Security fixes
- DLA-4821-2 libmodule-cpants-analyse-perl for Debian 12 "Bookworm" . The security fix for (symlink escape in Archive::Tar), published for perl as DLA-4821-1, broke the test suite of the libmodule-cpants-analyse-perl package. Fixed in
1.01-1+deb12u1. - DLA-4822-1 ruby-oauth2 for Debian 12 "Bookworm" . Bugs in ruby-oauth2 could lead to a bearer token being sent to the host named by a redirect Location. Fixed in
1.4.4-1+deb12u1. - DLA-4823-1 roundcube for Debian 12 "Bookworm" . Bugs in roundcube could lead to cross-site scripting, server-side request forgery, information disclosure, email header injection, or privilege escalation. Fixed in
1.6.5+dfsg-1+deb12u12. - DSA-6543-1 libreoffice for Debian 13 "Trixie" . Bugs in libreoffice could lead to denial of service, information disclosure or the execution of arbitrary code if malformed document files are opened. Fixed in
4:25.2.3-2+deb13u8. - DSA-6544-1 sabnzbdplus for Debian 13 "Trixie" . Bugs in sabnzbdplus could lead to the execution of arbitrary code or authorisation bypass. Fixed in
4.5.0+dfsg-1+deb13u2. - DLA-4824-1 libpng1.6 for Debian 12 "Bookworm" . Bugs in libpng1.6 could lead to denial of service. Fixed in
1.6.39-2+deb12u6. - DLA-4821-1 perl for Debian 12 "Bookworm" . Bugs in perl were fixed. header parsing in IO::Uncompress::Unzip IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. Fixed in
5.36.0-7+deb12u4.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13.7 "Trixie" remained the current stable release.