A libcommons-net-java security update has been released for Debian GNU/Linux 9 Extended LTS to address an issue where a malicious server can redirect the Commons Net code to use a different host, which may lead to the leakage of information about services running on the private network of the client.