Security fixes
- DSA-6197-3 dovecot for Debian 12 "Bookworm" . The oldstable (bookworm) backport of the security fix for introduced a regression in the passwd-file path normalization. Updated packages are now available to correct this issue. Fixed in
1:2.3.19.1+dfsg1-2.1+deb12u4. - DLA-4557-1 pyasn1 for Debian 11 "Bullseye" . Pyasn1, a generic ASN.1 library for Python, is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. Fixed in
0.4.8-1+deb11u2. - DLA-4558-1 libexif for Debian 11 "Bullseye" . Bugs in libexif could causes crashes or information leaks. If the exif_mnote_data_get_value function in MakerNotes gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow. Fixed in
0.6.22-3+deb11u1. - DSA-6240-1 imagemagick for Debian 13 "Trixie" . Bugs in imagemagick could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. Fixed in
8:7.1.1.43+dfsg1-1+deb13u8. - DSA-6241-1 python-aiohttp for Debian 13 "Trixie" . Bugs in python-aiohttp could lead to denial of service, HTTP request smuggling or information disclosure. Fixed in
3.11.16-1+deb13u1. - DLA-4556-1 dovecot for Debian 11 "Bullseye" . Bugs in dovecot could lead to Denial of Service, information leak, path traversal, authentication bypass, replay attacks or timing side channel attacks. The decode2text. Fixed in
1:2.3.13+dfsg1-2+deb11u3. - DSA-6242-1 thunderbird for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in thunderbird could lead to the execution of arbitrary code. Fixed in Trixie
1:140.10.1esr-1~deb13u1, Bookworm1:140.10.1esr-1~deb12u1. - DSA-6243-1 linux for Debian 12 "Bookworm" . Bugs in linux could lead to a privilege escalation, denial of service or information leaks. 1.170-1. Fixed in
6.1.170-1. - DSA-6239-1 chromium for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs that could lead to the execution of arbitrary code, denial of service, or information disclosure. Fixed in Trixie
147.0.7727.137-1~deb13u1, Bookworm147.0.7727.137-1~deb12u1. - DLA-4559-1 imagemagick for Debian 11 "Bullseye" . Bugs in imagemagick could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. Fixed in
8:6.9.11.60+dfsg-1.3+deb11u12.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).