Security fixes
- DLA-4448-1 imagemagick for Debian 11 "Bullseye" . imagemagick, was affected by multiple vulnerabilities A stack overflow via infinite recursion was found in MSL (Magick Scripting Language) `<write>` command when writing to MSL format A heap buffer overflow vulnerability was found in the XBM image decode. Fixed in
8:6.9.11.60+dfsg-1.3+deb11u9. - DLA-4449-1 zvbi for Debian 11 "Bullseye" . Bugs in zvbi were fixed. is related to an uninitialized pointer in src/conv.c:: vbi_strndup_iconv_ucs2() The other issues are related to integer overflows in several functions distributed all over the code. Fixed in
0.2.35-18+deb11u1. - DLA-4450-1 taglib for Debian 11 "Bullseye" . Security issues in taglib were fixed. Fixed in
1.11.1+dfsg.1-3+deb11u1. - DLA-4451-1 shapelib for Debian 11 "Bullseye" . Security issues in shapelib were fixed. Fixed in
1.5.0-2+deb11u1. - DLA-4447-1 php7.4 for Debian 11 "Bullseye" . Bugs in php7.4 could lead to server side request forgery or denial of service. Heap buffer overflow in array_merge(). Fixed in
7.4.33-1+deb11u10. - DLA-4452-1 apache2 for Debian 11 "Bullseye" . Security issues in apache2 were fixed. Fixed in
2.4.66-1~deb11u1. - DLA-4453-1 inetutils for Debian 11 "Bullseye" . Kyu Neushwaistein aka Carlos Cortes Alvarez found that inetutils, was vulnerable to an authentication bypass problem in telnetd, which could lead to remote root shell access (if telnetd is enabled and exposed). Fixed in
2:2.0-1+deb11u3.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).