Security fixes
- DSA-6559-1 buildstream for Debian 13 "Trixie" . Missing validation of tar sources in the Buildstream software integration tool could allow to write files on the build host. Fixed in
1.6.9-2+deb13u1. - DSA-6561-1 sogo for Debian 13 "Trixie" . Bugs in sogo could lead to cross-site scripting, shell injection, password reset poisoning or SQL injection. Fixed in
5.12.1-3+deb13u3. - DSA-6560-1 firefox-esr for Debian 13 "Trixie" . Bugs in firefox-esr could lead to the execution of arbitrary code, sandbox escape, information disclosure, mitigation bypass or privilege escalation. Fixed in
153.5.0esr-1~deb13u1. - DSA-6558-1 curl for Debian 13 "Trixie" . Bugs in curl could lead to remote code execution. Fixed in
8.14.1-2+deb13u7. - DLA-4834-2 keystone for Debian 12 "Bookworm" . keystone does not automatically restart after a security update, which can leave a vulnerable keystone process running even after the package has been upgraded. Fixed in
2:22.0.2-0+deb12u6.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
No standout project-wide threads singled out for this day beyond routine packaging mail.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page for this day. Debian 13.7 "Trixie" remained the current stable release.