Security fixes
- DSA-6583 libheif for Debian 13 "Trixie" . Multiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images. Processing specially crafted images could result in denial of service through excessive resource consumption or crashes, or disclosure of process memory. Fixed in
1.23.6-2~deb13u1. - DLA-4857-1 caddy for Debian 12 "Bookworm" . Multiple security issues were discovered in Caddy, a web server with automatic HTTPS, which could lead to the bypass of path- or host-based access controls, the execution of an unintended file by a FastCGI backend, the injection of identity headers trusted by applications running behind Caddy, unauthorised reconfiguration of the server through its admin API, Fixed in
2.6.2-5+deb12u1.
Announcements and releases
No formal project announcements.
Project and event news
- MiniDebConf Beijing was underway (talks in Chinese, with a public livestream).
Notable discussions
- More replies landed on the systemd dependency and Northstar threads.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.