Debian GNU/Linux 11 (Bullseye) LTS has released two important security advisories addressing vulnerabilities in the ruby-saml library and the libsndfile audio library.

The advisory for ruby-saml highlights a fixed Denial of Service (DoS) vulnerability associated with processing large SAML responses. This issue has been rectified in version 1.11.0-1+deb11u3, and users are urged to update their ruby-saml packages to this version to safeguard against potential attacks.

Meanwhile, the libsndfile advisory addresses two distinct vulnerabilities. The first, CVE-2022-33065, involves multiple signed integer overflows, which can lead to DoS or other unspecified impacts when processing audio headers. The second, CVE-2024-50612, pertains to memory corruption caused by an out-of-bounds read during the parsing of specially crafted input files, also resulting in DoS. The fixes for these vulnerabilities are included in version 1.0.31-2+deb11u1 of libsndfile, and users are advised to upgrade to this version.

To ensure system security, it is crucial for users of Debian 11 to update both ruby-saml and libsndfile to their latest patched versions. Detailed information regarding the security status of these packages can be accessed through the Debian security tracker pages. For guidance on applying updates, users can refer to the Debian LTS wiki.

As security threats continue to evolve, regular updates and vigilance are necessary to protect systems from vulnerabilities. Debian's proactive approach in issuing these advisories reflects its commitment to maintaining a secure environment for users and developers alike. Users are encouraged to stay informed about further updates and best practices in security management

Ruby-Saml and Libsndfile updates for Debian 11 LTS

Two security advisories have been issued for Debian GNU/Linux 11 (Bullseye) LTS, one for ruby-saml and another for libsndfile. The ruby-saml advisory fixes a Denial of Service (DoS) vulnerability caused by large SAML responses, which has been resolved in version 1.11.0-1+deb11u3. The libsndfile advisory addresses two vulnerabilities: CVE-2022-33065, which allows for DoS or unspecified impacts through signed integers overflow, and CVE-2024-50612, which causes memory corruption due to an out-of-bounds read in a specially crafted input file. It is recommended that users upgrade their packages to the latest versions (ruby-saml 1.11.0-1+deb11u3 and libsndfile 1.0.31-2+deb11u1) to resolve these security issues.

[DLA 4288-1] ruby-saml security update
[DLA-4287-1] libsndfile security update

Ruby-Saml and Libsndfile updates for Debian 11 LTS @ Linux Compatible