CLSA-2025-1741216285 Fix CVE(s): CVE-2024-47175

SECURITY UPDATE: PPD injection issues - debian/patches/CVE-2024-47175.patch: sanitize make and model, PPDize preset and template names in cups/ppd-cache.c - CVE-2024-47175...

Code Injection

keras is vulnerable to Code Injection. The vulnerability is due to improper model sanitization through the Lambda layer, allowing an attacker to inject arbitrary Python code into a model via a lambda function. If an unsuspecting developer then loads this model, arbitrary code execution occurs...

Cross-site Scripting (XSS)

github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization in the username field of the user model...