Security fixes
- DSA-6507-1 unbound for Debian 13 "Trixie" . Bugs in unbound could lead to denial of service, cache poisoning, DNS cookie bypass or potentially the execution of arbitrary code. Fixed in
1.26.1-0+deb13u1. - DLA-4787-1 ruby-jwt for Debian 12 "Bookworm" . ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC. Fixed in
2.5.0-1+deb12u1. - DLA-4788-1 linux-6.12 for Debian 12 "Bookworm" . Bugs in linux-6.12 could lead to a privilege escalation, denial of service or information leaks. Fixed in
6.12.107-1~deb12u1. - DSA-6508-1 chromium for Debian 13 "Trixie" . Bugs that could lead to the execution of arbitrary code, denial of service, or information disclosure. Fixed in
153.0.8010.52-1~deb13u1.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13 "Trixie" was the current stable release through this period (point releases noted on their own days).