Security fixes
- DSA-6607-1 apt for Trixie . After an HTTP redirect, APT could merge two downloads with the same URI; a man-in-the-middle attacker could replace a package after verification and run code as root. Fixed in
3.0.4. - DLA-4880-1 apt for Bookworm . The same redirect flaw for Debian 12. Fixed in
2.6.2. - DSA-6608-1 puppet-agent for Trixie . Missing checks on event data could allow code to run on a Puppet server. Fixed in
8.10.0-5+deb13u1. - DSA-6609-1 trapperkeeper-authorization-clojure for Trixie . Faulty hostname ACL checks could let one Puppet client download another host's catalogue. Fixed in
2.0.1-2+deb13u1. - DSA-6610-1 xen for Trixie . Xen bugs that could allow guest-to-host privilege escalation or information disclosure. Fixed in
4.20.4+63-g7abfd2bce2-0+deb13u1. - DLA-4881-1 xen for Bookworm . Matching Xen issues for Debian 12 (briefly posted earlier as DLA-4818-1, then corrected). Fixed in
4.17.7+13-g2445b30a44-0+deb12u1. - DSA-6611-1 imagemagick for Trixie . Many ImageMagick bugs that could cause a crash, leak data, bypass policy checks or run code on malformed images. Fixed in
8:7.1.1.43+dfsg1-1+deb13u14. - DSA-6612-1 symfony for Trixie . Symfony issues that could lead to denial of service or email header injection. Fixed in
6.4.49+dfsg-0+deb13u1.
Announcements and releases
No new debian-announce, debian-news or Bits posts.
Project and event news
- On Planet Debian, Juan Manuel Méndez Rey introduced himself after his blog was added to the Planet; he recently became a Debian Maintainer.
- MiniDebConf Cambridge opens tomorrow at Arm for sprint days, with talks on Saturday and Sunday.
Notable discussions
- The big-endian / WebKitGTK thread continued.
- More mail arrived in the spdx2debian and NEW upload threads.
Quiet sources
micronews, bits.debian.org and the official News page had nothing beyond the security traffic above.