Debian LTS libmatio Critical Buffer Overflow CVE-2025-2337 DLA-4644-1

CVE-2025-2337

A vulnerability, which was classified as critical, has been found in
libmatio Mat_VarPrint function. The manipulation leads to heap-based buffer
overflow. The attack may be initiated remotely. The exploit has been
disclosed to the public and may be used.

CVE-2025-2338

A Denial of Service (DoS) and head-based buffer overflow was found, which
could potentially lead to remote code execution if libmatio is embedded in
services that accepts user-supplied .mat files.

CVE-2025-50343

A Denial of Service (DoS) and in certain cases heap corruption vulnerability
was found, which could lead to potential remote code execution if libmatio is
embedded in services that accepts user-supplied .mat files.

For Debian 12 bookworm, these problems have been fixed in version
1.5.23-2+deb12u1.

For Debian 11 bullseye, see separate DLA-4459-1.

We recommend that you upgrade your libmatio packages.

For the detailed security status of libmatio please refer to
its security tracker page at: