Security fixes
- DLA-4849-1 expat for Debian 12 "Bookworm" . Multiple vulnerabilities have been found in expat. CVE-2025-59375 The patchset previously uploaded in DLA-4807-1 did not fully address the issue since a major part of it was conditionally included only when XML_GE was enabled. This upload enables that define. CVE-2026-56132 A heap-based buffer overflow in doProlog in xmlparse.c caused by scaffold backing array reallocation which was mishandled whe Fixed in
2.5.0-1+deb12u5. - DSA-6534-3 webkit2gtk for Debian 13 "Trixie" . The webkit2gtk update released as DSA-6534-1 introduced a regression that prevents Evolution from displaying images embedded in HTML emails. Fixed in
2.54.0-1~deb13u3. - DLA-4850-1 linux-6.12 for Debian 12 "Bookworm" . Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. Fixed in
6.12.113-1~deb12u1. - DSA-6577 chromium for Debian 13 "Trixie" . Security issues were discovered in Chromium which could lead to the execution of arbitrary code, denial of service, or information disclosure. Fixed in
156.0.8078.47-1~deb13u1. - DSA-6578 aide for Debian 13 "Trixie" . Two vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files. Fixed in
0.19.1-2+deb13u5. - DLA-4851-1 aide for Debian 12 "Bookworm" . Two vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files. Fixed in
0.18.3-1+deb12u5.
Announcements and releases
- diffoscope 335 was released.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
- Christian Kastner split out a related fasttrack discussion from the Northstar thread .
- The weekly work-needing packages report for Oct 23 went out .
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.