Security fixes
Debian 13 Trixie (stable), from the Debian security team:
- DSA-6613-1 zlib . Bugs in the zlib compression library could let crafted input crash a program or possibly run code. Fixed in
1:1.3.dfsg+really1.3.1-1+deb13u1. - DSA-6614-1 ruby3.3 . Many Ruby interpreter flaws that could allow IMAP command injection, denial of service, information disclosure or code execution. Fixed in
3.3.13-0+deb13u1. - DSA-6615-1 libreoffice . A buffer overflow when opening dBASE database files could let a crafted file run code. Fixed in
4:25.2.3-2+deb13u9. - DSA-6600-2 vim regression update . The earlier vim security update failed to build packages for the s390x architecture because tests failed; this fixes that. Fixed in
2:9.1.1230-2+deb13u2. - DSA-6616-1 linux . Linux kernel flaws that could allow privilege escalation, denial of service or information leaks. Fixed in
6.12.116-1.
Debian 12 Bookworm, from the long-term support (LTS) team:
- DLA-4887-1 cjose . A crafted encrypted token could crash an application that uses this JOSE library and corrupt its memory. Separately, tokens encrypted with AES-CBC-HMAC used an all-zero key, so anyone holding one could read and change its contents. Fixed in
0.6.2.1-1+deb12u2. - DLA-4888-1 rsync . Many rsync flaws that could allow local privilege escalation, bypassed access restrictions, information disclosure, denial of service or code execution. Instead of patching the old version, the LTS team moved Bookworm to rsync 3.5.0. That brings some behavior changes, so read the package NEWS or the LTS team’s notes before upgrading. Fixed in
3.5.0+ds1-0+deb12u1. - DLA-4886-1 telegram-desktop . A crafted
tg://link could make Telegram Desktop upload local files, including session keys, to an attacker’s channel, which could lead to account takeover. Fixed in4.6.5+ds-2+deb12u1. The advisory text is dated November 6, but it was posted to the list on November 9.
Announcements and releases
There were no new point releases or formal project announcements. The Debian News page still leads with September 12’s Debian 13.7 release, which remains the current stable point release.
Project and event news
- MiniDebConf Cambridge held its two days of talks at Arm over the weekend. Debian micronews announced the Saturday start , the live stream and the Sunday sessions .
- Andrew Cater’s day 1 report confirms that Saturday morning’s talks went ahead, covering kernel coverage tracing with vock, rebuilding the archive on your desktop and Secure Boot, followed by lightning talks. The first recordings, the welcome and the vock talk, are now in the meetings archive.
- The schedule also listed Simon McVittie on the Steam Runtime, Neil Williams on Debian Developer burnout and a Sunday “Bits from the Release Team” by Graham Inggs and Paul Gevers. These were scheduled sessions; I found no reports or recordings for them yet.
Notable discussions
- The debian-devel debate over the DFSG team’s LLM-generated reviews of packages in the NEW queue grew sharper over the weekend:
- Ian Jackson argued that the reviews break the project’s generative-AI resolution . He said no one is accountable for them and there was no consensus beforehand, and asked the Project Leader to step in.
- Former Project Leader Jonathan Carter agreed .
- Sean Whitton reported an off-list reply from Andrew McMillan , who appears to be the person running the reviews. Sean suggested that delegates should say where they want feedback; in this case that appears to be Salsa issues.
- Ben Finney split that point into a new thread on delegates’ expected communication channels .
- Charles Plessy pushed back , arguing that many hand-written debian/copyright files in the archive are worse than the LLM reports. He also noted that the team now emails only links to them.
- Lucas Nussbaum replied that the only project-wide action is a notification email, which can be turned off (opt-out).
- On debian-project, a user asked about Debian’s position on age verification and systemd’s new optional birthDate field . The question was whether Debian 14 will enable or read the field, and whether any such change would be discussed publicly first. Replies followed on Sunday and Monday; there is no official answer yet.
- New package proposals included austin-python, pyqt6-pdf and nscp, among others.
Blogs
- Birger Schacht explains using Incus with the Debian 13 cloud image for throwaway development VMs .
Debian in the news
- Slax 2026.11 is out. On November 8, Tomas Matejicek released Slax 2026.11, the first new Slax in about three years. This portable USB distribution is based on Debian 13 trixie and is not an official Debian release. It has a rebuilt desktop, Secure Boot support, a graphical installer and an optional AI assistant that requires sign-in, all in a 512 MiB ISO. 9to5Linux covered the release independently. View on timeline
- SparkyOS onUSB 2026.11 (Debian). Also on November 8, SparkyLinux released a Debian testing-based build of its portable “run from a USB stick” system, with separate UEFI and BIOS images and Linux 7.2.15. The first SparkyOS onUSB release in October was based on Arch Linux. This is a downstream project, not part of Debian. View on timeline
Source check
These sources had nothing new in the window: debian-announce (last post September 12), debian-news (August), Bits from Debian (October 7 artwork call), the News page, Developer’s News (page last changed August 15) and debconf.org. The debian-devel-announce November archive returned a server error, and the list’s “recent” view still showed October, so I can’t fully confirm it was quiet. On LWN’s front page, the only in-window Debian items were routine security-update roundups. The UDD public mirror timed out, so I didn’t check upload activity this time.