Security fixes
- DLA-4484-1 python-django for Debian 11 "Bullseye" . Contrib.auth.handlers. Fixed in
2:2.2.28-1~deb11u12. - DSA-6142-1 gegl for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in gegl could lead to denial of service or the execution of arbitrary code if malformed files are processed. For the oldstable distribution (bookworm), this problem has been fixed in version 1:0.4. Fixed in Trixie
1:0.4.62-2+deb13u2, Bookworm1:0.4.42-2+deb12u2. - DSA-6143-1 libvpx for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in libvpx could lead to denial of service or potentially the execution of arbitrary code. Fixed in Trixie
1.15.0-2.1+deb13u1, Bookworm1.12.0-1+deb12u5. - DSA-6144-1 inetutils for Debian 13 "Trixie" . Ron Ben Yizhak discovered that the inetutils implementation of telnetd didn't sanitise the CREDENTIALS_DIRECTORY environment variable before passing it to the login binary. This could be exploited to bypass authentication and login as root. Fixed in
2:2.6-3+deb13u2. - DSA-6145-1 nova for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in nova could lead to unsafe image resize operations that could destroy data on the host system. Only compute nodes using the Flat image backend are affected. Fixed in Trixie
2:31.0.0-6+deb13u2, Bookworm2:26.2.2-1~deb12u4.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).