[SECURITY] [DLA 4325-1] redis security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4325-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Chris Lamb
October 09, 2025 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : redis
Version : 5:6.0.16-1+deb11u8
CVE IDs : CVE-2025-46817 CVE-2025-46819 CVE-2025-49844
Debian Bug : 1117553
Multiple vulnerabilities were discovered in Redis, a popular
key/value database:
* CVE-2025-46817: Fix an issue where an authenticated user could have
used a specially-crafted Lua script to cause an integer overflow
and potentially lead to remote code execution.
* CVE-2025-46819: Address a potential vulnerability where an
authenticated user could have used a specially-crafted Lua script
to read out-of-bound data and/or crash the server and thereby
create a denial of service attack.
* CVE-2025-49844: Fix an issue where authenticated users could have
exploited a specially-crafted Lua script to manipulate the garbage
collector, trigger a use-after-free and potentially lead to remote
code execution.
For Debian 11 bullseye, these problems have been fixed in version
5:6.0.16-1+deb11u8.
We recommend that you upgrade your redis packages.
For the detailed security status of redis please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/redis
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmjn8jUACgkQHpU+J9Qx
HlhlTQ/8D9GPs05lSMD40BlAt1N3PLg+bB2TnV9TGQHn11HRSvyYLj9skdZJqndi
FzoWvf3nU5z+3cYrG6XujBmz0cnLUr6rgaT95sZd6lZNkBOTFv4nua/e53muGkQF
v36d/PnCMnwtu03LY2K572kk7WoC1ZD/1PxOqbwdxjTzefgMQ1p2YW8dTdDx0/NK
FwJeNhLPta6C9ozpk/TiCRtVl3BaJihmMLUXew3oFyxWEuDTtZq8G/MSH2XQtK3q
/GUnYuCPDd80xiUa8Brnlm6MhzpqYTbinufd52CH0ibg9ZxRLoXQatKfhJsfrhRe
kosp3VvvqjmcrlsqmQLHd6pGHXb+0dSWAc3RL+sfgXStCc8NfTeT0w9jp4IJXWHq
jxKM0paEiOtx3hQKvgSiujg7TjCr7ckX9vICST/NeVWp5kd2GN8AxDsa1mgxY4rr
gwlBsazAESSWtWGZ1FkQehG3BNJ5S8uVenk+Rz+rwGXDqiVnn+xdwMR1pnnkZnOm
OnkdUgnE2Fx+hyXJg6OMR3/fbjVNqZk/VZThnMiRDeAOQcMV8rUIdXlLTDf/Rxyu
0PHaTD/engBQjQMZVr0WdgEEEO+dDwBuTVDmvc4uDNk4SZYPaVtuUP+RZrRn+Y17
pTjkDpB29bfqg3zpsOOgikqsfZT0EnDJR6YyFAiwA4fTvvQj8wk=
=zC8A
-----END PGP SIGNATURE-----
Reply to: