Hi Dylan, On Wed, Jul 15, 2026 at 11:31:15AM +0000, Dylan Aïssi wrote: > Source: plymouth > Version: 24.004.60-5.2 > Tags: security upstream > X-Debbugs-Cc: [email protected], Debian Security Team > <[email protected]> > > Hi, > > The following vulnerabilities (without CVEs yet) have been identified and > fixed upstream for plymouth: > > 1. ply-terminal-emulator: fix CUB cursor underflow: > - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/405 > > 2. ply-image: fix integer overflow in BMP loader dimension handling: > - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/406 > > 3. ply-throbber: bound scandir cleanup loop by entry count: > - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/407 > > 4. ply-rich-text: bound move_character indices to array length > - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/408 > > 5. ply-console-viewer: cancel pending timeouts on free: > - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/412 > > 6. ply-utils: check open() result in check_secure_boot_settings() > - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/413 > > I have created a MR on salsa to backport the fixes: > - https://salsa.debian.org/debian/plymouth/-/merge_requests/12 > > The severity doesn’t seem high, but I’d also like to fix these issues in > Trixie.
Can you please fix those via an upcoming point release for trixie, once they are addressed in unstable. Regards, Salvatore
