Security fixes
- DSA-6579 roundcube for Debian 13 "Trixie" . Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could lead to IMAP command injection, cross-site scripting, SSRF bypass, email header injection, css property injection, remote content blocking bypass, information disclosure or privilege escalation. Fixed in
1.6.20+dfsg-0+deb13u1. - DSA-6580 erlang for Debian 13 "Trixie" . The affected components include the HTTP client and server, SSH, TLS, ASN.1 decoding, the network driver, and URI, LDAP and SNMP parsing. The update tightens protocol validation and HTTP/SSH resource limits. Applications relying on previously permissive behavior may need adjustment. Fixed in
1:27.3.4.1+dfsg-1+deb13u4. - DLA-4852-1 clamav for Debian 12 "Bookworm" . Several vulnerabilities have been found in the ClamAV antivirus toolkit, which could lead to denial of service or possibly other unspecified impact when processing maliciously crafted files. Fixed in
1.4.6+dfsg-0+deb12u1. - DSA-6581 unbound for Debian 13 "Trixie" . Multiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. Fixed in
1.26.2-0+deb13u1. - DLA-4853-1 chromium for Debian 12 "Bookworm" . Security issues were discovered in Chromium which could lead to the execution of arbitrary code, denial of service, or information disclosure. Fixed in
156.0.8078.47-1~deb12u1. - DLA-4854-1 tzdata for Debian 12 "Bookworm" . This update includes the changes in tzdata 2026e. Notable changes are: - - Canadaâ??s Northwest Territories moved to permanent -06 on 2026-08-21 and will not fall back from -06 to -07 on 2026-11-01 - - Manitoba moves to permanent -05 on 2026-10-31 and will not fall back from -05 to -06 on 2026-11-01 Fixed in
2026e-0+deb12u1. - DSA-6582 brotli for Debian 13 "Trixie" . A vulnerability was discovered in Brotli, a generic-purpose lossless compression suite, which could lead to denial of service, or potentially the execution of arbitrary code. Fixed in
1.1.0-2+deb13u1. - DLA-4855-1 brotli for Debian 12 "Bookworm" . A vulnerability was discovered in Brotli, a generic-purpose lossless compression suite, which could lead to denial of service, or potentially the execution of arbitrary code. Fixed in
1.0.9-2+deb12u1. - DLA-4856-1 xdg-dbus-proxy for Debian 12 "Bookworm" . It was discovered that an incorrect implementation of message filtering in xdg-dbus-proxy, a filtering proxy for D-Bus connections, allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely Fixed in
0.1.4-3+deb12u2.
Announcements and releases
- micronews pointed to the livestream for MiniDebConf Beijing as it got underway .
Project and event news
- Amin Bandali posted Living healthier on Planet Debian.
Notable discussions
- Mail continued on Northstar, systemd-only packages, and fasttrack.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.