Security fixes
- DSA-6362-1 gst-plugins-bad1.0 for Debian 13 "Trixie" . Bugs in gst-plugins-bad1.0 could lead to denial of service or potentially the execution of arbitrary code if a malformed media file is opened. Fixed in
1.26.2-3+deb13u2. - DSA-6363-1 python-urllib3 for Debian 13 "Trixie" . The urllib3 Python HTTP library didn't sanitise some cross-origin redirects, which could result in information disclosure. Fixed in
2.3.0-3+deb13u2. - DLA-4641-1 beets for Debian 11 "Bullseye" . Beets, a media library management system, is vulnerable to run arbitrary JavaScript code in the victim browser, exfiltrate viewable data, and perform UI-driven actions as the victim session. Fixed in
1.4.9-7+deb11u1. - DLA-4642-1 u-boot for Debian 12 "Bookworm" and Debian 11 "Bullseye" . Multiple issues where found in u-boot, which could lead to information leak and signature verification bypass. buffer overread vulnerability in the DHCP implementation mishandles use of unit addresses in a FIT. Fixed in Bookworm
2023.01+dfsg-2+deb12u3, Bullseye2021.01+dfsg-5+deb11u3. - DLA-4643-1 imagemagick for Debian 12 "Bookworm" and Debian 11 "Bullseye" . Which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. 9.11.60. Fixed in Bookworm
8:6.9.11.60+dfsg-1.6+deb12u11, Bullseye8:6.9.11.60+dfsg-1.3+deb11u14.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).