Source: plymouth Version: 24.004.60-5.2 Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities (without CVEs yet) have been identified and fixed upstream for plymouth: 1. ply-terminal-emulator: fix CUB cursor underflow: - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/405 2. ply-image: fix integer overflow in BMP loader dimension handling: - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/406 3. ply-throbber: bound scandir cleanup loop by entry count: - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/407 4. ply-rich-text: bound move_character indices to array length - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/408 5. ply-console-viewer: cancel pending timeouts on free: - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/412 6. ply-utils: check open() result in check_secure_boot_settings() - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/413 I have created a MR on salsa to backport the fixes: - https://salsa.debian.org/debian/plymouth/-/merge_requests/12 The severity doesn’t seem high, but I’d also like to fix these issues in Trixie. Best regards, Dylan
