Recent security advisories have been released for several Debian GNU/Linux packages, including PAM, FFmpeg, Jq, and Shibboleth-SP, addressing critical vulnerabilities that could be exploited by attackers. The vulnerabilities in question involve risks such as denial of service, privilege escalation, SQL injection, and heap buffer overflows.

Specific vulnerabilities identified include:
- PAM: Two vulnerabilities (CVE-2024-22365 and CVE-2025-6020) were found in the PAM namespace module, which could lead to denial of service through blocked login processes and potential privilege escalation via symlink attacks.
- FFmpeg: Multiple vulnerabilities (CVE-2025-1594, CVE-2025-7700, and CVE-2025-10256) were discovered, posing risks of denial of service and arbitrary code execution when handling malformed multimedia files.
- Jq: A heap buffer overflow vulnerability (CVE-2025-48060) was found, which could occur when formatting empty strings within the JSON processor.
- Shibboleth-SP: An SQL injection vulnerability (CVE-2025-9943) was identified, allowing unauthenticated attackers to extract arbitrary data from a database if certain configurations are present.

The affected Debian distributions and their respective updates include:
- Debian GNU/Linux 9 (Stretch): Jq security update (ELA-1520-1)
- Debian GNU/Linux 10 (Buster): Shibboleth-SP security update (ELA-1521-1) and Jq security update (DLA 4307-1)
- Debian GNU/Linux 11 (Bullseye): PAM security update (DLA 4306-1) and Jq security update (DLA 4307-1)
- Debian GNU/Linux 13 (Trixie): FFmpeg security update (DSA 6007-1)

Users are strongly encouraged to upgrade their packages to the patched versions to mitigate these vulnerabilities. Detailed security tracking pages for each package provide additional information about their statuses and recommended actions.

In summary, it is crucial for users of Debian systems to stay informed about these updates and apply them promptly to ensure the security and integrity of their systems. Continuous monitoring of security advisories and timely upgrades is essential in safeguarding against potential exploits

PAM, FFmpeg, Jq, Shibboleth-SP updates for Debian

Multiple security advisories have been issued for various Debian GNU/Linux packages, including pam, ffmpeg, jq, and shibboleth-sp. Attackers could exploit vulnerabilities such as denial of service, privilege escalation, SQL injection, and heap buffer overflows, which these advisories address. The affected packages include pam (CVE-2024-22365 and CVE-2025-6020), ffmpeg (CVE-2025-1594, CVE-2025-7700, and CVE-2025-10256), jq (CVE-2025-48060), and shibboleth-sp (CVE-2025-9943).

Debian GNU/Linux 9 (Stretch) and 10 (Buster) Extended LTS:
ELA-1520-1 jq security update

Debian GNU/Linux 10 (Buster) Extended LTS:
ELA-1521-1 shibboleth-sp security update

Debian GNU/Linux 11 (Bullseye) LTS:
[DLA 4306-1] pam security update
[DLA 4307-1] jq security update

Debian GNU/Linux 13 (Trixie):
[DSA 6007-1] ffmpeg security update

PAM, FFmpeg, Jq, Shibboleth-SP updates for Debian @ Linux Compatible