Security fixes
- DSA-6567-2 cifs-utils for Debian 13 "Trixie" . The update for cifs-utils announced in DSA 6567-1 introduced a regression when using the sec=krb5 and cruid mount options. Updated packages are now available to correct this issue. Fixed in
2:7.4-1+deb13u2. - DSA-6570 haproxy for Debian 13 "Trixie" . Two vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which could lead to denial of service. Fixed in
3.0.11-1+deb13u4. - DSA-6571 xen for Debian 13 "Trixie" . Multiple vulnerabilities have been discovered in the Xen hypervisor, which could lead to privilege escalation, information disclosure or denial of service. Fixed in
4.20.4+39-gf1e1321c87-0+deb13u1. - DLA-4842-1 haproxy for Debian 12 "Bookworm" . Three vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which could lead to denial of service or HTTP request smuggling. CVE-2026-33555 Martino Spagnuolo reported that the HTTP/3 parsing code in HAProxy, a fast and reliable load balancing reverse proxy, does not properly validate the received body size and the announced content-length header, which may Fixed in
2.6.12-1+deb12u4.
Announcements and releases
- Dirk Eddelbuettel released myman 0.12.0 on CRAN.
- Ludovic Rousseau released pcsc-lite 2.5.3.
Project and event news
- Steinar H. Gunderson posted decompilation patterns, part 15.
Notable discussions
- Andreas Røsdal asked about packaging the Northstar web browser for Debian , kicking off a long thread.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.