Security fixes
- DSA-6307-1 kitty for Debian 13 "Trixie" . Bugs in kitty could lead to the execution of arbitrary code or denial of service. Fixed in
0.41.1-2+deb13u1. - DLA-4605-1 python-flask-httpauth for Debian 11 "Bullseye" . Bugs in python-flask-httpauth in a situation where the client makes a request to a token protected resource without passing a token, or passing an empty token, python-flask-httpauth would invoke the application's token verification callback function with the t. Fixed in
3.2.4-3.1+deb11u1. - DLA-4602-1 lemonldap-ng for Debian 11 "Bullseye" . A Web-SSO system. CSRF on 2FA registration It does not Localize _ during rule evaluation. Fixed in
2.0.11+ds-4+deb11u8. - DSA-6308-1 nagios4 for Debian 13 "Trixie" and Debian 12 "Bookworm" . Some of the CGI scripts of the Nagios monitoring system were susceptible to cross-site request forgery. For the oldstable distribution (bookworm), this problem has been fixed in version 4. Fixed in Trixie
4.4.6-4.1+deb13u1, Bookworm4.4.6-4+deb12u1. - DLA-4603-1 krb5 for Debian 11 "Bullseye" . Security issues in krb5 were fixed. Fixed in
1.18.3-6+deb11u8. - DLA-4604-1 roundcube for Debian 11 "Bullseye" . Bugs in roundcube could lead to cross-site scripting, SQL injection, server-side request forgery, information disclosure, code injection, or deletion of arbitrary files. Fixed in
1.4.15+dfsg.1-1+deb11u9. - DSA-6305-1 linux for Debian 13 "Trixie" . Bugs in linux could lead to a local privilege escalation. Fixed in
6.12.90-2. - DSA-6306-1 linux for Debian 12 "Bookworm" . Bugs in linux could lead to a privilege escalation, denial of service or information leaks. 1.174-1. Fixed in
6.1.174-1.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Debian in the news
- Proxmox Datacenter Manager 1.1: Proxmox Datacenter Manager 1.1 was released on May 28, based on Debian 13.5 Trixie. This Debian-based management product—not an official Debian release—adds centralized automated-installation configuration, subscription management and monitoring of connected Ceph clusters. View on timeline
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).