#1135634#5
Date:
2026-05-03 19:30:57 UTC
From:
To:
Please remove zulucrypt from bullseye (LTS).

- Affected by root LPE (Local Privilege Escalation) CVE-2025-53391,
  which is Debian-specific, rated 9.3/10 by MITRE.
  bullseye tested and vulnerable (FTR buster isn't).
https://security-tracker.debian.org/tracker/CVE-2025-53391

- Last maintainer contacted last December and January, no feedback.
https://bugs.debian.org/1108288
https://bugs.debian.org/1124603

- Removed from unstable and testing/trixie; last version from 2022
  (6.2) while upstream updated twice in 2024 (7.0, 7.1).
https://bugs.debian.org/1124603

- Removal requested for bookworm.
https://bugs.debian.org/1134891

- No reverse dependencies, per `apt rdepends zulucrypt-cli
  zulumount-cli zulucrypt-gui zulumount-gui zulupolkit zulusafe-cli
  libzulucrypt-exe1.2.0 libzulucrypt-exe-dev libzulucrypt1.2.0
  libzulucrypt-dev libzulucryptpluginmanager1.0.0
  libzulucryptpluginmanager-dev libzulucrypt-plugins`
  (only self-rdeps)

Cheers!
Sylvain Beucler
Debian LTS Team

#1135634#10
Date:
2026-05-03 19:38:40 UTC
From:
To:
Control: reassign -1 ftp.debian.org

The Release Team don't manage LTS suites. I assumed you would know this
:-)

I don't know if the Archive Team will be happy to do this, but they're
the only people who can, so reassigning.

Regards,

Adam