Security fixes
- DLA-4513-1 gvfs for Debian 11 "Bullseye" . Codean Labs found that gvfs, was affected by multiple vulnerabililies including FTP bounce attack which could lead to probing open ports on client network and improper CRLF validation which could allow an attacker to inject arbitrary FTP commands. Fixed in
1.46.2-2+deb11u1. - DSA-6182-1 libxml-parser-perl for Debian 13 "Trixie" and Debian 12 "Bookworm" . Joris van Rantwijk discovered that libxml-parser-perl, is prone to a heap-based buffer overflow flaw when parsing an XML file with very deep element nesting. For the oldstable distribution (bookworm), this problem has been fixed in version 2. Fixed in Trixie
2.47-2~deb13u1, Bookworm2.46-4+deb12u1.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).