Debian GNU/Linux 10.13 → 13.7

32 releases · 0 breaking changes · 1014 security fixes · 0 advisories fixed

1014security0breaking0deprecated0feature266fix

Is 10.13 affected?

Breaking changes

None in the release notes.

Security changes

security 92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, … in 13.7
security alsa-lib: Fix heap overflow issue [CVE-2026-25068] in 13.7
security ansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332] in 13.7
security bettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default in 13.7
security binwalk: Fix path traversal issue [CVE-2026-7179] in 13.7
security cyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088] in 13.7
security dcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868] in 13.7
security dhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258] in 13.7
security dnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969] in 13.7
security flask: Ensure Vary: Cookie is set on session access [CVE-2026-27205] in 13.7
security fluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714] in 13.7
security glib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue… in 13.7
security glibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers in 13.7
security goaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777] in 13.7
security gpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122] in 13.7
security gzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992] in 13.7
security imagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871… in 13.7
security incus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501] in 13.7
security libhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017] in 13.7
security libio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962] in 13.7
security libmongocrypt: Fix missing input validation issue [CVE-2026-81523] in 13.7
security libnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942] in 13.7
security libnfs: Fix integer overflow [CVE-2026-53689] in 13.7
security libraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660] in 13.7
security libsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
security libsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
security libsocket-perl: Fix out of bounds read issue [CVE-2026-12087] in 13.7
security libssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034] in 13.7
security libvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623] in 13.7
security libwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161] in 13.7
security lwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836] in 13.7
security mbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow… in 13.7
security mongo-c-driver: Fix missing input validation issue [CVE-2026-81524] in 13.7
security mrtg: Fix privilege escalation issue [CVE-2026-72694] in 13.7
security node-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800] in 13.7
security onionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706] in 13.7
security opencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253] in 13.7
security patool: Fix path traversal vulnerability [CVE-2026-29509] in 13.7
security perl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix… in 13.7
security php-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766] in 13.7
security 109 security advisories included: DSA-6250 chromium, DSA-6256 php8.4, DSA-6266 nghttp2, DSA-6267 thunderbird, DSA-6268 ffmpeg, DSA-6270 postgresql-17, DSA-6271 gsasl, DSA-6273 chromium, DSA-6274 linux-signed-amd64 +2, DSA-6277 openjpeg2, DSA-6278 nginx, DSA-6279 redis, DSA-6280 netatalk, … in 13.6
security apache2: Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of service issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues… in 13.6
security beets: Fix XSS vulnerability [CVE-2026-42052] in 13.6
security calibre: Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader-background endpoint path… in 13.6
security ckermit: Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check in 13.6
security composer: Fix support for new GitHub token format [CVE-2026-45793] in 13.6
security curl: Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use-after-free and… in 13.6
security dcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] in 13.6
security debusine: Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853] in 13.6
security deepdiff: Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155] in 13.6
security dhcpcd: Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117] in 13.6
security dolphin: Fix sandbox escape issue [CVE-2026-41525] in 13.6
security errands: Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063] in 13.6
security gdown: Fix arbitray file write issue [CVE-2026-40491] in 13.6
security giflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] in 13.6
security gimp: Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915] in 13.6
security graphite2: Fix out-of-bounds write [CVE-2026-50593] in 13.6
security ironic: Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths;… in 13.6
security isc-kea: Fix denial of service issue [CVE-2026-3608] in 13.6
security keystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] in 13.6
security libapache-session-browseable-perl: Improve entropy source [CVE-2026-8503] in 13.6
security libbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625] in 13.6
security libcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046] in 13.6
security libcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240] in 13.6
security libcrypt-urandom-perl: Fix buffer overflow issue [CVE-2026-2474] in 13.6
security libhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829] in 13.6
security libnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] in 13.6
security libslirp: Fix memory disclosure issue [CVE-2026-9539] in 13.6
security libtasn1-6: Fix buffer overflow issue [CVE-2025-13151] in 13.6
security libvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] in 13.6
security libxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177] in 13.6
security libxml2: Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation… in 13.6
security libxpm: Fix out of bounds read issue [CVE-2026-4367] in 13.6
security lxml-html-clean: Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350] in 13.6
security mesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] in 13.6
security miniupnpd: Fix integer underflow issue [CVE-2026-5720] in 13.6
security modsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] in 13.6
security mutt: Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864] in 13.6
security mxml: Fix out-of-bounds read [CVE-2026-5037] in 13.6
security nbconvert: Fix arbitrary file read/write issues [CVE-2026-39377 CVE-2026-39378] in 13.6
security 96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, … in 13.5
security 389-ds-base: Fix heap overflow issue [CVE-2025-14905] in 13.5
security apache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue… in 13.5
security awstats: Prevent command injection [CVE-2025-63261] in 13.5
security black: Fix arbitrary file write issue [CVE-2026-32274] in 13.5
security bubblewrap: Fix privilege escalation issue [CVE-2026-41163] in 13.5
security calibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] in 13.5
security cimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146] in 13.5
security cockpit: Fix code execution issue [CVE-2026-4631] in 13.5
security composer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176] in 13.5
security curl: Fix server certificate verification issue [CVE-2025-13034] in 13.5
security dovecot: Fix memory leak in CVE-2026-27857 fix in 13.5
security erlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943] in 13.5
security exim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] in 13.5
security firewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948] in 13.5
security freerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680… in 13.5
security git-lfs: Fix arbitrary file write issue [CVE-2025-26625] in 13.5
security glance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure in 13.5
security glib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode… in 13.5
security glibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;… in 13.5
security gvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] in 13.5
security harfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693] in 13.5
security jpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures in 13.5
security jq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164] in 13.5
security kissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] in 13.5
security libarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] in 13.5
security libcap2: Fix time of check / time of use issue [CVE-2026-4878] in 13.5
security libcdio: Fix buffer overflow issue [CVE-2024-36600] in 13.5
security libcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468] in 13.5
security libcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564] in 13.5
security libexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] in 13.5
security libnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] in 13.5
security libtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111] in 13.5
security libvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854] in 13.5
security libxml-security-java: Fix private key disclosure issue [CVE-2023-44483] in 13.5
security lxc: Fix authorisation bypass issue [CVE-2026-39402] in 13.5
security mapserver: Fix buffer overflow issue [CVE-2026-33721] in 13.5
security modsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691] in 13.5
security mongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files in 13.5
security musl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200] in 13.5
security 62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 13.4
security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 13.4
security augeas: Fix null pointer dereference issue [CVE-2025-2588] in 13.4
security capstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114] in 13.4
security civetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763] in 13.4
security direwolf: Fix stack buffer overflow [CVE-2025-34457] in 13.4
security dpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219] in 13.4
security erlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107] in 13.4
security fluidsynth: Fix null pointer dereference issue [CVE-2025-56225] in 13.4
security fonttools: Fix arbitrary file write issue [CVE-2025-66034] in 13.4
security glibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the… in 13.4
security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269] in 13.4
security jaraco.context: Prevent path traversal [CVE-2026-23949] in 13.4
security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 13.4
security libsndfile: Fix memory leak issue [CVE-2025-56226] in 13.4
security mariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support in 13.4
security node-proxy-agents: Fix path traversal issue [CVE-2026-27699] in 13.4
security openssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985] in 13.4
security pcsx2: Fix code execution issue [CVE-2025-49589] in 13.4
security phpunit: Fix unsafe deserialization issue [CVE-2026-24765] in 13.4
security postgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006] in 13.4
security python-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007] in 13.4
security python-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146] in 13.4
security python-multipart: Fix arbitrary file write issue [CVE-2026-24486] in 13.4
security qemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665] in 13.4
security requests: Fix credential leak issue [CVE-2024-47081] in 13.4
security rust-ntp-proto: Fix excessive load issue [CVE-2026-26076] in 13.4
security rust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076 in 13.4
security sqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf in 13.4
security starlette: Fix denial of service issue [CVE-2025-62727] in 13.4
security suricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264] in 13.4
security wget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195] in 13.4
security wireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203] in 13.4
security xen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553] in 13.4
security zabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643] in 13.4
security 36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, … in 13.3
security apache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200] in 13.3
security calibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486] in 13.3
security composer: Fix ANSI sequence injection [CVE-2025-67746] in 13.3
security cups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524] in 13.3
security edk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770] in 13.3
security freedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462] in 13.3
security glib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512] in 13.3
security gnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc in 13.3
security gnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback in 13.3
security imagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950] in 13.3
security libcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499] in 13.3
security libcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503] in 13.3
security libphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119] in 13.3
security libvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the… in 13.3
security lxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507] in 13.3
security mbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438] in 13.3
security mongo-c-driver: Avoid invalid memory reads [CVE-2025-12119] in 13.3
security node-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033] in 13.3
security pgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819] in 13.3
security postgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818] in 13.3
security qemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464] in 13.3
security r-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation in 13.3
security rlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075] in 13.3
security rsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158] in 13.3
security rust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897] in 13.3
security sogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499] in 13.3
security suricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344] in 13.3
security symfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries in 13.3
security 52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, … in 13.2
security 7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001] in 13.2
security curl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563] in 13.2
security dnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187] in 13.2
security imagemagick: Fix integer overflow issue [CVE-2025-62171] in 13.2
security lemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication in 13.2
security libcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libhtp: Prevent memory leak with lzma [CVE-2025-53537] in 13.2
security libsmb2: Fix buffer overflow issue [CVE-2025-57632] in 13.2
security libssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277] in 13.2
security libwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678] in 13.2
security libxml2: Fix XPath recursion depth DoS [CVE-2025-9714] in 13.2
security libyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683] in 13.2
security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 13.2
security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 13.2
security mapserver: Fix SQL injection issue [CVE-2025-59431] in 13.2
security modsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571] in 13.2
security nvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345] in 13.2
security open-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244] in 13.2
security phpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573] in 13.2
security poppler: Fix infinite recursion [CVE-2025-50420] in 13.2
security python-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068] in 13.2
security qemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls in 13.2
security rabbitmq-server: Fix logging on sensitive data [CVE-2025-50200] in 13.2
security sail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510] in 13.2
security samba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230] in 13.2
security suricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147] in 13.2
security 14 security advisories included: DSA-5975 linux-signed-amd64 +2, DSA-5976 chromium, DSA-5977 aide, DSA-5978 webkit2gtk, DSA-5979 libxslt, DSA-5980 firefox-esr, DSA-5981 chromium, DSA-5983 qemu, DSA-5984 thunderbird, DSA-5986 node-cipher-base, DSA-5988 chromium, DSA-5989 udisks2, … in 13.1
security firebird3.0: Fix null pointer dereference in XDR message parsing [CVE-2025-54989] in 13.1
security git: New upstream bug-fix release; fix arbitrary file write issues [CVE-2025-27613 CVE-2025-46835]; fix code execution issues [CVE-2025-27614 CVE-2025-48384]; fix protocol injection issue, possibly leading to arbitrary code execution [CVE-2025-48385] in 13.1
security golang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211] in 13.1
security imagemagick: Security fixes: heap buffer overflow in the InterpretImageFilename function [CVE-2025-53014]; infinite loop when writing during a specific XMP file conversion command [CVE-2025-53015]; memory leak in the magick stream command [CVE-2025-53019]; stack overflow through vsnprintf()… in 13.1
security iperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350] in 13.1
security libcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927] in 13.1
security libcoap3: Fix buffer overflow issue [CVE-2024-0962]; fix integer overflow issue [CVE-2024-31031] in 13.1
security mozjs128: New upstream stable release; fix uninitialised memory issue [CVE-2025-9181], memory safety issues [CVE-2025-9185] in 13.1
security nginx: Fix potential information leak in ngx_mail_smtp_module [CVE-2025-53859] in 13.1
security node-tmp: Fix arbitrary file write issue [CVE-2025-54798] in 13.1
security openjpeg2: Fix out-of-bounds write issue [CVE-2025-54874] in 13.1
security pcre2: New upstream stable release; fix potential information disclosure issue [CVE-2025-58050] in 13.1
security postgresql-17: New upstream stable release; tighten security checks in planner estimation functions [CVE-2025-8713]; prevent pg_dump scripts from being used to attack the user running the restore [CVE-2025-8714]; convert newlines to spaces in names included in comments in pg_dump output… in 13.1
security shaarli: Fix cross site scripting issue [CVE-2025-55291] in 13.1
security wolfssl: Avoid weak and predictable random numbers [CVE-2025-7394] in 13.1
security 84 security advisories included: DLA-4627 kernel-wedge, DLA-4628 linux-base, DLA-4632 atril, DLA-4633 libreoffice, DLA-4635 firefox-esr, DLA-4636 thunderbird, DLA-4637 libconfig-inifiles-perl, DLA-4638 libgd-perl, DLA-4639 libhttp-daemon-perl, DLA-4642 u-boot, DLA-4643 imagemagick, … in 12.15
security 7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] in 12.15
security apache2: Fix HTTP/2 request DoS and file handle exhaustion [CVE-2026-49975 CVE-2026-48913]; fix proxy, DAV, LDAP, SSL, XML and header memory/crash issues [CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44185]; fix proxy FTP directory listing XSS… in 12.15
security beets: Fix XSS vulnerability [CVE-2026-42052]; fix build-time test failures in 12.15
security calibre: Fix various potential security issues; read resources only from book contents [CVE-2026-33206]; keep extracted files within container dir [CVE-2026-30853]; prevent reading background images from outside the config dir [CVE-2026-33205] in 12.15
security composer: Fix support for new GitHub token format [CVE-2026-45793] in 12.15
security curl: Fix cache poisoning issue [CVE-2025-10148]; fix data leak issues [CVE-2025-14524 CVE-2026-3783]; fix incorrect connection re-use issues [CVE-2025-14819 CVE-2026-3784 CVE-2026-5773 CVE-2026-7168] in 12.15
security dcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] in 12.15
security dhcpcd5: Fix NULL pointer dereference issue [CVE-2025-70102]; fix out-of-bounds write issue [CVE-2026-56114] in 12.15
security firewalld: Fix DBUS policy checking [CVE-2026-4948] in 12.15
security giflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] in 12.15
security graphite2: Fix out-of-bounds write [CVE-2026-50593] in 12.15
security ironic: Fix file disclosure via image sources [CVE-2025-44021]; fix console command injection [CVE-2026-42510]; fix Swift token disclosure [CVE-2026-42997]; fix unsafe template execution [CVE-2026-44916] in 12.15
security keystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] in 12.15
security libbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625] in 12.15
security libcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046] in 12.15
security libcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240] in 12.15
security libhtml-gumbo-perl: Fix uninitialized memory access [CVE-2025-15646] in 12.15
security libhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829] in 12.15
security libnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] in 12.15
security libvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] in 12.15
security libxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177] in 12.15
security libxml2: Fix catalogue recursion and duplicate-catalog handling [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; limit RelaxNG include recursion [CVE-2026-0989]; fix xmllint shell memory leak [CVE-2026-1757]; correct schematron regression-test outputs [CVE-2025-49794 CVE-2025-49796]; fix XML writer… in 12.15
security mariadb: New upstream stable release; fix code execution issues [CVE-2025-13699 CVE-2026-44168 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261]; fix denial of service issues [CVE-2026-21968 CVE-2026-34303]; fix logging bypass issue [CVE-2026-3494]; fix path traversal issue [CVE-2026-44171]; fix SQL… in 12.15
security mesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] in 12.15
security modsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] in 12.15
security mxml: Fix out-of-bounds read [CVE-2026-5037] in 12.15
security node-flatted: Fix prototype pollution issue [CVE-2026-33228] in 12.15
security openslide: Fix possible code execution issue [CVE-2026-48977] in 12.15
security p7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] in 12.15
security php-guzzlehttp-psr7: Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers in 12.15
security phpunit: Fix unsafe deserialization in PHPT code coverage handling [CVE-2026-24765] in 12.15
security protobuf: Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409] in 12.15
security pydantic: Fix denial of service in email verification [CVE-2024-3772] in 12.15
security pymatgen: Fix denial of service in GaussianInput.from_string [CVE-2022-42964] in 12.15
security python-filelock: Fix symlink vulnerabilies [CVE-2025-68146 CVE-2026-22701] in 12.15
security python-markdown: Fix parsing of bogus HTML markup [CVE-2025-69534] in 12.15
security python-pyramid: Fix information disclosure issue [CVE-2023-40587] in 12.15
security python-xmltodict: Fix XML injection issue [CVE-2025-9375] in 12.15
security python3.11: Prevent incorrect tar archive handling [CVE-2025-13462]; ensure bytecode-only imports use normal security checks [CVE-2026-2297]; reject unsafe cookie values [CVE-2026-3644]; prevent XML parser crashes [CVE-2026-4224]; prevent browser command injection [CVE-2026-4519]; prevent bz2/lzma… in 12.15
security 131 security advisories included: DSA-6003 firefox-esr, DSA-6025 firefox-esr, DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 12.14
security 7zip: New upstream stable release; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links… in 12.14
security apache2: New upstream release: fix http2 regression; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue… in 12.14
security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 12.14
security augeas: Fix NULL pointer dereference issue [CVE-2025-2588] in 12.14
security awstats: Prevent command injection [CVE-2025-63261] in 12.14
security busybox: Fix stack overflow [CVE-2022-48174] and use-after-free [CVE-2023-42363 CVE-2023-42364 CVE-2023-42365] errors in 12.14
security c3p0: Fix recursive entity expansion issue [CVE-2019-5427] in 12.14
security calibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] in 12.14
security composer: Fix code execution issue [CVE-2023-43655]; fix command injection issues [CVE-2026-40261 CVE-2026-40176] in 12.14
security containerd: Fix CRI Attach implementation [CVE-2025-64329]; fix overly broad directory permissions [CVE-2024-25621]; fix large UID:GID (> 32bit) overflow [CVE-2024-40635] in 12.14
security dovecot: Correct incomplete backport of CVE-2026-27855 fix; fix memory leak in CVE-2026-27857 fix in 12.14
security dpkg: New upstream stable release; fix insufficient permissions check leading to possible denial of service issue [CVE-2025-6297]; fix denial of service issue [CVE-2026-2219]; fix buffer over-read issue; fix uninitialized variable warning with Rules-Requires-Root; fix segmentation fault in… in 12.14
security erlang: Fix denial of service issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix HTTP request smuggling issue [CVE-2026-23941]; fix path traversal issues [CVE-2026-23942 CVE-2026-21620]; fix compression bomb issue [CVE-2026-23943] in 12.14
security exim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] in 12.14
security fonttools: Fix XML External Entity injection issue [CVE-2023-45139]; fix code execution issue [CVE-2025-66034] in 12.14
security glance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure in 12.14
security glib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode… in 12.14
security glibc: Fix integer overflow issue [CVE-2026-0861]; fix uninitialised memory use issue [CVE-2025-15281]; fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix performance bottleneck with ASAN on… in 12.14
security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix integer underflow issue [CVE-2025-67269] in 12.14
security grub-efi-amd64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
security grub-efi-arm64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
security grub-efi-ia32-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
security grub2: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix commands/extcmd:… in 12.14
security gvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] in 12.14
security kissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] in 12.14
security libarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] in 12.14
security libcap2: Fix time of check / time of use issue [CVE-2026-4878]; rebuild with updated glibc in 12.14
security libexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] in 12.14
security libnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] in 12.14
security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 12.14
security libreoffice: Fix incomplete fix for CVE-2024-12426 in 12.14
security libuev: Fix buffer overrun issue [CVE-2022-48620] in 12.14
security libvncserver: Fix out-of-bounds read issue [CVE-2026-32853]; fix null pointer dereference issue [CVE-2026-32854] in 12.14
security libxml-security-java: Fix private key disclosure issue [CVE-2023-44483] in 12.14
security lxc: Fix authorisation bypass issue [CVE-2026-39402] in 12.14
security mapserver: Fix SQL injection issue [CVE-2025-59431]; fix buffer overflow issue [CVE-2026-33721]; fix heap-buffer-overflow and double-free issues in maplexer in 12.14
security modsecurity-crs: Fix rule bypass issue [CVE-2023-38199]; fix file extension blocking bypass issue [CVE-2026-33691] in 12.14
security mongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files in 12.14
security nginx: Fix buffer overflow issues [CVE-2026-27654 CVE-2026-27784 CVE-2026-32647]; fix session authentication issues [CVE-2026-27651 CVE-2026-28753]; fix OCSP result bypass issue [CVE-2026-28755]; use $host instead of $http_host in 12.14
security 77 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, DSA-6003 firefox-esr, DSA-6004 chromium, … in 12.13
security angular.js: Fix regular expression-based denial of service issues [CVE-2022-25844 CVE-2023-26116 CVE-2023-26117 CVE-2023-26118]; fix restriction bypass issues [CVE-2024-8372 CVE-2024-8373]; fix denial of service issue [CVE-2024-21490]; fix improper sanitization issues [CVE-2025-0716 CVE-2025-2336] in 12.13
security apache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200] in 12.13
security calibre: Fix code execution issue [CVE-2025-64486] in 12.13
security composer: Fix ANSI sequence injection [CVE-2025-67746] in 12.13
security cups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524] in 12.13
security freerdp2: New upstream release; fix multiple memory-safety vulnerabilities: integer overflow/underflow and out-of-bounds write in NSC, Clear, and GDI bitmap codecs [CVE-2024-22211 CVE-2024-32037 CVE-2024-32038 CVE-2024-32039 CVE-2024-32040]; out-of-bounds reads in ZGFX, Planar, NCRUSH,… in 12.13
security gdk-pixbuf: Fix buffer overflow issue [CVE-2025-7345] in 12.13
security git: Fix arbitrary file creation/truncation in gitk [CVE-2025-27613]; prevent arbitrary file overwrite in git-gui with crafted directory names [CVE-2025-46835]; correct submodule path parsing with trailing CR [CVE-2025-48384]; validate bundle-uri to prevent protocol injection during clone… in 12.13
security glib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512] in 12.13
security gnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename in 12.13
security imagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-62171 CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950] in 12.13
security lemonldap-ng: Fix sessions tablename when not default; fix oidc flow when user encountered an error on server side; fix Kerberos JavaScript when used with Choice; improve CORS checking; fix path_info handling; fix shell injection issue [CVE-2025-59518]; hide session id from Ajax responses in 12.13
security libcommons-lang-java: Fix uncontrolled recursion issue [CVE-2025-48924] in 12.13
security libcommons-lang3-java: Fix uncontrolled recursion issue [CVE-2025-48924] in 12.13
security libhtp: Fix denial of service issue via unbounded HTTP header processing [CVE-2024-23837 CVE-2024-45797] in 12.13
security libnginx-mod-http-lua: Fix HTTP HEAD request smuggling [CVE-2024-33452] in 12.13
security libphp-adodb: Fix SQL injection in sqlite and sqlite3 metadata lookups [CVE-2025-54119] in 12.13
security libssh: Fix integer overflow issue [CVE-2025-4877]; fix use of uninitialized variable [CVE-2025-4878]; fix out of bounds memory access issue [CVE-2025-5318]; fix double free issue [CVE-2025-5351]; fix use of uninitialized memory [CVE-2025-5372 CVE-2025-5987]; fix null pointer dereference issue… in 12.13
security libxml2: Fix denial of service issue [CVE-2025-9714] in 12.13
security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 12.13
security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 12.13
security modsecurity-apache: Fix request body error handling to propagate Apache filter/read failures correctly [CVE-2025-54571]; map request body read failures to appropriate HTTP status codes; simplify request body error propagation in mod_security2 in 12.13
security mongo-c-driver: Avoid invalid memory reads [CVE-2025-12119] in 12.13
security mydumper: Fix arbitrary file read issue [CVE-2025-30224] in 12.13
security nvidia-graphics-drivers: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286] in 12.13
security nvidia-open-gpu-kernel-modules: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286] in 12.13
security open-vm-tools: Disable SDMP service version collection by default to mitigate local privilege escalation [CVE-2025-41244] in 12.13
security openrefine: Fix MySQL host parameter injection in JDBC URL parsing [CVE-2024-23833]; fix reflected XSS in gdata OAuth callback handler [CVE-2024-47878]; fix content-type confusion XSS in ExportRows endpoint [CVE-2024-47880]; prevent remote or extension loading via SQLite connection URL… in 12.13
security pam: Fix local privilege escalation in pam_namespace [CVE-2025-6020] in 12.13
security pgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]; fix expired password use issue [CVE-2025-2291] in 12.13
security postgresql-15: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818] in 12.13
security qemu: New upstream stable release; fix qemu-img info https://example.com; fix migration of guests using virtio-net; fix use after free issue [CVE-2025-11234] in 12.13
security r-cran-gh: Fix sensitive data leak issue [CVE-2025-54956] in 12.13
security rear: Prevent created initrd from being world-readable when GRUB_RESCUE=y [CVE-2024-23301] in 12.13
security rlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075] in 12.13
security rsync: Improve test coverage for future updates; fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158] in 12.13
security ruby-sinatra: Fix regular expression-based denial of service issue [CVE-2025-61921] in 12.13
security samba: Fix information leak issue [CVE-2018-14628]; fix command injection issue [CVE-2025-10230]; fix uninitialized memory disclosure issue [CVE-2025-9640] in 12.13
security sogo: Fix HTML injection issue [CVE-2023-48104]; fix CSS injection issue [CVE-2024-24510]; fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]; fix crash on invalid mailIdentities in 12.13
security 75 security advisories included: DSA-5914 chromium, DSA-5916 chromium, DSA-5918 varnish, DSA-5919 open-vm-tools, DSA-5920 chromium, DSA-5921 thunderbird, DSA-5922 firefox-esr, DSA-5923 net-tools, DSA-5924 intel-microcode, DSA-5925 linux-signed-amd64 +3, DSA-5926 firefox-esr, … in 12.12
security amd64-microcode: Update AMD-SEV firmware [CVE-2024-56161]; update included microcode in 12.12
security apache2: New upstream stable release; fix HTTP response splitting issue [CVE-2024-42516]; fix server-side request forgery issue [CVE-2024-43204 CVE-2024-43394]; fix log injection issue [CVE-2024-47252]; fix access control bypass issue [CVE-2025-23048]; fix denial of service issue [CVE-2025-49630];… in 12.12
security botan: Fix denial of service issues [CVE-2024-34702 CVE-2024-34703]; fix improper parsing of name constraints [CVE-2024-39312]; fix compiler-induced secret-dependent operation issue [CVE-2024-50383] in 12.12
security cjson: Fix denial of service issue [CVE-2023-26819]; fix buffer overflow issue [CVE-2023-53154] in 12.12
security clamav: New upstream stable release; fix buffer overflow issues [CVE-2025-20128 CVE-2025-20260] in 12.12
security cloud-init: Make hotplug socket writable only by root [CVE-2024-11584]; don't attempt to identify non-x86 OpenStack instances [CVE-2024-6174] in 12.12
security commons-beanutils: Fix improper access control issue [CVE-2025-48734] in 12.12
security commons-vfs: Fix path traversal issue [CVE-2025-27553] in 12.12
security corosync: Fix buffer overflow vulnerability on large UDP packets [CVE-2025-30472] in 12.12
security djvulibre: Fix denial of service issues [CVE-2021-46310 CVE-2021-46312] in 12.12
security dropbear: Fix shell injection vulnerability in multihop handling [CVE-2025-47203] in 12.12
security erlang: ssh: fix strict KEX hardening [CVE-2025-46712]; zip: sanitize pathnames when extracting files with absolute pathnames [CVE-2025-4748]; fix documentation build failure with newer xsltproc versions in 12.12
security expat: Fix denial of service issues [CVE-2023-52425 CVE-2024-8176]; fix parser crash [CVE-2024-50602] in 12.12
security fig2dev: Detect nan in spline control values [CVE-2025-46397]; permit \0 in 2nd line in fig file [CVE-2025-46398]; ge output: correct spline computation [CVE-2025-46399]; reject arcs with a radius smaller than 3 [CVE-2025-46400] in 12.12
security firebird3.0: Fix NULL pointer dereference issue [CVE-2025-54989] in 12.12
security fort-validator: Fix denial of service issues [CVE-2024-45234 CVE-2024-45235 CVE-2024-45236 CVE-2024-45238 CVE-2024-45239 CVE-2024-48943]; fix buffer overflow issue [CVE-2024-45237] in 12.12
security glib2.0: Fix buffer underflow issue [CVE-2025-4373 CVE-2025-7039]; improve upgrade safety in 12.12
security glibc: Fix incorrect LD_LIBRARY_PATH search in dlopen for static setuid binaries [CVE-2025-4802]; improve memory layout of structures in exp/exp10/expf functions; add an SVE implementation of memset on aarch64; improve generic implementation of memset on aarch64; fix double free issue… in 12.12
security golang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211] in 12.12
security gst-plugins-base1.0: Fix buffer overrun issue [CVE-2025-47806]; fix NULL pointer dereference issues [CVE-2025-47807 CVE-2025-47808] in 12.12
security gst-plugins-good1.0: Fix possible information disclosure issue [CVE-2025-47219] in 12.12
security iperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350] in 12.12
security jinja2: Fix arbitrary code execution issue [CVE-2025-27516] in 12.12
security jq: Zero-terminate string in jv.c [CVE-2025-48060] in 12.12
security kmail-account-wizard: Fix man in the middle attack issue [CVE-2024-50624] in 12.12
security krb5: Fix message tampering issue [CVE-2025-3576]; disable issuance of tickets using RC4 or triple-DES session keys by default in 12.12
security kubernetes: Sanitise raw data output to terminal [CVE-2021-25743]; hide long and multi-line strings when printing in 12.12
security libarchive: Fix integer overflow issues [CVE-2025-5914 CVE-2025-5916], buffer over read issue [CVE-2025-5915], buffer overlow issue [CVE-2025-5917] in 12.12
security libcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927] in 12.12
security libfcgi: Fix integer overflow issue [CVE-2025-23016] in 12.12
security libphp-adodb: Fix SQL injection vulnerability in pg_insert_id() [CVE-2025-46337] in 12.12
security libraw: Fix out-of-bounds read issues [CVE-2025-43961 CVE-2025-43962 CVE-2025-43963]; enforce minimum w0 and w1 values [CVE-2025-43964] in 12.12
security libsndfile: Fix integer overflow issues [CVE-2022-33065]; fix out of bounds read issue [CVE-2024-50612] in 12.12
security libsoup3: New upstream bug-fix release; fix buffer overrun issue [CVE-2024-52531]; fix denial of service issues [CVE-2024-52532 CVE-2025-32051]; fix heap overflow issues [CVE-2025-32052 CVE-2025-32053]; fix integer overflow issue [CVE-2025-32050]; fix heap buffer overflow issues [CVE-2025-2784];… in 12.12
security libtpms: Fix out of bounds read issue [CVE-2025-49133] in 12.12
security libxml2: Fix integer overflow issue in xmlBuildQName [CVE-2025-6021]; fix potential buffer overflows in the interactive shell [CVE-2025-6170]; fix use-after-free issue in xmlSchematronReportOutput [CVE-2025-49794]; fix type confusion issue in xmlSchematronReportOutput [CVE-2025-49796] in 12.12
security libyaml-libyaml-perl: Fix arbitrary file edit issue [CVE-2025-40908] in 12.12
security luajit: Fix buffer overflow issue [CVE-2024-25176]; fix denial of service issue [CVE-2024-25177]; fix out-of-bounds read issue [CVE-2024-25178] in 12.12
security mariadb: New upstream stable release; security fixes [CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-30693 CVE-2025-30722]; fix restart after out of memory; new upstream stable release; fix variable name in debian-start.sh in 12.12
security 39 security advisories included: DSA-5877 chromium, DSA-5878 php8.2, DSA-5879 opensaml, DSA-5880 freetype, DSA-5881 rails, DSA-5882 chromium, DSA-5883 mercurial, DSA-5884 libxslt, DSA-5885 webkit2gtk, DSA-5886 ruby-rack, DSA-5887 exim4, DSA-5888 ghostscript, DSA-5889 firefox-esr, … in 12.11
security abseil: Fix heap buffer overflow issue [CVE-2025-0838]; fix build failure on ppc64el in 12.11
security fig2dev: Reject huge pattern lengths [CVE-2025-31162]; reject arcs with co-incident points [CVE-2025-31163]; allow an arc-box with zero radius [CVE-2025-31164] in 12.11
security fossil: Fix interaction with an Apache HTTP server including the fix for CVE-2024-24795 in 12.11
security gcc-12: Fix -fstack-protector handling of overflows on AArch64 [CVE-2023-4039] in 12.11
security glib2.0: Fix integer overflow in g_date_time_new_from_iso8601() [CVE-2025-3360] in 12.11
security haproxy: Fix heap buffer overflow issue [CVE-2025-32464] in 12.11
security imagemagick: Fix MIFF image depth mishandled after SetQuantumFormat [CVE-2025-43965] in 12.11
security krb5: Fix memory leak in ndr.c [CVE-2024-26462]; prevent buffer overflow when calculating ulog buffer size [CVE-2025-24528] in 12.11
security libbson-xs-perl: Fix security issues in embedded copy of libbson: denial of service [CVE-2017-14227]; buffer over-read [CVE-2018-16790]; infinite loop [CVE-2023-0437]; memory corruption [CVE-2024-6381]; buffer overflows [CVE-2024-6383 CVE-2025-0755] in 12.11
security libcap2: Fix incorrect recognition of group names [CVE-2025-1390] in 12.11
security libdata-entropy-perl: Seed entropy pool with urandom by default [CVE-2025-1860] in 12.11
security libsub-handlesvia-perl: Fix arbitrary code execution issue [CVE-2025-30673] in 12.11
security mongo-c-driver: Fix infinite loop issue [CVE-2023-0437]; fix integer overflow issue [CVE-2024-6381]; fix buffer overflow issues [CVE-2024-6383 CVE-2025-0755] in 12.11
security network-manager: Fix crash dereferencing NULL pointer during debug logging [CVE-2024-6501] in 12.11
security nginx: Fix buffer underread and unordered chunk vulnerabilities in mp4 [CVE-2024-7347] in 12.11
security node-send: Fix cross-site scripting issue [CVE-2024-43799] in 12.11
security node-serialize-javascript: Fix cross-site scripting issue [CVE-2024-11831] in 12.11
security nvidia-graphics-drivers: New upstream stable release; remove ppc64el support (migrated to src:nvidia-graphics-drivers-tesla-535); fix build issues with newer kernel versions; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244] in 12.11
security nvidia-open-gpu-kernel-modules: New upstream stable release; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244] in 12.11
security openrazer: Fix out of bounds read issue [CVE-2025-32776] in 12.11
security openssh: Fix the DisableForwarding directive [CVE-2025-32728] in 12.11
security openssl: New upstream stable release; fix timing side channel issue [CVE-2024-13176] in 12.11
security openvpn: Avoid possible ASSERT() on OpenVPN servers using --tls-crypt-v2 [CVE-2025-2704]; prevent malicious peer DoS or log-flooding [CVE-2024-5594]; refuse multiple exit notifications from authenticated clients [CVE-2024-28882]; update expired certificates in build tests in 12.11
security phpmyadmin: Fix XSS vulnerabilities [CVE-2025-24529 CVE-2025-24530] in 12.11
security poppler: Fix crash on malformed files [CVE-2023-34872]; fix out-of-bounds read issues [CVE-2024-56378 CVE-2025-32365]; fix floating point exception issue [CVE-2025-32364] in 12.11
security postgresql-15: New upstream stable release; fix buffer over-read issue [CVE-2025-4207] in 12.11
security python-h11: Fix request smuggling issue [CVE-2025-43859] in 12.11
security python3.11: Fix misparsing issues [CVE-2025-0938 CVE-2025-1795] in 12.11
security qtbase-opensource-src: Delay HTTP2 communication until encrypted() can be responded to [CVE-2024-39936]; fix crash with null checks in table iface methods in 12.11
security redis: Fix denial of service issue [CVE-2025-21605] in 12.11
security shadow: Fix password leak issue [CVE-2023-4641]; fix chfn control character injection issue [CVE-2023-29383] in 12.11
security twitter-bootstrap3: Fix cross-site scripting issues [CVE-2024-6485 CVE-2024-6484] in 12.11
security twitter-bootstrap4: Fix cross-site scripting issue [CVE-2024-6531] in 12.11
security varnish: Prevent HTTP/1 client-side desync [CVE-2025-30346] in 12.11
security xmedcon: Fix buffer overflow [CVE-2025-2581] in 12.11
security 40 security advisories included: DSA-5834 chromium, DSA-5836 xen, DSA-5839 firefox-esr, DSA-5840 chromium, DSA-5841 thunderbird, DSA-5842 openafs, DSA-5843 rsync, DSA-5844 chromium, DSA-5845 tomcat10, DSA-5846 libreoffice, DSA-5847 snapcast, DSA-5848 chromium, DSA-5849 git-lfs, … in 12.10
security 389-ds-base: Fix crash when modifying userPassword using malformed input [CVE-2024-2199 CVE-2024-8445]; prevent denial of service while attempting to log in with a user with a malformed hash in their password [CVE-2024-5953]; prevent denial of service on the directory server with specially-crafted… in 12.10
security curl: Fix unintended HTTPS upgrades or premature reversion to HTTP when both subdomains and parent domains are used [CVE-2024-9681]; prevent stopping of stunnel before retries in the built-time tests; fix possible credentials leakage issues [CVE-2024-11053 CVE-2025-0167]; fix test failures due to… in 12.10
security dcmtk: Fix issue when rendering an invalid monochrome DICOM image [CVE-2024-47796]; ensure: HighBit < BitsAllocated [CVE-2024-52333]; fix possible overflows when allocating memory [CVE-2024-27628]; fix two segmentation faults [CVE-2024-34508 CVE-2024-34509]; fix arbitrary code execution issue… in 12.10
security djoser: Fix authentication bypass [CVE-2024-21543] in 12.10
security edk2: Fix overflow condition in PeCoffLoaderRelocateImage() [CVE-2024-38796]; fix potential UINT32 overflow in S3 ResumeCount [CVE-2024-1298] in 12.10
security flightgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781] in 12.10
security glibc: Fix buffer overflow when printing assertion failure message [CVE-2025-0395]; fix memset performance for unaligned destinations; fix TLS performance degradation after dlopen() usage; avoid integer truncation when parsing CPUID data with large cache sizes; ensure data passed to the rseq… in 12.10
security intel-microcode: New upstream security release [CVE-2023-34440 CVE-2023-43758 CVE-2024-24582 CVE-2024-28047 CVE-2024-28127 CVE-2024-29214 CVE-2024-31068 CVE-2024-31157 CVE-2024-36293 CVE-2024-37020 CVE-2024-39279 CVE-2024-39355] in 12.10
security jinja2: Fix arbitrary code execution issues [CVE-2024-56201 CVE-2024-56326] in 12.10
security lemonldap-ng: Fix CSRF vulnerability on 2FA registration interface [CVE-2024-52948] in 12.10
security libapache-mod-jk: Set correct default permissions for shared memory [CVE-2024-46544] in 12.10
security libeconf: Fix buffer overflow vulnerability [CVE-2023-32181 CVE-2023-22652] in 12.10
security librabbitmq: Add option to read username/password from file [CVE-2023-35789] in 12.10
security libtar: Fix out-of-bounds read in gnu_longlink() [CVE-2021-33643]; fix out-of-bounds read in gnu_longname() [CVE-2021-33644]; fix memory leak in th_read() [CVE-2021-33645]; fix memory leak in th_read() [CVE-2021-33646] in 12.10
security mariadb: New upstream stable release; fix security issue [CVE-2024-21096]; fix denial of service issue [CVE-2025-21490] in 12.10
security monero: Impose response limits on HTTP server connections [CVE-2025-26819] in 12.10
security nginx: Fix possible bypass of client certificate authentication [CVE-2025-23419] in 12.10
security node-axios: Fix CSRF vulnerability [CVE-2023-45857]; fix potential vulnerability in URL when determining an origin [CVE-2024-57965] in 12.10
security node-postcss: Fix mishandling of non-integer values leading to denial of service in nanoid [CVE-2024-55565]; fix parsing of external untrusted CSS [CVE-2023-44270] in 12.10
security php-nesbot-carbon: Fix arbitrary file include issue [CVE-2025-22145] in 12.10
security postgresql-15: New upstream stable release; harden PQescapeString and allied functions against invalidly-encoded strings; improve behavior of libpq's quoting functions [CVE-2025-1094] in 12.10
security puma: Fix behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers [CVE-2023-40175]; limit size of chunk extensions [CVE-2024-21647]; prevent manipulation of headers set by intermediate proxies [CVE-2024-45614] in 12.10
security python-django: Fix regular expression-based denial of service issue [CVE-2023-36053], denial of service issues [CVE-2024-38875 CVE-2024-39614 CVE-2024-41990 CVE-2024-41991], user enumeration issue [CVE-2024-39329], directory traversal issue [CVE-2024-39330], excessive memory consumption issue… in 12.10
security simgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781] in 12.10
security sssd: Apply GPO policy consistently [CVE-2023-3758] in 12.10
security subversion: Fix vulnerable parsing of control characters in paths served by mod_dav_svn [CVE-2024-46901] in 12.10
security vim: Fix crash when expanding ~ in substitute [CVE-2023-2610]; fix buffer-overflow in vim_regsub_both() [CVE-2023-4738]; fix heap use after free in ins_compl_get_exp() [CVE-2023-4752]; fix heap-buffer-overflow in vim_regsub_both [CVE-2023-4781]; fix buffer-overflow in trunc_string()… in 12.10
security wget: Fix mishandling of semicolons in userinfo in URLs [CVE-2024-38428] in 12.10
security 35 security advisories included: DSA-5801 firefox-esr, DSA-5803 thunderbird, DSA-5804 webkit2gtk, DSA-5805 guix, DSA-5806 libarchive, DSA-5807 nss, DSA-5808 ghostscript, DSA-5809 symfony, DSA-5810 chromium, DSA-5811 mpg123, DSA-5812 postgresql-15, DSA-5813 symfony, DSA-5814 thunderbird, … in 12.9
security ansible-core: New upstream stable release; fix arbitrary code execution issue [CVE-2024-11079]; fix information disclosure issue [CVE-2024-8775]; fix file overwrite issue [CVE-2024-9902]; fix test failure in 12.9
security audiofile: Fix null pointer dereference issue [CVE-2019-13147]; fix information leak issue [CVE-2022-24599] in 12.9
security avahi: Fix denial of service issues [CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473]; fix browsing when invalid services are present in 12.9
security dnsmasq: Fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; set default maximum EDNS.0 UDP packet size to 1232 [CVE-2023-28450] in 12.9
security glib2.0: Fix buffer overflow when configured to use a SOCKS4a proxy with a very long username [CVE-2024-52533] in 12.9
security gnuchess: Fix arbitrary code execution issue [CVE-2021-30184] in 12.9
security gsl: Fix buffer overflow calculating the quantile value [CVE-2020-35357] in 12.9
security gst-plugins-base1.0: Don't try parsing extended header if not enough data is available (id3v2) [CVE-2024-47542] in 12.9
security gunicorn: Prevent HTTP request smuggling [CVE-2024-1135] in 12.9
security icinga2: Prevent TLS certificate bypass [CVE-2024-49369] in 12.9
security intel-microcode: New upstream security release [CVE-2024-21853 CVE-2024-23918 CVE-2024-24968 CVE-2024-23984] in 12.9
security jinja2: Prevent HTML attribute injection [CVE-2024-22195 CVE-2024-34064] in 12.9
security lemonldap-ng: Fix privilege escalation when adaptive auth levels used [CVE-2024-52946]; fix XSS in upgrade plugin [CVE-2024-52947] in 12.9
security libebml: Fix buffer overflow issue [CVE-2023-52339] in 12.9
security libpgjava: Fix SQL injection issue [CVE-2024-1597] in 12.9
security libsoup2.4: Prevent HTTP request smuggling [CVE-2024-52530]; fix buffer overflow in soup_header_parse_param_list_strict [CVE-2024-52531]; fix DoS reading from WebSocket clients [CVE-2024-52532] in 12.9
security libxstream-java: Fix denial of service issue [CVE-2024-47072] in 12.9
security nvidia-graphics-drivers: New upstream stable release [CVE-2024-0126] in 12.9
security nvidia-open-gpu-kernel-modules: New upstream LTS release [CVE-2024-0126] in 12.9
security opensc: Fix data leak issue [CVE-2023-5992]; fix use-after-free issue [CVE-2024-1454]; fix missing initialisation issue [CVE-2024-45615]; fix various issues with APDU buffer handling [CVE-2024-45616]; fix missing or incorrect function return value checks [CVE-2024-45617 CVE-2024-45618]; fix… in 12.9
security poco: Fix integer overflow issue [CVE-2023-52389] in 12.9
security pypy3: Fix email address parsing issue [CVE-2023-27043]; fix possible Server Side Request Forgery issue [CVE-2024-11168]; fix private IP address range parsing [CVE-2024-4032]; fix regular expression based Denial of Service issue [CVE-2024-6232]; fix header injection issue [CVE-2024-6923]; fix… in 12.9
security python-asyncssh: Fix rogue extension negotiation issue [CVE-2023-46445]; fix rogue session attack issue [CVE-2023-46446] in 12.9
security python-tornado: Fix open redirect issue [CVE-2023-28370]; fix denial of service issue [CVE-2024-52804] in 12.9
security python-urllib3: Fix possible information leak during cross-origin redirects [CVE-2023-43804]; fix request body not stripped after redirect from 303 status changes request method to GET [CVE-2023-45803]; fix Proxy-Authorization request header isn't stripped during cross-origin redirects… in 12.9
security python-werkzeug: Fix denial of service when file upload begins with CR or LF [CVE-2023-46136]; fix arbitrary code execution on developer's machine via the debugger [CVE-2024-34069]; fix denial of service when processing multipart/form-data requests [CVE-2024-49767] in 12.9
security python3.11: Reject malformed addresses in email.parseaddr() [CVE-2023-27043]; encode newlines in headers in the email module [CVE-2024-6923]; fix quadratic complexity parsing cookies with backslashes [CVE-2024-7592]; fix venv activation scripts failure to quote paths [CVE-2024-9287]; fix improper… in 12.9
security qemu: New upstream bugfix release [CVE-2024-7409]; mark internal codegen helper symbols as hidden, fixing build failure on arm64 in 12.9
security redis: Fix denial of service with malformed ACL selectors [CVE-2024-31227]; fix denial of service through unbound pattern matching [CVE-2024-31228]; fix stack overflow [CVE-202431449] in 12.9
security renderdoc: Fix integer overflows [CVE-2023-33863 CVE-2023-33864]; fix symlink attack vector [CVE-2023-33865] in 12.9
security ruby-doorkeeper: Prevent skipping of authorization steps [CVE-2023-34246] in 12.9
security setuptools: Fix remote code execution issue [CVE-2024-6345] in 12.9
security sqlparse: Fix regular expression-related denial of service issue [CVE-2023-30608]; fix denial of service issue [CVE-2024-4340] in 12.9
security texlive-bin: Fix data loss when using discretionaries with priorities; fix heap buffer overflow [CVE-2024-25262] in 12.9
security tiff: Fix buffer overflow issues [CVE-2023-25433 CVE-2023-26966]; fix use-after-free issue [CVE-2023-26965]; fix null pointer dereference issue [CVE-2023-2908]; fix denial of service issues [CVE-2023-3618 CVE-2023-52356 CVE-2024-7006] in 12.9
security util-linux: Fix wider mitigation for CVE-2024-28085 in 12.9
security zfs-linux: Add missing symbols in libzfs4linux and libzpool5linux; fix dnode dirty test [CVE-2023-49298]; fix sharenfs IPv6 address parsing [CVE-2013-20001]; fixes related to NULL pointer, memory allocation, etc. in 12.9
security zookeeper: Fix information disclosure in persistent watchers handling [CVE-2024-23944] in 12.9
security 47 security advisories included: DSA-5729 apache2, DSA-5733 thunderbird, DSA-5744 thunderbird, DSA-5758 trafficserver, DSA-5759 python3.11, DSA-5760 ghostscript, DSA-5761 chromium, DSA-5762 webkit2gtk, DSA-5763 pymatgen, DSA-5764 openssl, DSA-5765 firefox-esr, DSA-5766 chromium, … in 12.8
security 7zip: Fix heap buffer overflow in NTFS handler [CVE-2023-52168]; fix out-of-bounds read in NTFS handler [CVE-2023-52169] in 12.8
security amanda: Update incomplete fix for CVE-2022-37704, restoring operation with xfsdump in 12.8
security apr: Use 0600 perms for named shared mem consistently [CVE-2023-49582] in 12.8
security cjson: Fix segmentation violation issue [CVE-2024-31755] in 12.8
security clamav: New upstream stable release; fix denial of service issue [CVE-2024-20505], file corruption issue [CVE-2024-20506] in 12.8
security curl: Fix incorrect handling of some OCSP responses [CVE-2024-8096] in 12.8
security docker.io: Fix bypassing of AuthZ plugins in some circumstances [CVE-2024-41110] in 12.8
security intel-microcode: New upstream release; security fixes [CVE-2024-23984 CVE-2024-24968] in 12.8
security lemonldap-ng: Fix cross-site scripting vulnerability on login page [CVE-2024-48933] in 12.8
security nghttp2: Fix denial of service issue [CVE-2024-28182] in 12.8
security node-dompurify: Fix prototype pollution issues [CVE-2024-45801 CVE-2024-48910] in 12.8
security openssl: New upstream stable release; fix buffer overread issue [CVE-2024-5535], out of bounds memory access [CVE-2024-9143] in 12.8
security puredata: Fix privilege escalation issue [CVE-2023-47480] in 12.8
security python-cryptography: Fix NULL dereference when loading PKCS7 certificates [CVE-2023-49083]; fix NULL dereference when PKCS#12 key and cert don't match [CVE-2024-26130] in 12.8
security sqlite3: Fix a buffer overread issue [CVE-2023-7104], a stack overflow issue and an integer overflow issue in 12.8
security tgt: chap: Use proper entropy source [CVE-2024-45751] in 12.8
security wireshark: New upstream security release [CVE-2024-0208, CVE-2024-0209, CVE-2024-2955, CVE-2024-4853, CVE-2024-4854, CVE-2024-4855, CVE-2024-8250, CVE-2024-8645] in 12.8
security xfpt: Fix buffer overflow issue [CVE-2024-43700] in 12.8
security 51 security advisories included: DSA-5617 chromium, DSA-5629 chromium, DSA-5634 chromium, DSA-5636 chromium, DSA-5639 chromium, DSA-5648 chromium, DSA-5654 chromium, DSA-5656 chromium, DSA-5668 chromium, DSA-5675 chromium, DSA-5676 chromium, DSA-5683 chromium, DSA-5687 chromium, … in 12.7
security amd64-microcode: New upstream release; security fixes [CVE-2023-31315]; SEV firmware fixes [CVE-2023-20584 CVE-2023-31356] in 12.7
security ansible: New upstream stable release; fix key leakage issue [CVE-2023-4237] in 12.7
security ansible-core: New upstream stable release; fix information disclosure issue [CVE-2024-0690]; fix template injection issue [CVE-2023-5764]; fix path traversal issue [CVE-2023-5115] in 12.7
security apache2: New upstream stable release; fix content disclosure issue [CVE-2024-40725] in 12.7
security cacti: Fix remote code execution issues [CVE-2024-25641 CVE-2024-31459], cross site scripting issues [CVE-2024-29894 CVE-2024-31443 CVE-2024-31444], SQL injection issues [CVE-2024-31445 CVE-2024-31458 CVE-2024-31460], type juggling issue [CVE-2024-34340]; fix autopkgtest failure in 12.7
security calibre: Fix remote code execution issue [CVE-2024-6782, cross site scripting issue [CVE-2024-7008], SQL injection issue [CVE-2024-7009] in 12.7
security cockpit: Fix denial of service issue [CVE-2024-6126] in 12.7
security cups: Fix issues with domain socket handling [CVE-2024-35235] in 12.7
security curl: Fix ASN.1 date parser overread issue [CVE-2024-7264] in 12.7
security cyrus-imapd: Fix regression introduced in CVE-2024-34055 fix in 12.7
security dcm2niix: Fix potential code execution issue [CVE-2024-27629] in 12.7
security dmitry: Security fixes [CVE-2024-31837 CVE-2020-14931 CVE-2017-7938] in 12.7
security gettext.js: Fix server side request forgery issue [CVE-2024-43370] in 12.7
security gtk+2.0: Avoid looking for modules in the current working directory [CVE-2024-6655] in 12.7
security gtk+3.0: Avoid looking for modules in the current working directory [CVE-2024-6655] in 12.7
security imagemagick: Fix segmentation fault issue; fix incomplete fix for CVE-2023-34151 in 12.7
security intel-microcode: New upstream release; security fixes [CVE-2023-42667 CVE-2023-49141 CVE-2024-24853 CVE-2024-24980 CVE-2024-25939] in 12.7
security libvirt: birsh: Make domif-setlink work more than once; qemu: domain: Fix logic when tainting domain; fix denial of service issues [CVE-2023-3750 CVE-2024-1441 CVE-2024-2494 CVE-2024-2496] in 12.7
security newlib: Fix buffer overflow issue [CVE-2021-3420] in 12.7
security openssl: New upstream stable release; fix denial of service issues [CVE-2024-2511 CVE-2024-4603]; fix use after free issue [CVE-2024-4741] in 12.7
security putty: Fix weak ECDSA nonce generation allowing secret key recovery [CVE-2024-31497] in 12.7
security qemu: New upstream stable release; fix denial of service issue [CVE-2024-4467] in 12.7
security xmedcon: Fix buffer overflow issue [CVE-2024-29421] in 12.7
security 77 security advisories included: DSA-5575 webkit2gtk, DSA-5580 webkit2gtk, DSA-5589 nodejs, DSA-5609 slurm-wlm-contrib, DSA-5616 ruby-sanitize, DSA-5618 webkit2gtk, DSA-5619 libgit2, DSA-5620 unbound, DSA-5621 bind9, DSA-5623 postgresql-15, DSA-5624 edk2, DSA-5625 engrampa, … in 12.6
security amavisd-new: Handle multiple boundary parameters that contain conflicting values [CVE-2024-28054]; fix race condition in postinst in 12.6
security bluez: Fix remote code execution issues [CVE-2023-27349 CVE-2023-50229 CVE-2023-50230] in 12.6
security cjson: Fix missing NULL checks [CVE-2023-50471 CVE-2023-50472] in 12.6
security clamav: New upstream stable release; fix possible heap overflow issue [CVE-2024-20290], possible command injection issue [CVE-2024-20328] in 12.6
security curl: Do not keep default protocols when deselected [CVE-2024-2004]; fix memory leak [CVE-2024-2398] in 12.6
security emacs: Security fixes [CVE-2024-30202 CVE-2024-30203 CVE-2024-30204 CVE-2024-30205]; replace expired package-keyring.gpg with a current version in 12.6
security gdk-pixbuf: ANI: Reject files with multiple anih chunks [CVE-2022-48622]; ANI: Reject files with multiple INAM or IART chunks; ANI: Validate anih chunk size in 12.6
security glewlwyd: Fix potential buffer overflow during FIDO2 credential validation [CVE-2023-49208]; fix open redirection via redirect_uri [CVE-2024-25715] in 12.6
security gnutls28: Fix certtool crash when verifying a certificate chain with more than 16 certificates [CVE-2024-28835]; fix side-channel in the deterministic ECDSA [CVE-2024-28834]; fix a memory leak; fix two segfault issues in 12.6
security gross: Fix stack-based buffer overflow [CVE-2023-52159] in 12.6
security intel-microcode: Security mitigations [CVE-2023-22655 CVE-2023-28746 CVE-2023-38575 CVE-2023-39368 CVE-2023-43490]; mitigate for INTEL-SA-01051 [CVE-2023-45733], INTEL-SA-01052 [CVE-2023-46103], INTEL-SA-01036 [CVE-2023-45745, CVE-2023-47855] and unspecified functional issues on various Intel… in 12.6
security jose: Fix potential denial-of-service issue [CVE-2023-50967] in 12.6
security json-smart: Fix excessive recursion leading to stack overflow [CVE-2023-1370]; fix denial of service via crafted request [CVE-2021-31684] in 12.6
security libapache2-mod-auth-openidc: Fix mising input validation leading to DoS [CVE-2024-24814] in 12.6
security libjwt: Fix timing side channel attack [CVE-2024-25189] in 12.6
security libtommath: Fix integer overflow [CVE-2023-36328] in 12.6
security nsis: Don't allow unprivileged users to delete the uninstaller directory [CVE-2023-37378]; fix regression in disabling stub relocations; build reproducibly for arm64 in 12.6
security nvidia-graphics-drivers: Restore compatibility with newer Linux kernel builds; take over packages from nvidia-graphics-drivers-tesla; add new nvidia-suspend-common package; relax dh-dkms build-dependency for compatibility with bookworm; new upstream stable release [CVE-2023-0180 CVE-2023-0183… in 12.6
security nvidia-graphics-drivers-tesla-470: Restore compatibility with newer Linux kernel builds; stop building nvidia-cuda-mps; new upstream stable release; security fixes [CVE-2022-42265 CVE-2024-0074 CVE-2024-0078 CVE-2024-0090 CVE-2024-0092] in 12.6
security nvidia-open-gpu-kernel-modules: Update to 535 series LTS drivers [CVE-2023-0180 CVE-2023-0183 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199 CVE-2023-25515 CVE-2023-25516 CVE-2023-31022… in 12.6
security openssl: New upstream stable release; fix excessive time taken issues [CVE-2023-5678 CVE-2023-6237], vector register corruption issue on PowerPC [CVE-2023-6129], PKCS12 Decoding crashes [CVE-2024-0727] in 12.6
security ovn: New upstream stable version; fix insufficient validation of incoming BFD packets [CVE-2024-2182] in 12.6
security php-phpseclib: Guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength(); remove visibitility modifiers from static variables in 12.6
security php-phpseclib3: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength() in 12.6
security phpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength() in 12.6
security postgresql-15: New upstream stable release; restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner [CVE-2024-4317] in 12.6
security pymongo: Fix out-of-bounds read issue [CVE-2024-5629] in 12.6
security pypy3: Strip C0 control and space characters in urlsplit [CVE-2023-24329]; avoid bypass of TLS handshake protections on closed sockets [CVE-2023-40217]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450] in 12.6
security python-aiosmtpd: Fix SMTP smuggling issue [CVE-2024-27305]; fix STARTTLS unencrypted command injection issue [CVE-2024-34083] in 12.6
security python-idna: Fix denial of service issue [CVE-2024-3651] in 12.6
security python-jwcrypto: Fix denial of service issue [CVE-2024-28102] in 12.6
security python3.11: Fix use-after-free crash when deallocating a frame object; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; fix os.path.normpath(): Path truncation at null bytes [CVE-2023-41105]; avoid bypass of TLS… in 12.6
security qemu: New upstream stable release; security fixes [CVE-2024-26327 CVE-2024-26328 CVE-2024-3446 CVE-2024-3447] in 12.6
security qtbase-opensource-src: Fix regression in patch for CVE-2023-24607; avoid using system CA certificates when not wanted [CVE-2023-34410]; fix buffer overflow [CVE-2023-37369]; fix infinite loop in XML recursive entity expansion [CVE-2023-38197]; fix buffer overflow with crafted KTX image file… in 12.6
security sendmail: Fix SMTP smuggling issue [CVE-2023-51765] in 12.6
security systemd: New upstream stable release; fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; libnss-myhostname.nss: Install after files; libnss-mymachines.nss: Install before resolve and dns in 12.6
security wpa: Fix authentication bypass issue [CVE-2023-52160] in 12.6
security 39 security advisories included: DSA-5572 roundcube, DSA-5573 chromium, DSA-5574 libreoffice, DSA-5576 xorg-server, DSA-5577 chromium, DSA-5578 ghostscript, DSA-5579 freeimage, DSA-5581 firefox-esr, DSA-5582 thunderbird, DSA-5583 gst-plugins-bad1.0, DSA-5584 bluez, DSA-5585 chromium, … in 12.5
security apktool: Prevent arbitrary file writes with malicious resource names [CVE-2024-21633] in 12.5
security atril: Fix crash when opening some epub files; fix index loading for certain epub documents; add fallback for malformed epub files in check_mime_type; use libarchive instead of external command for extracting documents [CVE-2023-51698] in 12.5
security calibre: Fix HTML Input: Don't add resources that exist outside the folder hierarchy rooted at the parent folder of the input HTML file by default [CVE-2023-46303] in 12.5
security dropbear: Fix terrapin attack [CVE-2023-48795] in 12.5
security espeak-ng: Fix buffer overflow issues [CVE-2023-49990 CVE-2023-49992 CVE-2023-49993], buffer underflow issue [CVE-2023-49991], floating point exception issue [CVE-2023-49994] in 12.5
security filezilla: Prevent Terrapin exploit [CVE-2023-48795] in 12.5
security fish: Handle Unicode non-printing characters safely when given as command substitution [CVE-2023-49284] in 12.5
security gnutls28: Fix assertion failure when verifying a certificate chain with a cycle of cross signatures [CVE-2024-0567]; fix timing side-channel issue [CVE-2024-0553] in 12.5
security indent: Fix buffer under read issue [CVE-2024-0911] in 12.5
security libde265: Fix buffer overflow issues [CVE-2023-49465 CVE-2023-49467 CVE-2023-49468] in 12.5
security libspreadsheet-parsexlsx-perl: Fix possible memory bomb [CVE-2024-22368]; fix XML External Entity issue [CVE-2024-23525] in 12.5
security mariadb: New upstream stable release; fix denial of service issue [CVE-2023-22084] in 12.5
security postfix: New upstream stable release; address SMTP smuggling issue [CVE-2023-51764] in 12.5
security proftpd-dfsg: Implement fix for the Terrapin attack [CVE-2023-48795]; fix out-of-bounds read issue [CVE-2023-51713] in 12.5
security proftpd-mod-proxy: Implement fix for the Terrapin attack [CVE-2023-48795] in 12.5
security pypdf: Fix infinite loop issue [CVE-2023-36464] in 12.5
security pypdf2: Fix infinite loop issue [CVE-2023-36464] in 12.5
security qemu: New upstream stable release; virtio-net: correctly copy vnet header when flushing TX [CVE-2023-6693]; fix null pointer dereference issue [CVE-2023-6683]; revert patch causing regressions in suspend / resume functionality in 12.5
security systemd: New upstream stable release; fix missing verification issue in systemd-resolved [CVE-2023-7008] in 12.5
security tar: Fix boundary checking in base-256 decoder [CVE-2022-48303], handling of extended header prefixes [CVE-2023-39804] in 12.5
security tinyxml: Fix assertion issue [CVE-2023-34194] in 12.5
security wolfssl: Fix security issue when client sent neither PSK nor KSE extensions [CVE-2023-3724] in 12.5
security xen: New upstream stable release; security fixes [CVE-2023-46837 CVE-2023-46839 CVE-2023-46840] in 12.5
security 60 security advisories included: DSA-5499 chromium, DSA-5506 firefox-esr, DSA-5508 chromium, DSA-5511 mosquitto, DSA-5512 exim4, DSA-5513 thunderbird, DSA-5514 glibc, DSA-5515 chromium, DSA-5516 libxpm, DSA-5517 libx11, DSA-5518 libvpx, DSA-5519 grub-efi-amd64-signed +3, … in 12.4
security amanda: Fix local privilege escalation [CVE-2023-30577] in 12.4
security axis: Filter out unsupported protocols in the client class ServiceFactory [CVE-2023-40743] in 12.4
security exfatprogs: Fix out-of-bounds memory access issues [CVE-2023-45897] in 12.4
security exim4: Fix security issues relating to the proxy protocol [CVE-2023-42117] and DNSDB lookups [CVE-2023-42119]; add hardening for SPF lookups; disallow UTF-16 surrogates from ${utf8clean:...}; fix crash with tls_dhparam = none; fix $recipients expansion when used within ${run...}; fix expiry date… in 12.4
security gnutls28: Fix timing sidechannel issue [CVE-2023-5981] in 12.4
security libde265: Fix segmentation violation issue [CVE-2023-27102], buffer overflow issues [CVE-2023-27103 CVE-2023-47471], buffer over-read issue [CVE-2023-43887] in 12.4
security linux: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security linux-signed-amd64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security linux-signed-arm64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security linux-signed-i386: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security minizip: Fix integer and heap overflow issues [CVE-2023-45853] in 12.4
security node-undici: Delete cookie and host headers on cross-origin redirect [CVE-2023-45143] in 12.4
security nvidia-graphics-drivers: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security nvidia-graphics-drivers-tesla: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security nvidia-graphics-drivers-tesla-470: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security nvidia-open-gpu-kernel-modules: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security opendkim: Fix removal of incoming Authentication-Results: headers [CVE-2022-48521] in 12.4
security openrefine: Fix remote code execution vulnerability [CVE-2023-41887 CVE-2023-41886] in 12.4
security opensc: Fix out-of-bounds read issue [CVE-2023-4535], potential PIN bypass [CVE-2023-40660], memory-handling issues [CVE-2023-40661] in 12.4
security perl: Fix buffer overrun issue [CVE-2023-47038] in 12.4
security php-phpseclib3: Fix denial of service issue [CVE-2023-49316] in 12.4
security postgresql-15: New upstream stable release; fix SQL injection issue [CVE-2023-39417]; fix MERGE to enforce row security policies properly [CVE-2023-39418] in 12.4
security qemu: Update to upstream stable release 7.2.7; hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] in 12.4
security symfony: Fix session fixation issue [CVE-2023-46733]; add missing escaping [CVE-2023-46734] in 12.4
security unadf: Fix buffer overflow issue [CVE-2016-1243]; fix code execution issue [CVE-2016-1244] in 12.4
security vips: Fix null pointer dereference issue [CVE-2023-40032] in 12.4
security xen: New upstream stable update; fix several security issues [CVE-2022-40982 CVE-2023-20569 CVE-2023-20588 CVE-2023-20593 CVE-2023-34320 CVE-2023-34321 CVE-2023-34322 CVE-2023-34323 CVE-2023-34325 CVE-2023-34326 CVE-2023-34327 CVE-2023-34328 CVE-2023-46835 CVE-2023-46836] in 12.4
security 43 security advisories included: DSA-5454 kanboard, DSA-5455 iperf3, DSA-5456 chromium, DSA-5457 webkit2gtk, DSA-5458 openjdk-17, DSA-5459 amd64-microcode, DSA-5460 curl, DSA-5462 linux-signed-amd64 +3, DSA-5463 thunderbird, DSA-5464 firefox-esr, DSA-5465 python-django, DSA-5466 ntpsec, … in 12.2
security amd64-microcode: Update included microcode, including fixes for AMD Inception on AMD Zen4 processors [CVE-2023-20569] in 12.2
security batik: Fix Server Side Request Forgery issues [CVE-2022-44729 CVE-2022-44730] in 12.2
security clamav: New upstream stable release; security fixes [CVE-2023-20197 CVE-2023-20212] in 12.2
security cups: Fix heap-based buffer overflow issue [CVE-2023-4504]; fix unauthenticated access issue [CVE-2023-32360] in 12.2
security curl: Build with OpenLDAP to correct improper fetch of binary LDAP attributes; fix excessive memory consumption issue [CVE-2023-38039] in 12.2
security efibootguard: Fix Insufficient or missing validation and sanitization of input from untrustworthy bootloader environment files [CVE-2023-39950] in 12.2
security ghostscript: Fix buffer overflow issue [CVE-2023-38559]; try and secure the IJS server startup [CVE-2023-43115] in 12.2
security glibc: Fix the value of F_GETLK/F_SETLK/F_SETLKW with __USE_FILE_OFFSET64 on ppc64el; fix a stack read overflow in getaddrinfo in no-aaaa mode [CVE-2023-4527]; fix use after free in getcanonname [CVE-2023-4806 CVE-2023-5156]; fix _dl_find_object to return correct values even during early startup in 12.2
security hnswlib: Fix double free in init_index when the M argument is a large integer [CVE-2023-37365] in 12.2
security horizon: Fix open redirect issue [CVE-2022-45582] in 12.2
security indent: Fix out of buffer read; fix buffer overwrite [CVE-2023-40305] in 12.2
security inetutils: Check return values when dropping privileges [CVE-2023-40303] in 12.2
security krb5: Fix freeing of uninitialised pointer [CVE-2023-36054] in 12.2
security lemonldap-ng: Apply login control to auth-slave requests; fix open redirection due to incorrect escape handling; fix open redirection when OIDC RP has no redirect URIs; fix Server Side Request Forgery issue [CVE-2023-44469] in 12.2
security libapache-mod-jk: Remove implicit mapping functionality, which could lead to unintended exposure of the status worker and/or bypass of security constraints [CVE-2023-41081] in 12.2
security modsecurity: Fix denial of service issue [CVE-2023-38285] in 12.2
security mozjs102: New upstream stable release; fix incorrect value used during WASM compilation [CVE-2023-4046], potential use after free issue [CVE-2023-37202], memory safety issues [CVE-2023-37211 CVE-2023-34416] in 12.2
security node-dottie: Security fix (prototype pollution) [CVE-2023-26132] in 12.2
security openrefine: Fix arbitrary code execution issue [CVE-2023-37476] in 12.2
security openssh: Fix remote code execution issue via a forwarded agent socket [CVE-2023-38408] in 12.2
security openssl: New upstream stable release; security fixes [CVE-2023-2975 CVE-2023-3446 CVE-2023-3817] in 12.2
security pandoc: Fix arbitrary file write issue [CVE-2023-35936] in 12.2
security python-git: Fix remote code execution issue [CVE-2023-40267], blind local file inclusion issue [CVE-2023-41040] in 12.2
security qemu: Update to upstream 7.2.5 tree; ui/vnc-clipboard: fix infinite loop in inflate_buffer [CVE-2023-3255]; fix NULL pointer dereference issue [CVE-2023-3354]; fix buffer overflow issue [CVE-2023-3180] in 12.2
security rar: Upstream bugfix release [CVE-2023-40477] in 12.2
security roundcube: New upstream stable release; fix OAuth2 authentication; fix cross site scripting issues [CVE-2023-43770] in 12.2
security timg: Fix buffer overflow vulnerability [CVE-2023-40968] in 12.2
security unrar-nonfree: Fix remote code execution issue [CVE-2023-40477] in 12.2
security 23 security advisories included: DSA-5423 thunderbird, DSA-5425 php8.2, DSA-5427 webkit2gtk, DSA-5428 chromium, DSA-5429 wireshark, DSA-5430 openjdk-17, DSA-5432 xmltooling, DSA-5433 libx11, DSA-5434 minidlna, DSA-5435 trafficserver, DSA-5436 hsqldb1.8.0, DSA-5437 hsqldb, DSA-5439 bind9, … in 12.1
security cpdb-libs: Fix a buffer overflow vulnerability [CVE-2023-34095] in 12.1
security cpp-httplib: Fix CRLF injection issue [CVE-2023-26130] in 12.1
security cups: Security fixes: use-after-free [CVE-2023-34241]; heap buffer overflow [CVE-2023-32324] in 12.1
security dbus: New upstream stable release; fix denial of service issue [CVE-2023-34969]; stop trying to take DPKG_ROOT into account, restoring copying of systemd's /etc/machine-id in preference to creating an entirely new machine ID in 12.1
security guestfs-tools: Security update [CVE-2022-2211] in 12.1
security kanboard: Fix malicious injection of HTML tags into DOM [CVE-2023-32685]; fix parameter-based indirect object referencing leading to private file exposure [CVE-2023-33956]; fix missing access controls [CVE-2023-33968, CVE-2023-33970]; fix stored XSS in Task External Link functionality… in 12.1
security libreswan: Fix potential denial-of-service issue [CVE-2023-30570] in 12.1
security libxml2: Fix NULL pointer dereference issue [CVE-2022-2309] in 12.1
security linux: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001] in 12.1
security linux-signed-amd64: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001] in 12.1
security linux-signed-arm64: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001] in 12.1
security linux-signed-i386: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001] in 12.1
security node-tough-cookie: Fix prototype pollution issue [CVE-2023-26136] in 12.1
security node-undici: Security fixes: protect Host HTTP header from CLRF injection [CVE-2023-23936]; potential ReDoS on Headers.set and Headers.append [CVE-2023-24807] in 12.1
security node-webpack: Security fix (cross-realm objects) [CVE-2023-28154] in 12.1
security nvidia-graphics-drivers: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516] in 12.1
security nvidia-graphics-drivers-tesla: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516] in 12.1
security nvidia-graphics-drivers-tesla-470: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516] in 12.1
security nvidia-open-gpu-kernel-modules: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516] in 12.1
security qemu: New upstream stable release; fix USB devices not being available to XEN HVM domUs; 9pfs: prevent opening special files [CVE-2023-2861]; fix reentrancy issues in the LSI controller [CVE-2023-0330] in 12.1
security smarty4: Fix arbitrary code execution issue [CVE-2023-28447] in 12.1
security tang: Fix race condition when creating/rotating keys [CVE-2023-1672] in 12.1
security texlive-bin: Disable socket in luatex by default [CVE-2023-32668]; make installable on i386 in 12.1
security xerial-sqlite-jdbc: Use a UUID for connection ID [CVE-2023-32697] in 12.1
security yajl: Memory leak security fix; fix denial of service issue [CVE-2017-16516], integer overflow issue [CVE-2022-24795] in 12.1
security 21 security advisories included: DSA-5718 org-mode, DSA-5719 emacs, DSA-5721 ffmpeg, DSA-5722 libvpx, DSA-5723 plasma-workspace, DSA-5725 znc, DSA-5726 krb5, DSA-5727 firefox-esr, DSA-5728 exim4, DSA-5729 apache2, DSA-5730 linux-signed-amd64 +3, DSA-5734 bind9, DSA-5736 openjdk-11, … in 11.11
security amd64-microcode: New upstream release; security fixes [CVE-2023-31315]; SEV firmware fixes [CVE-2023-20584 CVE-2023-31356] in 11.11
security ansible: New usptream stable release; fix template injection issue [CVE-2021-3583], information disclosure issue [CVE-2021-3620], file overwrite issue [CVE-2023-5115], template injection issue [CVE-2023-5764], information disclosure issues [CVE-2024-0690 CVE-2022-3697]; document workaround for ec2… in 11.11
security apache2: New upstream stable release; fix content disclosure issue [CVE-2024-40725] in 11.11
security bind9: Allow the limits introduced to fix CVE-2024-1737 to be configured in 11.11
security calibre: Fix cross site scripting issue [CVE-2024-7008], SQL injection issue [CVE-2024-7009] in 11.11
security cjson: Add NULL checks to cJSON_SetValuestring and cJSON_InsertItemInArray [CVE-2023-50472 CVE-2023-50471 CVE-2024-31755] in 11.11
security cups: Fix issues with domain socket handling [CVE-2024-35235]; fix regression when domain sockets only are used in 11.11
security curl: Fix ASN.1 date parser overread issue [CVE-2024-7264] in 11.11
security fusiondirectory: Backport compatibility with php-cas version addressing CVE 2022-39369; fix improper session handling issue [CVE-2022-36179]; fix cross site scripting issue [CVE-2022-36180] in 11.11
security gettext.js: Fix server side request forgery issue [CVE-2024-43370] in 11.11
security glewlwyd: Fix buffer overflow during webauthn signature assertion [CVE-2022-27240]; prevent directory traversal in static_compressed_inmemory_website_callback.c [CVE-2022-29967]; copy bootstrap, jquery, fork-awesome instead of linking them; buffer overflow during FIDO2 signature validation… in 11.11
security glibc: Fix ffsll() performance issue depending on code alignment; performance improvements for memcpy() on arm64; fix y2038 regression in nscd following CVE-2024-33601 and CVE-2024-33602 fix in 11.11
security gtk+2.0: Avoid looking for modules in current working directory [CVE-2024-6655] in 11.11
security gtk+3.0: Avoid looking for modules in current working directory [CVE-2024-6655] in 11.11
security imagemagick: Fix divide by zero issues [CVE-2021-20312 CVE-2021-20313]; fix incomplete fix for CVE-2023-34151 in 11.11
security indent: Reinstate ROUND_UP macro and adjust the initial buffer size to fix memory handling problems; fix out-of-buffer read in search_brace()/lexi(); fix heap buffer overwrite in search_brace() [CVE-2023-40305]; heap buffer underread in set_buf_break() [CVE-2024-0911] in 11.11
security intel-microcode: New upstream release; security fixes [CVE-2023-42667 CVE-2023-49141 CVE-2024-24853 CVE-2024-24980 CVE-2024-25939] in 11.11
security libvirt: Fix sVirt confinement issue [CVE-2021-3631], use after free issue [CVE-2021-3975], denial of service issues [CVE-2021-3667 CVE-2021-4147 CVE-2022-0897 CVE-2024-1441 CVE-2024-2494 CVE-2024-2496] in 11.11
security ntfs-3g: Fix use-after-free in ntfs_uppercase_mbs [CVE-2023-52890] in 11.11
security php-cas: Fix Service Hostname Discovery Exploitation issue [CVE-2022-39369] in 11.11
security putty: Fix weak ECDSA nonce generation allowing secret key recovery [CVE-2024-31497] in 11.11
security runc: Fix busybox tarball url; prevent buffer overflow writing netlink messages [CVE-2021-43784]; fix tests on newer kernels; prevent write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... [CVE-2023-25809]; fix access control regression [CVE-2023-27561 CVE-2023-28642] in 11.11
security xmedcon: Fix heap overflow [CVE-2024-29421] in 11.11
security 69 security advisories included: DSA-5146 puma, DSA-5360 emacs, DSA-5575 webkit2gtk, DSA-5580 webkit2gtk, DSA-5596 asterisk, DSA-5616 ruby-sanitize, DSA-5618 webkit2gtk, DSA-5619 libgit2, DSA-5620 unbound, DSA-5621 bind9, DSA-5622 postgresql-13, DSA-5624 edk2, DSA-5625 engrampa, … in 11.10
security allegro5: Fix buffer overflow issues [CVE-2021-36489] in 11.10
security amavisd-new: Handle multiple boundary parameters that contain conflicting values [CVE-2024-28054] in 11.10
security curl: Fix memory leak when HTTP/2 server push is aborted [CVE-2024-2398] in 11.10
security emacs: Protect against unsafe remote resources [CVE-2024-30203 CVE-2024-30204 CVE-2024-30205]; fix memory leak in patch for CVE-2022-48337 in 11.10
security gdk-pixbuf: ANI: Reject files with multiple anih chunks [CVE-2022-48622]; ANI: Reject files with multiple INAM or IART chunks; ANI: Validate anih chunk size in 11.10
security gnutls28: Fix assertion failure verifying a certificate chain with a cycle of cross signatures [CVE-2024-0567]; fix timing side-channel attack inside RSA-PSK key exchange [CVE-2024-0553] in 11.10
security gross: Fix stack-based buffer overflow [CVE-2023-52159] in 11.10
security imlib2: Fix heap-buffer overflow vulnerability when using the tgaflip function in loader_tga.c [CVE-2024-25447 CVE-2024-25448 CVE-2024-25450] in 11.10
security intel-microcode: Fixes for INTEL-SA-INTEL-SA-00972 [CVE-2023-39368], INTEL-SA-INTEL-SA-00982 [CVE-2023-38575], INTEL-SA-INTEL-SA-00898 [CVE-2023-28746], INTEL-SA-INTEL-SA-00960 [CVE-2023-22655] and INTEL-SA-INTEL-SA-01045 [CVE-2023-43490]; mitigate for INTEL-SA-01051 [CVE-2023-45733],… in 11.10
security jose: Fix potential denial-of-service issue [CVE-2023-50967] in 11.10
security json-smart: Fix excessive recursion leading to stack overflow [CVE-2023-1370]; fix denial of service via crafted request [CVE-2021-31684] in 11.10
security libapache2-mod-auth-openidc: Fix missing input validation leading to DoS [CVE-2024-24814] in 11.10
security libjwt: Fix a timing side channel via strcmp() [CVE-2024-25189] in 11.10
security libmicrohttpd: Fix out of bounds read with crafted POST requests [CVE-2023-27371] in 11.10
security libssh2: Fix out of bounds memory check in _libssh2_packet_add [CVE-2020-22218] in 11.10
security nano: Fix malicious symlink issue [CVE-2024-5742] in 11.10
security nvidia-graphics-drivers: End support for Tesla 450 drivers; build libnvidia-fbc1 for arm64; upstream security fixes [CVE-2022-42265 CVE-2024-0074 CVE-2024-0078]; new upstream stable release; security fixes [CVE-2024-0090 CVE-2024-0092]; fix build on ppc64el in 11.10
security nvidia-graphics-drivers-tesla-470: New upstream LTS release [CVE-2024-0074 CVE-2024-0078 CVE-2022-42265 CVE-2024-0090 CVE-2024-0092]; fix build on ppc64el in 11.10
security org-mode: Protect against unsafe remote resources [CVE-2024-30203 CVE-2024-30204 CVE-2024-30205] in 11.10
security php-phpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength() in 11.10
security phpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength() in 11.10
security pypdf2: Fix quadratic runtime with malformed PDF missing xref marker [CVE-2023-36810]; fix infinite loop with crafted input [CVE-2022-24859] in 11.10
security python-aiosmtpd: Fix SMTP smuggling issue [CVE-2024-27305]; fix STARTTLS unencrypted command injection issue [CVE-2024-34083] in 11.10
security python-idna: Fix denial of service issue [CVE-2024-3651] in 11.10
security qtbase-opensource-src: Security fixes [CVE-2022-25255 CVE-2023-24607 CVE-2023-32762 CVE-2023-32763 CVE-2023-33285 CVE-2023-34410 CVE-2023-37369 CVE-2023-38197 CVE-2023-51714 CVE-2024-25580] in 11.10
security sendmail: Fix SMTP smuggling issue [CVE-2023-51765]; add forgotten configuration for rejecting NUL by default in 11.10
security wpa: Fix authentication bypass issue [CVE-2023-52160] in 11.10
security 86 security advisories included: DSA-5496 firefox-esr, DSA-5499 chromium, DSA-5506 firefox-esr, DSA-5508 chromium, DSA-5509 firefox-esr, DSA-5511 mosquitto, DSA-5512 exim4, DSA-5513 thunderbird, DSA-5514 glibc, DSA-5515 chromium, DSA-5516 libxpm, DSA-5517 libx11, DSA-5518 libvpx, … in 11.9
security axis: Filter out unsupported protocols in the client class ServiceFactory [CVE-2023-40743] in 11.9
security dropbear: Fix security measure bypass issue [CVE-2021-36369]; fix terrapin attack [CVE-2023-48795] in 11.9
security exuberant-ctags: Fix arbitrary command execution issue [CVE-2022-4515] in 11.9
security filezilla: Prevent terrapin exploit [CVE-2023-48795] in 11.9
security glib2.0: Align with upstream stable fixes; fix denial of service issues [CVE-2023-32665 CVE-2023-32611 CVE-2023-29499 CVE-2023-32636] in 11.9
security gnutls28: Security fix for timing sidechannel attack [CVE-2023-5981] in 11.9
security imagemagick: Various security fixes [CVE-2021-20241 CVE-2021-20243 CVE-2021-20244 CVE-2021-20245 CVE-2021-20246 CVE-2021-20309 CVE-2021-3574 CVE-2021-39212 CVE-2021-4219 CVE-2022-1114 CVE-2022-28463 CVE-2022-32545 CVE-2022-32546] in 11.9
security jqueryui: Fix cross-site scripting issue [CVE-2022-31160] in 11.9
security libde265: Fix segmentation violation in the function decoder_context::process_slice_segment_header [CVE-2023-27102]; fix heap buffer overflow in the function derive_collocated_motion_vectors [CVE-2023-27103]; fix buffer over-read in pic_parameter_set::dump [CVE-2023-43887]; fix buffer overflow in… in 11.9
security libpod: Fix incorrect handling of supplementary groups [CVE-2022-2989] in 11.9
security libspreadsheet-parsexlsx-perl: Fix possible memory bomb [CVE-2024-22368]; fix XML External Entity issue [CVE-2024-23525] in 11.9
security mariadb-10.5: New upstream stable release; fix denial of service issue [CVE-2023-22084] in 11.9
security minizip: Reject overflows of zip header fields [CVE-2023-45853] in 11.9
security modsecurity-apache: Fix protection bypass issues [CVE-2022-48279 CVE-2023-24021] in 11.9
security node-dottie: Fix prototype pollution issue [CVE-2023-26132] in 11.9
security node-url-parse: Fix authorisation bypass issue [CVE-2022-0512] in 11.9
security node-xml2js: Fix prototype pollution issue [CVE-2023-0842] in 11.9
security nvidia-graphics-drivers: New upstream release [CVE-2023-31022] in 11.9
security nvidia-graphics-drivers-tesla-470: New upstream release [CVE-2023-31022] in 11.9
security opendkim: Properly delete Authentication-Results headers [CVE-2022-48521] in 11.9
security perl: Prevent buffer overflow via illegal Unicode property [CVE-2023-47038] in 11.9
security postfix: New upstream stable release; address SMTP smuggling issue [CVE-2023-51764] in 11.9
security postgresql-13: New upstream stable release; fix SQL injection issue [CVE-2023-39417] in 11.9
security python-websockets: Fix predictable duration issue [CVE-2021-33880] in 11.9
security symfony: Ensure CodeExtension's filters properly escape their input [CVE-2023-46734] in 11.9
security tar: Fix boundary checking in base-256 decoder [CVE-2022-48303], handling of extended header prefixes [CVE-2023-39804] in 11.9
security tinyxml: Fix assertion issue [CVE-2023-34194] in 11.9
security unadf: Fix stack buffer overflow issue [CVE-2016-1243]; fix arbitary code execution issue [CVE-2016-1244] in 11.9
security wolfssl: Fix buffer overflow issues [CVE-2022-39173 CVE-2022-42905], key disclosure issue [CVE-2022-42961], predictable buffer in input keying material [CVE-2023-3724] in 11.9
security xerces-c: Fix use-after-free issue [CVE-2018-1311]; fix integer overflow issue [CVE-2023-37536] in 11.9
security 98 security advisories included: DSA-5394 ffmpeg, DSA-5395 nodejs, DSA-5396 evolution +1, DSA-5397 wpewebkit, DSA-5398 chromium, DSA-5399 odoo, DSA-5400 firefox-esr, DSA-5401 postgresql-13, DSA-5402 linux-signed-amd64 +3, DSA-5403 thunderbird, DSA-5404 chromium, … in 11.8
security amd64-microcode: Update included microcode, including fixes for AMD Inception on AMD Zen4 processors [CVE-2023-20569] in 11.8
security batik: Fix Server Side Request Forgery issues [CVE-2022-44729 CVE-2022-44730] in 11.8
security clamav: New upstream stable release; fix denial of service vulnerability via HFS+ parser [CVE-2023-20197] in 11.8
security cpio: Fix arbitrary code execution issue [CVE-2021-38185]; replace Suggests: on libarchive1 with libarchive-dev in 11.8
security cups: Fix heap-based buffer overflow issues [CVE-2023-4504 CVE-2023-32324], unauthenticated access issue [CVE-2023-32360], use-after-free issue [CVE-2023-34241] in 11.8
security curl: Fix code execution issues [CVE-2023-27533 CVE-2023-27534], information disclosure issues [CVE-2023-27535 CVE-2023-27536 CVE-2023-28322], inappropriate connection re-use issue [CVE-2023-27538], improper certificate validation issue [CVE-2023-28321] in 11.8
security dbus: New upstream stable release; fix denial of service issue [CVE-2023-34969] in 11.8
security ghostscript: Fix buffer overflow issue [CVE-2023-38559]; try and secure the IJS server startup [CVE-2023-43115] in 11.8
security grunt: Fix race condition in symlink copying [CVE-2022-1537] in 11.8
security hnswlib: Fix double free in init_index when the M argument is a large integer [CVE-2023-37365] in 11.8
security horizon: Fix open redirect issue [CVE-2022-45582] in 11.8
security inetutils: Check return values for set*id() functions, avoiding potential security issues [CVE-2023-40303] in 11.8
security krb5: Fix free of uninitialised pointer [CVE-2023-36054] in 11.8
security lemonldap-ng: Fix open redirection when OIDC RP has no redirect URIs; fix Server Side Request Forgery issue [CVE-2023-44469]; fix open redirection due to incorrect escape handling in 11.8
security libapache-mod-jk: Remove implicit mapping functionality, which could lead to unintended exposure of the status worker and/or bypass of security constraints [CVE-2023-41081] in 11.8
security libreswan: Fix denial of service issue [CVE-2023-30570] in 11.8
security libsignal-protocol-c: Fix integer overflow issue [CVE-2022-48468] in 11.8
security lua5.3: Fix use after free in lua_upvaluejoin (lapi.c) [CVE-2019-6706]; fix segmentation fault in getlocal and setlocal (ldebug.c) [CVE-2020-24370] in 11.8
security mariadb-10.5: New upstream bugfix release [CVE-2022-47015] in 11.8
security ncurses: Disallow loading of custom terminfo entries in setuid/setgid programs [CVE-2023-29491] in 11.8
security node-css-what: Fix regular expression-based denial of service issue [CVE-2022-21222 CVE-2021-33587] in 11.8
security node-json5: Fix prototype pollution issue [CVE-2022-46175] in 11.8
security node-tough-cookie: Security fix: prototype pollution [CVE-2023-26136] in 11.8
security nvidia-graphics-drivers: New upstream release [CVE-2023-25515 CVE-2023-25516]; improve compatibility with recent kernels in 11.8
security nvidia-graphics-drivers-tesla-450: New upstream release [CVE-2023-25515 CVE-2023-25516] in 11.8
security nvidia-graphics-drivers-tesla-470: New upstream bugfix release [CVE-2023-25515 CVE-2023-25516] in 11.8
security openssh: Fix remote code execution issue via a forwarded agent socket [CVE-2023-38408] in 11.8
security openssl: New upstream stable release; fix denial of service issues [CVE-2023-3446 CVE-2023-3817] in 11.8
security org-mode: Fix command injection vulnerability [CVE-2023-28617] in 11.8
security pandoc: Fix arbitrary file write issues [CVE-2023-35936 CVE-2023-38745] in 11.8
security pev: Fix buffer overflow issue [CVE-2021-45423] in 11.8
security php-guzzlehttp-psr7: Fix improper input validation [CVE-2023-29197] in 11.8
security php-nyholm-psr7: Fix improper input validation issue [CVE-2023-29197] in 11.8
security protobuf: Security fixes: DoS in Java [CVE-2021-22569]; NULL pointer dereference [CVE-2021-22570]; memory DoS [CVE-2022-1941] in 11.8
security python2.7: Fix parameter cloaking issue [CVE-2021-23336], URL injection issue [CVE-2022-0391], use-after-free issue [CVE-2022-48560], XML External Entity issue [CVE-2022-48565]; improve constant-time comparisons in compare_digest() [CVE-2022-48566]; improve URL parsing [CVE-2023-24329]; prevent… in 11.8
security qemu: Fix infinite loop [CVE-2020-14394], NULL pointer dereference issue [CVE-2021-20196], integer overflow issue [CVE-2021-20203], buffer overflow issues [CVE-2021-3507 CVE-2023-3180], denial of service issues [CVE-2021-3930 CVE-2023-3301], use-after-free issue [CVE-2022-0216], possible stack… in 11.8
security rar: New upstream release; fix directory traversal issue [CVE-2022-30333]; fix arbitrary code execution issue [CVE-2023-40477] in 11.8
security rhonabwy: Fix aesgcm buffer overflow [CVE-2022-32096] in 11.8
security roundcube: New upstream stable release; fix cross-site scripting issue [CVE-2023-43770]; Enigma: Fix initial synchronization of private keys in 11.8
security 99 security advisories included: DSA-5170 nodejs, DSA-5237 firefox-esr, DSA-5238 thunderbird, DSA-5259 firefox-esr, DSA-5262 thunderbird, DSA-5282 firefox-esr, DSA-5284 thunderbird, DSA-5300 pngcheck, DSA-5301 firefox-esr, DSA-5302 chromium, DSA-5303 thunderbird, DSA-5304 xorg-server, … in 11.7
security avahi: Fix local denial of service issue [CVE-2021-3468] in 11.7
security c-ares: Prevent stack overflow and denial of service [CVE-2022-4904] in 11.7
security clamav: New upstream stable release; fix possible remote code execution issue in the HFS+ file parser [CVE-2023-20032], possible information leak in the DMG file parser [CVE-2023-20052] in 11.7
security containerd: Fix denial of service issue [CVE-2023-25153]; fix possible privilege escalation via incorrect setup of supplementary groups [CVE-2023-25173] in 11.7
security crun: Fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27650] in 11.7
security duktape: Fix crash issue [CVE-2021-46322] in 11.7
security erlang: Fix client authentication bypass issue [CVE-2022-37026]; use -O1 optimization for armel because -O2 makes erl segfault on certain platforms, e.g. Marvell in 11.7
security exiv2: Security fixes [CVE-2021-29458 CVE-2021-29463 CVE-2021-29464 CVE-2021-29470 CVE-2021-29473 CVE-2021-29623 CVE-2021-32815 CVE-2021-34334 CVE-2021-34335 CVE-2021-3482 CVE-2021-37615 CVE-2021-37616 CVE-2021-37618 CVE-2021-37619 CVE-2021-37620 CVE-2021-37621 CVE-2021-37622 CVE-2021-37623] in 11.7
security flask-security: Fix open redirect vulnerability [CVE-2021-23385] in 11.7
security flatpak: New upstream stable release; escape special characters when displaying permissions and metadata [CVE-2023-28101]; don't allow copy/paste via the TIOCLINUX ioctl when running in a Linux virtual console [CVE-2023-28100] in 11.7
security golang-github-containers-psgo: Do not enter the process user namespace [CVE-2022-1227] in 11.7
security golang-github-containers-storage: Make previously internal functions publicly accessible, required to allow fixing CVE-2022-1227 in other packages in 11.7
security golang-github-prometheus-exporter-toolkit: Patch tests to avoid race condition; fix authentication cache poisoning issue [CVE-2022-46146] in 11.7
security joblib: Fix arbitrary code execution issue [CVE-2022-21797] in 11.7
security lemonldap-ng: Fix URL validation bypass issue; fix 2FA issue when using AuthBasic handler [CVE-2023-28862] in 11.7
security libapache2-mod-auth-openidc: Fix open redirect issue [CVE-2022-23527] in 11.7
security libapreq2: Fix buffer overflow issue [CVE-2022-22728] in 11.7
security libgit2: Enable SSH key verification by default [CVE-2023-22742] in 11.7
security libpod: Fix privilege escalation issue [CVE-2022-1227]; fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27649]; fix parsing of DBUS_SESSION_BUS_ADDRESS in 11.7
security libreoffice: Change Croatia's default currency to Euro; avoid empty -Djava.class.path= [CVE-2022-38745] in 11.7
security libxpm: Fix infinite loop issues [CVE-2022-44617 CVE-2022-46285]; fix double free issue in error handling code; fix compression commands depend on PATH [CVE-2022-4883] in 11.7
security libzen: Fix null pointer dereference issue [CVE-2020-36646] in 11.7
security lxc: Fix file existence oracle [CVE-2022-47952] in 11.7
security ncurses: Guard against corrupt terminfo data [CVE-2022-29458]; fix tic crash on very long tc/use clauses in 11.7
security node-cookiejar: Guard against maliciously-sized cookies [CVE-2022-25901] in 11.7
security node-webpack: Avoid cross-realm object access [CVE-2023-28154] in 11.7
security nvidia-graphics-drivers: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199] in 11.7
security nvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199] in 11.7
security nvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199] in 11.7
security postgresql-13: New upstream stable release; fix client memory disclosure issue [CVE-2022-41862] in 11.7
security snakeyaml: Fix denial of service issues [CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751]; add documentation regarding security support / issues in 11.7
security symfony: Remove private headers before storing responses with HttpCache [CVE-2022-24894]; remove CSRF tokens from storage on successful login [CVE-2022-24895] in 11.7
security systemd: Fix information leak issue [CVE-2022-4415], denial of service issue [CVE-2022-3821]; ata_id: fix getting Response Code from SCSI Sense Data; logind: fix getting property OnExternalPower via D-Bus; fix crash in systemd-machined in 11.7
security unbound: Fix Non-Responsive Delegation Attack [CVE-2022-3204]; fix ghost domain names issue [CVE-2022-30698 CVE-2022-30699] in 11.7
security w3m: Fix out-of-bounds write issue [CVE-2022-38223] in 11.7
security 72 security advisories included: DSA-5212 chromium, DSA-5223 chromium, DSA-5224 poppler, DSA-5225 chromium, DSA-5226 pcs, DSA-5227 libgoogle-gson-java, DSA-5228 gdk-pixbuf, DSA-5229 freecad, DSA-5230 chromium, DSA-5231 connman, DSA-5232 tinygltf, DSA-5233 e17, DSA-5234 fish, … in 11.6
security awstats: Fix cross site scripting issue [CVE-2022-46391] in 11.6
security clickhouse: Fix out-of-bounds read issues [CVE-2021-42387 CVE-2021-42388], buffer overflow issues [CVE-2021-43304 CVE-2021-43305] in 11.6
security containerd: CRI plugin: Fix goroutine leak during Exec [CVE-2022-23471] in 11.6
security dojo: Fix prototype pollution issue [CVE-2021-23450] in 11.6
security g810-led: Control device access with uaccess instead of making everything world-writable [CVE-2022-46338] in 11.6
security lemonldap-ng: Improve session destroy propagation [CVE-2022-37186] in 11.6
security leptonlib: Fix divide-by-zero [CVE-2022-38266] in 11.6
security libapache2-mod-auth-mellon: Fix open redirect issue [CVE-2021-3639] in 11.6
security libconfuse: Fix a heap-based buffer over-read in cfg_tilde_expand [CVE-2022-40320] in 11.6
security libtasn1-6: Fix out-of-bounds read issue [CVE-2021-46848] in 11.6
security libvncserver: Fix memory leak [CVE-2020-29260]; support larger screen sizes in 11.6
security mariadb-10.5: New upstream stable release; security fixes [CVE-2018-25032 CVE-2021-46669 CVE-2022-27376 CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 CVE-2022-27380 CVE-2022-27381 CVE-2022-27382 CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 CVE-2022-27387 CVE-2022-27444 CVE-2022-27445 CVE-2022-27446… in 11.6
security mod-wsgi: Drop X-Client-IP header when it is not a trusted header [CVE-2022-2255] in 11.6
security mplayer: Fix several security issues [CVE-2022-38850 CVE-2022-38851 CVE-2022-38855 CVE-2022-38858 CVE-2022-38860 CVE-2022-38861 CVE-2022-38863 CVE-2022-38864 CVE-2022-38865 CVE-2022-38866] in 11.6
security node-hawk: Parse URLs using stdlib [CVE-2022-29167] in 11.6
security node-loader-utils: Fix prototype pollution issue [CVE-2022-37599 CVE-2022-37601], regular expression-based denial of service issue [CVE-2022-37603] in 11.6
security node-minimatch: Improve protection against regular expression-based denial of service [CVE-2022-3517]; fix regression in patch for CVE-2022-3517 in 11.6
security node-qs: Fix prototype pollution issue [CVE-2022-24999] in 11.6
security node-xmldom: Fix prototype pollution issue [CVE-2022-37616]; prevent insertion of non-well-formed nodes [CVE-2022-39353] in 11.6
security nvidia-graphics-drivers: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261… in 11.6
security nvidia-graphics-drivers-legacy-390xx: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34680 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259] in 11.6
security nvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261 CVE-2022-42262… in 11.6
security nvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261… in 11.6
security onionshare: Fix denial of service issue [CVE-2022-21689], HTML injection issue [CVE-2022-21690] in 11.6
security powerline-gitstatus: Fix command injection via malicious repository config [CVE-2022-42906] in 11.6
security tinyexr: Fix heap overflow issues [CVE-2022-34300 CVE-2022-38529] in 11.6
security tinyxml: Fix infinite loop [CVE-2021-42260] in 11.6
security virglrenderer: Fix out-of-bounds write issue [CVE-2022-0135] in 11.6
security xfig: Fix buffer overflow issue [CVE-2021-40241] in 11.6
security 46 security advisories included: DSA-5175 thunderbird, DSA-5176 blender, DSA-5177 ldap-account-manager, DSA-5178 intel-microcode, DSA-5179 php7.4, DSA-5180 chromium, DSA-5181 request-tracker4, DSA-5182 webkit2gtk, DSA-5183 wpewebkit, DSA-5184 xen, DSA-5185 mat2, DSA-5187 chromium, … in 11.5
security avahi: Fix display of URLs containing '&' in avahi-discover; do not disable timeout cleanup on watch cleanup; fix NULL pointer crashes when trying to resolve badly-formatted hostnames [CVE-2021-3502] in 11.5
security curl: Reject cookies with control bytes [CVE-2022-35252] in 11.5
security dbus-broker: Fix assertion failure when disconnecting peer groups; fix memory leak; fix null pointer dereference [CVE-2022-31213] in 11.5
security dlt-daemon: Fix double free issue [CVE-2022-31291] in 11.5
security dovecot: Fix possible security issues when two passdb configuration entries exist with the same driver and args settings [CVE-2022-30550] in 11.5
security fig2dev: Fix double free issue [CVE-2021-37529], denial of service issue [CVE-2021-37530]; stop misplacement of embedded eps images in 11.5
security gif2apng: Fix heap-based buffer overflows [CVE-2021-45909 CVE-2021-45910 CVE-2021-45911] in 11.5
security glibc: Fix an off-by-one buffer overflow/underflow in getcwd() [CVE-2021-3999]; fix several overflows in wide character functions; add a few EVEX optimized string functions to fix a performance issue (up to 40%) with Skylake-X processors; make grantpt usable after multi-threaded fork; ensure that… in 11.5
security http-parser: Unset F_CHUNKED on new Transfer-Encoding, fixing possible HTTP request smuggling issue [CVE-2020-8287] in 11.5
security inetutils: Fix buffer overflow issue [CVE-2019-0053], stack exhaustion issue, handling of FTP PASV responses [CVE-2021-40491], denial of service issue [CVE-2022-39028] in 11.5
security libhttp-daemon-perl: Improve handling of Content-Length header [CVE-2022-31081] in 11.5
security libreoffice: Support EUR in .hr locale; add HRKEUR conversion rate to Calc and the Euro Wizard; security fixes [CVE-2021-25636 CVE-2022-26305 CVE-2022-26306 CVE-2022-26307]; fix hang accessing Evolution address books in 11.5
security lwip: Fix buffer overflow issues [CVE-2020-22283 CVE-2020-22284] in 11.5
security node-log4js: Do not create world-readable files by default [CVE-2022-21704] in 11.5
security node-moment: Fix regular expression-based denial of service issue [CVE-2022-31129] in 11.5
security nvidia-graphics-drivers: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615] in 11.5
security nvidia-graphics-drivers-legacy-390xx: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615] in 11.5
security nvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615] in 11.5
security nvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615] in 11.5
security pcre2: Fix out-of-bounds read issues [CVE-2022-1586 CVE-2022-1587] in 11.5
security postgresql-13: Do not let extension scripts replace objects not already belonging to the extension [CVE-2022-2625] in 11.5
security 73 security advisories included: DSA-4999 asterisk, DSA-5026 firefox-esr, DSA-5034 thunderbird, DSA-5044 firefox-esr, DSA-5045 thunderbird, DSA-5069 firefox-esr, DSA-5074 thunderbird, DSA-5086 thunderbird, DSA-5090 firefox-esr, DSA-5094 thunderbird, DSA-5097 firefox-esr, … in 11.4
security apache2: New upstream stable release; fix HTTP request smuggling issue [CVE-2022-26377], out-of-bounds read issues [CVE-2022-28330 CVE-2022-28614 CVE-2022-28615], denial of service issues [CVE-2022-29404 CVE-2022-30522], possible out-of-bounds read issue [CVE-2022-30556], possible IP-based… in 11.4
security clamav: New upstream stable release; security fixes [CVE-2022-20770 CVE-2022-20771 CVE-2022-20785 CVE-2022-20792 CVE-2022-20796] in 11.4
security composer: Fix code injection issue [CVE-2022-24828]; update GitHub token pattern in 11.4
security dbus-broker: Fix buffer overflow issue [CVE-2022-31212] in 11.4
security freetype: Fix buffer overflow issue [CVE-2022-27404]; fix crashes [CVE-2022-27405 CVE-2022-27406] in 11.4
security fribidi: Fix buffer overflow issues [CVE-2022-25308 CVE-2022-25309]; fix crash [CVE-2022-25310] in 11.4
security gnutls28: Fix SSSE3 SHA384 miscalculation; fix null pointer deference issue [CVE-2021-4209] in 11.4
security golang-github-russellhaering-goxmldsig: Fix null pointer dereference caused by crafted XML signatures [CVE-2020-7711] in 11.4
security grunt: Fix path traversal issue [CVE-2022-0436] in 11.4
security htmldoc: Fix infinite loop [CVE-2022-24191], integer overflow issues [CVE-2022-27114] and heap buffer overflow issue [CVE-2022-28085] in 11.4
security knot-resolver: Fix possible assertion failure in NSEC3 edge-case [CVE-2021-40083] in 11.4
security libapache2-mod-auth-openidc: New upstream stable release; fix open redirect issue [CVE-2021-39191]; fix crash on reload / restart in 11.4
security libsdl2: Avoid out-of-bounds read while loading malformed BMP file [CVE-2021-33657], and during YUV to RGB conversion in 11.4
security logrotate: Skip locking if state file is world-readable [CVE-2022-1348]; make configuration parsing stricter in order to avoid parsing foreign files such as core dumps in 11.4
security minidlna: Validate HTTP requests to protect against DNS rebinding attacks [CVE-2022-26505] in 11.4
security mutt: Fix uudecode buffer overflow issue [CVE-2022-1328] in 11.4
security nginx: Fix crash when libnginx-mod-http-lua is loaded and init_worker_by_lua* is used; mitigate application layer protocol content confusion attack in the Mail module [CVE-2021-3618] in 11.4
security node-ejs: Fix server-side template injection issue [CVE-2022-29078] in 11.4
security node-eventsource: Strip sensitive headers on redirect to different origin [CVE-2022-1650] in 11.4
security node-got: Don't allow redirection to Unix socket [CVE-2022-33987] in 11.4
security node-mermaid: Fix cross-site scripting issues [CVE-2021-23648 CVE-2021-43861] in 11.4
security node-minimist: Fix prototype pollution issue [CVE-2021-44906] in 11.4
security node-moment: Fix path traversal issue [CVE-2022-24785] in 11.4
security node-node-forge: Fix signature verification issues [CVE-2022-24771 CVE-2022-24772 CVE-2022-24773] in 11.4
security node-sqlite3: Fix denial of service issue [CVE-2022-21227] in 11.4
security node-url-parse: Fix authentication bypass issues [CVE-2022-0686 CVE-2022-0691] in 11.4
security nvidia-graphics-drivers: New upstream release; switch to upstream 470 tree; fix denial of service issues [CVE-2022-21813 CVE-2022-21814]; fix out-of-bounds write issue [CVE-2022-28181], out-of-bounds read issue [CVE-2022-28183], denial of service issues [CVE-2022-28184 CVE-2022-28191 CVE-2022-28192] in 11.4
security nvidia-graphics-drivers-legacy-390xx: New upstream release; fix out-of-bound write issues [CVE-2022-28181 CVE-2022-28185] in 11.4
security nvidia-graphics-drivers-tesla-450: New upstream stable release; fix out-of-bounds write issues [CVE-2022-28181 CVE-2022-28185], denial of service issue [CVE-2022-28192] in 11.4
security nvidia-graphics-drivers-tesla-470: New package, switching Tesla support to upstream 470 tree; fix out-of-bounds write issue [CVE-2022-28181], out-of-bounds read issue [CVE-2022-28183], denial of service issues [CVE-2022-28184 CVE-2022-28191 CVE-2022-28192] in 11.4
security php-guzzlehttp-psr7: Fix improper header parsing [CVE-2022-24775] in 11.4
security python-scrapy: Don't send authentication data with all requests [CVE-2021-41125]; don't expose cookies cross-domain when redirecting [CVE-2022-0577] in 11.4
security runc: Honour seccomp defaultErrnoRet; do not set inheritable capabilities [CVE-2022-29162] in 11.4
security samba: Fix winbind start failure when allow trusted domains = no is used; fix MIT Kerberos authentication; fix share escape issue via mkdir race condition [CVE-2021-43566]; fix possible serious data corruption issue due to Windows client cache poisoning; fix installation on non-systemd systems in 11.4
security twisted: Fix information disclosure issue with cross-domain redirects [CVE-2022-21712], denial of service issue during SSH handshakes [CVE-2022-21716], HTTP request smuggling issues [CVE-2022-24801] in 11.4
security unrar-nonfree: Fix directory traversal issue [CVE-2022-30333] in 11.4
security 73 security advisories included: DSA-5000 openjdk-11, DSA-5001 redis, DSA-5012 openjdk-17, DSA-5021 mediawiki, DSA-5023 modsecurity-apache, DSA-5024 apache-log4j2, DSA-5025 tang, DSA-5027 xorg-server, DSA-5028 spip, DSA-5029 sogo, DSA-5030 webkit2gtk, DSA-5031 wpewebkit, … in 11.3
security apache-log4j1.2: Resolve security issues [CVE-2021-4104 CVE-2022-23302 CVE-2022-23305 CVE-2022-23307], by removing support for the JMSSink, JDBCAppender, JMSAppender and Apache Chainsaw modules in 11.3
security apache-log4j2: Fix remote code execution issue [CVE-2021-44832] in 11.3
security apache2: New upstream release; fix crash due to random memory read [CVE-2022-22719]; fix HTTP request smuggling issue [CVE-2022-22720]; fix out-of-bounds write issues [CVE-2022-22721 CVE-2022-23943] in 11.3
security atftp: Fix information leak issue [CVE-2021-46671] in 11.3
security clamav: New upstream stable release; fix denial of service issue [CVE-2022-20698] in 11.3
security dask.distributed: Fix undesired listening of workers on public interfaces [CVE-2021-42343]; fix compatibility with Python 3.9 in 11.3
security e2guardian: Fix missing SSL certificate validation issue [CVE-2021-44273] in 11.3
security flac: Fix out-of-bounds write issue [CVE-2021-0561] in 11.3
security glibc: Fix bad conversion from ISO-2022-JP-3 with iconv [CVE-2021-43396]; fix buffer overflow issues [CVE-2022-23218 CVE-2022-23219]; fix use-after-free issue [CVE-2021-33574]; stop replacing older versions of /etc/nsswitch.conf; simplify the check for supported kernel versions, as 2.x kernels are… in 11.3
security gnuplot: Fix division by zero [CVE-2021-44917] in 11.3
security golang-1.15: Fix IsOnCurve for big.Int values that are not valid coordinates [CVE-2022-23806]; math/big: prevent large memory consumption in Rat.SetString [CVE-2022-23772]; cmd/go: prevent branches from materializing into versions [CVE-2022-23773]; fix stack exhaustion compiling deeply nested… in 11.3
security htmldoc: Fix out-of-bounds read issue [CVE-2022-0534] in 11.3
security intel-microcode: Update included microcode; mitigate some security issues [CVE-2020-8694 CVE-2020-8695 CVE-2021-0127 CVE-2021-0145 CVE-2021-0146 CVE-2021-33120] in 11.3
security lemonldap-ng: Fix auth process in password-testing plugins [CVE-2021-40874] in 11.3
security libarchive: Fix extracting hardlinks to symlinks; fix handling of symlink ACLs [CVE-2021-23177]; never follow symlinks when setting file flags [CVE-2021-31566] in 11.3
security libxml2: Fix use-after-free issue [CVE-2022-23308] in 11.3
security mariadb-10.5: New upstream release; security fixes [CVE-2021-35604 CVE-2021-46659 CVE-2021-46661 CVE-2021-46662 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46667 CVE-2021-46668 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052] in 11.3
security mujs: Fix buffer overflow issue [CVE-2021-45005] in 11.3
security node-cached-path-relative: Fix prototype pollution issue [CVE-2021-23518] in 11.3
security node-fetch: Don't forward secure headers to third party domains [CVE-2022-0235] in 11.3
security node-follow-redirects: Don't send Cookie header across domains [CVE-2022-0155]; don't send confidential headers across schemes [CVE-2022-0536] in 11.3
security node-markdown-it: Fix regular expression-based denial of service issue [CVE-2022-21670] in 11.3
security node-nth-check: Fix regular expression-based denial of service issue [CVE-2021-3803] in 11.3
security node-prismjs: Escape markup in command line output [CVE-2022-23647]; update minified files to ensure that Regular Expression Denial of Service issue is resolved [CVE-2021-3801] in 11.3
security node-trim-newlines: Fix regular expression-based denial of service issue [CVE-2021-33623] in 11.3
security nvidia-graphics-drivers-tesla-450: New upstream release; fix denial of service issues [CVE-2022-21813 CVE-2022-21814]; nvidia-kernel-support: Provide /etc/modprobe.d/nvidia-options.conf as a template in 11.3
security openvswitch: Fix use-after-free issue [CVE-2021-36980]; fix installation of libofproto in 11.3
security php-crypt-gpg: Prevent additional options being passed to GPG [CVE-2022-24953] in 11.3
security php-laravel-framework: Fix cross-site scripting issue [CVE-2021-43808], missing blocking of executable content upload [CVE-2021-43617] in 11.3
security phpliteadmin: Fix cross-site scripting issue [CVE-2021-46709] in 11.3
security python-django: Fix denial of service issue [CVE-2021-45115], information disclosure issue [CVE-2021-45116], directory traversal issue [CVE-2021-45452]; fix a traceback around the handling of RequestSite/get_current_site() due to a circular import in 11.3
security symfony: Fix CVE injection issue [CVE-2021-41270] in 11.3
security systemd: Fix uncontrolled recursion in systemd-tmpfiles [CVE-2021-3997]; demote systemd-timesyncd from Depends to Recommends, removing a dependency cycle; fix failure to bind mount a directory into a container using machinectl; fix regression in udev resulting in long delays when processing… in 11.3
security weechat: Fix denial of service issue [CVE-2021-40516] in 11.3
security wolfssl: Fix several issues related to OCSP-handling [CVE-2021-3336 CVE-2021-37155 CVE-2021-38597] and TLS1.3 support [CVE-2021-44718 CVE-2022-25638 CVE-2022-25640] in 11.3
security xterm: Fix buffer overflow issue [CVE-2022-24130] in 11.3
security zziplib: Fix denial of service issue [CVE-2020-18442] in 11.3
security 29 security advisories included: DSA-4980 qemu, DSA-4981 firefox-esr, DSA-4982 apache2, DSA-4983 neutron, DSA-4984 flatpak, DSA-4985 wordpress, DSA-4986 tomcat9, DSA-4987 squashfs-tools, DSA-4988 libreoffice, DSA-4989 strongswan, DSA-4992 php7.4, DSA-4994 bind9, DSA-4995 webkit2gtk, … in 11.2
security btrbk: Fix regression in the update for CVE-2021-38173 in 11.2
security containerd: New upstream stable release; handle ambiguous OCI manifest parsing [CVE-2021-41190]; support clone3 in default seccomp profile in 11.2
security datatables.js: Fix insufficient escaping of arrays passed to the HTML escape entities function [CVE-2021-23445] in 11.2
security docker.io: Fix possible change of host file system permissions [CVE-2021-41089]; lock down file permissions in /var/lib/docker [CVE-2021-41091]; prevent credentials being sent to the default registry [CVE-2021-41092]; add support for clone3 syscall in default seccomp policy in 11.2
security edk2: Address Boot Guard TOCTOU vulnerability [CVE-2019-11098] in 11.2
security gerbv: Fix out-of-bounds write issue [CVE-2021-40391] in 11.2
security gmp: Fix integer and buffer overflow issue [CVE-2021-43618] in 11.2
security golang-1.15: New upstream stable release; fix net/http: panic due to racy read of persistConn after handler panic [CVE-2021-36221]; fix archive/zip: overflow in preallocation check can cause OOM panic [CVE-2021-39293]; fix buffer over-run issue [CVE-2021-38297], out of bounds read issue… in 11.2
security htmldoc: Fix buffer overflow issues [CVE-2021-40985 CVE-2021-43579] in 11.2
security isync: Fix multiple buffer overflow issues [CVE-2021-3657] in 11.2
security jqueryui: Fix untrusted code execution issues [CVE-2021-41182 CVE-2021-41183 CVE-2021-41184] in 11.2
security keepalived: Fix overly broad DBus policy [CVE-2021-44225] in 11.2
security keystone: Resolve information leak allowing determination of whether users exist [CVE-2021-38155]; apply some performance improvements to the default keystone-uwsgi.ini in 11.2
security kodi: Fix buffer overflow in PLS playlists [CVE-2021-42917] in 11.2
security lldpd: Fix heap overflow issue [CVE-2021-43612]; do not set VLAN tag if client did not set it in 11.2
security node-getobject: Resolve prototype pollution issue [CVE-2020-28282] in 11.2
security node-json-schema: Resolve prototype pollution issue [CVE-2021-3918] in 11.2
security plib: Fix integer overflow issue [CVE-2021-38714] in 11.2
security privoxy: Fix memory leaks [CVE-2021-44540 CVE-2021-44541 CVE-2021-44542]; fix cross-site scripting issue [CVE-2021-44543] in 11.2
security python-django: New upstream security release: fix potential bypass of an upstream access control based on URL paths [CVE-2021-44420] in 11.2
security ros-ros-comm: Fix denial of service issue [CVE-2021-37146] in 11.2
security udisks2: Mount options: Always use errors=remount-ro for ext filesystems [CVE-2021-3802]; use the mkfs command to format exfat partitions; add Recommends exfatprogs as preferred alternative in 11.2
security vim: Fix heap overflows [CVE-2021-3770 CVE-2021-3778], use after free issue [CVE-2021-3796]; remove vim-gtk alternatives during vim-gtk -> vim-gtk3 transition, easing upgrades from buster in 11.2
security 32 security advisories included: DSA-4959 thunderbird, DSA-4960 haproxy, DSA-4961 tor, DSA-4962 ledgersmb, DSA-4963 openssl, DSA-4964 grilo, DSA-4965 libssh, DSA-4966 gpac, DSA-4967 squashfs-tools, DSA-4968 haproxy, DSA-4969 firefox-esr, DSA-4970 postorius, DSA-4971 ntfs-3g, … in 11.1
security atftp: Fix buffer overflow [CVE-2021-41054] in 11.1
security cyrus-imapd: Fix denial-of-service issue [CVE-2021-33582] in 11.1
security glewlwyd: Fix possible buffer overflow during FIDO2 signature validation in webauthn registration [CVE-2021-40818] in 11.1
security krb5: Fix KDC null dereference crash on FAST request with no server field [CVE-2021-37750]; fix memory leak in krb5_gss_inquire_cred in 11.1
security libslirp: Fix multiple buffer overflow issues [CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595] in 11.1
security linux: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300] in 11.1
security linux-signed-amd64: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300] in 11.1
security linux-signed-arm64: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300] in 11.1
security linux-signed-i386: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300] in 11.1
security mariadb-10.5: New upstream stable release; security fixes [CVE-2021-2372 CVE-2021-2389] in 11.1
security modsecurity-crs: Fix request body bypass issue [CVE-2021-35368] in 11.1
security node-ansi-regex: Fix regular expression-based denial of service issue [CVE-2021-3807] in 11.1
security node-axios: Fix regular expression-based denial of service issue [CVE-2021-3749] in 11.1
security node-object-path: Fix prototype pollution issues [CVE-2021-23434 CVE-2021-3805] in 11.1
security node-prismjs: Fix regular expression-based denial of service issue [CVE-2021-3801] in 11.1
security node-set-value: Fix prototype pollution [CVE-2021-23440] in 11.1
security node-tar: Remove non-directory paths from the directory cache [CVE-2021-32803]; strip absolute paths more comprehensively [CVE-2021-32804] in 11.1
security postgresql-13: New upstream stable release; fix mis-planning of repeated application of a projection step [CVE-2021-3677]; disallow SSL renegotiation more completely in 11.1
security request-tracker4: Fix login timing side-channel attack issue [CVE-2021-38562] in 11.1
security sabnzbdplus: Prevent directory escape in renamer function [CVE-2021-29488] in 11.1
security shiro: Fix authentication bypass issues [CVE-2020-1957 CVE-2020-11989 CVE-2020-13933 CVE-2020-17510]; update Spring Framework compatibility patch; support Guice 4 in 11.1
security ublock-origin: New upstream stable release; fix denial of service issue [CVE-2021-36773] in 11.1
security ulfius: Ensure memory is initialised before use [CVE-2021-40540] in 11.1

Every release in between

13.7 Sep 12, 2026 Release notes ↗

security92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, …

securityalsa-lib: Fix heap overflow issue [CVE-2026-25068]

securityansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332]

securitybettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default

securitybinwalk: Fix path traversal issue [CVE-2026-7179]

securitycyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088]

securitydcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868]

securitydhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258]

securitydnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969]

securityflask: Ensure Vary: Cookie is set on session access [CVE-2026-27205]

securityfluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714]

securityglib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue…

securityglibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers

securitygoaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777]

securitygpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122]

securitygzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992]

securityimagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871…

securityincus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501]

securitylibhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017]

securitylibio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962]

securitylibmongocrypt: Fix missing input validation issue [CVE-2026-81523]

securitylibnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942]

securitylibnfs: Fix integer overflow [CVE-2026-53689]

securitylibraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660]

securitylibsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness

securitylibsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness

securitylibsocket-perl: Fix out of bounds read issue [CVE-2026-12087]

securitylibssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034]

securitylibvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623]

securitylibwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161]

securitylwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836]

securitymbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow…

securitymongo-c-driver: Fix missing input validation issue [CVE-2026-81524]

securitymrtg: Fix privilege escalation issue [CVE-2026-72694]

securitynode-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800]

securityonionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706]

securityopencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253]

securitypatool: Fix path traversal vulnerability [CVE-2026-29509]

securityperl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix…

securityphp-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766]

+67 more items in the release notes

13.6 Jul 11, 2026 Release notes ↗

security109 security advisories included: DSA-6250 chromium, DSA-6256 php8.4, DSA-6266 nghttp2, DSA-6267 thunderbird, DSA-6268 ffmpeg, DSA-6270 postgresql-17, DSA-6271 gsasl, DSA-6273 chromium, DSA-6274 linux-signed-amd64 +2, DSA-6277 openjpeg2, DSA-6278 nginx, DSA-6279 redis, DSA-6280 netatalk, …

securityapache2: Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of service issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues…

securitybeets: Fix XSS vulnerability [CVE-2026-42052]

securitycalibre: Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader-background endpoint path…

securityckermit: Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check

securitycomposer: Fix support for new GitHub token format [CVE-2026-45793]

securitycurl: Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use-after-free and…

securitydcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805]

securitydebusine: Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853]

securitydeepdiff: Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155]

securitydhcpcd: Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117]

securitydolphin: Fix sandbox escape issue [CVE-2026-41525]

securityerrands: Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063]

securitygdown: Fix arbitray file write issue [CVE-2026-40491]

securitygiflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740]

securitygimp: Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915]

securitygraphite2: Fix out-of-bounds write [CVE-2026-50593]

securityironic: Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths;…

securityisc-kea: Fix denial of service issue [CVE-2026-3608]

securitykeystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551]

securitylibapache-session-browseable-perl: Improve entropy source [CVE-2026-8503]

securitylibbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625]

securitylibcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046]

securitylibcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240]

securitylibcrypt-urandom-perl: Fix buffer overflow issue [CVE-2026-2474]

securitylibhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829]

securitylibnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191]

securitylibslirp: Fix memory disclosure issue [CVE-2026-9539]

securitylibtasn1-6: Fix buffer overflow issue [CVE-2025-13151]

securitylibvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538]

securitylibxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177]

securitylibxml2: Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation…

securitylibxpm: Fix out of bounds read issue [CVE-2026-4367]

securitylxml-html-clean: Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350]

securitymesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393]

securityminiupnpd: Fix integer underflow issue [CVE-2026-5720]

securitymodsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268]

securitymutt: Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864]

securitymxml: Fix out-of-bounds read [CVE-2026-5037]

securitynbconvert: Fix arbitrary file read/write issues [CVE-2026-39377 CVE-2026-39378]

+85 more items in the release notes

13.5 May 16, 2026 Release notes ↗

security96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, …

security389-ds-base: Fix heap overflow issue [CVE-2025-14905]

securityapache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue…

securityawstats: Prevent command injection [CVE-2025-63261]

securityblack: Fix arbitrary file write issue [CVE-2026-32274]

securitybubblewrap: Fix privilege escalation issue [CVE-2026-41163]

securitycalibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824]

securitycimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146]

securitycockpit: Fix code execution issue [CVE-2026-4631]

securitycomposer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176]

securitycurl: Fix server certificate verification issue [CVE-2025-13034]

securitydovecot: Fix memory leak in CVE-2026-27857 fix

securityerlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943]

securityexim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687]

securityfirewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948]

securityfreerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680…

securitygit-lfs: Fix arbitrary file write issue [CVE-2025-26625]

securityglance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure

securityglib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode…

securityglibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;…

securitygvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296]

securityharfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693]

securityjpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures

securityjq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164]

securitykissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445]

securitylibarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121]

securitylibcap2: Fix time of check / time of use issue [CVE-2026-4878]

securitylibcdio: Fix buffer overflow issue [CVE-2024-36600]

securitylibcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468]

securitylibcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564]

securitylibexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385]

securitylibnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199]

securitylibtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111]

securitylibvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854]

securitylibxml-security-java: Fix private key disclosure issue [CVE-2023-44483]

securitylxc: Fix authorisation bypass issue [CVE-2026-39402]

securitymapserver: Fix buffer overflow issue [CVE-2026-33721]

securitymodsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691]

securitymongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files

securitymusl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200]

+105 more items in the release notes

13.4 Mar 14, 2026 Release notes ↗

security62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …

fixakonadi: Show all folders in kmail

fixapache2: Fix HTTP/2 regression

securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]

fixasahi-scripts: Fix SD card reader autosuspend

securityaugeas: Fix null pointer dereference issue [CVE-2025-2588]

fixbase-files: Update for the point release

fixbash: Rebuild with updated glibc

securitycapstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114]

securitycivetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763]

securitydirewolf: Fix stack buffer overflow [CVE-2025-34457]

securitydpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219]

securityerlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107]

securityfluidsynth: Fix null pointer dereference issue [CVE-2025-56225]

securityfonttools: Fix arbitrary file write issue [CVE-2025-66034]

securityglibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the…

securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269]

securityjaraco.context: Prevent path traversal [CVE-2026-23949]

securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]

securitylibsndfile: Fix memory leak issue [CVE-2025-56226]

securitymariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support

securitynode-proxy-agents: Fix path traversal issue [CVE-2026-27699]

securityopenssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985]

securitypcsx2: Fix code execution issue [CVE-2025-49589]

securityphpunit: Fix unsafe deserialization issue [CVE-2026-24765]

securitypostgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006]

securitypython-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007]

securitypython-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146]

securitypython-multipart: Fix arbitrary file write issue [CVE-2026-24486]

securityqemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665]

securityrequests: Fix credential leak issue [CVE-2024-47081]

securityrust-ntp-proto: Fix excessive load issue [CVE-2026-26076]

securityrust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076

securitysqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf

securitystarlette: Fix denial of service issue [CVE-2025-62727]

securitysuricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264]

securitywget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195]

securitywireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203]

securityxen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553]

securityzabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643]

+72 more items in the release notes

13.3 Jan 10, 2026 Release notes ↗

security36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, …

fixansible: New upstream stable release

securityapache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200]

fixat-spi2-core: Ensure xkb group is taken into account for key events

fixawffull: Fix systemd timer invocation to avoid premature cron-script exit

fixbase-files: Update for the point release

fixbash: Rebuild with updated glibc

fixbglibs: Rebuild with updated glibc

fixbusybox: Rebuild with updated glibc

securitycalibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486]

fixcatatonit: Rebuild with updated glibc

fixcdebootstrap: Rebuild with updated glibc

fixchkrootkit: Rebuild with updated glibc

fixcloud-init: Ensure deb822 sources.list template renders correctly

securitycomposer: Fix ANSI sequence injection [CVE-2025-67746]

securitycups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524]

securityedk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770]

securityfreedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462]

securityglib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]

securitygnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc

securitygnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback

securityimagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]

securitylibcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499]

securitylibcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]

securitylibphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119]

securitylibvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the…

securitylxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507]

securitymbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438]

securitymongo-c-driver: Avoid invalid memory reads [CVE-2025-12119]

securitynode-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033]

securitypgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]

securitypostgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]

securityqemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464]

securityr-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation

securityrlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]

securityrsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]

securityrust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897]

securitysogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]

securitysuricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344]

securitysymfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries

+69 more items in the release notes

13.2 Nov 15, 2025 Release notes ↗

security52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, …

security7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001]

fix7zip-rar: Add missing CRC table constructor

fixaide: Fix bin/buildcache use by running it from a root timer; various updates and fixes to included rules

fixallow-html-temp: New upstream version to support newer Thunderbird releases

fixalsa-ucm-conf-asahi: Install missing aop_audio UCM configs

fixansible: Update collections to maintain compatibility with ansible-core 2.19

fixansible-core: New upstream stable release; fix regression from 2.18 regarding handlers and play tags

fixasahi-scripts: Fix the macaudio default profile check; add the apple_nvmem_spmi module to the initramfs explicitly; make update-m1n1 idempotent

fixbase-files: Update for the point release

fixbrltty: atSpi2: do not manage widgets without text interface; avoid excessive verbose bluetooth/usbfs messages

fixconsole-setup: Update keyboard layouts dz(la) into dz(azerty-oss) and Use ca/multix variant instead of ca/multi; fix dz(azerty-oss/deadkeys) into dz, which is what xkb really provides; fix dz default layout

fixcups: Fix operation of checkboxes in admin interface

securitycurl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563]

fixdebian-edu-config: Use SERVER_ADDRESS in RewriteRule instead of hard-coded 'www'; drop desktop bundle from bundlesequence

securitydnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187]

securityimagemagick: Fix integer overflow issue [CVE-2025-62171]

securitylemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication

securitylibcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibhtp: Prevent memory leak with lzma [CVE-2025-53537]

securitylibsmb2: Fix buffer overflow issue [CVE-2025-57632]

securitylibssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277]

securitylibwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678]

securitylibxml2: Fix XPath recursion depth DoS [CVE-2025-9714]

securitylibyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683]

securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]

securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]

securitymapserver: Fix SQL injection issue [CVE-2025-59431]

securitymodsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571]

securitynvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345]

securityopen-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244]

securityphpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573]

securitypoppler: Fix infinite recursion [CVE-2025-50420]

securitypython-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068]

securityqemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls

securityrabbitmq-server: Fix logging on sensitive data [CVE-2025-50200]

securitysail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510]

securitysamba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230]

securitysuricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147]

+84 more items in the release notes

13.1 Sep 6, 2025 Release notes ↗

security14 security advisories included: DSA-5975 linux-signed-amd64 +2, DSA-5976 chromium, DSA-5977 aide, DSA-5978 webkit2gtk, DSA-5979 libxslt, DSA-5980 firefox-esr, DSA-5981 chromium, DSA-5983 qemu, DSA-5984 thunderbird, DSA-5986 node-cipher-base, DSA-5988 chromium, DSA-5989 udisks2, …

fixauto-apt-proxy: Check explicitly configured proxies before network gateway

fixbase-files: Update for the point release

fixcourier: Fix courier-webmin

fixdebian-installer: Increase Linux kernel ABI to 6.12.43+deb13; rebuild against proposed-updates; add a workaround for a GRUB graphics initialisation bug

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdesktop-base: Fix placement of plymouth prompts in multi-monitor setups

fixdevscripts: Update suite and codename mappings

fixdpdk: New upstream point release

fixethtool: netlink: fix print_string when the value is NULL

securityfirebird3.0: Fix null pointer dereference in XDR message parsing [CVE-2025-54989]

fixflvstreamer: Stop installing rtmpsrv and rtmpsuck, avoiding file conflict with the rtmpdump package

fixgalera-4: New upstream stable release

securitygit: New upstream bug-fix release; fix arbitrary file write issues [CVE-2025-27613 CVE-2025-46835]; fix code execution issues [CVE-2025-27614 CVE-2025-48384]; fix protocol injection issue, possibly leading to arbitrary code execution [CVE-2025-48385]

fixglib2.0: New upstream bugfix release; fix a corner case when upgrading from bookworm

fixgnome-control-center: Fix a UI issue and an error display issue; translation updates

fixgnome-online-accounts: New upstream bug-fix release; update translations

fixgnome-shell: New upstream bugfix release

securitygolang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211]

fixgssdp: New upstream bug-fix release; fix issues with Since: and Deprecated: declarations in documentation

securityimagemagick: Security fixes: heap buffer overflow in the InterpretImageFilename function [CVE-2025-53014]; infinite loop when writing during a specific XMP file conversion command [CVE-2025-53015]; memory leak in the magick stream command [CVE-2025-53019]; stack overflow through vsnprintf()…

fixinit-system-helpers: Fix handling of os-release diversions from live-build, ensuring they don't exist in non-live systems

fixinstallation-guide: Enable Hungarian and Ukrainian translations; fix boot-dev-select-arm64 and armhf-armmp-supported-platforms hyperlinks

securityiperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350]

fixkamailio: Relax OpenSSL version check to only match against major version

fixlibadwaita-1: New upstream bugfix release

securitylibcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927]

securitylibcoap3: Fix buffer overflow issue [CVE-2024-0962]; fix integer overflow issue [CVE-2024-31031]

fixlibreoffice: Add EUR support for Bulgaria; fix installation of Impress sound effects; fix playing of videos in Impress under Qt6

fixlibrepo: New upstream bug-fix release, fixing support for DNF5; improve handling of SELinux in the Debian packaging

fixlinux: New upstream stable release

fixlinux-signed-amd64: New upstream stable release

securitymozjs128: New upstream stable release; fix uninitialised memory issue [CVE-2025-9181], memory safety issues [CVE-2025-9185]

securitynginx: Fix potential information leak in ngx_mail_smtp_module [CVE-2025-53859]

securitynode-tmp: Fix arbitrary file write issue [CVE-2025-54798]

securityopenjpeg2: Fix out-of-bounds write issue [CVE-2025-54874]

securitypcre2: New upstream stable release; fix potential information disclosure issue [CVE-2025-58050]

securitypostgresql-17: New upstream stable release; tighten security checks in planner estimation functions [CVE-2025-8713]; prevent pg_dump scripts from being used to attack the user running the restore [CVE-2025-8714]; convert newlines to spaces in names included in comments in pg_dump output…

securityshaarli: Fix cross site scripting issue [CVE-2025-55291]

securitywolfssl: Avoid weak and predictable random numbers [CVE-2025-7394]

+32 more items in the release notes

12.15 Jul 11, 2026 Release notes ↗

security84 security advisories included: DLA-4627 kernel-wedge, DLA-4628 linux-base, DLA-4632 atril, DLA-4633 libreoffice, DLA-4635 firefox-esr, DLA-4636 thunderbird, DLA-4637 libconfig-inifiles-perl, DLA-4638 libgd-perl, DLA-4639 libhttp-daemon-perl, DLA-4642 u-boot, DLA-4643 imagemagick, …

security7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104]

securityapache2: Fix HTTP/2 request DoS and file handle exhaustion [CVE-2026-49975 CVE-2026-48913]; fix proxy, DAV, LDAP, SSL, XML and header memory/crash issues [CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44185]; fix proxy FTP directory listing XSS…

securitybeets: Fix XSS vulnerability [CVE-2026-42052]; fix build-time test failures

securitycalibre: Fix various potential security issues; read resources only from book contents [CVE-2026-33206]; keep extracted files within container dir [CVE-2026-30853]; prevent reading background images from outside the config dir [CVE-2026-33205]

securitycomposer: Fix support for new GitHub token format [CVE-2026-45793]

securitycurl: Fix cache poisoning issue [CVE-2025-10148]; fix data leak issues [CVE-2025-14524 CVE-2026-3783]; fix incorrect connection re-use issues [CVE-2025-14819 CVE-2026-3784 CVE-2026-5773 CVE-2026-7168]

securitydhcpcd5: Fix NULL pointer dereference issue [CVE-2025-70102]; fix out-of-bounds write issue [CVE-2026-56114]

securityfirewalld: Fix DBUS policy checking [CVE-2026-4948]

securitygiflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740]

securitygraphite2: Fix out-of-bounds write [CVE-2026-50593]

securityironic: Fix file disclosure via image sources [CVE-2025-44021]; fix console command injection [CVE-2026-42510]; fix Swift token disclosure [CVE-2026-42997]; fix unsafe template execution [CVE-2026-44916]

securitykeystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551]

securitylibbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625]

securitylibcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046]

securitylibhtml-gumbo-perl: Fix uninitialized memory access [CVE-2025-15646]

securitylibhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829]

securitylibnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191]

securitylibvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538]

securitylibxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177]

securitylibxml2: Fix catalogue recursion and duplicate-catalog handling [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; limit RelaxNG include recursion [CVE-2026-0989]; fix xmllint shell memory leak [CVE-2026-1757]; correct schematron regression-test outputs [CVE-2025-49794 CVE-2025-49796]; fix XML writer…

securitymariadb: New upstream stable release; fix code execution issues [CVE-2025-13699 CVE-2026-44168 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261]; fix denial of service issues [CVE-2026-21968 CVE-2026-34303]; fix logging bypass issue [CVE-2026-3494]; fix path traversal issue [CVE-2026-44171]; fix SQL…

securitymesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393]

securitymodsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268]

securitymxml: Fix out-of-bounds read [CVE-2026-5037]

securitynode-flatted: Fix prototype pollution issue [CVE-2026-33228]

securityopenslide: Fix possible code execution issue [CVE-2026-48977]

securityp7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104]

securityphp-guzzlehttp-psr7: Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers

securityphpunit: Fix unsafe deserialization in PHPT code coverage handling [CVE-2026-24765]

securityprotobuf: Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409]

securitypydantic: Fix denial of service in email verification [CVE-2024-3772]

securitypymatgen: Fix denial of service in GaussianInput.from_string [CVE-2022-42964]

securitypython-filelock: Fix symlink vulnerabilies [CVE-2025-68146 CVE-2026-22701]

securitypython-markdown: Fix parsing of bogus HTML markup [CVE-2025-69534]

securitypython-pyramid: Fix information disclosure issue [CVE-2023-40587]

securitypython-xmltodict: Fix XML injection issue [CVE-2025-9375]

securitypython3.11: Prevent incorrect tar archive handling [CVE-2025-13462]; ensure bytecode-only imports use normal security checks [CVE-2026-2297]; reject unsafe cookie values [CVE-2026-3644]; prevent XML parser crashes [CVE-2026-4224]; prevent browser command injection [CVE-2026-4519]; prevent bz2/lzma…

+49 more items in the release notes

12.14 May 16, 2026 Release notes ↗

security131 security advisories included: DSA-6003 firefox-esr, DSA-6025 firefox-esr, DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …

security7zip: New upstream stable release; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links…

securityapache2: New upstream release: fix http2 regression; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue…

securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]

securityaugeas: Fix NULL pointer dereference issue [CVE-2025-2588]

securityawstats: Prevent command injection [CVE-2025-63261]

securitybusybox: Fix stack overflow [CVE-2022-48174] and use-after-free [CVE-2023-42363 CVE-2023-42364 CVE-2023-42365] errors

securityc3p0: Fix recursive entity expansion issue [CVE-2019-5427]

securitycomposer: Fix code execution issue [CVE-2023-43655]; fix command injection issues [CVE-2026-40261 CVE-2026-40176]

securitycontainerd: Fix CRI Attach implementation [CVE-2025-64329]; fix overly broad directory permissions [CVE-2024-25621]; fix large UID:GID (> 32bit) overflow [CVE-2024-40635]

securitydovecot: Correct incomplete backport of CVE-2026-27855 fix; fix memory leak in CVE-2026-27857 fix

securitydpkg: New upstream stable release; fix insufficient permissions check leading to possible denial of service issue [CVE-2025-6297]; fix denial of service issue [CVE-2026-2219]; fix buffer over-read issue; fix uninitialized variable warning with Rules-Requires-Root; fix segmentation fault in…

securityerlang: Fix denial of service issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix HTTP request smuggling issue [CVE-2026-23941]; fix path traversal issues [CVE-2026-23942 CVE-2026-21620]; fix compression bomb issue [CVE-2026-23943]

securityfonttools: Fix XML External Entity injection issue [CVE-2023-45139]; fix code execution issue [CVE-2025-66034]

securityglance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure

securityglibc: Fix integer overflow issue [CVE-2026-0861]; fix uninitialised memory use issue [CVE-2025-15281]; fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix performance bottleneck with ASAN on…

securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix integer underflow issue [CVE-2025-67269]

securitygrub-efi-amd64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…

securitygrub-efi-arm64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…

securitygrub-efi-ia32-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…

securitygrub2: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix commands/extcmd:…

securitygvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296]

securitykissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445]

securitylibarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121]

securitylibcap2: Fix time of check / time of use issue [CVE-2026-4878]; rebuild with updated glibc

securitylibexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385]

securitylibnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199]

securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]

securitylibreoffice: Fix incomplete fix for CVE-2024-12426

securitylibuev: Fix buffer overrun issue [CVE-2022-48620]

securitylibvncserver: Fix out-of-bounds read issue [CVE-2026-32853]; fix null pointer dereference issue [CVE-2026-32854]

securitylibxml-security-java: Fix private key disclosure issue [CVE-2023-44483]

securitylxc: Fix authorisation bypass issue [CVE-2026-39402]

securitymapserver: Fix SQL injection issue [CVE-2025-59431]; fix buffer overflow issue [CVE-2026-33721]; fix heap-buffer-overflow and double-free issues in maplexer

securitymodsecurity-crs: Fix rule bypass issue [CVE-2023-38199]; fix file extension blocking bypass issue [CVE-2026-33691]

securitynginx: Fix buffer overflow issues [CVE-2026-27654 CVE-2026-27784 CVE-2026-32647]; fix session authentication issues [CVE-2026-27651 CVE-2026-28753]; fix OCSP result bypass issue [CVE-2026-28755]; use $host instead of $http_host

+60 more items in the release notes

12.13 Jan 10, 2026 Release notes ↗

security77 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, DSA-6003 firefox-esr, DSA-6004 chromium, …

securityangular.js: Fix regular expression-based denial of service issues [CVE-2022-25844 CVE-2023-26116 CVE-2023-26117 CVE-2023-26118]; fix restriction bypass issues [CVE-2024-8372 CVE-2024-8373]; fix denial of service issue [CVE-2024-21490]; fix improper sanitization issues [CVE-2025-0716 CVE-2025-2336]

securitycalibre: Fix code execution issue [CVE-2025-64486]

securitycomposer: Fix ANSI sequence injection [CVE-2025-67746]

securityfreerdp2: New upstream release; fix multiple memory-safety vulnerabilities: integer overflow/underflow and out-of-bounds write in NSC, Clear, and GDI bitmap codecs [CVE-2024-22211 CVE-2024-32037 CVE-2024-32038 CVE-2024-32039 CVE-2024-32040]; out-of-bounds reads in ZGFX, Planar, NCRUSH,…

securitygdk-pixbuf: Fix buffer overflow issue [CVE-2025-7345]

securitygit: Fix arbitrary file creation/truncation in gitk [CVE-2025-27613]; prevent arbitrary file overwrite in git-gui with crafted directory names [CVE-2025-46835]; correct submodule path parsing with trailing CR [CVE-2025-48384]; validate bundle-uri to prevent protocol injection during clone…

securityglib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]

securityimagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-62171 CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]

securitylemonldap-ng: Fix sessions tablename when not default; fix oidc flow when user encountered an error on server side; fix Kerberos JavaScript when used with Choice; improve CORS checking; fix path_info handling; fix shell injection issue [CVE-2025-59518]; hide session id from Ajax responses

securitylibcommons-lang-java: Fix uncontrolled recursion issue [CVE-2025-48924]

securitylibcommons-lang3-java: Fix uncontrolled recursion issue [CVE-2025-48924]

securitylibhtp: Fix denial of service issue via unbounded HTTP header processing [CVE-2024-23837 CVE-2024-45797]

securitylibnginx-mod-http-lua: Fix HTTP HEAD request smuggling [CVE-2024-33452]

securitylibphp-adodb: Fix SQL injection in sqlite and sqlite3 metadata lookups [CVE-2025-54119]

securitylibssh: Fix integer overflow issue [CVE-2025-4877]; fix use of uninitialized variable [CVE-2025-4878]; fix out of bounds memory access issue [CVE-2025-5318]; fix double free issue [CVE-2025-5351]; fix use of uninitialized memory [CVE-2025-5372 CVE-2025-5987]; fix null pointer dereference issue…

securitylibxml2: Fix denial of service issue [CVE-2025-9714]

securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]

securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]

securitymodsecurity-apache: Fix request body error handling to propagate Apache filter/read failures correctly [CVE-2025-54571]; map request body read failures to appropriate HTTP status codes; simplify request body error propagation in mod_security2

securitymongo-c-driver: Avoid invalid memory reads [CVE-2025-12119]

securitymydumper: Fix arbitrary file read issue [CVE-2025-30224]

securitynvidia-graphics-drivers: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]

securitynvidia-open-gpu-kernel-modules: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]

securityopen-vm-tools: Disable SDMP service version collection by default to mitigate local privilege escalation [CVE-2025-41244]

securityopenrefine: Fix MySQL host parameter injection in JDBC URL parsing [CVE-2024-23833]; fix reflected XSS in gdata OAuth callback handler [CVE-2024-47878]; fix content-type confusion XSS in ExportRows endpoint [CVE-2024-47880]; prevent remote or extension loading via SQLite connection URL…

securitypam: Fix local privilege escalation in pam_namespace [CVE-2025-6020]

securitypgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]; fix expired password use issue [CVE-2025-2291]

securitypostgresql-15: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]

securityqemu: New upstream stable release; fix qemu-img info https://example.com; fix migration of guests using virtio-net; fix use after free issue [CVE-2025-11234]

securityr-cran-gh: Fix sensitive data leak issue [CVE-2025-54956]

securityrear: Prevent created initrd from being world-readable when GRUB_RESCUE=y [CVE-2024-23301]

securityrlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]

securityrsync: Improve test coverage for future updates; fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]

securityruby-sinatra: Fix regular expression-based denial of service issue [CVE-2025-61921]

securitysamba: Fix information leak issue [CVE-2018-14628]; fix command injection issue [CVE-2025-10230]; fix uninitialized memory disclosure issue [CVE-2025-9640]

securitysogo: Fix HTML injection issue [CVE-2023-48104]; fix CSS injection issue [CVE-2024-24510]; fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]; fix crash on invalid mailIdentities

+57 more items in the release notes

12.12 Sep 6, 2025 Release notes ↗

security75 security advisories included: DSA-5914 chromium, DSA-5916 chromium, DSA-5918 varnish, DSA-5919 open-vm-tools, DSA-5920 chromium, DSA-5921 thunderbird, DSA-5922 firefox-esr, DSA-5923 net-tools, DSA-5924 intel-microcode, DSA-5925 linux-signed-amd64 +3, DSA-5926 firefox-esr, …

securityamd64-microcode: Update AMD-SEV firmware [CVE-2024-56161]; update included microcode

securityapache2: New upstream stable release; fix HTTP response splitting issue [CVE-2024-42516]; fix server-side request forgery issue [CVE-2024-43204 CVE-2024-43394]; fix log injection issue [CVE-2024-47252]; fix access control bypass issue [CVE-2025-23048]; fix denial of service issue [CVE-2025-49630];…

securitybotan: Fix denial of service issues [CVE-2024-34702 CVE-2024-34703]; fix improper parsing of name constraints [CVE-2024-39312]; fix compiler-induced secret-dependent operation issue [CVE-2024-50383]

securitycjson: Fix denial of service issue [CVE-2023-26819]; fix buffer overflow issue [CVE-2023-53154]

securityclamav: New upstream stable release; fix buffer overflow issues [CVE-2025-20128 CVE-2025-20260]

securitycloud-init: Make hotplug socket writable only by root [CVE-2024-11584]; don't attempt to identify non-x86 OpenStack instances [CVE-2024-6174]

securitycommons-beanutils: Fix improper access control issue [CVE-2025-48734]

securitycommons-vfs: Fix path traversal issue [CVE-2025-27553]

securitycorosync: Fix buffer overflow vulnerability on large UDP packets [CVE-2025-30472]

securitydjvulibre: Fix denial of service issues [CVE-2021-46310 CVE-2021-46312]

securitydropbear: Fix shell injection vulnerability in multihop handling [CVE-2025-47203]

securityerlang: ssh: fix strict KEX hardening [CVE-2025-46712]; zip: sanitize pathnames when extracting files with absolute pathnames [CVE-2025-4748]; fix documentation build failure with newer xsltproc versions

securityexpat: Fix denial of service issues [CVE-2023-52425 CVE-2024-8176]; fix parser crash [CVE-2024-50602]

securityfig2dev: Detect nan in spline control values [CVE-2025-46397]; permit \0 in 2nd line in fig file [CVE-2025-46398]; ge output: correct spline computation [CVE-2025-46399]; reject arcs with a radius smaller than 3 [CVE-2025-46400]

securityfirebird3.0: Fix NULL pointer dereference issue [CVE-2025-54989]

securityfort-validator: Fix denial of service issues [CVE-2024-45234 CVE-2024-45235 CVE-2024-45236 CVE-2024-45238 CVE-2024-45239 CVE-2024-48943]; fix buffer overflow issue [CVE-2024-45237]

securityglib2.0: Fix buffer underflow issue [CVE-2025-4373 CVE-2025-7039]; improve upgrade safety

securityglibc: Fix incorrect LD_LIBRARY_PATH search in dlopen for static setuid binaries [CVE-2025-4802]; improve memory layout of structures in exp/exp10/expf functions; add an SVE implementation of memset on aarch64; improve generic implementation of memset on aarch64; fix double free issue…

securitygolang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211]

securitygst-plugins-base1.0: Fix buffer overrun issue [CVE-2025-47806]; fix NULL pointer dereference issues [CVE-2025-47807 CVE-2025-47808]

securitygst-plugins-good1.0: Fix possible information disclosure issue [CVE-2025-47219]

securityiperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350]

securityjinja2: Fix arbitrary code execution issue [CVE-2025-27516]

securityjq: Zero-terminate string in jv.c [CVE-2025-48060]

securitykmail-account-wizard: Fix man in the middle attack issue [CVE-2024-50624]

securitykrb5: Fix message tampering issue [CVE-2025-3576]; disable issuance of tickets using RC4 or triple-DES session keys by default

securitykubernetes: Sanitise raw data output to terminal [CVE-2021-25743]; hide long and multi-line strings when printing

securitylibarchive: Fix integer overflow issues [CVE-2025-5914 CVE-2025-5916], buffer over read issue [CVE-2025-5915], buffer overlow issue [CVE-2025-5917]

securitylibcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927]

securitylibfcgi: Fix integer overflow issue [CVE-2025-23016]

securitylibphp-adodb: Fix SQL injection vulnerability in pg_insert_id() [CVE-2025-46337]

securitylibraw: Fix out-of-bounds read issues [CVE-2025-43961 CVE-2025-43962 CVE-2025-43963]; enforce minimum w0 and w1 values [CVE-2025-43964]

securitylibsndfile: Fix integer overflow issues [CVE-2022-33065]; fix out of bounds read issue [CVE-2024-50612]

securitylibsoup3: New upstream bug-fix release; fix buffer overrun issue [CVE-2024-52531]; fix denial of service issues [CVE-2024-52532 CVE-2025-32051]; fix heap overflow issues [CVE-2025-32052 CVE-2025-32053]; fix integer overflow issue [CVE-2025-32050]; fix heap buffer overflow issues [CVE-2025-2784];…

securitylibtpms: Fix out of bounds read issue [CVE-2025-49133]

securitylibxml2: Fix integer overflow issue in xmlBuildQName [CVE-2025-6021]; fix potential buffer overflows in the interactive shell [CVE-2025-6170]; fix use-after-free issue in xmlSchematronReportOutput [CVE-2025-49794]; fix type confusion issue in xmlSchematronReportOutput [CVE-2025-49796]

securitylibyaml-libyaml-perl: Fix arbitrary file edit issue [CVE-2025-40908]

securityluajit: Fix buffer overflow issue [CVE-2024-25176]; fix denial of service issue [CVE-2024-25177]; fix out-of-bounds read issue [CVE-2024-25178]

securitymariadb: New upstream stable release; security fixes [CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-30693 CVE-2025-30722]; fix restart after out of memory; new upstream stable release; fix variable name in debian-start.sh

+96 more items in the release notes

12.11 May 17, 2025 Release notes ↗

security39 security advisories included: DSA-5877 chromium, DSA-5878 php8.2, DSA-5879 opensaml, DSA-5880 freetype, DSA-5881 rails, DSA-5882 chromium, DSA-5883 mercurial, DSA-5884 libxslt, DSA-5885 webkit2gtk, DSA-5886 ruby-rack, DSA-5887 exim4, DSA-5888 ghostscript, DSA-5889 firefox-esr, …

securityabseil: Fix heap buffer overflow issue [CVE-2025-0838]; fix build failure on ppc64el

fixadonthell: Fix compatibility with SWIG 4.1

fixbase-files: Update for the point release

fixbash: Rebuild for outdated Built-Using (glibc/2.36-9+deb12u5)

fixbusybox: Rebuild for outdated Built-Using (glibc/2.36-9)

securityfig2dev: Reject huge pattern lengths [CVE-2025-31162]; reject arcs with co-incident points [CVE-2025-31163]; allow an arc-box with zero radius [CVE-2025-31164]

securityfossil: Fix interaction with an Apache HTTP server including the fix for CVE-2024-24795

securitygcc-12: Fix -fstack-protector handling of overflows on AArch64 [CVE-2023-4039]

securityglib2.0: Fix integer overflow in g_date_time_new_from_iso8601() [CVE-2025-3360]

securityhaproxy: Fix heap buffer overflow issue [CVE-2025-32464]

securityimagemagick: Fix MIFF image depth mishandled after SetQuantumFormat [CVE-2025-43965]

securitykrb5: Fix memory leak in ndr.c [CVE-2024-26462]; prevent buffer overflow when calculating ulog buffer size [CVE-2025-24528]

securitylibbson-xs-perl: Fix security issues in embedded copy of libbson: denial of service [CVE-2017-14227]; buffer over-read [CVE-2018-16790]; infinite loop [CVE-2023-0437]; memory corruption [CVE-2024-6381]; buffer overflows [CVE-2024-6383 CVE-2025-0755]

securitylibcap2: Fix incorrect recognition of group names [CVE-2025-1390]

securitylibdata-entropy-perl: Seed entropy pool with urandom by default [CVE-2025-1860]

securitylibsub-handlesvia-perl: Fix arbitrary code execution issue [CVE-2025-30673]

securitymongo-c-driver: Fix infinite loop issue [CVE-2023-0437]; fix integer overflow issue [CVE-2024-6381]; fix buffer overflow issues [CVE-2024-6383 CVE-2025-0755]

securitynetwork-manager: Fix crash dereferencing NULL pointer during debug logging [CVE-2024-6501]

securitynginx: Fix buffer underread and unordered chunk vulnerabilities in mp4 [CVE-2024-7347]

securitynode-send: Fix cross-site scripting issue [CVE-2024-43799]

securitynode-serialize-javascript: Fix cross-site scripting issue [CVE-2024-11831]

securitynvidia-graphics-drivers: New upstream stable release; remove ppc64el support (migrated to src:nvidia-graphics-drivers-tesla-535); fix build issues with newer kernel versions; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244]

securitynvidia-open-gpu-kernel-modules: New upstream stable release; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244]

securityopenrazer: Fix out of bounds read issue [CVE-2025-32776]

securityopenssh: Fix the DisableForwarding directive [CVE-2025-32728]

securityopenssl: New upstream stable release; fix timing side channel issue [CVE-2024-13176]

securityopenvpn: Avoid possible ASSERT() on OpenVPN servers using --tls-crypt-v2 [CVE-2025-2704]; prevent malicious peer DoS or log-flooding [CVE-2024-5594]; refuse multiple exit notifications from authenticated clients [CVE-2024-28882]; update expired certificates in build tests

securityphpmyadmin: Fix XSS vulnerabilities [CVE-2025-24529 CVE-2025-24530]

securitypoppler: Fix crash on malformed files [CVE-2023-34872]; fix out-of-bounds read issues [CVE-2024-56378 CVE-2025-32365]; fix floating point exception issue [CVE-2025-32364]

securitypostgresql-15: New upstream stable release; fix buffer over-read issue [CVE-2025-4207]

securitypython-h11: Fix request smuggling issue [CVE-2025-43859]

securitypython3.11: Fix misparsing issues [CVE-2025-0938 CVE-2025-1795]

securityqtbase-opensource-src: Delay HTTP2 communication until encrypted() can be responded to [CVE-2024-39936]; fix crash with null checks in table iface methods

securityredis: Fix denial of service issue [CVE-2025-21605]

securityshadow: Fix password leak issue [CVE-2023-4641]; fix chfn control character injection issue [CVE-2023-29383]

securitytwitter-bootstrap3: Fix cross-site scripting issues [CVE-2024-6485 CVE-2024-6484]

securitytwitter-bootstrap4: Fix cross-site scripting issue [CVE-2024-6531]

securityvarnish: Prevent HTTP/1 client-side desync [CVE-2025-30346]

securityxmedcon: Fix buffer overflow [CVE-2025-2581]

+42 more items in the release notes

12.10 Mar 15, 2025 Release notes ↗

security40 security advisories included: DSA-5834 chromium, DSA-5836 xen, DSA-5839 firefox-esr, DSA-5840 chromium, DSA-5841 thunderbird, DSA-5842 openafs, DSA-5843 rsync, DSA-5844 chromium, DSA-5845 tomcat10, DSA-5846 libreoffice, DSA-5847 snapcast, DSA-5848 chromium, DSA-5849 git-lfs, …

security389-ds-base: Fix crash when modifying userPassword using malformed input [CVE-2024-2199 CVE-2024-8445]; prevent denial of service while attempting to log in with a user with a malformed hash in their password [CVE-2024-5953]; prevent denial of service on the directory server with specially-crafted…

fixbase-files: Update for the point release

fixbup: New upstream bugfix release

fixcontainerd: Fix tests causing FTBFS on the auto-builder network

securitycurl: Fix unintended HTTPS upgrades or premature reversion to HTTP when both subdomains and parent domains are used [CVE-2024-9681]; prevent stopping of stunnel before retries in the built-time tests; fix possible credentials leakage issues [CVE-2024-11053 CVE-2025-0167]; fix test failures due to…

fixdacite: Do not cache result of get_default_value_for_field

securitydcmtk: Fix issue when rendering an invalid monochrome DICOM image [CVE-2024-47796]; ensure: HighBit < BitsAllocated [CVE-2024-52333]; fix possible overflows when allocating memory [CVE-2024-27628]; fix two segmentation faults [CVE-2024-34508 CVE-2024-34509]; fix arbitrary code execution issue…

fixdebian-installer: Increase Linux kernel ABI to 6.1.0-32; rebuild against proposed-updates

fixdebian-ports-archive-keyring: Add 2026 key; move 2023 and 2024 keys to the removed keyring

fixdgit: Add missing parameters for source upload target

securitydjoser: Fix authentication bypass [CVE-2024-21543]

fixdns-root-data: Add the DNSKEY record for KSK-2024

securityedk2: Fix overflow condition in PeCoffLoaderRelocateImage() [CVE-2024-38796]; fix potential UINT32 overflow in S3 ResumeCount [CVE-2024-1298]

fixelpa: Fix tests on machines with 2 vCPU or fewer

securityflightgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781]

fixgensim: Fix build failure on single-CPU machines

securityglibc: Fix buffer overflow when printing assertion failure message [CVE-2025-0395]; fix memset performance for unaligned destinations; fix TLS performance degradation after dlopen() usage; avoid integer truncation when parsing CPUID data with large cache sizes; ensure data passed to the rseq…

fixgolang-github-containers-buildah: Disable a test known to fail on the auto-builder network, fixing build failure

securityintel-microcode: New upstream security release [CVE-2023-34440 CVE-2023-43758 CVE-2024-24582 CVE-2024-28047 CVE-2024-28127 CVE-2024-29214 CVE-2024-31068 CVE-2024-31157 CVE-2024-36293 CVE-2024-37020 CVE-2024-39279 CVE-2024-39355]

securityjinja2: Fix arbitrary code execution issues [CVE-2024-56201 CVE-2024-56326]

securitylemonldap-ng: Fix CSRF vulnerability on 2FA registration interface [CVE-2024-52948]

securitylibapache-mod-jk: Set correct default permissions for shared memory [CVE-2024-46544]

securitylibeconf: Fix buffer overflow vulnerability [CVE-2023-32181 CVE-2023-22652]

securitylibrabbitmq: Add option to read username/password from file [CVE-2023-35789]

securitylibtar: Fix out-of-bounds read in gnu_longlink() [CVE-2021-33643]; fix out-of-bounds read in gnu_longname() [CVE-2021-33644]; fix memory leak in th_read() [CVE-2021-33645]; fix memory leak in th_read() [CVE-2021-33646]

securitymariadb: New upstream stable release; fix security issue [CVE-2024-21096]; fix denial of service issue [CVE-2025-21490]

securitymonero: Impose response limits on HTTP server connections [CVE-2025-26819]

securitynginx: Fix possible bypass of client certificate authentication [CVE-2025-23419]

securitynode-axios: Fix CSRF vulnerability [CVE-2023-45857]; fix potential vulnerability in URL when determining an origin [CVE-2024-57965]

securitynode-postcss: Fix mishandling of non-integer values leading to denial of service in nanoid [CVE-2024-55565]; fix parsing of external untrusted CSS [CVE-2023-44270]

securityphp-nesbot-carbon: Fix arbitrary file include issue [CVE-2025-22145]

securitypostgresql-15: New upstream stable release; harden PQescapeString and allied functions against invalidly-encoded strings; improve behavior of libpq's quoting functions [CVE-2025-1094]

securitypuma: Fix behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers [CVE-2023-40175]; limit size of chunk extensions [CVE-2024-21647]; prevent manipulation of headers set by intermediate proxies [CVE-2024-45614]

securitypython-django: Fix regular expression-based denial of service issue [CVE-2023-36053], denial of service issues [CVE-2024-38875 CVE-2024-39614 CVE-2024-41990 CVE-2024-41991], user enumeration issue [CVE-2024-39329], directory traversal issue [CVE-2024-39330], excessive memory consumption issue…

securitysimgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781]

securitysssd: Apply GPO policy consistently [CVE-2023-3758]

securitysubversion: Fix vulnerable parsing of control characters in paths served by mod_dav_svn [CVE-2024-46901]

securityvim: Fix crash when expanding ~ in substitute [CVE-2023-2610]; fix buffer-overflow in vim_regsub_both() [CVE-2023-4738]; fix heap use after free in ins_compl_get_exp() [CVE-2023-4752]; fix heap-buffer-overflow in vim_regsub_both [CVE-2023-4781]; fix buffer-overflow in trunc_string()…

securitywget: Fix mishandling of semicolons in userinfo in URLs [CVE-2024-38428]

+27 more items in the release notes

12.9 Jan 11, 2025 Release notes ↗

security35 security advisories included: DSA-5801 firefox-esr, DSA-5803 thunderbird, DSA-5804 webkit2gtk, DSA-5805 guix, DSA-5806 libarchive, DSA-5807 nss, DSA-5808 ghostscript, DSA-5809 symfony, DSA-5810 chromium, DSA-5811 mpg123, DSA-5812 postgresql-15, DSA-5813 symfony, DSA-5814 thunderbird, …

fixallow-html-temp: Update for Thunderbird 128 compatibility

securityansible-core: New upstream stable release; fix arbitrary code execution issue [CVE-2024-11079]; fix information disclosure issue [CVE-2024-8775]; fix file overwrite issue [CVE-2024-9902]; fix test failure

securityaudiofile: Fix null pointer dereference issue [CVE-2019-13147]; fix information leak issue [CVE-2022-24599]

securityavahi: Fix denial of service issues [CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473]; fix browsing when invalid services are present

securitydnsmasq: Fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; set default maximum EDNS.0 UDP packet size to 1232 [CVE-2023-28450]

securityglib2.0: Fix buffer overflow when configured to use a SOCKS4a proxy with a very long username [CVE-2024-52533]

securitygnuchess: Fix arbitrary code execution issue [CVE-2021-30184]

securitygsl: Fix buffer overflow calculating the quantile value [CVE-2020-35357]

securitygst-plugins-base1.0: Don't try parsing extended header if not enough data is available (id3v2) [CVE-2024-47542]

securitygunicorn: Prevent HTTP request smuggling [CVE-2024-1135]

securityicinga2: Prevent TLS certificate bypass [CVE-2024-49369]

securityintel-microcode: New upstream security release [CVE-2024-21853 CVE-2024-23918 CVE-2024-24968 CVE-2024-23984]

securityjinja2: Prevent HTML attribute injection [CVE-2024-22195 CVE-2024-34064]

securitylemonldap-ng: Fix privilege escalation when adaptive auth levels used [CVE-2024-52946]; fix XSS in upgrade plugin [CVE-2024-52947]

securitylibebml: Fix buffer overflow issue [CVE-2023-52339]

securitylibpgjava: Fix SQL injection issue [CVE-2024-1597]

securitylibsoup2.4: Prevent HTTP request smuggling [CVE-2024-52530]; fix buffer overflow in soup_header_parse_param_list_strict [CVE-2024-52531]; fix DoS reading from WebSocket clients [CVE-2024-52532]

securitylibxstream-java: Fix denial of service issue [CVE-2024-47072]

securitynvidia-graphics-drivers: New upstream stable release [CVE-2024-0126]

securitynvidia-open-gpu-kernel-modules: New upstream LTS release [CVE-2024-0126]

securityopensc: Fix data leak issue [CVE-2023-5992]; fix use-after-free issue [CVE-2024-1454]; fix missing initialisation issue [CVE-2024-45615]; fix various issues with APDU buffer handling [CVE-2024-45616]; fix missing or incorrect function return value checks [CVE-2024-45617 CVE-2024-45618]; fix…

securitypoco: Fix integer overflow issue [CVE-2023-52389]

securitypypy3: Fix email address parsing issue [CVE-2023-27043]; fix possible Server Side Request Forgery issue [CVE-2024-11168]; fix private IP address range parsing [CVE-2024-4032]; fix regular expression based Denial of Service issue [CVE-2024-6232]; fix header injection issue [CVE-2024-6923]; fix…

securitypython-asyncssh: Fix rogue extension negotiation issue [CVE-2023-46445]; fix rogue session attack issue [CVE-2023-46446]

securitypython-tornado: Fix open redirect issue [CVE-2023-28370]; fix denial of service issue [CVE-2024-52804]

securitypython-urllib3: Fix possible information leak during cross-origin redirects [CVE-2023-43804]; fix request body not stripped after redirect from 303 status changes request method to GET [CVE-2023-45803]; fix Proxy-Authorization request header isn't stripped during cross-origin redirects…

securitypython-werkzeug: Fix denial of service when file upload begins with CR or LF [CVE-2023-46136]; fix arbitrary code execution on developer's machine via the debugger [CVE-2024-34069]; fix denial of service when processing multipart/form-data requests [CVE-2024-49767]

securitypython3.11: Reject malformed addresses in email.parseaddr() [CVE-2023-27043]; encode newlines in headers in the email module [CVE-2024-6923]; fix quadratic complexity parsing cookies with backslashes [CVE-2024-7592]; fix venv activation scripts failure to quote paths [CVE-2024-9287]; fix improper…

securityqemu: New upstream bugfix release [CVE-2024-7409]; mark internal codegen helper symbols as hidden, fixing build failure on arm64

securityredis: Fix denial of service with malformed ACL selectors [CVE-2024-31227]; fix denial of service through unbound pattern matching [CVE-2024-31228]; fix stack overflow [CVE-202431449]

securityrenderdoc: Fix integer overflows [CVE-2023-33863 CVE-2023-33864]; fix symlink attack vector [CVE-2023-33865]

securityruby-doorkeeper: Prevent skipping of authorization steps [CVE-2023-34246]

securitysetuptools: Fix remote code execution issue [CVE-2024-6345]

securitysqlparse: Fix regular expression-related denial of service issue [CVE-2023-30608]; fix denial of service issue [CVE-2024-4340]

securitytexlive-bin: Fix data loss when using discretionaries with priorities; fix heap buffer overflow [CVE-2024-25262]

securitytiff: Fix buffer overflow issues [CVE-2023-25433 CVE-2023-26966]; fix use-after-free issue [CVE-2023-26965]; fix null pointer dereference issue [CVE-2023-2908]; fix denial of service issues [CVE-2023-3618 CVE-2023-52356 CVE-2024-7006]

securityutil-linux: Fix wider mitigation for CVE-2024-28085

securityzfs-linux: Add missing symbols in libzfs4linux and libzpool5linux; fix dnode dirty test [CVE-2023-49298]; fix sharenfs IPv6 address parsing [CVE-2013-20001]; fixes related to NULL pointer, memory allocation, etc.

securityzookeeper: Fix information disclosure in persistent watchers handling [CVE-2024-23944]

+33 more items in the release notes

12.8 Nov 9, 2024 Release notes ↗

security47 security advisories included: DSA-5729 apache2, DSA-5733 thunderbird, DSA-5744 thunderbird, DSA-5758 trafficserver, DSA-5759 python3.11, DSA-5760 ghostscript, DSA-5761 chromium, DSA-5762 webkit2gtk, DSA-5763 pymatgen, DSA-5764 openssl, DSA-5765 firefox-esr, DSA-5766 chromium, …

security7zip: Fix heap buffer overflow in NTFS handler [CVE-2023-52168]; fix out-of-bounds read in NTFS handler [CVE-2023-52169]

securityamanda: Update incomplete fix for CVE-2022-37704, restoring operation with xfsdump

securityapr: Use 0600 perms for named shared mem consistently [CVE-2023-49582]

fixbase-files: Update for the point release

fixbtrfs-progs: Fix checksum calculation errors during volume conversion in btrfs-convert

fixcalamares-settings-debian: Fix missing launcher on KDE desktops; fix btrfs mounts

securitycjson: Fix segmentation violation issue [CVE-2024-31755]

securityclamav: New upstream stable release; fix denial of service issue [CVE-2024-20505], file corruption issue [CVE-2024-20506]

fixcloud-init: Add support for multiple networkd Route sections

fixcloud-initramfs-tools: Add missing dependencies in the initramfs

securitycurl: Fix incorrect handling of some OCSP responses [CVE-2024-8096]

fixdebian-installer: Reinstate some armel netboot targets (openrd); increase Linux kernel ABI to 6.1.0-27; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdevscripts: bts: always upgrade to STARTTLS on 587/tcp; build-rdeps: add support for non-free-firmware; chdist: update sources.list examples with non-free-firmware; build-rdeps: use all available distros by default

fixdiffoscope: Fix build failure when processing a deliberately overlapping zip file in tests

fixdistro-info-data: Add Ubuntu 25.04

securitydocker.io: Fix bypassing of AuthZ plugins in some circumstances [CVE-2024-41110]

fixdpdk: New upstream stable release

fixexim4: Fix crash in dbmnz when looking up keys with no content

fixfcgiwrap: Set proper ownership on repositories in git backend

fixgalera-4: New upstream stable release

fixglib2.0: Provide libgio-2.0-dev from libglib2.0-dev, and libgio-2.0-dev-bin from libglib2.0-dev-bin

fixglibc: Change Croatian locale to use Euro as currency; revert upstream commit that modified the GLIBC_PRIVATE ABI, causing crashes with some static binaries on arm64; vfscanf(): fix matches longer than INT_MAX; ungetc(): fix uninitialized read when putting into unused streams, backup buffer leak…

fixgtk+3.0: Fix letting Orca announce initial focus

fixikiwiki-hosting: Allow reading of all user repositories

securityintel-microcode: New upstream release; security fixes [CVE-2024-23984 CVE-2024-24968]

fixipmitool: Fix a buffer overrun in open interface; fix lan print fails on unsupported parameters; fix reading of temperature sensors; fix using hex values when sending raw data

fixiputils: Fix incorrect handling of ICMP responses intended for other processes

fixkexec-tools: Mask kexec.service to prevent the init.d script handling kexec process on a systemd enabled system

securitylemonldap-ng: Fix cross-site scripting vulnerability on login page [CVE-2024-48933]

securitynghttp2: Fix denial of service issue [CVE-2024-28182]

securitynode-dompurify: Fix prototype pollution issues [CVE-2024-45801 CVE-2024-48910]

securityopenssl: New upstream stable release; fix buffer overread issue [CVE-2024-5535], out of bounds memory access [CVE-2024-9143]

securitypuredata: Fix privilege escalation issue [CVE-2023-47480]

securitypython-cryptography: Fix NULL dereference when loading PKCS7 certificates [CVE-2023-49083]; fix NULL dereference when PKCS#12 key and cert don't match [CVE-2024-26130]

securitysqlite3: Fix a buffer overread issue [CVE-2023-7104], a stack overflow issue and an integer overflow issue

securitytgt: chap: Use proper entropy source [CVE-2024-45751]

securitywireshark: New upstream security release [CVE-2024-0208, CVE-2024-0209, CVE-2024-2955, CVE-2024-4853, CVE-2024-4854, CVE-2024-4855, CVE-2024-8250, CVE-2024-8645]

securityxfpt: Fix buffer overflow issue [CVE-2024-43700]

+29 more items in the release notes

12.7 Aug 31, 2024 Release notes ↗

security51 security advisories included: DSA-5617 chromium, DSA-5629 chromium, DSA-5634 chromium, DSA-5636 chromium, DSA-5639 chromium, DSA-5648 chromium, DSA-5654 chromium, DSA-5656 chromium, DSA-5668 chromium, DSA-5675 chromium, DSA-5676 chromium, DSA-5683 chromium, DSA-5687 chromium, …

securityamd64-microcode: New upstream release; security fixes [CVE-2023-31315]; SEV firmware fixes [CVE-2023-20584 CVE-2023-31356]

securityansible: New upstream stable release; fix key leakage issue [CVE-2023-4237]

securityansible-core: New upstream stable release; fix information disclosure issue [CVE-2024-0690]; fix template injection issue [CVE-2023-5764]; fix path traversal issue [CVE-2023-5115]

securityapache2: New upstream stable release; fix content disclosure issue [CVE-2024-40725]

fixbase-files: Update for the point release

securitycacti: Fix remote code execution issues [CVE-2024-25641 CVE-2024-31459], cross site scripting issues [CVE-2024-29894 CVE-2024-31443 CVE-2024-31444], SQL injection issues [CVE-2024-31445 CVE-2024-31458 CVE-2024-31460], type juggling issue [CVE-2024-34340]; fix autopkgtest failure

fixcalamares-settings-debian: Fix Xfce launcher permission issue

securitycalibre: Fix remote code execution issue [CVE-2024-6782, cross site scripting issue [CVE-2024-7008], SQL injection issue [CVE-2024-7009]

fixchoose-mirror: Update list of available mirrors

securitycockpit: Fix denial of service issue [CVE-2024-6126]

securitycups: Fix issues with domain socket handling [CVE-2024-35235]

securitycurl: Fix ASN.1 date parser overread issue [CVE-2024-7264]

securitycyrus-imapd: Fix regression introduced in CVE-2024-34055 fix

securitydcm2niix: Fix potential code execution issue [CVE-2024-27629]

fixdebian-installer: Increase Linux kernel ABI to 6.1.0-25; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

securitydmitry: Security fixes [CVE-2024-31837 CVE-2020-14931 CVE-2017-7938]

fixdropbear: Fix noremotetcp behaviour of keepalive packets in combination with the no-port-forwarding authorized_keys(5) restriction

securitygettext.js: Fix server side request forgery issue [CVE-2024-43370]

fixglibc: Fix freeing uninitialized memory in libc_freeres_fn(); fix several performance issues and possible crashses

fixglogic: Require Gtk 3.0 and PangoCairo 1.0

fixgraphviz: Fix broken scale

securitygtk+2.0: Avoid looking for modules in the current working directory [CVE-2024-6655]

securitygtk+3.0: Avoid looking for modules in the current working directory [CVE-2024-6655]

securityimagemagick: Fix segmentation fault issue; fix incomplete fix for CVE-2023-34151

fixinitramfs-tools: hook_functions: Fix copy_file with source including a directory symlink; hook-functions: copy_file: Canonicalise target filename; install hid-multitouch module for Surface Pro 4 Keyboard; add hyper-keyboard module, needed to enter LUKS password in Hyper-V; auto_add_modules: Add…

securityintel-microcode: New upstream release; security fixes [CVE-2023-42667 CVE-2023-49141 CVE-2024-24853 CVE-2024-24980 CVE-2024-25939]

fixipmitool: Add missing enterprise-numbers.txt file

fixlibapache2-mod-auth-openidc: Avoid crash when the Forwarded header is not present but OIDCXForwardedHeaders is configured for it

fixlibnvme: Fix buffer overflow during scanning devices that do not support sub-4k reads

securitylibvirt: birsh: Make domif-setlink work more than once; qemu: domain: Fix logic when tainting domain; fix denial of service issues [CVE-2023-3750 CVE-2024-1441 CVE-2024-2494 CVE-2024-2496]

fixlinux: New upstream release; bump ABI to 25

fixlinux-signed-amd64: New upstream release; bump ABI to 25

fixlinux-signed-arm64: New upstream release; bump ABI to 25

securitynewlib: Fix buffer overflow issue [CVE-2021-3420]

securityopenssl: New upstream stable release; fix denial of service issues [CVE-2024-2511 CVE-2024-4603]; fix use after free issue [CVE-2024-4741]

securityputty: Fix weak ECDSA nonce generation allowing secret key recovery [CVE-2024-31497]

securityqemu: New upstream stable release; fix denial of service issue [CVE-2024-4467]

securityxmedcon: Fix buffer overflow issue [CVE-2024-29421]

+12 more items in the release notes

12.6 Jun 29, 2024 Release notes ↗

security77 security advisories included: DSA-5575 webkit2gtk, DSA-5580 webkit2gtk, DSA-5589 nodejs, DSA-5609 slurm-wlm-contrib, DSA-5616 ruby-sanitize, DSA-5618 webkit2gtk, DSA-5619 libgit2, DSA-5620 unbound, DSA-5621 bind9, DSA-5623 postgresql-15, DSA-5624 edk2, DSA-5625 engrampa, …

fixaide: Fix concurrent reading of extended attributes

securityamavisd-new: Handle multiple boundary parameters that contain conflicting values [CVE-2024-28054]; fix race condition in postinst

fixarchlinux-keyring: Switch to pre-built keyrings; sync with upstream

securitybluez: Fix remote code execution issues [CVE-2023-27349 CVE-2023-50229 CVE-2023-50230]

securitycjson: Fix missing NULL checks [CVE-2023-50471 CVE-2023-50472]

securityclamav: New upstream stable release; fix possible heap overflow issue [CVE-2024-20290], possible command injection issue [CVE-2024-20328]

securitycurl: Do not keep default protocols when deselected [CVE-2024-2004]; fix memory leak [CVE-2024-2398]

securityemacs: Security fixes [CVE-2024-30202 CVE-2024-30203 CVE-2024-30204 CVE-2024-30205]; replace expired package-keyring.gpg with a current version

securitygdk-pixbuf: ANI: Reject files with multiple anih chunks [CVE-2022-48622]; ANI: Reject files with multiple INAM or IART chunks; ANI: Validate anih chunk size

securityglewlwyd: Fix potential buffer overflow during FIDO2 credential validation [CVE-2023-49208]; fix open redirection via redirect_uri [CVE-2024-25715]

securitygnutls28: Fix certtool crash when verifying a certificate chain with more than 16 certificates [CVE-2024-28835]; fix side-channel in the deterministic ECDSA [CVE-2024-28834]; fix a memory leak; fix two segfault issues

securitygross: Fix stack-based buffer overflow [CVE-2023-52159]

securityintel-microcode: Security mitigations [CVE-2023-22655 CVE-2023-28746 CVE-2023-38575 CVE-2023-39368 CVE-2023-43490]; mitigate for INTEL-SA-01051 [CVE-2023-45733], INTEL-SA-01052 [CVE-2023-46103], INTEL-SA-01036 [CVE-2023-45745, CVE-2023-47855] and unspecified functional issues on various Intel…

securityjose: Fix potential denial-of-service issue [CVE-2023-50967]

securityjson-smart: Fix excessive recursion leading to stack overflow [CVE-2023-1370]; fix denial of service via crafted request [CVE-2021-31684]

securitylibapache2-mod-auth-openidc: Fix mising input validation leading to DoS [CVE-2024-24814]

securitylibjwt: Fix timing side channel attack [CVE-2024-25189]

securitylibtommath: Fix integer overflow [CVE-2023-36328]

securitynsis: Don't allow unprivileged users to delete the uninstaller directory [CVE-2023-37378]; fix regression in disabling stub relocations; build reproducibly for arm64

securitynvidia-graphics-drivers: Restore compatibility with newer Linux kernel builds; take over packages from nvidia-graphics-drivers-tesla; add new nvidia-suspend-common package; relax dh-dkms build-dependency for compatibility with bookworm; new upstream stable release [CVE-2023-0180 CVE-2023-0183…

securitynvidia-graphics-drivers-tesla-470: Restore compatibility with newer Linux kernel builds; stop building nvidia-cuda-mps; new upstream stable release; security fixes [CVE-2022-42265 CVE-2024-0074 CVE-2024-0078 CVE-2024-0090 CVE-2024-0092]

securitynvidia-open-gpu-kernel-modules: Update to 535 series LTS drivers [CVE-2023-0180 CVE-2023-0183 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199 CVE-2023-25515 CVE-2023-25516 CVE-2023-31022…

securityopenssl: New upstream stable release; fix excessive time taken issues [CVE-2023-5678 CVE-2023-6237], vector register corruption issue on PowerPC [CVE-2023-6129], PKCS12 Decoding crashes [CVE-2024-0727]

securityovn: New upstream stable version; fix insufficient validation of incoming BFD packets [CVE-2024-2182]

securityphp-phpseclib: Guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength(); remove visibitility modifiers from static variables

securityphp-phpseclib3: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength()

securityphpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength()

securitypostgresql-15: New upstream stable release; restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner [CVE-2024-4317]

securitypymongo: Fix out-of-bounds read issue [CVE-2024-5629]

securitypypy3: Strip C0 control and space characters in urlsplit [CVE-2023-24329]; avoid bypass of TLS handshake protections on closed sockets [CVE-2023-40217]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450]

securitypython-aiosmtpd: Fix SMTP smuggling issue [CVE-2024-27305]; fix STARTTLS unencrypted command injection issue [CVE-2024-34083]

securitypython-idna: Fix denial of service issue [CVE-2024-3651]

securitypython-jwcrypto: Fix denial of service issue [CVE-2024-28102]

securitypython3.11: Fix use-after-free crash when deallocating a frame object; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; fix os.path.normpath(): Path truncation at null bytes [CVE-2023-41105]; avoid bypass of TLS…

securityqemu: New upstream stable release; security fixes [CVE-2024-26327 CVE-2024-26328 CVE-2024-3446 CVE-2024-3447]

securityqtbase-opensource-src: Fix regression in patch for CVE-2023-24607; avoid using system CA certificates when not wanted [CVE-2023-34410]; fix buffer overflow [CVE-2023-37369]; fix infinite loop in XML recursive entity expansion [CVE-2023-38197]; fix buffer overflow with crafted KTX image file…

securitysendmail: Fix SMTP smuggling issue [CVE-2023-51765]

securitysystemd: New upstream stable release; fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; libnss-myhostname.nss: Install after files; libnss-mymachines.nss: Install before resolve and dns

securitywpa: Fix authentication bypass issue [CVE-2023-52160]

+123 more items in the release notes

12.5 Feb 10, 2024 Release notes ↗

security39 security advisories included: DSA-5572 roundcube, DSA-5573 chromium, DSA-5574 libreoffice, DSA-5576 xorg-server, DSA-5577 chromium, DSA-5578 ghostscript, DSA-5579 freeimage, DSA-5581 firefox-esr, DSA-5582 thunderbird, DSA-5583 gst-plugins-bad1.0, DSA-5584 bluez, DSA-5585 chromium, …

securityapktool: Prevent arbitrary file writes with malicious resource names [CVE-2024-21633]

securityatril: Fix crash when opening some epub files; fix index loading for certain epub documents; add fallback for malformed epub files in check_mime_type; use libarchive instead of external command for extracting documents [CVE-2023-51698]

fixbase-files: Update for the 12.5 point release

fixcaja: Fix desktop rendering artifacts after resolution changes; fix use of informal date format

securitycalibre: Fix HTML Input: Don't add resources that exist outside the folder hierarchy rooted at the parent folder of the input HTML file by default [CVE-2023-46303]

fixcompton: Remove recommendation of picom

fixcryptsetup: cryptsetup-initramfs: Add support for compressed kernel modules; cryptsetup-suspend-wrapper: Don't error out on missing /lib/systemd/system-sleep directory; add_modules(): Change suffix drop logic to match initramfs-tools

fixdebian-edu-artwork: Provide an Emerald theme based artwork for Debian Edu 12

fixdebian-edu-config: New upstream release

fixdebian-edu-doc: Update included documentation and translations

fixdebian-edu-fai: New upstream release

fixdebian-edu-install: New upstream release; fix security sources.list

fixdebian-installer: Increase Linux kernel ABI to 6.1.0-18; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdebian-ports-archive-keyring: Add Debian Ports Archive Automatic Signing Key (2025)

fixdpdk: New upstream stable release

securitydropbear: Fix terrapin attack [CVE-2023-48795]

fixengrampa: Fix several memory leaks; fix archive save as functionality

securityespeak-ng: Fix buffer overflow issues [CVE-2023-49990 CVE-2023-49992 CVE-2023-49993], buffer underflow issue [CVE-2023-49991], floating point exception issue [CVE-2023-49994]

securityfilezilla: Prevent Terrapin exploit [CVE-2023-48795]

securityfish: Handle Unicode non-printing characters safely when given as command substitution [CVE-2023-49284]

fixfssync: Disable flaky tests

securitygnutls28: Fix assertion failure when verifying a certificate chain with a cycle of cross signatures [CVE-2024-0567]; fix timing side-channel issue [CVE-2024-0553]

securityindent: Fix buffer under read issue [CVE-2024-0911]

fixisl: Fix use on older CPUs

securitylibde265: Fix buffer overflow issues [CVE-2023-49465 CVE-2023-49467 CVE-2023-49468]

securitylibspreadsheet-parsexlsx-perl: Fix possible memory bomb [CVE-2024-22368]; fix XML External Entity issue [CVE-2024-23525]

securitymariadb: New upstream stable release; fix denial of service issue [CVE-2023-22084]

securitypostfix: New upstream stable release; address SMTP smuggling issue [CVE-2023-51764]

securityproftpd-dfsg: Implement fix for the Terrapin attack [CVE-2023-48795]; fix out-of-bounds read issue [CVE-2023-51713]

securityproftpd-mod-proxy: Implement fix for the Terrapin attack [CVE-2023-48795]

securitypypdf: Fix infinite loop issue [CVE-2023-36464]

securitypypdf2: Fix infinite loop issue [CVE-2023-36464]

securityqemu: New upstream stable release; virtio-net: correctly copy vnet header when flushing TX [CVE-2023-6693]; fix null pointer dereference issue [CVE-2023-6683]; revert patch causing regressions in suspend / resume functionality

securitysystemd: New upstream stable release; fix missing verification issue in systemd-resolved [CVE-2023-7008]

securitytar: Fix boundary checking in base-256 decoder [CVE-2022-48303], handling of extended header prefixes [CVE-2023-39804]

securitytinyxml: Fix assertion issue [CVE-2023-34194]

securitywolfssl: Fix security issue when client sent neither PSK nor KSE extensions [CVE-2023-3724]

securityxen: New upstream stable release; security fixes [CVE-2023-46837 CVE-2023-46839 CVE-2023-46840]

+29 more items in the release notes

12.4 Dec 10, 2023 Release notes ↗

security60 security advisories included: DSA-5499 chromium, DSA-5506 firefox-esr, DSA-5508 chromium, DSA-5511 mosquitto, DSA-5512 exim4, DSA-5513 thunderbird, DSA-5514 glibc, DSA-5515 chromium, DSA-5516 libxpm, DSA-5517 libx11, DSA-5518 libvpx, DSA-5519 grub-efi-amd64-signed +3, …

fixadequate: Skip symbol-size-mismatch test on architectures where array symbols don't include a specific length; disable deprecation warnings about smartmatch, given, when in Perl 5.38; fix warnings from version comparison about smartmatch being experimental

securityamanda: Fix local privilege escalation [CVE-2023-30577]

fixarctica-greeter: Move logo away from border when greeting

fixawstats: Avoid prompts on upgrade due to logrotate configuration cleanup

securityaxis: Filter out unsupported protocols in the client class ServiceFactory [CVE-2023-40743]

fixbase-files: Update for the 12.4 point release

fixca-certificates-java: Remove circular dependencies

fixcalibre: Fix crash in Get Books when regenerating UIC files

fixcrun: Fix containers with systemd as their init system, when using newer kernel versions

fixcups: Take into account that on some printers the ColorModel option's choice for color printing is CMYK and not RGB

fixdav4tbsync: New upstream version, restoring compatibility with newer Thunderbird versions

fixdebian-edu-artwork: Provide an Emerald theme based artwork for Debian Edu 12

fixdebian-edu-config: New upstream stable version; fix setting and changing of LDAP passwords

fixdebian-edu-doc: Update included documentation and translations

securityexfatprogs: Fix out-of-bounds memory access issues [CVE-2023-45897]

securityexim4: Fix security issues relating to the proxy protocol [CVE-2023-42117] and DNSDB lookups [CVE-2023-42119]; add hardening for SPF lookups; disallow UTF-16 surrogates from ${utf8clean:...}; fix crash with tls_dhparam = none; fix $recipients expansion when used within ${run...}; fix expiry date…

securitygnutls28: Fix timing sidechannel issue [CVE-2023-5981]

securitylibde265: Fix segmentation violation issue [CVE-2023-27102], buffer overflow issues [CVE-2023-27103 CVE-2023-47471], buffer over-read issue [CVE-2023-43887]

securitylinux: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securitylinux-signed-amd64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securitylinux-signed-arm64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securitylinux-signed-i386: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securityminizip: Fix integer and heap overflow issues [CVE-2023-45853]

securitynode-undici: Delete cookie and host headers on cross-origin redirect [CVE-2023-45143]

securitynvidia-graphics-drivers: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securitynvidia-graphics-drivers-tesla: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securitynvidia-graphics-drivers-tesla-470: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securitynvidia-open-gpu-kernel-modules: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securityopendkim: Fix removal of incoming Authentication-Results: headers [CVE-2022-48521]

securityopenrefine: Fix remote code execution vulnerability [CVE-2023-41887 CVE-2023-41886]

securityopensc: Fix out-of-bounds read issue [CVE-2023-4535], potential PIN bypass [CVE-2023-40660], memory-handling issues [CVE-2023-40661]

securityperl: Fix buffer overrun issue [CVE-2023-47038]

securityphp-phpseclib3: Fix denial of service issue [CVE-2023-49316]

securitypostgresql-15: New upstream stable release; fix SQL injection issue [CVE-2023-39417]; fix MERGE to enforce row security policies properly [CVE-2023-39418]

securityqemu: Update to upstream stable release 7.2.7; hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]

securitysymfony: Fix session fixation issue [CVE-2023-46733]; add missing escaping [CVE-2023-46734]

securityunadf: Fix buffer overflow issue [CVE-2016-1243]; fix code execution issue [CVE-2016-1244]

securityvips: Fix null pointer dereference issue [CVE-2023-40032]

securityxen: New upstream stable update; fix several security issues [CVE-2022-40982 CVE-2023-20569 CVE-2023-20588 CVE-2023-20593 CVE-2023-34320 CVE-2023-34321 CVE-2023-34322 CVE-2023-34323 CVE-2023-34325 CVE-2023-34326 CVE-2023-34327 CVE-2023-34328 CVE-2023-46835 CVE-2023-46836]

+55 more items in the release notes

12.2 Oct 7, 2023 Release notes ↗

security43 security advisories included: DSA-5454 kanboard, DSA-5455 iperf3, DSA-5456 chromium, DSA-5457 webkit2gtk, DSA-5458 openjdk-17, DSA-5459 amd64-microcode, DSA-5460 curl, DSA-5462 linux-signed-amd64 +3, DSA-5463 thunderbird, DSA-5464 firefox-esr, DSA-5465 python-django, DSA-5466 ntpsec, …

securityamd64-microcode: Update included microcode, including fixes for AMD Inception on AMD Zen4 processors [CVE-2023-20569]

fixarctica-greeter: Support configuring the onscreen keyboard theme via ArcticaGreeter's gsettings; use Compact OSK layout (instead of Small) which includes special keys such as German Umlauts; fix display of authentication failure messages; use active theme rather than emerald

fixautofs: Fix regression determining reachability on dual-stack hosts

fixbase-files: Update for the 12.2 point release

securitybatik: Fix Server Side Request Forgery issues [CVE-2022-44729 CVE-2022-44730]

fixboxer-data: No longer install https-everywhere for Firefox

fixbrltty: xbrlapi: Do not try to start brltty with ba+a2 when unavailable; fix cursor routing and braille panning in Orca when xbrlapi is installed but the a2 screen driver is not

fixca-certificates-java: Work around unconfigured JRE during new installations

fixcairosvg: Handle data: URLs in safe mode

fixcalibre: Fix export feature

securityclamav: New upstream stable release; security fixes [CVE-2023-20197 CVE-2023-20212]

fixcryptmount: Avoid memory initialisation issues in command line parser

securitycups: Fix heap-based buffer overflow issue [CVE-2023-4504]; fix unauthenticated access issue [CVE-2023-32360]

securitycurl: Build with OpenLDAP to correct improper fetch of binary LDAP attributes; fix excessive memory consumption issue [CVE-2023-38039]

fixcyrus-imapd: Ensure mailboxes are not lost on upgrades from bullseye

fixdar: Fix issues with creating isolated catalogs when dar was built using a recent gcc version

securityefibootguard: Fix Insufficient or missing validation and sanitization of input from untrustworthy bootloader environment files [CVE-2023-39950]

securityghostscript: Fix buffer overflow issue [CVE-2023-38559]; try and secure the IJS server startup [CVE-2023-43115]

securityglibc: Fix the value of F_GETLK/F_SETLK/F_SETLKW with __USE_FILE_OFFSET64 on ppc64el; fix a stack read overflow in getaddrinfo in no-aaaa mode [CVE-2023-4527]; fix use after free in getcanonname [CVE-2023-4806 CVE-2023-5156]; fix _dl_find_object to return correct values even during early startup

securityhnswlib: Fix double free in init_index when the M argument is a large integer [CVE-2023-37365]

securityhorizon: Fix open redirect issue [CVE-2022-45582]

securityindent: Fix out of buffer read; fix buffer overwrite [CVE-2023-40305]

securityinetutils: Check return values when dropping privileges [CVE-2023-40303]

securitykrb5: Fix freeing of uninitialised pointer [CVE-2023-36054]

securitylemonldap-ng: Apply login control to auth-slave requests; fix open redirection due to incorrect escape handling; fix open redirection when OIDC RP has no redirect URIs; fix Server Side Request Forgery issue [CVE-2023-44469]

securitylibapache-mod-jk: Remove implicit mapping functionality, which could lead to unintended exposure of the status worker and/or bypass of security constraints [CVE-2023-41081]

securitymodsecurity: Fix denial of service issue [CVE-2023-38285]

securitymozjs102: New upstream stable release; fix incorrect value used during WASM compilation [CVE-2023-4046], potential use after free issue [CVE-2023-37202], memory safety issues [CVE-2023-37211 CVE-2023-34416]

securitynode-dottie: Security fix (prototype pollution) [CVE-2023-26132]

securityopenrefine: Fix arbitrary code execution issue [CVE-2023-37476]

securityopenssh: Fix remote code execution issue via a forwarded agent socket [CVE-2023-38408]

securityopenssl: New upstream stable release; security fixes [CVE-2023-2975 CVE-2023-3446 CVE-2023-3817]

securitypandoc: Fix arbitrary file write issue [CVE-2023-35936]

securitypython-git: Fix remote code execution issue [CVE-2023-40267], blind local file inclusion issue [CVE-2023-41040]

securityqemu: Update to upstream 7.2.5 tree; ui/vnc-clipboard: fix infinite loop in inflate_buffer [CVE-2023-3255]; fix NULL pointer dereference issue [CVE-2023-3354]; fix buffer overflow issue [CVE-2023-3180]

securityrar: Upstream bugfix release [CVE-2023-40477]

securityroundcube: New upstream stable release; fix OAuth2 authentication; fix cross site scripting issues [CVE-2023-43770]

securitytimg: Fix buffer overflow vulnerability [CVE-2023-40968]

securityunrar-nonfree: Fix remote code execution issue [CVE-2023-40477]

+78 more items in the release notes

12.1 Jul 22, 2023 Release notes ↗

security23 security advisories included: DSA-5423 thunderbird, DSA-5425 php8.2, DSA-5427 webkit2gtk, DSA-5428 chromium, DSA-5429 wireshark, DSA-5430 openjdk-17, DSA-5432 xmltooling, DSA-5433 libx11, DSA-5434 minidlna, DSA-5435 trafficserver, DSA-5436 hsqldb1.8.0, DSA-5437 hsqldb, DSA-5439 bind9, …

fixaide: Properly handle creating the system user; fix child directory processing on equal match

fixautofs: Fix hang when using Kerberos-authenticated LDAP

fixayatana-indicator-datetime: Fix playing of custom alarm sounds

fixbase-files: Update for the 12.1 point release

fixbepasty: Fix rendering of text uploads

fixboost1.81: Add missing dependency on libboost-json1.81.0 to libboost-json1.81-dev

fixbup: Correctly restore POSIX ACLs

fixcontext: Enable socket in ConTeXt mtxrun

securitycpdb-libs: Fix a buffer overflow vulnerability [CVE-2023-34095]

securitycpp-httplib: Fix CRLF injection issue [CVE-2023-26130]

fixcrowdsec: Fix default acquis.yaml to also include the journalctl datasource, limited to the ssh.service unit, making sure acquisition works even without the traditional auth.log file; make sure an invalid datasource doesn't make the engine error out

securitycups: Security fixes: use-after-free [CVE-2023-34241]; heap buffer overflow [CVE-2023-32324]

fixcvs: Configure full path to ssh

securitydbus: New upstream stable release; fix denial of service issue [CVE-2023-34969]; stop trying to take DPKG_ROOT into account, restoring copying of systemd's /etc/machine-id in preference to creating an entirely new machine ID

fixdebian-installer: Increase Linux kernel ABI to 6.1.0-10; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdesktop-base: Remove emerald alternatives on package uninstallation

fixdh-python: Re-introduce Breaks+Replaces on python2 needed to help apt in some upgrade scenarios

securityguestfs-tools: Security update [CVE-2022-2211]

securitykanboard: Fix malicious injection of HTML tags into DOM [CVE-2023-32685]; fix parameter-based indirect object referencing leading to private file exposure [CVE-2023-33956]; fix missing access controls [CVE-2023-33968, CVE-2023-33970]; fix stored XSS in Task External Link functionality…

securitylibreswan: Fix potential denial-of-service issue [CVE-2023-30570]

securitylibxml2: Fix NULL pointer dereference issue [CVE-2022-2309]

securitylinux: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001]

securitylinux-signed-amd64: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001]

securitylinux-signed-arm64: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001]

securitylinux-signed-i386: New upstream stable release; netfilter: nf_tables: do not ignore genmask when looking up chain by id [CVE-2023-31248], prevent OOB access in nft_byteorder_eval [CVE-2023-35001]

securitynode-tough-cookie: Fix prototype pollution issue [CVE-2023-26136]

securitynode-undici: Security fixes: protect Host HTTP header from CLRF injection [CVE-2023-23936]; potential ReDoS on Headers.set and Headers.append [CVE-2023-24807]

securitynode-webpack: Security fix (cross-realm objects) [CVE-2023-28154]

securitynvidia-graphics-drivers: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516]

securitynvidia-graphics-drivers-tesla: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516]

securitynvidia-graphics-drivers-tesla-470: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516]

securitynvidia-open-gpu-kernel-modules: New upstream stable release; security fixes [CVE-2023-25515 CVE-2023-25516]

securityqemu: New upstream stable release; fix USB devices not being available to XEN HVM domUs; 9pfs: prevent opening special files [CVE-2023-2861]; fix reentrancy issues in the LSI controller [CVE-2023-0330]

securitysmarty4: Fix arbitrary code execution issue [CVE-2023-28447]

securitytang: Fix race condition when creating/rotating keys [CVE-2023-1672]

securitytexlive-bin: Disable socket in luatex by default [CVE-2023-32668]; make installable on i386

securityxerial-sqlite-jdbc: Use a UUID for connection ID [CVE-2023-32697]

securityyajl: Memory leak security fix; fix denial of service issue [CVE-2017-16516], integer overflow issue [CVE-2022-24795]

+50 more items in the release notes

11.11 Aug 31, 2024 Release notes ↗

security21 security advisories included: DSA-5718 org-mode, DSA-5719 emacs, DSA-5721 ffmpeg, DSA-5722 libvpx, DSA-5723 plasma-workspace, DSA-5725 znc, DSA-5726 krb5, DSA-5727 firefox-esr, DSA-5728 exim4, DSA-5729 apache2, DSA-5730 linux-signed-amd64 +3, DSA-5734 bind9, DSA-5736 openjdk-11, …

securityamd64-microcode: New upstream release; security fixes [CVE-2023-31315]; SEV firmware fixes [CVE-2023-20584 CVE-2023-31356]

securityansible: New usptream stable release; fix template injection issue [CVE-2021-3583], information disclosure issue [CVE-2021-3620], file overwrite issue [CVE-2023-5115], template injection issue [CVE-2023-5764], information disclosure issues [CVE-2024-0690 CVE-2022-3697]; document workaround for ec2…

securityapache2: New upstream stable release; fix content disclosure issue [CVE-2024-40725]

fixbase-files: Update for the point release

securitybind9: Allow the limits introduced to fix CVE-2024-1737 to be configured

securitycalibre: Fix cross site scripting issue [CVE-2024-7008], SQL injection issue [CVE-2024-7009]

fixchoose-mirror: Update list of available mirrors

securitycjson: Add NULL checks to cJSON_SetValuestring and cJSON_InsertItemInArray [CVE-2023-50472 CVE-2023-50471 CVE-2024-31755]

securitycups: Fix issues with domain socket handling [CVE-2024-35235]; fix regression when domain sockets only are used

securitycurl: Fix ASN.1 date parser overread issue [CVE-2024-7264]

fixdebian-installer: Increase Linux kernel ABI to 5.10.0-32; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdropbear: Fix noremotetcp behaviour of keepalive packets in combination with the no-port-forwarding authorized_keys(5) restriction

securityfusiondirectory: Backport compatibility with php-cas version addressing CVE 2022-39369; fix improper session handling issue [CVE-2022-36179]; fix cross site scripting issue [CVE-2022-36180]

securitygettext.js: Fix server side request forgery issue [CVE-2024-43370]

securityglewlwyd: Fix buffer overflow during webauthn signature assertion [CVE-2022-27240]; prevent directory traversal in static_compressed_inmemory_website_callback.c [CVE-2022-29967]; copy bootstrap, jquery, fork-awesome instead of linking them; buffer overflow during FIDO2 signature validation…

securityglibc: Fix ffsll() performance issue depending on code alignment; performance improvements for memcpy() on arm64; fix y2038 regression in nscd following CVE-2024-33601 and CVE-2024-33602 fix

fixgraphviz: Fix broken scaling

securitygtk+2.0: Avoid looking for modules in current working directory [CVE-2024-6655]

securitygtk+3.0: Avoid looking for modules in current working directory [CVE-2024-6655]

fixhealpix-java: Fix build failure

securityimagemagick: Fix divide by zero issues [CVE-2021-20312 CVE-2021-20313]; fix incomplete fix for CVE-2023-34151

securityindent: Reinstate ROUND_UP macro and adjust the initial buffer size to fix memory handling problems; fix out-of-buffer read in search_brace()/lexi(); fix heap buffer overwrite in search_brace() [CVE-2023-40305]; heap buffer underread in set_buf_break() [CVE-2024-0911]

securityintel-microcode: New upstream release; security fixes [CVE-2023-42667 CVE-2023-49141 CVE-2024-24853 CVE-2024-24980 CVE-2024-25939]

securitylibvirt: Fix sVirt confinement issue [CVE-2021-3631], use after free issue [CVE-2021-3975], denial of service issues [CVE-2021-3667 CVE-2021-4147 CVE-2022-0897 CVE-2024-1441 CVE-2024-2494 CVE-2024-2496]

fixmidge: Exclude examples/covers/* for DFSG-compliance; add build-arch/build-indep build targets; use quilt (3.0) source package format

fixmlpost: Fix build failure with newer ImageMagick versions

fixnet-tools: Drop build-dependency on libdnet-dev

fixnfs-utils: Pass all valid export flags to nfsd

securityntfs-3g: Fix use-after-free in ntfs_uppercase_mbs [CVE-2023-52890]

fixnvidia-graphics-drivers-tesla-418: Fix use of GPL-only symbols causing build failures

fixnvidia-graphics-drivers-tesla-450: New upstream stable release

fixnvidia-graphics-drivers-tesla-460: New upstream stable release

fixocsinventory-server: Backport compatibility with php-cas version addressing CVE 2022-39369

fixonionshare: Demote obfs4proxy dependency to Recommends, to allow removal of obfs4proxy

securityphp-cas: Fix Service Hostname Discovery Exploitation issue [CVE-2022-39369]

securityputty: Fix weak ECDSA nonce generation allowing secret key recovery [CVE-2024-31497]

securityrunc: Fix busybox tarball url; prevent buffer overflow writing netlink messages [CVE-2021-43784]; fix tests on newer kernels; prevent write access to user-owned cgroup hierarchy /sys/fs/cgroup/user.slice/... [CVE-2023-25809]; fix access control regression [CVE-2023-27561 CVE-2023-28642]

securityxmedcon: Fix heap overflow [CVE-2024-29421]

+11 more items in the release notes

11.10 Jun 29, 2024 Release notes ↗

security69 security advisories included: DSA-5146 puma, DSA-5360 emacs, DSA-5575 webkit2gtk, DSA-5580 webkit2gtk, DSA-5596 asterisk, DSA-5616 ruby-sanitize, DSA-5618 webkit2gtk, DSA-5619 libgit2, DSA-5620 unbound, DSA-5621 bind9, DSA-5622 postgresql-13, DSA-5624 edk2, DSA-5625 engrampa, …

securityallegro5: Fix buffer overflow issues [CVE-2021-36489]

securityamavisd-new: Handle multiple boundary parameters that contain conflicting values [CVE-2024-28054]

fixbart: Fix build test failures by relaxing a floating-point comparison

fixbart-cuda: Fix build test failures by relaxing a floating-point comparison

fixbase-files: Update for the point release

fixcloud-init-22.4.2: Introduce later-versioned replacement for cloud-init package

fixcpu: Provide exactly one definition of globalLdap in ldap plugin

securitycurl: Fix memory leak when HTTP/2 server push is aborted [CVE-2024-2398]

fixdebian-installer: Increase Linux kernel ABI to 5.10.0-30; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdebsig-verify: Rebuild for outdated Built-Using

fixdeets: Rebuild for outdated Built-Using

fixdistro-info-data: Declare intentions for bullseye/bookworm; fix past data; add Ubuntu 24.10

fixdjango-mailman3: Scrub messages before archiving

fixdns-root-data: Update root hints; update expired security information

securityemacs: Protect against unsafe remote resources [CVE-2024-30203 CVE-2024-30204 CVE-2024-30205]; fix memory leak in patch for CVE-2022-48337

securitygdk-pixbuf: ANI: Reject files with multiple anih chunks [CVE-2022-48622]; ANI: Reject files with multiple INAM or IART chunks; ANI: Validate anih chunk size

securitygnutls28: Fix assertion failure verifying a certificate chain with a cycle of cross signatures [CVE-2024-0567]; fix timing side-channel attack inside RSA-PSK key exchange [CVE-2024-0553]

securitygross: Fix stack-based buffer overflow [CVE-2023-52159]

securityimlib2: Fix heap-buffer overflow vulnerability when using the tgaflip function in loader_tga.c [CVE-2024-25447 CVE-2024-25448 CVE-2024-25450]

securityintel-microcode: Fixes for INTEL-SA-INTEL-SA-00972 [CVE-2023-39368], INTEL-SA-INTEL-SA-00982 [CVE-2023-38575], INTEL-SA-INTEL-SA-00898 [CVE-2023-28746], INTEL-SA-INTEL-SA-00960 [CVE-2023-22655] and INTEL-SA-INTEL-SA-01045 [CVE-2023-43490]; mitigate for INTEL-SA-01051 [CVE-2023-45733],…

securityjose: Fix potential denial-of-service issue [CVE-2023-50967]

securityjson-smart: Fix excessive recursion leading to stack overflow [CVE-2023-1370]; fix denial of service via crafted request [CVE-2021-31684]

securitylibapache2-mod-auth-openidc: Fix missing input validation leading to DoS [CVE-2024-24814]

securitylibjwt: Fix a timing side channel via strcmp() [CVE-2024-25189]

securitylibmicrohttpd: Fix out of bounds read with crafted POST requests [CVE-2023-27371]

securitylibssh2: Fix out of bounds memory check in _libssh2_packet_add [CVE-2020-22218]

securitynano: Fix malicious symlink issue [CVE-2024-5742]

securitynvidia-graphics-drivers: End support for Tesla 450 drivers; build libnvidia-fbc1 for arm64; upstream security fixes [CVE-2022-42265 CVE-2024-0074 CVE-2024-0078]; new upstream stable release; security fixes [CVE-2024-0090 CVE-2024-0092]; fix build on ppc64el

securitynvidia-graphics-drivers-tesla-470: New upstream LTS release [CVE-2024-0074 CVE-2024-0078 CVE-2022-42265 CVE-2024-0090 CVE-2024-0092]; fix build on ppc64el

securityorg-mode: Protect against unsafe remote resources [CVE-2024-30203 CVE-2024-30204 CVE-2024-30205]

securityphp-phpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength()

securityphpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength()

securitypypdf2: Fix quadratic runtime with malformed PDF missing xref marker [CVE-2023-36810]; fix infinite loop with crafted input [CVE-2022-24859]

securitypython-aiosmtpd: Fix SMTP smuggling issue [CVE-2024-27305]; fix STARTTLS unencrypted command injection issue [CVE-2024-34083]

securitypython-idna: Fix denial of service issue [CVE-2024-3651]

securityqtbase-opensource-src: Security fixes [CVE-2022-25255 CVE-2023-24607 CVE-2023-32762 CVE-2023-32763 CVE-2023-33285 CVE-2023-34410 CVE-2023-37369 CVE-2023-38197 CVE-2023-51714 CVE-2024-25580]

securitysendmail: Fix SMTP smuggling issue [CVE-2023-51765]; add forgotten configuration for rejecting NUL by default

securitywpa: Fix authentication bypass issue [CVE-2023-52160]

+23 more items in the release notes

11.9 Feb 10, 2024 Release notes ↗

security86 security advisories included: DSA-5496 firefox-esr, DSA-5499 chromium, DSA-5506 firefox-esr, DSA-5508 chromium, DSA-5509 firefox-esr, DSA-5511 mosquitto, DSA-5512 exim4, DSA-5513 thunderbird, DSA-5514 glibc, DSA-5515 chromium, DSA-5516 libxpm, DSA-5517 libx11, DSA-5518 libvpx, …

securityaxis: Filter out unsupported protocols in the client class ServiceFactory [CVE-2023-40743]

fixbase-files: Update for the 11.9 point release

fixcifs-utils: Fix non-parallel builds

fixcompton: Remove recommendation of picom

fixconda-package-handling: Skip unreliable tests

fixconmon: Do not hang when forwarding container stdout/stderr with lots of output

fixcrun: Fix containers with systemd as their init system, when using newer kernel versions

fixdebian-installer: Increase Linux kernel ABI to 5.10.0-28; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdebian-ports-archive-keyring: Add Debian Ports Archive Automatic Signing Key (2025)

securitydropbear: Fix security measure bypass issue [CVE-2021-36369]; fix terrapin attack [CVE-2023-48795]

securityexuberant-ctags: Fix arbitrary command execution issue [CVE-2022-4515]

securityfilezilla: Prevent terrapin exploit [CVE-2023-48795]

securityglib2.0: Align with upstream stable fixes; fix denial of service issues [CVE-2023-32665 CVE-2023-32611 CVE-2023-29499 CVE-2023-32636]

securitygnutls28: Security fix for timing sidechannel attack [CVE-2023-5981]

securityimagemagick: Various security fixes [CVE-2021-20241 CVE-2021-20243 CVE-2021-20244 CVE-2021-20245 CVE-2021-20246 CVE-2021-20309 CVE-2021-3574 CVE-2021-39212 CVE-2021-4219 CVE-2022-1114 CVE-2022-28463 CVE-2022-32545 CVE-2022-32546]

securityjqueryui: Fix cross-site scripting issue [CVE-2022-31160]

securitylibde265: Fix segmentation violation in the function decoder_context::process_slice_segment_header [CVE-2023-27102]; fix heap buffer overflow in the function derive_collocated_motion_vectors [CVE-2023-27103]; fix buffer over-read in pic_parameter_set::dump [CVE-2023-43887]; fix buffer overflow in…

securitylibpod: Fix incorrect handling of supplementary groups [CVE-2022-2989]

securitylibspreadsheet-parsexlsx-perl: Fix possible memory bomb [CVE-2024-22368]; fix XML External Entity issue [CVE-2024-23525]

securitymariadb-10.5: New upstream stable release; fix denial of service issue [CVE-2023-22084]

securityminizip: Reject overflows of zip header fields [CVE-2023-45853]

securitymodsecurity-apache: Fix protection bypass issues [CVE-2022-48279 CVE-2023-24021]

securitynode-dottie: Fix prototype pollution issue [CVE-2023-26132]

securitynode-url-parse: Fix authorisation bypass issue [CVE-2022-0512]

securitynode-xml2js: Fix prototype pollution issue [CVE-2023-0842]

securitynvidia-graphics-drivers: New upstream release [CVE-2023-31022]

securitynvidia-graphics-drivers-tesla-470: New upstream release [CVE-2023-31022]

securityopendkim: Properly delete Authentication-Results headers [CVE-2022-48521]

securityperl: Prevent buffer overflow via illegal Unicode property [CVE-2023-47038]

securitypostfix: New upstream stable release; address SMTP smuggling issue [CVE-2023-51764]

securitypostgresql-13: New upstream stable release; fix SQL injection issue [CVE-2023-39417]

securitypython-websockets: Fix predictable duration issue [CVE-2021-33880]

securitysymfony: Ensure CodeExtension's filters properly escape their input [CVE-2023-46734]

securitytar: Fix boundary checking in base-256 decoder [CVE-2022-48303], handling of extended header prefixes [CVE-2023-39804]

securitytinyxml: Fix assertion issue [CVE-2023-34194]

securityunadf: Fix stack buffer overflow issue [CVE-2016-1243]; fix arbitary code execution issue [CVE-2016-1244]

securitywolfssl: Fix buffer overflow issues [CVE-2022-39173 CVE-2022-42905], key disclosure issue [CVE-2022-42961], predictable buffer in input keying material [CVE-2023-3724]

securityxerces-c: Fix use-after-free issue [CVE-2018-1311]; fix integer overflow issue [CVE-2023-37536]

+31 more items in the release notes

11.8 Oct 7, 2023 Release notes ↗

security98 security advisories included: DSA-5394 ffmpeg, DSA-5395 nodejs, DSA-5396 evolution +1, DSA-5397 wpewebkit, DSA-5398 chromium, DSA-5399 odoo, DSA-5400 firefox-esr, DSA-5401 postgresql-13, DSA-5402 linux-signed-amd64 +3, DSA-5403 thunderbird, DSA-5404 chromium, …

securityamd64-microcode: Update included microcode, including fixes for AMD Inception on AMD Zen4 processors [CVE-2023-20569]

securitybatik: Fix Server Side Request Forgery issues [CVE-2022-44729 CVE-2022-44730]

securityclamav: New upstream stable release; fix denial of service vulnerability via HFS+ parser [CVE-2023-20197]

securitycpio: Fix arbitrary code execution issue [CVE-2021-38185]; replace Suggests: on libarchive1 with libarchive-dev

securitycups: Fix heap-based buffer overflow issues [CVE-2023-4504 CVE-2023-32324], unauthenticated access issue [CVE-2023-32360], use-after-free issue [CVE-2023-34241]

securitycurl: Fix code execution issues [CVE-2023-27533 CVE-2023-27534], information disclosure issues [CVE-2023-27535 CVE-2023-27536 CVE-2023-28322], inappropriate connection re-use issue [CVE-2023-27538], improper certificate validation issue [CVE-2023-28321]

securitydbus: New upstream stable release; fix denial of service issue [CVE-2023-34969]

securityghostscript: Fix buffer overflow issue [CVE-2023-38559]; try and secure the IJS server startup [CVE-2023-43115]

securitygrunt: Fix race condition in symlink copying [CVE-2022-1537]

securityhnswlib: Fix double free in init_index when the M argument is a large integer [CVE-2023-37365]

securityhorizon: Fix open redirect issue [CVE-2022-45582]

securityinetutils: Check return values for set*id() functions, avoiding potential security issues [CVE-2023-40303]

securitykrb5: Fix free of uninitialised pointer [CVE-2023-36054]

securitylemonldap-ng: Fix open redirection when OIDC RP has no redirect URIs; fix Server Side Request Forgery issue [CVE-2023-44469]; fix open redirection due to incorrect escape handling

securitylibapache-mod-jk: Remove implicit mapping functionality, which could lead to unintended exposure of the status worker and/or bypass of security constraints [CVE-2023-41081]

securitylibreswan: Fix denial of service issue [CVE-2023-30570]

securitylibsignal-protocol-c: Fix integer overflow issue [CVE-2022-48468]

securitylua5.3: Fix use after free in lua_upvaluejoin (lapi.c) [CVE-2019-6706]; fix segmentation fault in getlocal and setlocal (ldebug.c) [CVE-2020-24370]

securitymariadb-10.5: New upstream bugfix release [CVE-2022-47015]

securityncurses: Disallow loading of custom terminfo entries in setuid/setgid programs [CVE-2023-29491]

securitynode-css-what: Fix regular expression-based denial of service issue [CVE-2022-21222 CVE-2021-33587]

securitynode-json5: Fix prototype pollution issue [CVE-2022-46175]

securitynode-tough-cookie: Security fix: prototype pollution [CVE-2023-26136]

securitynvidia-graphics-drivers: New upstream release [CVE-2023-25515 CVE-2023-25516]; improve compatibility with recent kernels

securitynvidia-graphics-drivers-tesla-450: New upstream release [CVE-2023-25515 CVE-2023-25516]

securitynvidia-graphics-drivers-tesla-470: New upstream bugfix release [CVE-2023-25515 CVE-2023-25516]

securityopenssh: Fix remote code execution issue via a forwarded agent socket [CVE-2023-38408]

securityopenssl: New upstream stable release; fix denial of service issues [CVE-2023-3446 CVE-2023-3817]

securityorg-mode: Fix command injection vulnerability [CVE-2023-28617]

securitypandoc: Fix arbitrary file write issues [CVE-2023-35936 CVE-2023-38745]

securitypev: Fix buffer overflow issue [CVE-2021-45423]

securityphp-guzzlehttp-psr7: Fix improper input validation [CVE-2023-29197]

securityphp-nyholm-psr7: Fix improper input validation issue [CVE-2023-29197]

securityprotobuf: Security fixes: DoS in Java [CVE-2021-22569]; NULL pointer dereference [CVE-2021-22570]; memory DoS [CVE-2022-1941]

securitypython2.7: Fix parameter cloaking issue [CVE-2021-23336], URL injection issue [CVE-2022-0391], use-after-free issue [CVE-2022-48560], XML External Entity issue [CVE-2022-48565]; improve constant-time comparisons in compare_digest() [CVE-2022-48566]; improve URL parsing [CVE-2023-24329]; prevent…

securityqemu: Fix infinite loop [CVE-2020-14394], NULL pointer dereference issue [CVE-2021-20196], integer overflow issue [CVE-2021-20203], buffer overflow issues [CVE-2021-3507 CVE-2023-3180], denial of service issues [CVE-2021-3930 CVE-2023-3301], use-after-free issue [CVE-2022-0216], possible stack…

securityrar: New upstream release; fix directory traversal issue [CVE-2022-30333]; fix arbitrary code execution issue [CVE-2023-40477]

securityrhonabwy: Fix aesgcm buffer overflow [CVE-2022-32096]

securityroundcube: New upstream stable release; fix cross-site scripting issue [CVE-2023-43770]; Enigma: Fix initial synchronization of private keys

+55 more items in the release notes

11.7 Apr 29, 2023 Release notes ↗

security99 security advisories included: DSA-5170 nodejs, DSA-5237 firefox-esr, DSA-5238 thunderbird, DSA-5259 firefox-esr, DSA-5262 thunderbird, DSA-5282 firefox-esr, DSA-5284 thunderbird, DSA-5300 pngcheck, DSA-5301 firefox-esr, DSA-5302 chromium, DSA-5303 thunderbird, DSA-5304 xorg-server, …

fixakregator: Fix validity checks, including fixing deletion of feeds and folders

fixapache2: Don't automatically enable apache2-doc.conf; fix regressions in http2 and mod_rewrite introduced in 2.4.56

fixat-spi2-core: Set stop timeout to 5 seconds, so as not to needlessly block system shutdowns

securityavahi: Fix local denial of service issue [CVE-2021-3468]

fixbase-files: Update for the 11.7 point release

securityc-ares: Prevent stack overflow and denial of service [CVE-2022-4904]

securityclamav: New upstream stable release; fix possible remote code execution issue in the HFS+ file parser [CVE-2023-20032], possible information leak in the DMG file parser [CVE-2023-20052]

securitycontainerd: Fix denial of service issue [CVE-2023-25153]; fix possible privilege escalation via incorrect setup of supplementary groups [CVE-2023-25173]

securitycrun: Fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27650]

securityduktape: Fix crash issue [CVE-2021-46322]

securityerlang: Fix client authentication bypass issue [CVE-2022-37026]; use -O1 optimization for armel because -O2 makes erl segfault on certain platforms, e.g. Marvell

securityexiv2: Security fixes [CVE-2021-29458 CVE-2021-29463 CVE-2021-29464 CVE-2021-29470 CVE-2021-29473 CVE-2021-29623 CVE-2021-32815 CVE-2021-34334 CVE-2021-34335 CVE-2021-3482 CVE-2021-37615 CVE-2021-37616 CVE-2021-37618 CVE-2021-37619 CVE-2021-37620 CVE-2021-37621 CVE-2021-37622 CVE-2021-37623]

securityflask-security: Fix open redirect vulnerability [CVE-2021-23385]

securityflatpak: New upstream stable release; escape special characters when displaying permissions and metadata [CVE-2023-28101]; don't allow copy/paste via the TIOCLINUX ioctl when running in a Linux virtual console [CVE-2023-28100]

securitygolang-github-containers-psgo: Do not enter the process user namespace [CVE-2022-1227]

securitygolang-github-containers-storage: Make previously internal functions publicly accessible, required to allow fixing CVE-2022-1227 in other packages

securitygolang-github-prometheus-exporter-toolkit: Patch tests to avoid race condition; fix authentication cache poisoning issue [CVE-2022-46146]

securityjoblib: Fix arbitrary code execution issue [CVE-2022-21797]

securitylemonldap-ng: Fix URL validation bypass issue; fix 2FA issue when using AuthBasic handler [CVE-2023-28862]

securitylibapache2-mod-auth-openidc: Fix open redirect issue [CVE-2022-23527]

securitylibapreq2: Fix buffer overflow issue [CVE-2022-22728]

securitylibgit2: Enable SSH key verification by default [CVE-2023-22742]

securitylibpod: Fix privilege escalation issue [CVE-2022-1227]; fix capability escalation issue due to containers being incorrectly started with non-empty default permissions [CVE-2022-27649]; fix parsing of DBUS_SESSION_BUS_ADDRESS

securitylibreoffice: Change Croatia's default currency to Euro; avoid empty -Djava.class.path= [CVE-2022-38745]

securitylibxpm: Fix infinite loop issues [CVE-2022-44617 CVE-2022-46285]; fix double free issue in error handling code; fix compression commands depend on PATH [CVE-2022-4883]

securitylibzen: Fix null pointer dereference issue [CVE-2020-36646]

securitylxc: Fix file existence oracle [CVE-2022-47952]

securityncurses: Guard against corrupt terminfo data [CVE-2022-29458]; fix tic crash on very long tc/use clauses

securitynode-cookiejar: Guard against maliciously-sized cookies [CVE-2022-25901]

securitynode-webpack: Avoid cross-realm object access [CVE-2023-28154]

securitynvidia-graphics-drivers: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199]

securitynvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199]

securitynvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2023-0180 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199]

securitypostgresql-13: New upstream stable release; fix client memory disclosure issue [CVE-2022-41862]

securitysnakeyaml: Fix denial of service issues [CVE-2022-25857 CVE-2022-38749 CVE-2022-38750 CVE-2022-38751]; add documentation regarding security support / issues

securitysymfony: Remove private headers before storing responses with HttpCache [CVE-2022-24894]; remove CSRF tokens from storage on successful login [CVE-2022-24895]

securitysystemd: Fix information leak issue [CVE-2022-4415], denial of service issue [CVE-2022-3821]; ata_id: fix getting Response Code from SCSI Sense Data; logind: fix getting property OnExternalPower via D-Bus; fix crash in systemd-machined

securityunbound: Fix Non-Responsive Delegation Attack [CVE-2022-3204]; fix ghost domain names issue [CVE-2022-30698 CVE-2022-30699]

securityw3m: Fix out-of-bounds write issue [CVE-2022-38223]

+53 more items in the release notes

11.6 Dec 17, 2022 Release notes ↗

security72 security advisories included: DSA-5212 chromium, DSA-5223 chromium, DSA-5224 poppler, DSA-5225 chromium, DSA-5226 pcs, DSA-5227 libgoogle-gson-java, DSA-5228 gdk-pixbuf, DSA-5229 freecad, DSA-5230 chromium, DSA-5231 connman, DSA-5232 tinygltf, DSA-5233 e17, DSA-5234 fish, …

securityawstats: Fix cross site scripting issue [CVE-2022-46391]

fixbase-files: Update /etc/debian_version for the 11.6 point release

fixbinfmt-support: Run binfmt-support.service after systemd-binfmt.service

securityclickhouse: Fix out-of-bounds read issues [CVE-2021-42387 CVE-2021-42388], buffer overflow issues [CVE-2021-43304 CVE-2021-43305]

securitycontainerd: CRI plugin: Fix goroutine leak during Exec [CVE-2022-23471]

fixcore-async-clojure: Fix build failures in test suite

fixdcfldd: Fix SHA1 output on big-endian architectures

fixdebian-installer: Rebuild against proposed-updates; increase Linux kernel ABI to 5.10.0-20

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdebmirror: Add non-free-firmware to the default section list

fixdistro-info-data: Add Ubuntu 23.04, Lunar Lobster; update Debian ELTS end dates; correct Debian 8 (jessie) release date

securitydojo: Fix prototype pollution issue [CVE-2021-23450]

fixdovecot-fts-xapian: Generate dependency on dovecot ABI version in use during build

fixefitools: Fix intermittent build failure due to incorrect dependency in makefile

securityg810-led: Control device access with uaccess instead of making everything world-writable [CVE-2022-46338]

securitylemonldap-ng: Improve session destroy propagation [CVE-2022-37186]

securityleptonlib: Fix divide-by-zero [CVE-2022-38266]

securitylibapache2-mod-auth-mellon: Fix open redirect issue [CVE-2021-3639]

securitylibconfuse: Fix a heap-based buffer over-read in cfg_tilde_expand [CVE-2022-40320]

securitylibtasn1-6: Fix out-of-bounds read issue [CVE-2021-46848]

securitylibvncserver: Fix memory leak [CVE-2020-29260]; support larger screen sizes

securitymariadb-10.5: New upstream stable release; security fixes [CVE-2018-25032 CVE-2021-46669 CVE-2022-27376 CVE-2022-27377 CVE-2022-27378 CVE-2022-27379 CVE-2022-27380 CVE-2022-27381 CVE-2022-27382 CVE-2022-27383 CVE-2022-27384 CVE-2022-27386 CVE-2022-27387 CVE-2022-27444 CVE-2022-27445 CVE-2022-27446…

securitymod-wsgi: Drop X-Client-IP header when it is not a trusted header [CVE-2022-2255]

securitymplayer: Fix several security issues [CVE-2022-38850 CVE-2022-38851 CVE-2022-38855 CVE-2022-38858 CVE-2022-38860 CVE-2022-38861 CVE-2022-38863 CVE-2022-38864 CVE-2022-38865 CVE-2022-38866]

securitynode-hawk: Parse URLs using stdlib [CVE-2022-29167]

securitynode-loader-utils: Fix prototype pollution issue [CVE-2022-37599 CVE-2022-37601], regular expression-based denial of service issue [CVE-2022-37603]

securitynode-minimatch: Improve protection against regular expression-based denial of service [CVE-2022-3517]; fix regression in patch for CVE-2022-3517

securitynode-qs: Fix prototype pollution issue [CVE-2022-24999]

securitynode-xmldom: Fix prototype pollution issue [CVE-2022-37616]; prevent insertion of non-well-formed nodes [CVE-2022-39353]

securitynvidia-graphics-drivers: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261…

securitynvidia-graphics-drivers-legacy-390xx: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34680 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259]

securitynvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261 CVE-2022-42262…

securitynvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2022-34670 CVE-2022-34674 CVE-2022-34675 CVE-2022-34677 CVE-2022-34679 CVE-2022-34680 CVE-2022-34682 CVE-2022-42254 CVE-2022-42255 CVE-2022-42256 CVE-2022-42257 CVE-2022-42258 CVE-2022-42259 CVE-2022-42260 CVE-2022-42261…

securityonionshare: Fix denial of service issue [CVE-2022-21689], HTML injection issue [CVE-2022-21690]

securitypowerline-gitstatus: Fix command injection via malicious repository config [CVE-2022-42906]

securitytinyexr: Fix heap overflow issues [CVE-2022-34300 CVE-2022-38529]

securitytinyxml: Fix infinite loop [CVE-2021-42260]

securityvirglrenderer: Fix out-of-bounds write issue [CVE-2022-0135]

securityxfig: Fix buffer overflow issue [CVE-2021-40241]

+30 more items in the release notes

11.5 Sep 10, 2022 Release notes ↗

security46 security advisories included: DSA-5175 thunderbird, DSA-5176 blender, DSA-5177 ldap-account-manager, DSA-5178 intel-microcode, DSA-5179 php7.4, DSA-5180 chromium, DSA-5181 request-tracker4, DSA-5182 webkit2gtk, DSA-5183 wpewebkit, DSA-5184 xen, DSA-5185 mat2, DSA-5187 chromium, …

securityavahi: Fix display of URLs containing '&' in avahi-discover; do not disable timeout cleanup on watch cleanup; fix NULL pointer crashes when trying to resolve badly-formatted hostnames [CVE-2021-3502]

fixbase-files: Update /etc/debian_version for the 11.5 point release

fixcargo-mozilla: New source package to support building of newer firefox-esr and thunderbird versions

fixclamav: New upstream stable release

fixcommons-daemon: Fix JVM detection

securitycurl: Reject cookies with control bytes [CVE-2022-35252]

securitydbus-broker: Fix assertion failure when disconnecting peer groups; fix memory leak; fix null pointer dereference [CVE-2022-31213]

fixdebian-installer: Rebuild against proposed-updates; increase Linux kernel ABI to 5.10.0-18

fixdebian-installer-netboot-images: Rebuild against proposed-updates; increase Linux kernel ABI to 5.10.0-18

fixdebian-security-support: Update support status of various packages

fixdebootstrap: Ensure non-merged-usr chroots can continue to be created for older releases and buildd chroots

securitydlt-daemon: Fix double free issue [CVE-2022-31291]

fixdnsproxy: Listen on localhost by default, rather than the possibly unavailable 192.168.168.1

securitydovecot: Fix possible security issues when two passdb configuration entries exist with the same driver and args settings [CVE-2022-30550]

fixdpkg: Fix conffile removal-on-upgrade handling, memory leak in remove-on-upgrade handling; Dpkg::Shlibs::Objdump: Fix apply_relocations to work with versioned symbols; add support for ARCv2 CPU; several updates and fixes to dpkg-fsys-usrunmess

securityfig2dev: Fix double free issue [CVE-2021-37529], denial of service issue [CVE-2021-37530]; stop misplacement of embedded eps images

fixfoxtrotgps: Fix crash by ensuring that threads are always unreferenced

securitygif2apng: Fix heap-based buffer overflows [CVE-2021-45909 CVE-2021-45910 CVE-2021-45911]

securityglibc: Fix an off-by-one buffer overflow/underflow in getcwd() [CVE-2021-3999]; fix several overflows in wide character functions; add a few EVEX optimized string functions to fix a performance issue (up to 40%) with Skylake-X processors; make grantpt usable after multi-threaded fork; ensure that…

fixgolang-github-pkg-term: Fix building on newer Linux kernels

fixgri: Use ps2pdf instead of convert for converting from PS to PDF

fixgrub-efi-amd64-signed: New upstream release

fixgrub-efi-arm64-signed: New upstream release

fixgrub-efi-ia32-signed: New upstream release

fixgrub2: New upstream release

securityhttp-parser: Unset F_CHUNKED on new Transfer-Encoding, fixing possible HTTP request smuggling issue [CVE-2020-8287]

fixifenslave: Fix bonded interface configurations

securityinetutils: Fix buffer overflow issue [CVE-2019-0053], stack exhaustion issue, handling of FTP PASV responses [CVE-2021-40491], denial of service issue [CVE-2022-39028]

securitylibhttp-daemon-perl: Improve handling of Content-Length header [CVE-2022-31081]

securitylibreoffice: Support EUR in .hr locale; add HRKEUR conversion rate to Calc and the Euro Wizard; security fixes [CVE-2021-25636 CVE-2022-26305 CVE-2022-26306 CVE-2022-26307]; fix hang accessing Evolution address books

securitylwip: Fix buffer overflow issues [CVE-2020-22283 CVE-2020-22284]

securitynode-log4js: Do not create world-readable files by default [CVE-2022-21704]

securitynode-moment: Fix regular expression-based denial of service issue [CVE-2022-31129]

securitynvidia-graphics-drivers: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615]

securitynvidia-graphics-drivers-legacy-390xx: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615]

securitynvidia-graphics-drivers-tesla-450: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615]

securitynvidia-graphics-drivers-tesla-470: New upstream release; security fixes [CVE-2022-31607 CVE-2022-31608 CVE-2022-31615]

securitypcre2: Fix out-of-bounds read issues [CVE-2022-1586 CVE-2022-1587]

securitypostgresql-13: Do not let extension scripts replace objects not already belonging to the extension [CVE-2022-2625]

+19 more items in the release notes

11.4 Jul 9, 2022 Release notes ↗

security73 security advisories included: DSA-4999 asterisk, DSA-5026 firefox-esr, DSA-5034 thunderbird, DSA-5044 firefox-esr, DSA-5045 thunderbird, DSA-5069 firefox-esr, DSA-5074 thunderbird, DSA-5086 thunderbird, DSA-5090 firefox-esr, DSA-5094 thunderbird, DSA-5097 firefox-esr, …

securityapache2: New upstream stable release; fix HTTP request smuggling issue [CVE-2022-26377], out-of-bounds read issues [CVE-2022-28330 CVE-2022-28614 CVE-2022-28615], denial of service issues [CVE-2022-29404 CVE-2022-30522], possible out-of-bounds read issue [CVE-2022-30556], possible IP-based…

fixbase-files: Update /etc/debian_version for the 11.4 point release

fixbash: Fix 1-byte buffer overflow read, causing corrupted multibyte characters in command substitutions

securityclamav: New upstream stable release; security fixes [CVE-2022-20770 CVE-2022-20771 CVE-2022-20785 CVE-2022-20792 CVE-2022-20796]

fixclementine: Add missing dependency on libqt5sql5-sqlite

securitycomposer: Fix code injection issue [CVE-2022-24828]; update GitHub token pattern

securitydbus-broker: Fix buffer overflow issue [CVE-2022-31212]

securityfreetype: Fix buffer overflow issue [CVE-2022-27404]; fix crashes [CVE-2022-27405 CVE-2022-27406]

securityfribidi: Fix buffer overflow issues [CVE-2022-25308 CVE-2022-25309]; fix crash [CVE-2022-25310]

securitygnutls28: Fix SSSE3 SHA384 miscalculation; fix null pointer deference issue [CVE-2021-4209]

securitygolang-github-russellhaering-goxmldsig: Fix null pointer dereference caused by crafted XML signatures [CVE-2020-7711]

securitygrunt: Fix path traversal issue [CVE-2022-0436]

securityhtmldoc: Fix infinite loop [CVE-2022-24191], integer overflow issues [CVE-2022-27114] and heap buffer overflow issue [CVE-2022-28085]

securityknot-resolver: Fix possible assertion failure in NSEC3 edge-case [CVE-2021-40083]

securitylibapache2-mod-auth-openidc: New upstream stable release; fix open redirect issue [CVE-2021-39191]; fix crash on reload / restart

securitylibsdl2: Avoid out-of-bounds read while loading malformed BMP file [CVE-2021-33657], and during YUV to RGB conversion

securitylogrotate: Skip locking if state file is world-readable [CVE-2022-1348]; make configuration parsing stricter in order to avoid parsing foreign files such as core dumps

securityminidlna: Validate HTTP requests to protect against DNS rebinding attacks [CVE-2022-26505]

securitymutt: Fix uudecode buffer overflow issue [CVE-2022-1328]

securitynginx: Fix crash when libnginx-mod-http-lua is loaded and init_worker_by_lua* is used; mitigate application layer protocol content confusion attack in the Mail module [CVE-2021-3618]

securitynode-ejs: Fix server-side template injection issue [CVE-2022-29078]

securitynode-eventsource: Strip sensitive headers on redirect to different origin [CVE-2022-1650]

securitynode-got: Don't allow redirection to Unix socket [CVE-2022-33987]

securitynode-mermaid: Fix cross-site scripting issues [CVE-2021-23648 CVE-2021-43861]

securitynode-minimist: Fix prototype pollution issue [CVE-2021-44906]

securitynode-moment: Fix path traversal issue [CVE-2022-24785]

securitynode-node-forge: Fix signature verification issues [CVE-2022-24771 CVE-2022-24772 CVE-2022-24773]

securitynode-sqlite3: Fix denial of service issue [CVE-2022-21227]

securitynode-url-parse: Fix authentication bypass issues [CVE-2022-0686 CVE-2022-0691]

securitynvidia-graphics-drivers: New upstream release; switch to upstream 470 tree; fix denial of service issues [CVE-2022-21813 CVE-2022-21814]; fix out-of-bounds write issue [CVE-2022-28181], out-of-bounds read issue [CVE-2022-28183], denial of service issues [CVE-2022-28184 CVE-2022-28191 CVE-2022-28192]

securitynvidia-graphics-drivers-legacy-390xx: New upstream release; fix out-of-bound write issues [CVE-2022-28181 CVE-2022-28185]

securitynvidia-graphics-drivers-tesla-450: New upstream stable release; fix out-of-bounds write issues [CVE-2022-28181 CVE-2022-28185], denial of service issue [CVE-2022-28192]

securitynvidia-graphics-drivers-tesla-470: New package, switching Tesla support to upstream 470 tree; fix out-of-bounds write issue [CVE-2022-28181], out-of-bounds read issue [CVE-2022-28183], denial of service issues [CVE-2022-28184 CVE-2022-28191 CVE-2022-28192]

securityphp-guzzlehttp-psr7: Fix improper header parsing [CVE-2022-24775]

securitypython-scrapy: Don't send authentication data with all requests [CVE-2021-41125]; don't expose cookies cross-domain when redirecting [CVE-2022-0577]

securityrunc: Honour seccomp defaultErrnoRet; do not set inheritable capabilities [CVE-2022-29162]

securitysamba: Fix winbind start failure when allow trusted domains = no is used; fix MIT Kerberos authentication; fix share escape issue via mkdir race condition [CVE-2021-43566]; fix possible serious data corruption issue due to Windows client cache poisoning; fix installation on non-systemd systems

securitytwisted: Fix information disclosure issue with cross-domain redirects [CVE-2022-21712], denial of service issue during SSH handshakes [CVE-2022-21716], HTTP request smuggling issues [CVE-2022-24801]

securityunrar-nonfree: Fix directory traversal issue [CVE-2022-30333]

+42 more items in the release notes

11.3 Mar 26, 2022 Release notes ↗

security73 security advisories included: DSA-5000 openjdk-11, DSA-5001 redis, DSA-5012 openjdk-17, DSA-5021 mediawiki, DSA-5023 modsecurity-apache, DSA-5024 apache-log4j2, DSA-5025 tang, DSA-5027 xorg-server, DSA-5028 spip, DSA-5029 sogo, DSA-5030 webkit2gtk, DSA-5031 wpewebkit, …

securityapache-log4j1.2: Resolve security issues [CVE-2021-4104 CVE-2022-23302 CVE-2022-23305 CVE-2022-23307], by removing support for the JMSSink, JDBCAppender, JMSAppender and Apache Chainsaw modules

securityapache-log4j2: Fix remote code execution issue [CVE-2021-44832]

securityapache2: New upstream release; fix crash due to random memory read [CVE-2022-22719]; fix HTTP request smuggling issue [CVE-2022-22720]; fix out-of-bounds write issues [CVE-2022-22721 CVE-2022-23943]

securityatftp: Fix information leak issue [CVE-2021-46671]

fixbase-files: Update for the 11.3 point release

fixbible-kjv: Fix off-by-one-error in search

securityclamav: New upstream stable release; fix denial of service issue [CVE-2022-20698]

securitydask.distributed: Fix undesired listening of workers on public interfaces [CVE-2021-42343]; fix compatibility with Python 3.9

securitye2guardian: Fix missing SSL certificate validation issue [CVE-2021-44273]

securityflac: Fix out-of-bounds write issue [CVE-2021-0561]

securityglibc: Fix bad conversion from ISO-2022-JP-3 with iconv [CVE-2021-43396]; fix buffer overflow issues [CVE-2022-23218 CVE-2022-23219]; fix use-after-free issue [CVE-2021-33574]; stop replacing older versions of /etc/nsswitch.conf; simplify the check for supported kernel versions, as 2.x kernels are…

securitygnuplot: Fix division by zero [CVE-2021-44917]

securitygolang-1.15: Fix IsOnCurve for big.Int values that are not valid coordinates [CVE-2022-23806]; math/big: prevent large memory consumption in Rat.SetString [CVE-2022-23772]; cmd/go: prevent branches from materializing into versions [CVE-2022-23773]; fix stack exhaustion compiling deeply nested…

securityhtmldoc: Fix out-of-bounds read issue [CVE-2022-0534]

securityintel-microcode: Update included microcode; mitigate some security issues [CVE-2020-8694 CVE-2020-8695 CVE-2021-0127 CVE-2021-0145 CVE-2021-0146 CVE-2021-33120]

securitylemonldap-ng: Fix auth process in password-testing plugins [CVE-2021-40874]

securitylibarchive: Fix extracting hardlinks to symlinks; fix handling of symlink ACLs [CVE-2021-23177]; never follow symlinks when setting file flags [CVE-2021-31566]

securitylibxml2: Fix use-after-free issue [CVE-2022-23308]

securitymariadb-10.5: New upstream release; security fixes [CVE-2021-35604 CVE-2021-46659 CVE-2021-46661 CVE-2021-46662 CVE-2021-46663 CVE-2021-46664 CVE-2021-46665 CVE-2021-46667 CVE-2021-46668 CVE-2022-24048 CVE-2022-24050 CVE-2022-24051 CVE-2022-24052]

securitymujs: Fix buffer overflow issue [CVE-2021-45005]

securitynode-cached-path-relative: Fix prototype pollution issue [CVE-2021-23518]

securitynode-fetch: Don't forward secure headers to third party domains [CVE-2022-0235]

securitynode-follow-redirects: Don't send Cookie header across domains [CVE-2022-0155]; don't send confidential headers across schemes [CVE-2022-0536]

securitynode-markdown-it: Fix regular expression-based denial of service issue [CVE-2022-21670]

securitynode-nth-check: Fix regular expression-based denial of service issue [CVE-2021-3803]

securitynode-prismjs: Escape markup in command line output [CVE-2022-23647]; update minified files to ensure that Regular Expression Denial of Service issue is resolved [CVE-2021-3801]

securitynode-trim-newlines: Fix regular expression-based denial of service issue [CVE-2021-33623]

securitynvidia-graphics-drivers-tesla-450: New upstream release; fix denial of service issues [CVE-2022-21813 CVE-2022-21814]; nvidia-kernel-support: Provide /etc/modprobe.d/nvidia-options.conf as a template

securityopenvswitch: Fix use-after-free issue [CVE-2021-36980]; fix installation of libofproto

securityphp-crypt-gpg: Prevent additional options being passed to GPG [CVE-2022-24953]

securityphp-laravel-framework: Fix cross-site scripting issue [CVE-2021-43808], missing blocking of executable content upload [CVE-2021-43617]

securityphpliteadmin: Fix cross-site scripting issue [CVE-2021-46709]

securitypython-django: Fix denial of service issue [CVE-2021-45115], information disclosure issue [CVE-2021-45116], directory traversal issue [CVE-2021-45452]; fix a traceback around the handling of RequestSite/get_current_site() due to a circular import

securitysymfony: Fix CVE injection issue [CVE-2021-41270]

securitysystemd: Fix uncontrolled recursion in systemd-tmpfiles [CVE-2021-3997]; demote systemd-timesyncd from Depends to Recommends, removing a dependency cycle; fix failure to bind mount a directory into a container using machinectl; fix regression in udev resulting in long delays when processing…

securityweechat: Fix denial of service issue [CVE-2021-40516]

securitywolfssl: Fix several issues related to OCSP-handling [CVE-2021-3336 CVE-2021-37155 CVE-2021-38597] and TLS1.3 support [CVE-2021-44718 CVE-2022-25638 CVE-2022-25640]

securityxterm: Fix buffer overflow issue [CVE-2022-24130]

securityzziplib: Fix denial of service issue [CVE-2020-18442]

+53 more items in the release notes

11.2 Dec 18, 2021 Release notes ↗

security29 security advisories included: DSA-4980 qemu, DSA-4981 firefox-esr, DSA-4982 apache2, DSA-4983 neutron, DSA-4984 flatpak, DSA-4985 wordpress, DSA-4986 tomcat9, DSA-4987 squashfs-tools, DSA-4988 libreoffice, DSA-4989 strongswan, DSA-4992 php7.4, DSA-4994 bind9, DSA-4995 webkit2gtk, …

fixauthheaders: New upstream bug-fix release

fixbase-files: Update /etc/debian_version for the 11.2 point release

fixbpftrace: Fix array indexing

fixbrltty: Fix operation under X when using sysvinit

securitybtrbk: Fix regression in the update for CVE-2021-38173

fixcalibre: Fix syntax error

fixchrony: Fix binding a socket to a network device with a name longer than 3 characters when the system call filter is enabled

fixcmake: Add PostgreSQL 13 to known versions

securitycontainerd: New upstream stable release; handle ambiguous OCI manifest parsing [CVE-2021-41190]; support clone3 in default seccomp profile

fixcurl: Remove -ffile-prefix-map from curl-config, fixing co-installability of libcurl4-gnutls-dev under multiarch

securitydatatables.js: Fix insufficient escaping of arrays passed to the HTML escape entities function [CVE-2021-23445]

fixdebian-edu-config: pxe-addfirmware: Fix TFTP server path; improve support for LTSP chroot setup and maintenance

fixdebian-edu-doc: Update Debian Edu Bullseye manual from the wiki; update translations

fixdebian-installer: Rebuild against proposed-updates; update kernel ABI to -10

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdistro-info-data: Update included data for Ubuntu 14.04 and 16.04 ESM; add Ubuntu 22.04 LTS

securitydocker.io: Fix possible change of host file system permissions [CVE-2021-41089]; lock down file permissions in /var/lib/docker [CVE-2021-41091]; prevent credentials being sent to the default registry [CVE-2021-41092]; add support for clone3 syscall in default seccomp policy

securityedk2: Address Boot Guard TOCTOU vulnerability [CVE-2019-11098]

fixfreeipmi: Install pkgconfig files to correct location

fixgdal: Fix BAG 2.0 Extract support in LVBAG driver

securitygerbv: Fix out-of-bounds write issue [CVE-2021-40391]

securitygmp: Fix integer and buffer overflow issue [CVE-2021-43618]

securitygolang-1.15: New upstream stable release; fix net/http: panic due to racy read of persistConn after handler panic [CVE-2021-36221]; fix archive/zip: overflow in preallocation check can cause OOM panic [CVE-2021-39293]; fix buffer over-run issue [CVE-2021-38297], out of bounds read issue…

fixgrass: Fix parsing of GDAL formats where the description contains a colon

securityhtmldoc: Fix buffer overflow issues [CVE-2021-40985 CVE-2021-43579]

securityisync: Fix multiple buffer overflow issues [CVE-2021-3657]

securityjqueryui: Fix untrusted code execution issues [CVE-2021-41182 CVE-2021-41183 CVE-2021-41184]

securitykeepalived: Fix overly broad DBus policy [CVE-2021-44225]

securitykeystone: Resolve information leak allowing determination of whether users exist [CVE-2021-38155]; apply some performance improvements to the default keystone-uwsgi.ini

securitykodi: Fix buffer overflow in PLS playlists [CVE-2021-42917]

securitylldpd: Fix heap overflow issue [CVE-2021-43612]; do not set VLAN tag if client did not set it

securitynode-getobject: Resolve prototype pollution issue [CVE-2020-28282]

securitynode-json-schema: Resolve prototype pollution issue [CVE-2021-3918]

securityplib: Fix integer overflow issue [CVE-2021-38714]

securityprivoxy: Fix memory leaks [CVE-2021-44540 CVE-2021-44541 CVE-2021-44542]; fix cross-site scripting issue [CVE-2021-44543]

securitypython-django: New upstream security release: fix potential bypass of an upstream access control based on URL paths [CVE-2021-44420]

securityros-ros-comm: Fix denial of service issue [CVE-2021-37146]

securityudisks2: Mount options: Always use errors=remount-ro for ext filesystems [CVE-2021-3802]; use the mkfs command to format exfat partitions; add Recommends exfatprogs as preferred alternative

securityvim: Fix heap overflows [CVE-2021-3770 CVE-2021-3778], use after free issue [CVE-2021-3796]; remove vim-gtk alternatives during vim-gtk -> vim-gtk3 transition, easing upgrades from buster

+25 more items in the release notes

11.1 Oct 9, 2021 Release notes ↗

security32 security advisories included: DSA-4959 thunderbird, DSA-4960 haproxy, DSA-4961 tor, DSA-4962 ledgersmb, DSA-4963 openssl, DSA-4964 grilo, DSA-4965 libssh, DSA-4966 gpac, DSA-4967 squashfs-tools, DSA-4968 haproxy, DSA-4969 firefox-esr, DSA-4970 postorius, DSA-4971 ntfs-3g, …

fixapr: Prevent out-of-bounds array dereference

securityatftp: Fix buffer overflow [CVE-2021-41054]

fixautomysqlbackup: Fix crash when using LATEST=yes

fixbase-files: Update for the 11.1 point release

fixclamav: New upstream stable release; fix clamdscan segfaults when --fdpass and --multipass are used together with ExcludePath

fixcloud-init: Avoid duplicate includedir in /etc/sudoers

securitycyrus-imapd: Fix denial-of-service issue [CVE-2021-33582]

fixdazzdb: Fix a use-after-free in DBstats

fixdebian-edu-config: debian-edu-ltsp-install: extend main server related exclude list; add slapd and xrdp-sesman to the list of masked services

fixdebian-installer: Rebuild against proposed updates; update Linux ABI to 5.10.0-9; use udebs from proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates; use udebs from proposed-updates and stable; use xz-compressed Packages files

fixdetox: Fix handling of large files

fixdevscripts: Make the --bpo option target bullseye-backports

fixdlt-viewer: Add missing qdlt/qdlt*.h header files to dev package

fixdpdk: New upstream stable release

fixfetchmail: Fix segmentation fault and security regression

fixflatpak: New upstream stable release; don't inherit an unusual $XDG_RUNTIME_DIR setting into the sandbox

fixfreeradius: Fix thread crash and sample configuration

securityglewlwyd: Fix possible buffer overflow during FIDO2 signature validation in webauthn registration [CVE-2021-40818]

securitykrb5: Fix KDC null dereference crash on FAST request with no server field [CVE-2021-37750]; fix memory leak in krb5_gss_inquire_cred

securitylibslirp: Fix multiple buffer overflow issues [CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595]

securitylinux: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300]

securitylinux-signed-amd64: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300]

securitylinux-signed-arm64: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300]

securitylinux-signed-i386: New upstream stable release; increase ABI to 9; [rt] Update to 5.10.65-rt53; [mipsel] bpf, mips: Validate conditional branch offsets [CVE-2021-38300]

securitymariadb-10.5: New upstream stable release; security fixes [CVE-2021-2372 CVE-2021-2389]

securitymodsecurity-crs: Fix request body bypass issue [CVE-2021-35368]

securitynode-ansi-regex: Fix regular expression-based denial of service issue [CVE-2021-3807]

securitynode-axios: Fix regular expression-based denial of service issue [CVE-2021-3749]

securitynode-object-path: Fix prototype pollution issues [CVE-2021-23434 CVE-2021-3805]

securitynode-prismjs: Fix regular expression-based denial of service issue [CVE-2021-3801]

securitynode-set-value: Fix prototype pollution [CVE-2021-23440]

securitynode-tar: Remove non-directory paths from the directory cache [CVE-2021-32803]; strip absolute paths more comprehensively [CVE-2021-32804]

securitypostgresql-13: New upstream stable release; fix mis-planning of repeated application of a projection step [CVE-2021-3677]; disallow SSL renegotiation more completely

securityrequest-tracker4: Fix login timing side-channel attack issue [CVE-2021-38562]

securitysabnzbdplus: Prevent directory escape in renamer function [CVE-2021-29488]

securityshiro: Fix authentication bypass issues [CVE-2020-1957 CVE-2020-11989 CVE-2020-13933 CVE-2020-17510]; update Spring Framework compatibility patch; support Guice 4

securityublock-origin: New upstream stable release; fix denial of service issue [CVE-2021-36773]

securityulfius: Ensure memory is initialised before use [CVE-2021-40540]

+36 more items in the release notes