Security fixes
- DLA-4809-1 nodejs for Debian 12 "Bookworm" . Bugs in nodejs could lead to denial of service, incorrect certificate validation or information disclosure. Fixed in
18.20.4+dfsg-1~deb12u3. - DSA-6534-1 webkit2gtk for Debian 13 "Trixie" . Bugs in webkit2gtk could lead to heap corruption, local privilege escalation, remote code execution, out-of-bounds memory access, cross-origin data leak and sandbox escape, among other problems. Fixed in
2.54.0-1~deb13u1. - DSA-6535-1 chromium for Debian 13 "Trixie" . Bugs that could lead to the execution of arbitrary code, denial of service, or information disclosure. Fixed in
154.0.8037.92-1~deb13u1. - DSA-6536-1 thunderbird for Debian 13 "Trixie" . Bugs in thunderbird could lead to the execution of arbitrary code. Fixed in
1:140.17.0esr-1~deb13u1. - DSA-6537-1 libpng1.6 for Debian 13 "Trixie" . Bugs in libpng1.6 could lead to denial of service. Fixed in
1.6.48-1+deb13u6. - DLA-4808-1 network-manager-l2tp for Debian 12 "Bookworm" . Andres Berbescu discovered two vulnerabilities in the L2TP connection plugin for Network Manager which allowed a local user with permissions to create/activate personal VPN connections to escalate their privileges to root. Fixed in
1.20.8-1+deb12u1. - DLA-4810-1 thunderbird for Debian 12 "Bookworm" . Bugs in thunderbird could lead to the execution of arbitrary code. Fixed in
1:140.17.0esr-1~deb12u1. - DLA-4811-1 chromium for Debian 12 "Bookworm" . Bugs that could lead to the execution of arbitrary code, denial of service, or information disclosure. Fixed in
154.0.8037.92-1~deb12u1. - DLA-4812-1 libio-compress-perl for Debian 12 "Bookworm" . Bugs in libio-compress-perl were fixed. Uncaught exception when parsing zip header with malformed DOS date. Fixed in
2.204-1+deb12u1. - DLA-4807-1 expat for Debian 12 "Bookworm". Bugs in expat could lead to denial of service or other issues when parsing crafted XML. Fixed in
2.5.0-1+deb12u4.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Debian in the news
- FlickOS 2.1 released. FlickOS 2.1, a Debian 13-based distribution—not an official Debian release—was released on October 1. It adds a login screen, start menu, welcome window and Settings History for undoing settings changes. View on timeline
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13.7 "Trixie" remained the current stable release.