Debian Linux: Unpatched System Files Can Be Overwritten

Summary

Certain Debian Linux systems are missing a security update, which allows an attacker to overwrite system files. This could lead to unauthorized access and data tampering. Update your Debian Linux system as soon as possible to fix the issue.

What to do

Update debian bubblewrap to version 0.11.2-1.
Update debian bubblewrap to version 0.11.0-2+deb13u1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:11	debian	bubblewrap	All versions
Debian:12	debian	bubblewrap	All versions
Debian:13	debian	bubblewrap	< 0.11.0-2+deb13u1 Fix: upgrade to 0.11.0-2+deb13u1
Debian:14	debian	bubblewrap	< 0.11.2-1 Fix: upgrade to 0.11.2-1

Original title

bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap ...

Original description

bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitrarily use the privileged operations, and in particular the "overlay mount" operation, allowing the creation of overlay mounts which is otherwise not allowed in the setuid version of bubblewrap. This issue has been patched in version 0.11.2.

https://security-tracker.debian.org/tracker/CVE-2026-41163 Vendor Advisory