Security fixes
- DSA-6184-1 incus for Debian 13 "Trixie" . Bugs in incus could lead to denial of service or the execution of arbitrary commands. Fixed in
6.0.4-2+deb13u5. - DSA-6185-1 phpseclib for Debian 13 "Trixie" and Debian 12 "Bookworm" . The AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack. Fixed in Trixie
1.0.23-6+deb13u1, Bookworm1.0.20-1+deb12u3. - DSA-6186-1 php-phpseclib for Debian 13 "Trixie" and Debian 12 "Bookworm" . The AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack. Fixed in Trixie
2.0.48-3+deb13u1, Bookworm2.0.42-1+deb12u3. - DSA-6187-1 php-phpseclib3 for Debian 13 "Trixie" and Debian 12 "Bookworm" . The AES-CBC implementation in the PHP Secure Communications Library was susceptible to a padding oracle timing attack. Fixed in Trixie
3.0.43-2+deb13u1, Bookworm3.0.19-1+deb12u4. - DLA-4516-1 gst-plugins-ugly1.0 for Debian 11 "Bullseye" . Bugs in gst-plugins-ugly1.0 were fixed. The ASF demuxer did not validate the number of streams against the size of its static streams array. Fixed in
1.18.4-2+deb11u2. - DLA-4514-1 gst-plugins-base1.0 for Debian 11 "Bullseye" . Bugs in gst-plugins-base1.0 could lead to denial of service or potentially the execution of arbitrary code if a malformed media file is opened. Fixed in
1.18.4-2+deb11u5. - DSA-6183-1 nodejs for Debian 13 "Trixie" . Bugs in nodejs could lead to denial of service, side channel attacks or information disclosure. Fixed in
20.19.2+dfsg-1+deb13u2.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).