Security fixes
- DSA-6585-2 thunderbird for Debian 13 "Trixie" . The update for thunderbird in DSA-6585-1 introduced a regression in the supported for PGP-encrypted emails. Updated packages are now available to correct this issue. Fixed in
1:153.5.1esr-1~deb13u2. - DSA-6587 pdns for Debian 13 "Trixie" . It was discovered that incorrect parsing of packets with compression pointers in the PowerDNS DNS server could result in denial of service. Fixed in
4.9.18-0+deb13u1. - DSA-6588 openjdk-21 for Debian 13 "Trixie" . Several vulnerabilities have been discovered in the OpenJDK Java runtime, which could lead to denial of service, sandbox bypass, incomplete certificate checks or information disclosure. Fixed in
21.0.13+9-1~deb13u2. - DSA-6589 php-mongodb for Debian 13 "Trixie" . Multiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could lead to denial of service. Fixed in
2.0.0-1+deb13u2. - DLA-4865-1 bind9 for Debian 12 "Bookworm" . Several vulnerabilities were discovered in BIND, a DNS server implementation, which could lead to denial of service or cache poisoning. Fixed in
1:9.18.49-1~deb12u3.
Announcements and releases
No formal project announcements.
Project and event news
No major project or event posts beyond the items above.
Notable discussions
- Many replies followed the I will no longer upload to NEW thread, including thanks to the DFSG/ftp team.
- There was also mail about Experimental Pseudo-Excuses not being generated since Oct 8.
Debian in the news
- RefreshOS 3.1 released. RefreshOS 3.1 was introduced on October 27 with Debian updates through 13.7 and its own APT repository. This Debian-based distribution—not an official Debian release—also improves compatibility with 32-bit software and fixes localized Reload Menu folder links. View on timeline
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.