Security fixes
- DLA-4734-1 lemonldap-ng for Debian 12 "Bookworm" and Debian 11 "Bullseye". Bugs in lemonldap-ng could insufficiently enforce access when using certain authentication backends. Fixed in Bookworm
2.16.1+ds-deb12u9, Bullseye2.0.11+ds-4+deb11u9. - DSA-6432-1 flatpak for Debian 13 "Trixie" . Bugs in flatpak could lead to local privilege escalation, sandbox escape or information disclosure. Fixed in
1.16.6-1~deb13u2. - DSA-6434-1 lemonldap-ng for Debian 13 "Trixie" . The Lemonldap::NG web SSO system insufficiently enforced access when using the GitHub/Linkedin authentication backends. Fixed in
2.21.2+ds-1+deb13u3. - DLA-4735-1 neutron for Debian 12 "Bookworm" . Bugs in neutron were fixed. These vulnerabilities were reported by Tim Shephard from roiai.ca. Fixed in
2:21.0.0-7+deb12u1. - DSA-6435-1 spip for Debian 13 "Trixie" . Bugs in spip could lead to remote code execution, SQL injection and server-side request forgery. Fixed in
4.4.19+dfsg-0+deb13u1. - DLA-4736-1 python-django for Debian 12 "Bookworm" and Debian 11 "Bullseye" . Security issues in python-django were fixed. Fixed in Bookworm
3:3.2.25-0+deb12u4, Bullseye2:2.2.28-1~deb11u13.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).