Security fixes
- DLA-4859-1 openssl for Debian 12 "Bookworm" . Several vulnerabilities have been discovered in OpenSSL, a Secure Socket Layer toolkit providing the SSL and TLS cryptographic protocols for secure communication over the Internet. A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Fixed in
3.0.22-1~deb12u2. - DLA-4860-1 libdatetime-timezone-perl for Debian 12 "Bookworm" . This update includes the changes in tzdata 2026e for the Perl bindings. For the list of changes, see DLA-4854-1. Fixed in
1:2.60-1+2026e. - DLA-4861-1 openjdk-17 for Debian 12 "Bookworm" . Several vulnerabilities have been discovered in the OpenJDK Java runtime, which could lead to denial of service, information disclosure, unauthorized access or bypass of sandbox restrictions. Fixed in
17.0.21+9-1~deb12u1. - DLA-4862-1 inkscape for Debian 12 "Bookworm" . A local file disclosure vulnerability was discovered in the XInclude processing component of Inkscape, a vector-based drawing program. A remote attacker can read local files via a crafted SVG file containing malicious xi:include tags. Fixed in
1.2.2-2+deb12u1. - DLA-4863-1 thunderbird for Debian 12 "Bookworm" . Multiple security issues were discovered in Thunderbird, which could lead to the execution of arbitrary code or information disclosure Debian follows the Thunderbird upstream releases. Support for the 140.x series has ended, so starting with this update we're now following the 153.x series. Fixed in
1:153.5.1esr-1~deb12u1. - DLA-4864-1 swupdate for Debian 12 "Bookworm" . Two vulnerabilities were discovered in swupdate, a software update framework for embedded systems, which could lead to privilege escalation or a signature validation bypass. Fixed in
2022.12+dfsg-4+deb12u3. - DSA-6586 valkey for Debian 13 "Trixie" . Several vulnerabilities were discovered in Valkey, an in-memory key-value database. These issues could cause denial of service and, in some cases, potentially allow arbitrary code execution. Fixed in
8.1.1+dfsg1-3+deb13u3.
Announcements and releases
No formal project announcements.
Project and event news
- Enrico Zini described sandboxing pre-commit with bubblewrap.
- Russell Coker wrote about CEO impersonation fraud.
Notable discussions
- Johannes Schauer Marin Rodrigues wrote I will no longer upload to NEW , starting a major discussion about the NEW queue and packaging friction.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.