Security fixes
- DLA-4873-1 dovecot for Debian 12 "Bookworm" . Multiple vulnerabilities were discovered in dovecot, a POP3/IMAP server, which could lead to denial of service, SMTP smuggling, information disclosure, SQL injection, remote code execution, bypass of ACL restrictions, or account impersonation. Fixed in
1:2.3.19.1+dfsg1-2.1+deb12u7. - DLA-4872-1 python-git for Debian 12 "Bookworm" . Multiple security vulnerabilities were discovered in python-git (GitPython), a Python library used to interact with git repositories. Fixed in
3.1.30-1+deb12u3. - DSA-6599 nss for Debian 13 "Trixie" . It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated nss packages are provided to remove the "eMudhra emSign Root CA - G3", "eMudhra emSign Root CA - C1" and "emSign ECC Root CA - C3" certificates. Fixed in
2:3.110-1+deb13u5. - DLA-4875-1 imagemagick for Debian 12 "Bookworm" . Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. Fixed in
8:6.9.11.60+dfsg-1.6+deb12u15. - DLA-4876-1 python-aiohttp for Debian 12 "Bookworm" . Several vulnerabilities have been found in aiohttp, an asynchronous HTTP client/server framework for asyncio and Python. Request smuggling vulnerability due to not parsing trailer sections of an HTTP request. Possible zip bomb attack against the server. Fixed in
3.8.4-1+deb12u2.
Announcements and releases
- Ludovic Rousseau released PyKCS11 1.5.21.
- Ludovic Rousseau released PySCard 2.3.2.
Project and event news
- Samuel Henrique proposed Distributary, a generated artwork theme for Debian 14 "Forky".
- Russell Coker posted his October links roundup.
Notable discussions
- More mail arrived on spdx2debian and the NEW queue discussion.
Quiet sources
Nothing new on debian-announce, debian-news, bits.debian.org or the official News page. Debian 13.7 "Trixie" remained the current stable release.