Debian alert DSA-6109-1 (incus)

From:
             
 
Moritz Muehlenhoff <jmm@debian.org>
To:
             
 
debian-security-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DSA 6109-1] incus security update
Date:
             
 
Fri, 23 Jan 2026 20:08:34 +0000
Message-ID:
             
 
<aXPVQpOjIZ0Bsnz6@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6109-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
January 23, 2026                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : incus
CVE ID         : CVE-2026-23953 CVE-2026-23954

Two security issues were discovered in Incus, a system container and
virtual machine manager, which could result the in execution of arbitrary
commands via malformed images.

For the stable distribution (trixie), these problems have been fixed in
version 6.0.4-2+deb13u4.

We recommend that you upgrade your incus packages.

For the detailed security status of incus please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/incus

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmlz1TIACgkQEMKTtsN8
Tja3AQ//VHHzFdL5O/cnPPQa4YcYTyzQ8AYeCNsgJlA20ZuZ/SxqxNEIzvZ8SbkJ
XOucJmjE3WRpOuV+KQ1GQyw3fO/+NH35ZY8hjGQjojuxAiHZx1Wm35HpYO9EWxJf
+XgVW82UcBPww0OIS/RpGowv8p5wVrTQERGQOir+OQDjtJhR5VwDPllSoh1po1if
r8bjtJeQsfjhlgGWQulhikiDS+1EyVYyq56W0GdWvPjY7Mk9HTCt057NYsu3znbx
nUxxzY87evJO8qhPm5tbIP07EL40Vo6wKB0Yv0v7PnUhFSGXYko50fwxo3PQeNR/
JxhDi4y/ClFvBknhW21hTPrwmt6BtqjEVEj2EUb7e0JUntivFpm9hsDey1AaaEnL
o5HWI2/DkZ2A8u3oYxSTQnf3UQRGoD9bIUj0mLI3WvoWO+uvr+OMqhC1nMFeKDnC
WHuoRY0Wsai73D3If3ePYlBzGH2A16jYNkXmKRSFY3Sebi3UT9UJV/kkJcl79vjj
sWhX7Hg1aaom6Ts0Ky+8LoQ0YytM8SWROfC5Zq1pJmBDnKgL3GzdWU1eupULgFqo
YRmpeYXuSrTrbaK17/ay3z/sWWC3uywcGNSuvHaw70ugh0ui9/PySPKiRQ+tb7Zv
Z7W1a2QDp5+UWJQBZ4rAi2KGZAEwav+ahaToXewPPqDLygFuRAE=
=fZ0w
-----END PGP SIGNATURE-----