A sane firewall won't protect you from privilege escalation from a local attacker. While unlikely, this is one more breach that could be exploited.
Debian bundles AppArmor profiles for most services. This will prevent an attacker from accessing outside the perimeter drawn by the AppArmor profile.
Debian bundles AppArmor profiles for most services. This will prevent an attacker from accessing outside the perimeter drawn by the AppArmor profile.