Security fixes for Bookworm (Thursday, Nov 5)
These are fixes from the long-term support team, which maintains older releases.
- DLA-4882-1, chromium . It fixes several Chromium bugs that could let an attacker run code, crash the browser or leak data. Fixed for Debian 12 Bookworm in
156.0.8078.79-1~deb12u1. - DLA-4883-1, ntfs-3g . It fixes many memory bugs in the NTFS disk tools, where a crafted disk could crash them or leak memory. Fixed for Debian 12 Bookworm in
1:2022.10.3-1+deb12u4. - DLA-4884-1, puppet-agent . Missing checks on incoming data could allow code to run on a Puppet server. Fixed for Debian 12 Bookworm in
7.23.0-1+deb12u1. - DLA-4885-1, trapperkeeper-authorization-clojure . A flaw in how hostnames were checked could let one Puppet client download another machine's configuration. Fixed for Debian 12 Bookworm in
1.0.0-4+deb12u1.
At the evening check, the security announcement archive still ended with November 4’s Symfony advisory (DSA-6612-1), and the LTS archive ended with November 5’s DLA-4885-1. The four fixes above are November 5 carry-over, not new November 6 advisories; the earlier apt redirect advisory (DSA-6607-1) remains relevant to the linked HTTPS discussion.
On the developer mailing list
- Alexander Kjäll argued that the apt flaw strengthens the case for using HTTPS by default for Debian's package mirrors.
- The thread on dropping big-endian architectures and WebKitGTK support for them is still going.
- There were several new package proposals and the weekly report on packages that need work.
Blogs and tools
- Version 337 of diffoscope, a tool for comparing files and packages, came out with a test fix.
- Ben Hutchings’s October activity report, published November 6, covers Debian firmware and kernel work, including firmware and Linux uploads to trixie-backports. These are October activities reported today, not newly announced November 6 package releases.
Debian in the news
- FlickOS 2.3 released. FlickOS 2.3 was released on November 6 with tools for moving files from Windows and finding alternatives to Windows applications. This Debian 13-based distribution—not an official Debian release—also introduces its own login and lock screens and websites in standalone windows. View on timeline
- Debian Installer accessibility testing: in a November 6 progress report, Isoken Ibizugbe describes testing Braille display emulation and working toward automating those checks in openQA. She explains the configuration obstacles and why nested virtualization emerged as a practical route forward; this is a progress report, not a completed-test-suite announcement. View on timeline
- MiniDebConf Cambridge: Friday hacking reports: the event runs November 5–8 at Arm, and Steve McIntyre and Andrew Cater published November 6 reports of Debian hacking and discussions, following Thursday’s venue report. The programme lists Saturday/Sunday talks and a Sunday Release Team update as scheduled activities, not completed reports. View on timeline
Source check
At this check, the Debian News page still led with September 12’s Debian 13.7 release and Bits from Debian with October 7’s artwork call. The release page identifies Debian 13.7 Trixie as current stable; the opened announcement and news year archives showed no November entry. The November developer-announcement endpoint returned 404 and its year endpoint 403, so this is a checked-source snapshot, not a claim that no other news exists.