Debian alert DLA-3930-1 (libsepol)

From:
             
 
Sean Whitton <spwhitton@spwhitton.name>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3930-1] libsepol security update
Date:
             
 
Tue, 22 Oct 2024 13:55:29 +0800
Message-ID:
             
 
<87ttd4isvi.fsf@melete.silentflame.com>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3930-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                         Sean Whitton
October 22, 2024                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : libsepol
Version        : 3.1-1+deb11u1
CVE ID         : CVE-2021-36084 CVE-2021-36085 CVE-2021-36086 CVE-2021-36087
Debian Bug     : 990526

Multiple vulnerabilities were discovered in libsepol, a set of userspace
utilities and libraries for manipulating SELinux policies.

CVE-2021-36084, CVE-2021-36085, CVE-2021-36086

    Three use-after-free problems were discovered in the CIL compiler.
    These could lead to data corruption, denial of service or possibly
    arbitrary code execution.

CVE-2021-36087

    A heap-based buffer over-read was discovered in the CIL compiler.
    This could lead to confidentiality or integrity violations, or
    crashes.

For Debian 11 bullseye, these problems have been fixed in version
3.1-1+deb11u1.

We recommend that you upgrade your libsepol packages.

For the detailed security status of libsepol please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libsepol

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJNBAEBCgA3FiEEm5FwB64DDjbk/CSLaVt65L8GYkAFAmcXPlEZHHNwd2hpdHRv
bkBzcHdoaXR0b24ubmFtZQAKCRBpW3rkvwZiQDdsD/0U+2AaLNPwmsCzhgxq+ily
jhdmM8PuZk2gVSKLcKpHiH6v+V0gurlz5uxwt77whaM85hIURqb4A7NoY2vqsY7m
yKKt0thkG0tzF2HS1nzIj/+JD6KTs1V6S8ahjc5BUbqU1pRkl6qXQpu4kk2yhpj2
9f4JZcrDNtcaaNlMkTjDqXj4tgNkqKoNxxUCpdC4dLR06NbP4nYQua57QH/J1rbz
gMxptsqGChKw8aBdVVv8CV6N7J7qRqVUQu7oW0PKGE5jD9Zwy1pW8rz2zf2ygVEH
g5jltIu3H3PQwPOjaeRi+AB4phSi2CyswuCHeqa7JnMBLsHhc+mOXcB/+TUiRg8W
bZJPcJ3bfaz5bKOOBoGOUV6wX2irmj9mZ0syUAvIDqV0YjxhKQp+CFLF3xtImF8E
h/DhE/jSxr2oXfq14MdKDjQdOGGxmikLmPoejOxZC8y7RhCJ5zJrcbWnUrERW890
NUx/vliRwyEVMZYtjIPiSDuNghXwFenoqobCDoY89NKT4h8gUYKC7aFVbPiXU9TZ
k4/vv09qo9Iay1oGDWPZ0h0xWJg6UUd0CwdysFQ/9Oej2Y9OAhd2O+QkV8zW1XzO
ejGbLmkyNstDGDm505e2Rn2H5uimz4JjQcuYQ2g2ikP0s/Q0NSNCLWScvMimXUEA
by0AbOofFaq/ADvx+ZL45Q==
=mVxe
-----END PGP SIGNATURE-----