Security fixes
- DSA-6600-1 vim for Debian 13 "Trixie" . Many bugs in Vim could let a crafted file, archive, help/tag file, modeline or NetBeans input run code, inject commands or crash the editor. Fixed in
2:9.1.1230-2+deb13u1. - DSA-6601-1 eog for Trixie . A buffer overflow in Eye of GNOME could let a malformed PNG run code. Fixed in
47.0-1+deb13u1. - DLA-4874-1 eog for Debian 12 "Bookworm" . Two PNG parsing bugs could crash the viewer, leak memory or, in one case, run code. Fixed in
43.2-1+deb12u1.
Announcements and releases
No new posts on debian-announce, debian-news or bits.debian.org.
Project and event news
- On Planet Debian, Vasudev Kamath wrote about debvulns 0.2.4, which now tracks needrestart and treats kernel fixes as open until the running kernel is new enough.
- Vincent Bernat posted a refreshed guide to a QEMU-based network lab that avoids disk images.
- Birger Schacht summarized recent Debian packaging work and orphaned
usbguardandusbguard-notifier.
Notable discussions
- The long spdx2debian / NEW queue thread kept going, along with related notes on how long packages wait in NEW.
- Several new package proposals landed, including 0c-ime-data and cine.
Quiet sources
micronews, the official News page and release.debian.org had nothing new for the day. Debian 13.7 "Trixie" remains the current stable release.