Security fixes
- DLA-4536-1 tiff for Debian 11 "Bullseye" . Bugs in tiff could lead to denial of service or the execution of arbitrary code if malformed image files are processed. Fixed in
4.2.0-1+deb11u8. - DLA-4537-1 mapserver for Debian 11 "Bullseye" . Bugs in mapserver could lead to Denial of Service via crafted SLD (Styled Layer Descriptor) sent by a remote unauthenticated attacker. Fixed in
7.6.2-1+deb11u2. - DSA-6214-1 chromium for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs that could lead to the execution of arbitrary code, denial of service, or information disclosure. Fixed in Trixie
147.0.7727.101-1~deb13u1, Bookworm147.0.7727.101-1~deb12u1. - DSA-6215-1 gimp for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in gimp could lead to denial of service or potentially the execution of arbitrary code if malformed PSP, JPEG 2000, PSD or ANI files are opened. Fixed in Trixie
3.0.4-3+deb13u8, Bookworm2.10.34-1+deb12u10. - DSA-6216-1 opam for Debian 13 "Trixie" and Debian 12 "Bookworm" . Andrew Nesbitt discovered that .install file directives were insufficiently restricted in OPAM, a package manager for OCaml. This could result in directory traversal out of the package area. Fixed in Trixie
2.3.0-1+deb13u1, Bookworm2.1.2-1+deb12u1. - DSA-6217-1 luanti for Debian 13 "Trixie" . Bugs in luanti could lead to incomplete restrictions for installed mods or sandbox escape. Fixed in
5.10.0+dfsg-5+deb13u1. - DLA-4524-2 postgresql-13 for Debian 11 "Bullseye" . The fix for introduced a regression in SUBSTRING() for toasted multibyte characters, as discussed in the upstream bug: https://www.postgresql.org/message-id/19406-9867fddddd724fca@postgresql.org Also a number of minor upstream fixes for the patches added in 13. Fixed in
13.23-0+deb11u3.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).