------------------------------------------------------------------------- Debian LTS Advisory DLA-4808-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Andreans Henriksson October 01, 2026 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : network-manager-l2tp Version : 1.20.8-1+deb12u1 CVE ID : CVE-2026-19624 CVE-2026-75131 CVE-2026-75883 CVE-2026-93337 Andres Berbescu discovered two vulnerabilities in the L2TP connection plugin for Network Manager which allowed a local user with permissions to create/activate personal VPN connections to escalate their privileges to root. For Debian 12 bookworm, these problems have been fixed in version 1.20.8-1+deb12u1. We recommend that you upgrade your network-manager-l2tp packages. For the detailed security status of network-manager-l2tp please refer to its security tracker page at: https://security-tracker.debian.org/tracker/network-manager-l2tp Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature