BLOG
At a glance
- Debian released a security update for Sympa addressing path traversal and an access-control bypass.
- The flaw could expose deleted archive files or raw archive files.
- The stated scope is Debian trixie, package sympa 6.2.76~dfsg-1.
- Upgrade to 6.2.76~dfsg-1+deb13u1.
Debian updates Sympa on trixie to fix archive-file access flaws
Debian released a security update for Sympa on trixie, fixing path traversal combined with an access-control bypass that could expose deleted or raw archive files. Upgrade the sympa package to 6.2.76~dfsg-1+deb13u1.
In this article
Debian has published a Sympa update to address an issue involving access to archive files. Administrators of Debian trixie should check the package version and upgrade if they are running the affected version. Read the Debian security announcement.
Overview and technical details
Sympa is mailing-list management software. The update fixes path traversal combined with an unauthorized access bypass, which could allow access to deleted archive files or raw archive files.
| Field | Details |
|---|---|
| Product | Sympa |
| Issue | Path traversal and access-control bypass |
| Source | Debian DSA |
Affected systems
| Product | Affected version | Fixed version |
|---|---|---|
| Debian trixie, package sympa | 6.2.76~dfsg-1 | 6.2.76~dfsg-1+deb13u1 |
System checks
Query the installed Sympa package version on Debian trixie:
dpkg-query -W -f='${Version}\n' sympaCheck whether the package version is lower than the fixed version. If the comparison returns a true status, the installed package is below the fixed version and needs an upgrade:
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' sympa)" lt 6.2.76~dfsg-1+deb13u1
Remediation and mitigation
- Upgrade the
sympapackage on Debian trixie to version6.2.76~dfsg-1+deb13u1.
References
Related articles
Ubuntu Linux kernel for NVIDIA Tegra: check systems and apply security updates
Ubuntu USN-9091-1 warns of multiple vulnerabilities in the Linux kernel for NVIDIA Tegra. The supplied record gives no affected branches or fixed packages. Check installed kernels and packages, then consult the Ubuntu notice for the applicable update.
Linux Kernel CVE-2026-99284: Local Privilege Escalation to Root and the Required Fix
Zero Day Initiative warns of CVE-2026-99284 in Linux Kernel: a low-privileged user able to execute code locally could escalate to root. Identify running kernel versions and update to a Linux release containing the fix.
Linux Kernel: BPF Local Storage race condition may enable privilege escalation
ZDI-26-1007 describes a race condition in Linux Kernel BPF Local Storage. A local attacker needs high-privileged code execution; successful exploitation may enable privilege escalation and arbitrary code execution in the kernel context. Check the kernel version and apply the vendor update.
Debian DSA-6626-1 updates c-ares to address four security vulnerabilities
Debian issued DSA-6626-1 with a c-ares security update for Debian 13 (trixie), addressing four vulnerabilities that may cause denial of service, DNS spoofing, or information exposure. Update affected c-ares 1.34.5-1+deb13u1 to 1.34.9-1~deb13u1 from trixie-security.