Security fixes
- DLA-4882-1 chromium for Bookworm . Further Chromium bugs that could allow code execution, a crash or information leaks. Fixed in
156.0.8078.79-1~deb12u1. - DLA-4883-1 ntfs-3g for Bookworm . Many memory bugs in the NTFS tools; a crafted disk image could crash the setuid helper or related programs, or leak memory. Fixed in
1:2022.10.3-1+deb12u4. - DLA-4884-1 puppet-agent for Bookworm . Missing validation of event data could allow code to run on a Puppet server. Fixed in
7.23.0-1+deb12u1. - DLA-4885-1 trapperkeeper-authorization-clojure for Bookworm . Faulty hostname checks could let one Puppet client download another machine's configuration. Fixed in
1.0.0-4+deb12u1.
No new security advisories for the current stable release (Trixie) today. Wednesday's DSA-6607-1 apt redirect flaw remains the latest DSA.
Announcements and releases
- diffoscope 337 was released with a test fix for compressed NuGet files.
No debian-announce, debian-news or Bits posts.
Project and event news
- MiniDebConf Cambridge 2026 opened at Arm for the Thursday–Friday sprint / DebCamp days. Talks run Saturday and Sunday, including a Release Team update on Sunday.
- Andrew Cater posted from the venue about the pre-talk hacking days on Planet Debian.
- Gunnar Wolf wrote about odd spam aimed at the keyring-maint team.
- John Goerzen posted a Letter from a Kansan reflecting on recent U.S. election results.
Notable discussions
- Alexander Kjäll argued that the apt redirect flaw strengthens the case for using HTTPS by default for Debian's package mirrors .
- The big-endian architectures / WebKitGTK thread continued.
Quiet sources
Official announcement lists, bits.debian.org and release.debian.org had no formal project announcements. Debian 13.7 "Trixie" is still the current stable release.