Security fixes
- DSA-6223-1 flatpak for Debian 12 "Bookworm" . Bugs in flatpak could allow a Flatpak app to delete arbitrary hosts on the host or break out of the sandbox resulting in code execution in the host context. Fixed in
1.14.10-1~deb12u2. - DSA-6224-1 xdg-dbus-proxy for Debian 12 "Bookworm" . Incorrect parsing of policy rules in the xdg-dbus-proxy (a filtering proxy for D-Bus connections) allowed the bypass of eavesdrop restrictions, which could result in information disclosure. Fixed in
0.1.4-3+deb12u1. - DSA-6225-1 firefox-esr for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in firefox-esr could lead to the execution of arbitrary code, spoofing, information disclosure or privilege escalation. Fixed in Trixie
140.10.0esr-1~deb13u1, Bookworm140.10.0esr-1~deb12u1. - DSA-6226-1 packagekit for Debian 13 "Trixie" and Debian 12 "Bookworm" . Maik Schaefer discovered that a TOCTOU race condition in PackageKit (a package management service over a DBus interface) could result in local privilege escalation. For the oldstable distribution (bookworm), this problem has been fixed in version 1. Fixed in Trixie
1.3.1-1+deb13u1, Bookworm1.2.6-5+deb12u1. - DSA-6227-1 strongswan for Debian 13 "Trixie" and Debian 12 "Bookworm" . Multiple vulnerabilities were fixed in strongSwan, an IKE/IPsec suite. A vulnerability in libtls related to the processing of the supported_versions extension in TLS that can result in an infinite loop. Fixed in Trixie
6.0.1-6+deb13u5, Bookworm5.9.8-5+deb12u4. - DSA-6228-1 cpp-httplib for Debian 13 "Trixie" . Bugs in cpp-httplib could lead to denial of service. Fixed in
0.18.7-1+deb13u1. - DLA-4545-1 packagekit for Debian 11 "Bullseye" . Maik Schaefer discovered that a TOCTOU race condition in PackageKit (a package management service over a DBus interface) could result in local privilege escalation. Fixed in
1.2.2-2+deb11u1.
Announcements and releases
- Upcoming debian.org e-mail change (SPF) on debian-devel-announce .
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).