Security fixes
- DLA-4601-1 memcached for Debian 11 "Bullseye" . This could have been used to reveal or extract information about authentication details. Fixed in
1.6.9+dfsg-1+deb11u1. - DSA-6298-1 imagemagick for Debian 13 "Trixie" . Bugs in imagemagick could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. Fixed in
8:7.1.1.43+dfsg1-1+deb13u9. - DSA-6299-1 kdenlive for Debian 13 "Trixie" and Debian 12 "Bookworm" . Opening a malformed project file in the Kdenlive video editor could result in the execution of arbitrary code. For the oldstable distribution (bookworm), this problem has been fixed in version 22. Fixed in Trixie
24.12.3-2+deb13u1, Bookworm22.12.3-2+deb12u2. - DSA-6300-1 node-shell-quote for Debian 13 "Trixie" and Debian 12 "Bookworm" . Akshat Sinha discovered that incorrect input sanitising in node-shell-quote, could result in shell command injection. For the oldstable distribution (bookworm), this problem has been fixed in version 1. Fixed in Trixie
1.7.4+~1.7.1-1+deb13u1, Bookworm1.7.4+~1.7.1-1+deb12u1. - DSA-6297-1 samba for Debian 13 "Trixie" and Debian 12 "Bookworm" . Bugs in samba could lead to bypass of access checks, overwrite of files in unintended situations using the WORM vfs module, installing CA certificates over http without verification when auto-enrol. Fixed in Trixie
2:4.22.8+dfsg-0+deb13u2, Bookworm2:4.17.12+dfsg-0+deb12u4.
Announcements and releases
- Bits from the SRMs on debian-devel-announce .
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).