Hi,

The following vulnerabilities (without CVEs yet) have been identified and fixed upstream for plymouth:

1. ply-terminal-emulator: fix CUB cursor underflow:
  - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/405

2. ply-image: fix integer overflow in BMP loader dimension handling:
  - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/406

3. ply-throbber: bound scandir cleanup loop by entry count:
  - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/407

4. ply-rich-text: bound move_character indices to array length
  - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/408

5. ply-console-viewer: cancel pending timeouts on free:
  - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/412

6. ply-utils: check open() result in check_secure_boot_settings()
  - https://gitlab.freedesktop.org/plymouth/plymouth/-/merge_requests/413

I have created a MR on salsa to backport the fixes:
  - https://salsa.debian.org/debian/plymouth/-/merge_requests/12

The severity doesn’t seem high, but I’d also like to fix these issues in Trixie.

Best regards,
Dylan

Hi Dylan,

Can you please fix those via an upcoming point release  for trixie,
once they are addressed in unstable.

Regards,
Salvatore