Debian Packages Face Critical Shell Command Execution Vulnerabilities

Debian has issued security advisories for critical vulnerabilities in libhttp-daemon-perl and libgd-perl, affecting versions in Debian 11 (bullseye) and Debian 12 (bookworm). The libhttp-daemon-perl vulnerability (DLA-4639) allows shell command execution, patched in versions 6.12-1+deb11u2 for bullseye and 6.16-1+deb13u1~deb12u1 for bookworm. Similarly, the libgd-perl flaw (DLA-4638) also permits shell command execution, with fixes in versions 2.73-1+deb11u1 for bullseye and 2.76-4+deb12u1 for bookworm. Users are strongly advised to upgrade their packages to mitigate potential exploitation. The vulnerabilities pose significant risks to systems running these libraries, particularly in web applications. Current status indicates that patches are available and users should apply them immediately.

Key Points: • Critical vulnerabilities in libhttp-daemon-perl and libgd-perl allow shell command execution. • Debian 11 and 12 users are urged to upgrade to patched versions immediately. • Both vulnerabilities have been assigned DLA-4639 and DLA-4638 advisories, respectively.