Security fixes
- DLA-4594-1 thunderbird for Debian 11 "Bullseye" . Bugs in thunderbird could lead to the execution of arbitrary code. Fixed in
1:140.11.0esr-1~deb11u1. - DLA-4595-1 gnutls28 for Debian 11 "Bullseye" . Bugs in gnutls28 could lead to constraint bypass, denial of service, information disclosure, authentication bypass or potentially execution of arbitrary code. Oleh Konko and Joshua Rogers independently discovered that domain name. Fixed in
3.7.1-5+deb11u10. - DSA-6291-1 haproxy for Debian 13 "Trixie" . Martino Spagnuolo reported that the HTTP/3 parsing code in HAProxy, does not properly validate the received body size and the announced content-length header, which may result in HTTP request smuggling. Fixed in
3.0.11-1+deb13u3. - DLA-4596-1 evince for Debian 11 "Bullseye" . Evince, a simple multi-page document viewer, is prone to a command injection vulnerability if a specially crafted PDF file is opened. Fixed in
3.38.2-1+deb11u1. - DSA-6292-1 haveged for Debian 13 "Trixie" and Debian 12 "Bookworm" . Dirk Mueller discovered that a flaw in the function performing a credential check on the command socket of haveged, may result in local privilege escalation. For the oldstable distribution (bookworm), this problem has been fixed in version 1. Fixed in Trixie
1.9.19-12+deb13u1, Bookworm1.9.14-1+deb12u1. - DSA-6293-1 krb5 for Debian 13 "Trixie" and Debian 12 "Bookworm" . Cem Onat Karagun discovered two vulnerabilities in the NegoEx parsing in krb5, the MIT implementation of Kerberos. An unauthenticated remote attacker can take advantage of these flaws to cause a denial of service. Fixed in Trixie
1.21.3-5+deb13u1, Bookworm1.20.1-2+deb12u5. - DLA-4597-1 atril for Debian 11 "Bullseye" . Atril, a simple multi-page document viewer, is prone to a command injection vulnerability if a specially crafted PDF file is opened. Fixed in
1.24.0-1+deb11u2. - DSA-6294-1 libgcrypt20 for Debian 13 "Trixie" and Debian 12 "Bookworm" . An incorrect implementation of ECDH encryption (with NIST, Brainpool, X448, or X25519 curves) within Libgcrypt could result in denial of service. For the oldstable distribution (bookworm), this problem has been fixed in version 1. Fixed in Trixie
1.11.0-7+deb13u1, Bookworm1.10.1-3+deb12u1.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).