[SECURITY] [DSA 6216-1] opam security update To : debian-security-announce@lists.debian.org Subject : [SECURITY] [DSA 6216-1] opam security update From : Moritz Muehlenhoff < jmm@debian.org > Date : Fri, 17 Apr 2026 21:18:50 +0000 Message-id : < [🔎] aeKjumr18z4QK_o8@seger.debian.org > Reply-to : debian-security-announce-request@lists.debian.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6216-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff April 17, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : opam CVE ID : CVE-2026-41082 Andrew Nesbitt discovered that .install file directives were insufficiently restricted in OPAM, a package manager for OCaml. This could result in directory traversal out of the package area. For the oldstable distribution (bookworm), this problem has been fixed in version 2.1.2-1+deb12u1. For the stable distribution (trixie), this problem has been fixed in version 2.3.0-1+deb13u1. We recommend that you upgrade your opam packages. For the detailed security status of opam please refer to its security tracker page at: https://security-tracker.debian.org/tracker/opam Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmniolsACgkQEMKTtsN8 TjZ+IQ/9EfvAwOZU0htii95ejQVRSl9+jkqAfMB2Q2kHGeXio0c1YOswspiVYRu2 u7dXzyhxPi5ighXU0yErpSeQvk02QuwclfYQ/4snYMjo60eKN6cs7XLblRpnru/L r3tiJHLRVKdQHmndZG6l+UwlFUSdW/x0Oq8tIswdIkrqVzlR3XAu/BG1e6iLMn5q kJCXxw/pWoNhmWiQL7GePmNv9ka0rv3BHMGwfcb/eeZv4SpNlTMsoQF0+X315H/f JxmslB/pU40IOOdXCcwB5nO3tv0GQ4YL22AIzzCuSepUb3ymCoU+HeSSF0Uzd1/p xn9THrE6nh1ZVKW4sNUqVzTlRhjdnpWl6dL4hVU6L7EqrMG0fXcJyr+ZgquWn7H9 a4DX3FOF2yb8nis4HuuadtA5VjhVOBtNRo3KFTMHr9UE1dYZWBBXtNGfSzBBwAeM HBchflfvo0VdXaP0Wnf3zgQ3S9MH2Xe6ggH1Tk9bkBeXEVAz+tuwtIIUyf0H7c7+ ufIEVUCgAPLnE7z8ntTD9mWzVz5PA99tlIu54McVYBiNoSw6GdBQlYP6cHmhW7m4 pkaVxajxtUYs05NWotsoBWS/sFPc2SKda/KbXYrjXAMD61PDFU8xXSF93t9elxdp UK6zw8NowhmV675qTS+9Xa1Objen0/uVLvtFwljj9PuFfEnPnMc= =3dJP -----END PGP SIGNATURE----- Reply to: debian-security-announce@lists.debian.org Moritz Muehlenhoff (on-list) Moritz Muehlenhoff (off-list) Prev by Date: [SECURITY] [DSA 6215-1] gimp security update Next by Date: [SECURITY] [DSA 6217-1] luanti security update Previous by thread: [SECURITY] [DSA 6215-1] gimp security update Next by thread: [SECURITY] [DSA 6217-1] luanti security update Index(es): Date Thread