Security fixes
- DLA-4762-1 libarchive for Debian 12 "Bookworm" and Debian 11 "Bullseye" . The filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Fixed in Bookworm
3.6.2-1+deb12u5, Bullseye3.4.3-2+deb11u5. - DLA-4764-2 libdbd-csv-perl for Debian 12 "Bookworm" and Debian 11 "Bullseye" . The security fix for (symlink escape in DBD::File), published for libdbi-perl as DLA-4764-1, broke the test suite of the libdbd-csv-perl package. Fixed in Bookworm
0.6000-1+deb12u1, Bullseye0.5800-1+deb11u1. - DLA-4765-1 expat for Debian 12 "Bookworm" . , , Calling certain libexpat functions from within a handler could cause use-after-free. , , , , , , , , Integer overflow in several functions. Fixed in
2.5.0-1+deb12u3. - DLA-4763-1 librabbitmq for Debian 12 "Bookworm" and Debian 11 "Bullseye" . Two issues has been found in librabbitmq, AMQP client library and tools written in C. The bounds check in librabbitmq/amqp_private. Fixed in Bookworm
0.11.0-1+deb12u3, Bullseye0.10.0-1+deb11u3. - DLA-4764-1 libdbi-perl for Debian 12 "Bookworm" and Debian 11 "Bullseye" . The Perl Database Interface (DBI), which may lead to arbitrary code execution, denial of service, file-backed filter bypass or path traversal. Fixed in Bookworm
1.643-4+deb12u2, Bullseye1.643-3+deb11u2.
Announcements and releases
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).