72RTh38YlxoD/0C1iTzQ6/TylZ2wCMHZgCVA/53TojHcFC6hHOPADI7oH54t0z/H SzP4OEtkL+SY+7ipMpepi6WT33QcuUPnhlQKvfV6avUPbe6AsMPsUpZKw/2hO1Fb PQseIQRqpyT7cc6n5T6Jt5sN4x35W3DdJ7fGWSBVF+VaQTgYHRo78TFlX9HzZ8wO 2ooX+FHt9oEITZvAMctq/fYU7B7aQvZznrO/EPTXGd8fmOaxt05uFRwsm/lEZ9Rc f5TEQsA6pXT/qipgmG46YhYwqCnBV9V8axoIG+HWH7gjqAPecgI= =cyF1 -END PGP SIGNATURE-
[SECURITY] [DLA 3291-1] node-object-path security update
- Debian LTS Advisory DLA-3291-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Guilhem Moulin January 29, 2023 https://wiki.debian.org/LTS - Package: node-object-path Version: 0.11.4-2+deb10u2 CVE ID : CVE-2021-3805 CVE-2021-23434 It was discovered that node-object-path, a Node.js module to access deep object properties using dot-separated paths, was vulnerable to prototype pollution. CVE-2021-3805 Prototype pollution vulnerability in the `del()`, `empty()`, `push()` and `insert()` functions when using the "inherited props" mode (e.g. when a new `object-path` instance is created with the `includeInheritedProps` option set to `true` or when using the `withInheritedProps` default instance). CVE-2021-23434 A type confusion vulnerability can lead to a bypass of the CVE-2020-15256 fix when the path components used in the path parameter are arrays, because the === operator returns always false when the type of the operands is different. For Debian 10 buster, these problems have been fixed in version 0.11.4-2+deb10u2. We recommend that you upgrade your node-object-path packages. For the detailed security status of node-object-path please refer to its security tracker page at: https://security-tracker.debian.org/tracker/node-object-path Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS signature.asc Description: PGP signature
[SECURITY] [DLA 3289-1] dojo security update
- Debian LTS Advisory DLA-3289-1debian-...@lists.debian.org https://www.debian.org/lts/security/ Guilhem Moulin January 28, 2023 https://wiki.debian.org/LTS - Package: dojo Version: 1.14.2+dfsg1-1+deb10u3 CVE ID : CVE-2020-4051 CVE-2021-23450 Debian Bug : 97 1014785 Two vulnerabilities were found in dojo, a modular JavaScript toolkit, that could result in information disclosure. CVE-2020-4051 The Dijit Editor's LinkDialog plugin of dojo 1.14.0 to 1.14.7 is vulnerable to cross-site scripting (XSS) attacks. CVE-2021-23450 Prototype pollution vulnerability via the setObject() function. For Debian 10 buster, these problems have been fixed in version 1.14.2+dfsg1-1+deb10u3. We recommend that you upgrade your dojo packages. For the detailed security status of dojo please refer to its security tracker page at: https://security-tracker.debian.org/tracker/dojo Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS signature.asc Description: PGP signature
