Debian alert DLA-4641-1 (beets)

From:
             
 
Emmanuel Arias <eamanu@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4641-1] beets security update
Date:
             
 
Tue, 23 Jun 2026 16:44:57 -0300
Message-ID:
             
 
<ajriOYdvKAAPTxbv@debian>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4641-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Emmanuel Arias
June 23, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : beets
Version        : 1.4.9-7+deb11u1
CVE ID         : CVE-2026-42052
Debian Bug     : 1135779

It was discovered that beets, a media library management system, is
vulnerable to run arbitrary JavaScript code in the victim browser,
exfiltrate viewable data, and perform UI-driven actions as the victim
session.

For Debian 11 bullseye, this problem has been fixed in version
1.4.9-7+deb11u1.

We recommend that you upgrade your beets packages.

For the detailed security status of beets please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/beets

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEE3lnVbvHK7ir4q61+p3sXeEcY/EFAmo64jgACgkQ+p3sXeEc
Y/GTwxAAsnBDwDA/VQAGm2lWzq+HrvuTH59InQhBkZFCZDr5cBq544mvdlMaE6v9
SfEebs3L6tX6F5DWbea7L//XdVEigRoQSgMy+fv7k9BE1Z//g2BvmDrSKsSG2GIS
czHon+5cnKvBDTE2qc6MtpHv3hkgFBT5DKk0wi7cZZBqpsGVNAnPLz/IufGqYxPS
IAutLKvwchh792K3pzNeEwR1C2flLUhNpkF5wn3zHcEL/QdTbQYe3EoAILObktSE
WOBK99vYbKRysOx+cKUgrjU7HRE/JgHq+y7g4Q/gvGbeame1JYkdYWqy+6nKfX+d
hu2CjWa1ME8RIg/jgXughrVirtCZEfBXq6IJ4oST0kXhtINLhl/Cj6HozQMViwMr
zXNqIfaCHbyNJ84qWjQfM+ICDAx4Re6HT47McagiSy53TKomIdd0ivpq7ompSa9i
I6N8tYDYcG/1/sBhH9CitzHXs7WkFAt85t3PIsto3zGL8hlcd3fGt6/kWHCR0FO2
8zerON7R951VjkfvOW+jcIh2acHd0X/dEgZ4MMvji4eA5qSGHEaa60Imr37ygB6W
bTRZKzUrM1H6ai0tlujs+R8ixEDzy4qCr/Igp+Fw92PZlJjaxZs3kZa/I+3Kvw74
JQwhMk/rKo57IeW6i8bitCdzszQJDZnFPWvkI7qTxxb1dxWy/oo=
=ZFng
-----END PGP SIGNATURE-----