Re: usbmuxd/CVE-2025-66004

[Utkarsh Gupta <guptautkarsh2102@gmail.com>]

Hi,

On Wed, Dec 17, 2025 at 8:05 PM Roberto C. Sánchez <roberto@debian.org> wrote:
> > when I was checking usbmuxd last week, it hadn't been triaged yet by
> > the security team. Judging by the description, it appears that the
> > damage that this issue could do is limited. However, Ubuntu released an
> > update with the fix for all of their releases. IMHO it makes sense to
> > cover that in Debian too and add it to dla-needed.txt (and ela-
> > needed.txt if appropriate).
> >
> I agree. It would be best to include a note indicating that as of the
> time of LTS triage that secteam has not yet triaged the package, so that
> whoever ends up working on it knows to coordinate with secteam and/or
> SRM in advance.

I'll take it up and sync with the security folks about the stable updates.


- u