Security fixes
- DLA-4443-1 dcmtk for Debian 11 "Bullseye" . Two vulnerabilities have been addressed in DCMTK, a collection of libraries and applications implementing large parts of the DICOM standard for medical images. Fixed in
3.6.5-1+deb11u6. - DLA-4444-1 apache-log4j2 for Debian 11 "Bullseye" . In Apache Log4j2, the Socket Appender does not perform TLS hostname verification of the peer certificate, even when the verifyHostName configuration attribute or the log4j2.sslVerifyHostName system property is set to true. Fixed in
2.17.1-1~deb11u2. - DLA-4442-1 thunderbird for Debian 11 "Bullseye" . Bugs in thunderbird could lead to the execution of arbitrary code. Fixed in
1:140.7.0esr-1~deb11u1.
Announcements and releases
- New delegation for DFSG, Licensing & New Packages Team on debian-devel-announce .
- New delegation for DFSG, Licensing & New Packages Team (superseding previous announcement) on debian-devel-announce .
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).