Security fixes
- DSA-6129-1 munge for Debian 13 "Trixie" and Debian 12 "Bookworm" . Titouan Lazard discovered a buffer overflow vulnerability in munge, which may allow local users to leak the MUNGE cryptographic key and forge arbitrary credentials. Additional details can be found in the upstream advisory: https://github. Fixed in Trixie
0.5.16-1.1~deb13u1, Bookworm0.5.15-2+deb12u1. - DLA-4478-1 tcpflow for Debian 11 "Bullseye" . #1126695 A bug has been found in the tcpflow package: a wrong length check in the 802.11 management frame parser allows a crafted frame with a large TIM length to cause an out-of-bounds write, resulting in a DoS and potentially in code execution. Fixed in
1.5.2+repack1-1+deb11u1. - DLA-4477-1 munge for Debian 11 "Bullseye" . Titouan Lazard discovered a buffer overflow vulnerability in munge, which may allow local users to leak the MUNGE cryptographic key and forge arbitrary credentials. Additional details can be found in the upstream advisory: https://github. Fixed in
0.5.14-4+deb11u1.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).