Security fixes
- DSA-6584 varnish for Debian 13 "Trixie" . Several vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could lead to cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing of HTTP/1.1 absolute-form request targets. Fixed in
7.7.0-3+deb13u2. - DSA-6585 thunderbird for Debian 13 "Trixie" . Multiple security issues were discovered in Thunderbird, which could lead to the execution of arbitrary code or information disclosure Debian follows the Thunderbird upstream releases. Support for the 140.x series has ended, so starting with this update we're now following the 153.x series. Fixed in
1:153.5.1esr-1~deb13u1. - DLA-4858-1 imagemagick for Debian 12 "Bookworm" . Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. Fixed in
8:6.9.11.60+dfsg-1.6+deb12u14.
Announcements and releases
- Otto Kekäläinen announced Debcraft v1.0, a tool for building Debian packages.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
- A forward about updating the Keyring Maintainers Team delegation was posted .
- The systemd-only packages thread continued.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.