Security fixes
- DSA-6545-1 roundcube for Debian 13 "Trixie" . Bugs in roundcube could lead to cross-site scripting, SRF bypass, email header injection, css property injection, remote content blocking bypass, information disclosure or privilege escalation. Fixed in
1.6.19+dfsg-0+deb13u1. - DSA-6546-1 rails for Debian 13 "Trixie" . Bugs in rails could lead to cross-site scripting, denial of service, path traversal or the execution of arbitrary code. Fixed in
2:7.2.2.2+dfsg-2~deb13u2. - DSA-6547-1 ruby-jwt for Debian 13 "Trixie" . Ruby-jwt, a JSON Web Token implementation in Ruby, insufficiently validated the HMAC of some tokens. Fixed in
2.7.1-1+deb13u1. - DSA-6548-1 node-shell-quote for Debian 13 "Trixie" . Bugs in node-shell-quote could lead to denial of service or shell command injection. Fixed in
1.7.4+~1.7.1-1+deb13u2. - DLA-4825-1 suricata-update for Debian 12 "Bookworm" . Guillem Lefait discovered a path traversal attack in suricata-update, which allowed malformed rules to overwrite files on the system. Fixed in
1.2.7-1+deb12u1.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Debian in the news
- Raspberry Pi Desktop for 64-bit PCs and Intel-based Macs: on October 6, Raspberry Pi announced the updated desktop image based on Debian Trixie. This Debian-based image—not an official Debian release—includes a Raspberry Pi Connect client and the Calamares installer. View on timeline
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13.7 "Trixie" remained the current stable release.