Security fixes
- DLA-4846-1 git-lfs for Debian 12 "Bookworm" . It was discovered that Git LFS, a Git extension for versioning large files, incorrectly handled symbolic links. An attacker, through a malicious Git repository, could write files outside of the victim's working tree or bare repository, leading to remote command execution. Fixed in
3.3.0-1+deb12u2. - DSA-6573 firefox-esr for Debian 13 "Trixie" . This update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provided by Firefox. Fixed in
153.5.1esr-1~deb13u1. - DLA-4847-1 firefox-esr for Debian 12 "Bookworm" . This update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for installations which have RemoteSettings disabled or which are unable to connect to the revocation backend service due to network constraints. Fixed in
153.5.1esr-1~deb12u1. - DSA-6574 php8.4 for Debian 13 "Trixie" . It was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of arbitrary code. Fixed in
8.4.27-1~deb13u1. - DLA-4848-1 php8.2 for Debian 12 "Bookworm" . Two critical vulnerabilities were found in PHP, a widely-used open source general purpose scripting language, which could lead to remote execution of arbitrary code. CVE-2026-109618 Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid. CVE-2026-109619 Request-owned internal global state can su Fixed in
8.2.35-1~deb12u1. - DSA-6575 nginx for Debian 13 "Trixie" . Several vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory corruption, denial of service, injection of requests to backend servers, or bypass of client certificate authentication. Fixed in
1.26.3-3+deb13u10. - DSA-6576 bind9 for Debian 13 "Trixie" . Several vulnerabilities were discovered in BIND, a DNS server implementation, which could lead to denial of service or remote code execution. Fixed in
1:9.20.30-1~deb13u1.
Announcements and releases
- micronews noted that the MiniDebConf Beijing schedule was published .
Project and event news
- Steinar H. Gunderson continued his decompilation series with part 18 on signed division.
Notable discussions
- The Northstar browser thread was still active.
Debian in the news
- Work toward CERN ROOT dependencies in Debian: On October 21, a Debian Science contributor requested review and sponsored uploads of packages for BVH and CDT, two dependencies of CERN’s ROOT software. This was a packaging proposal, not an announcement that ROOT or these packages had become available in Debian. View on timeline
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.