Security fixes
- DLA-4482-1 ceph for Debian 11 "Bullseye" . There was an issue in Ceph, the distributed storage and file system, where the Python bindings did not correctly implement SSL certificate checking. Fixed in
14.2.21-1+deb11u3. - DLA-4481-1 libpng1.6 for Debian 11 "Bullseye" . Security issues in libpng1.6 were fixed. Fixed in
1.6.37-3+deb11u2. - DSA-6137-1 roundcube for Debian 13 "Trixie" and Debian 12 "Bookworm" . CERT Polska and nullcathedral discovered that roundcube, did not correctly process and sanitize requests. This would allow an attacker to perform CSS injection attacks, or leak sensitive information. Fixed in Trixie
1.6.13+dfsg-0+deb13u1, Bookworm1.6.5+dfsg-1+deb12u7. - DSA-6138-1 libpng1.6 for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in libpng1.6 could lead to denial of service or potentially the execution of arbitrary code. For the oldstable distribution (bookworm), this problem has been fixed in version 1. Fixed in Trixie
1.6.48-1+deb13u3, Bookworm1.6.39-2+deb12u3. - DLA-4480-1 roundcube for Debian 11 "Bullseye" . Security issues in roundcube were fixed. Fixed in
1.4.15+dfsg.1-1+deb11u7.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).