Security fixes
- DSA-6190-1 gst-plugins-bad1.0 for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in gst-plugins-bad1.0 could lead to denial of service or potentially the execution of arbitrary code if a malformed media file is opened. Fixed in Trixie
1.26.2-3+deb13u1, Bookworm1.22.0-4+deb12u7. - DSA-6191-1 gst-plugins-ugly1.0 for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in gst-plugins-ugly1.0 could lead to denial of service or potentially the execution of arbitrary code if a malformed media file is opened. Fixed in Trixie
1.26.3-4+deb13u1, Bookworm1.22.0-2+deb12u2. - DLA-4520-1 python-tornado for Debian 11 "Bullseye" . Tornado is a scalable, non-blocking Python web framework and asynchronous networking library. Introduce new limits on the size and complexity of multipart bodies, including a default limit of 100 parts per request to mitigate a possible DoS. Fixed in
6.1.0-1+deb11u4.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).