Security fixes
- DLA-4866-1 firefox-esr for Debian 12 "Bookworm" . Multiple security issues have been found in the Mozilla Firefox web browser, which could lead to the execution of arbitrary code, sandbox escape, bypass of the same-origin policy, privilege escalation, information disclosure or spoofing. Fixed in
153.6.0esr-1~deb12u2. - DLA-4867-1 tzdata for Debian 12 "Bookworm" . This update includes the changes in tzdata 2026f. Notable changes are: - - Cuba will not fall back to -05 on 2026-11-01 and instead plans to maintain -04 through 2027-11-07 - - Mention that the "expires" in the leapseconds file is now obsolete Fixed in
2026f-0+deb12u1. - DLA-4868-1 libdatetime-timezone-perl for Debian 12 "Bookworm" . This update includes the changes in tzdata 2026f for the Perl bindings. For the list of changes, see DLA-4867-1. Fixed in
1:2.60-1+2026f. - DSA-6593 imagemagick for Debian 13 "Trixie" . Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. Fixed in
8:7.1.1.43+dfsg1-1+deb13u13. - DSA-6594 python-git for Debian 13 "Trixie" . Multiple security issues were discovered in GitPython, a Python library to interact with Git repositories, which could lead to information disclosure, directory traversal, execution of arbitrary code or denial of service. Fixed in
3.1.44-1+deb13u1. - DSA-6595 tor for Debian 13 "Trixie" . Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. Fixed in
0.4.9.15-0+deb13u1. - DLA-4869-1 vlc for Debian 12 "Bookworm" . Multiple vulnerabilities were discovered in the VLC media player, which could lead to the execution of arbitrary code or denial of service if a malformed media file is opened. Fixed in
3.0.24-0+deb12u1. - DSA-6596 wordpress for Debian 13 "Trixie" . Several vulnerabilities were discovered in wordpress, a web blogging tool, which could lead to denial of service, cross-site scripting, SQL injection, information disclosure, privilege escalation or remote code execution. Fixed in
6.8.12+dfsg1-0+deb13u1.
Announcements and releases
- diffoscope 336 was released (drops a Recommends on guix in the minimal package).
Project and event news
No major project or event posts beyond the items above.
Notable discussions
- The NEW upload thread continued, and there was mail on updating the Archive team.
- The weekly work-needing packages report for Oct 30 went out .
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.