VersionDrift
Product

Debian GNU/Linux 12.11 → 12.15

4 releases · 0 breaking changes · 160 security fixes · 0 advisories fixed

160security0breaking0deprecated0feature0fix

Is 12.11 affected? · What changed up to 13.7

Breaking changes

None in the release notes.

Security changes

  • security 84 security advisories included: DLA-4627 kernel-wedge, DLA-4628 linux-base, DLA-4632 atril, DLA-4633 libreoffice, DLA-4635 firefox-esr, DLA-4636 thunderbird, DLA-4637 libconfig-inifiles-perl, DLA-4638 libgd-perl, DLA-4639 libhttp-daemon-perl, DLA-4642 u-boot, DLA-4643 imagemagick, … in 12.15
  • security 7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] in 12.15
  • security apache2: Fix HTTP/2 request DoS and file handle exhaustion [CVE-2026-49975 CVE-2026-48913]; fix proxy, DAV, LDAP, SSL, XML and header memory/crash issues [CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44185]; fix proxy FTP directory listing XSS… in 12.15
  • security beets: Fix XSS vulnerability [CVE-2026-42052]; fix build-time test failures in 12.15
  • security calibre: Fix various potential security issues; read resources only from book contents [CVE-2026-33206]; keep extracted files within container dir [CVE-2026-30853]; prevent reading background images from outside the config dir [CVE-2026-33205] in 12.15
  • security composer: Fix support for new GitHub token format [CVE-2026-45793] in 12.15
  • security curl: Fix cache poisoning issue [CVE-2025-10148]; fix data leak issues [CVE-2025-14524 CVE-2026-3783]; fix incorrect connection re-use issues [CVE-2025-14819 CVE-2026-3784 CVE-2026-5773 CVE-2026-7168] in 12.15
  • security dcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] in 12.15
  • security dhcpcd5: Fix NULL pointer dereference issue [CVE-2025-70102]; fix out-of-bounds write issue [CVE-2026-56114] in 12.15
  • security firewalld: Fix DBUS policy checking [CVE-2026-4948] in 12.15
  • security giflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] in 12.15
  • security graphite2: Fix out-of-bounds write [CVE-2026-50593] in 12.15
  • security ironic: Fix file disclosure via image sources [CVE-2025-44021]; fix console command injection [CVE-2026-42510]; fix Swift token disclosure [CVE-2026-42997]; fix unsafe template execution [CVE-2026-44916] in 12.15
  • security keystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] in 12.15
  • security libbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625] in 12.15
  • security libcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046] in 12.15
  • security libcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240] in 12.15
  • security libhtml-gumbo-perl: Fix uninitialized memory access [CVE-2025-15646] in 12.15
  • security libhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829] in 12.15
  • security libnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] in 12.15
  • security libvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] in 12.15
  • security libxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177] in 12.15
  • security libxml2: Fix catalogue recursion and duplicate-catalog handling [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; limit RelaxNG include recursion [CVE-2026-0989]; fix xmllint shell memory leak [CVE-2026-1757]; correct schematron regression-test outputs [CVE-2025-49794 CVE-2025-49796]; fix XML writer… in 12.15
  • security mariadb: New upstream stable release; fix code execution issues [CVE-2025-13699 CVE-2026-44168 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261]; fix denial of service issues [CVE-2026-21968 CVE-2026-34303]; fix logging bypass issue [CVE-2026-3494]; fix path traversal issue [CVE-2026-44171]; fix SQL… in 12.15
  • security mesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] in 12.15
  • security modsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] in 12.15
  • security mxml: Fix out-of-bounds read [CVE-2026-5037] in 12.15
  • security node-flatted: Fix prototype pollution issue [CVE-2026-33228] in 12.15
  • security openslide: Fix possible code execution issue [CVE-2026-48977] in 12.15
  • security p7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] in 12.15
  • security php-guzzlehttp-psr7: Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers in 12.15
  • security phpunit: Fix unsafe deserialization in PHPT code coverage handling [CVE-2026-24765] in 12.15
  • security protobuf: Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409] in 12.15
  • security pydantic: Fix denial of service in email verification [CVE-2024-3772] in 12.15
  • security pymatgen: Fix denial of service in GaussianInput.from_string [CVE-2022-42964] in 12.15
  • security python-filelock: Fix symlink vulnerabilies [CVE-2025-68146 CVE-2026-22701] in 12.15
  • security python-markdown: Fix parsing of bogus HTML markup [CVE-2025-69534] in 12.15
  • security python-pyramid: Fix information disclosure issue [CVE-2023-40587] in 12.15
  • security python-xmltodict: Fix XML injection issue [CVE-2025-9375] in 12.15
  • security python3.11: Prevent incorrect tar archive handling [CVE-2025-13462]; ensure bytecode-only imports use normal security checks [CVE-2026-2297]; reject unsafe cookie values [CVE-2026-3644]; prevent XML parser crashes [CVE-2026-4224]; prevent browser command injection [CVE-2026-4519]; prevent bz2/lzma… in 12.15
  • security 131 security advisories included: DSA-6003 firefox-esr, DSA-6025 firefox-esr, DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 12.14
  • security 7zip: New upstream stable release; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links… in 12.14
  • security apache2: New upstream release: fix http2 regression; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue… in 12.14
  • security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 12.14
  • security augeas: Fix NULL pointer dereference issue [CVE-2025-2588] in 12.14
  • security awstats: Prevent command injection [CVE-2025-63261] in 12.14
  • security busybox: Fix stack overflow [CVE-2022-48174] and use-after-free [CVE-2023-42363 CVE-2023-42364 CVE-2023-42365] errors in 12.14
  • security c3p0: Fix recursive entity expansion issue [CVE-2019-5427] in 12.14
  • security calibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] in 12.14
  • security composer: Fix code execution issue [CVE-2023-43655]; fix command injection issues [CVE-2026-40261 CVE-2026-40176] in 12.14
  • security containerd: Fix CRI Attach implementation [CVE-2025-64329]; fix overly broad directory permissions [CVE-2024-25621]; fix large UID:GID (> 32bit) overflow [CVE-2024-40635] in 12.14
  • security dovecot: Correct incomplete backport of CVE-2026-27855 fix; fix memory leak in CVE-2026-27857 fix in 12.14
  • security dpkg: New upstream stable release; fix insufficient permissions check leading to possible denial of service issue [CVE-2025-6297]; fix denial of service issue [CVE-2026-2219]; fix buffer over-read issue; fix uninitialized variable warning with Rules-Requires-Root; fix segmentation fault in… in 12.14
  • security erlang: Fix denial of service issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix HTTP request smuggling issue [CVE-2026-23941]; fix path traversal issues [CVE-2026-23942 CVE-2026-21620]; fix compression bomb issue [CVE-2026-23943] in 12.14
  • security exim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] in 12.14
  • security fonttools: Fix XML External Entity injection issue [CVE-2023-45139]; fix code execution issue [CVE-2025-66034] in 12.14
  • security glance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure in 12.14
  • security glib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode… in 12.14
  • security glibc: Fix integer overflow issue [CVE-2026-0861]; fix uninitialised memory use issue [CVE-2025-15281]; fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix performance bottleneck with ASAN on… in 12.14
  • security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix integer underflow issue [CVE-2025-67269] in 12.14
  • security grub-efi-amd64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
  • security grub-efi-arm64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
  • security grub-efi-ia32-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
  • security grub2: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix commands/extcmd:… in 12.14
  • security gvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] in 12.14
  • security kissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] in 12.14
  • security libarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] in 12.14
  • security libcap2: Fix time of check / time of use issue [CVE-2026-4878]; rebuild with updated glibc in 12.14
  • security libexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] in 12.14
  • security libnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] in 12.14
  • security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 12.14
  • security libreoffice: Fix incomplete fix for CVE-2024-12426 in 12.14
  • security libuev: Fix buffer overrun issue [CVE-2022-48620] in 12.14
  • security libvncserver: Fix out-of-bounds read issue [CVE-2026-32853]; fix null pointer dereference issue [CVE-2026-32854] in 12.14
  • security libxml-security-java: Fix private key disclosure issue [CVE-2023-44483] in 12.14
  • security lxc: Fix authorisation bypass issue [CVE-2026-39402] in 12.14
  • security mapserver: Fix SQL injection issue [CVE-2025-59431]; fix buffer overflow issue [CVE-2026-33721]; fix heap-buffer-overflow and double-free issues in maplexer in 12.14
  • security modsecurity-crs: Fix rule bypass issue [CVE-2023-38199]; fix file extension blocking bypass issue [CVE-2026-33691] in 12.14
  • security mongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files in 12.14
  • security nginx: Fix buffer overflow issues [CVE-2026-27654 CVE-2026-27784 CVE-2026-32647]; fix session authentication issues [CVE-2026-27651 CVE-2026-28753]; fix OCSP result bypass issue [CVE-2026-28755]; use $host instead of $http_host in 12.14
  • security 77 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, DSA-6003 firefox-esr, DSA-6004 chromium, … in 12.13
  • security angular.js: Fix regular expression-based denial of service issues [CVE-2022-25844 CVE-2023-26116 CVE-2023-26117 CVE-2023-26118]; fix restriction bypass issues [CVE-2024-8372 CVE-2024-8373]; fix denial of service issue [CVE-2024-21490]; fix improper sanitization issues [CVE-2025-0716 CVE-2025-2336] in 12.13
  • security apache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200] in 12.13
  • security calibre: Fix code execution issue [CVE-2025-64486] in 12.13
  • security composer: Fix ANSI sequence injection [CVE-2025-67746] in 12.13
  • security cups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524] in 12.13
  • security freerdp2: New upstream release; fix multiple memory-safety vulnerabilities: integer overflow/underflow and out-of-bounds write in NSC, Clear, and GDI bitmap codecs [CVE-2024-22211 CVE-2024-32037 CVE-2024-32038 CVE-2024-32039 CVE-2024-32040]; out-of-bounds reads in ZGFX, Planar, NCRUSH,… in 12.13
  • security gdk-pixbuf: Fix buffer overflow issue [CVE-2025-7345] in 12.13
  • security git: Fix arbitrary file creation/truncation in gitk [CVE-2025-27613]; prevent arbitrary file overwrite in git-gui with crafted directory names [CVE-2025-46835]; correct submodule path parsing with trailing CR [CVE-2025-48384]; validate bundle-uri to prevent protocol injection during clone… in 12.13
  • security glib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512] in 12.13
  • security gnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename in 12.13
  • security imagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-62171 CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950] in 12.13
  • security lemonldap-ng: Fix sessions tablename when not default; fix oidc flow when user encountered an error on server side; fix Kerberos JavaScript when used with Choice; improve CORS checking; fix path_info handling; fix shell injection issue [CVE-2025-59518]; hide session id from Ajax responses in 12.13
  • security libcommons-lang-java: Fix uncontrolled recursion issue [CVE-2025-48924] in 12.13
  • security libcommons-lang3-java: Fix uncontrolled recursion issue [CVE-2025-48924] in 12.13
  • security libhtp: Fix denial of service issue via unbounded HTTP header processing [CVE-2024-23837 CVE-2024-45797] in 12.13
  • security libnginx-mod-http-lua: Fix HTTP HEAD request smuggling [CVE-2024-33452] in 12.13
  • security libphp-adodb: Fix SQL injection in sqlite and sqlite3 metadata lookups [CVE-2025-54119] in 12.13
  • security libssh: Fix integer overflow issue [CVE-2025-4877]; fix use of uninitialized variable [CVE-2025-4878]; fix out of bounds memory access issue [CVE-2025-5318]; fix double free issue [CVE-2025-5351]; fix use of uninitialized memory [CVE-2025-5372 CVE-2025-5987]; fix null pointer dereference issue… in 12.13
  • security libxml2: Fix denial of service issue [CVE-2025-9714] in 12.13
  • security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 12.13
  • security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 12.13
  • security modsecurity-apache: Fix request body error handling to propagate Apache filter/read failures correctly [CVE-2025-54571]; map request body read failures to appropriate HTTP status codes; simplify request body error propagation in mod_security2 in 12.13
  • security mongo-c-driver: Avoid invalid memory reads [CVE-2025-12119] in 12.13
  • security mydumper: Fix arbitrary file read issue [CVE-2025-30224] in 12.13
  • security nvidia-graphics-drivers: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286] in 12.13
  • security nvidia-open-gpu-kernel-modules: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286] in 12.13
  • security open-vm-tools: Disable SDMP service version collection by default to mitigate local privilege escalation [CVE-2025-41244] in 12.13
  • security openrefine: Fix MySQL host parameter injection in JDBC URL parsing [CVE-2024-23833]; fix reflected XSS in gdata OAuth callback handler [CVE-2024-47878]; fix content-type confusion XSS in ExportRows endpoint [CVE-2024-47880]; prevent remote or extension loading via SQLite connection URL… in 12.13
  • security pam: Fix local privilege escalation in pam_namespace [CVE-2025-6020] in 12.13
  • security pgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]; fix expired password use issue [CVE-2025-2291] in 12.13
  • security postgresql-15: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818] in 12.13
  • security qemu: New upstream stable release; fix qemu-img info https://example.com; fix migration of guests using virtio-net; fix use after free issue [CVE-2025-11234] in 12.13
  • security r-cran-gh: Fix sensitive data leak issue [CVE-2025-54956] in 12.13
  • security rear: Prevent created initrd from being world-readable when GRUB_RESCUE=y [CVE-2024-23301] in 12.13
  • security rlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075] in 12.13
  • security rsync: Improve test coverage for future updates; fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158] in 12.13
  • security ruby-sinatra: Fix regular expression-based denial of service issue [CVE-2025-61921] in 12.13
  • security samba: Fix information leak issue [CVE-2018-14628]; fix command injection issue [CVE-2025-10230]; fix uninitialized memory disclosure issue [CVE-2025-9640] in 12.13
  • security sogo: Fix HTML injection issue [CVE-2023-48104]; fix CSS injection issue [CVE-2024-24510]; fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]; fix crash on invalid mailIdentities in 12.13
  • security 75 security advisories included: DSA-5914 chromium, DSA-5916 chromium, DSA-5918 varnish, DSA-5919 open-vm-tools, DSA-5920 chromium, DSA-5921 thunderbird, DSA-5922 firefox-esr, DSA-5923 net-tools, DSA-5924 intel-microcode, DSA-5925 linux-signed-amd64 +3, DSA-5926 firefox-esr, … in 12.12
  • security amd64-microcode: Update AMD-SEV firmware [CVE-2024-56161]; update included microcode in 12.12
  • security apache2: New upstream stable release; fix HTTP response splitting issue [CVE-2024-42516]; fix server-side request forgery issue [CVE-2024-43204 CVE-2024-43394]; fix log injection issue [CVE-2024-47252]; fix access control bypass issue [CVE-2025-23048]; fix denial of service issue [CVE-2025-49630];… in 12.12
  • security botan: Fix denial of service issues [CVE-2024-34702 CVE-2024-34703]; fix improper parsing of name constraints [CVE-2024-39312]; fix compiler-induced secret-dependent operation issue [CVE-2024-50383] in 12.12
  • security cjson: Fix denial of service issue [CVE-2023-26819]; fix buffer overflow issue [CVE-2023-53154] in 12.12
  • security clamav: New upstream stable release; fix buffer overflow issues [CVE-2025-20128 CVE-2025-20260] in 12.12
  • security cloud-init: Make hotplug socket writable only by root [CVE-2024-11584]; don't attempt to identify non-x86 OpenStack instances [CVE-2024-6174] in 12.12
  • security commons-beanutils: Fix improper access control issue [CVE-2025-48734] in 12.12
  • security commons-vfs: Fix path traversal issue [CVE-2025-27553] in 12.12
  • security corosync: Fix buffer overflow vulnerability on large UDP packets [CVE-2025-30472] in 12.12
  • security djvulibre: Fix denial of service issues [CVE-2021-46310 CVE-2021-46312] in 12.12
  • security dropbear: Fix shell injection vulnerability in multihop handling [CVE-2025-47203] in 12.12
  • security erlang: ssh: fix strict KEX hardening [CVE-2025-46712]; zip: sanitize pathnames when extracting files with absolute pathnames [CVE-2025-4748]; fix documentation build failure with newer xsltproc versions in 12.12
  • security expat: Fix denial of service issues [CVE-2023-52425 CVE-2024-8176]; fix parser crash [CVE-2024-50602] in 12.12
  • security fig2dev: Detect nan in spline control values [CVE-2025-46397]; permit \0 in 2nd line in fig file [CVE-2025-46398]; ge output: correct spline computation [CVE-2025-46399]; reject arcs with a radius smaller than 3 [CVE-2025-46400] in 12.12
  • security firebird3.0: Fix NULL pointer dereference issue [CVE-2025-54989] in 12.12
  • security fort-validator: Fix denial of service issues [CVE-2024-45234 CVE-2024-45235 CVE-2024-45236 CVE-2024-45238 CVE-2024-45239 CVE-2024-48943]; fix buffer overflow issue [CVE-2024-45237] in 12.12
  • security glib2.0: Fix buffer underflow issue [CVE-2025-4373 CVE-2025-7039]; improve upgrade safety in 12.12
  • security glibc: Fix incorrect LD_LIBRARY_PATH search in dlopen for static setuid binaries [CVE-2025-4802]; improve memory layout of structures in exp/exp10/expf functions; add an SVE implementation of memset on aarch64; improve generic implementation of memset on aarch64; fix double free issue… in 12.12
  • security golang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211] in 12.12
  • security gst-plugins-base1.0: Fix buffer overrun issue [CVE-2025-47806]; fix NULL pointer dereference issues [CVE-2025-47807 CVE-2025-47808] in 12.12
  • security gst-plugins-good1.0: Fix possible information disclosure issue [CVE-2025-47219] in 12.12
  • security iperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350] in 12.12
  • security jinja2: Fix arbitrary code execution issue [CVE-2025-27516] in 12.12
  • security jq: Zero-terminate string in jv.c [CVE-2025-48060] in 12.12
  • security kmail-account-wizard: Fix man in the middle attack issue [CVE-2024-50624] in 12.12
  • security krb5: Fix message tampering issue [CVE-2025-3576]; disable issuance of tickets using RC4 or triple-DES session keys by default in 12.12
  • security kubernetes: Sanitise raw data output to terminal [CVE-2021-25743]; hide long and multi-line strings when printing in 12.12
  • security libarchive: Fix integer overflow issues [CVE-2025-5914 CVE-2025-5916], buffer over read issue [CVE-2025-5915], buffer overlow issue [CVE-2025-5917] in 12.12
  • security libcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927] in 12.12
  • security libfcgi: Fix integer overflow issue [CVE-2025-23016] in 12.12
  • security libphp-adodb: Fix SQL injection vulnerability in pg_insert_id() [CVE-2025-46337] in 12.12
  • security libraw: Fix out-of-bounds read issues [CVE-2025-43961 CVE-2025-43962 CVE-2025-43963]; enforce minimum w0 and w1 values [CVE-2025-43964] in 12.12
  • security libsndfile: Fix integer overflow issues [CVE-2022-33065]; fix out of bounds read issue [CVE-2024-50612] in 12.12
  • security libsoup3: New upstream bug-fix release; fix buffer overrun issue [CVE-2024-52531]; fix denial of service issues [CVE-2024-52532 CVE-2025-32051]; fix heap overflow issues [CVE-2025-32052 CVE-2025-32053]; fix integer overflow issue [CVE-2025-32050]; fix heap buffer overflow issues [CVE-2025-2784];… in 12.12
  • security libtpms: Fix out of bounds read issue [CVE-2025-49133] in 12.12
  • security libxml2: Fix integer overflow issue in xmlBuildQName [CVE-2025-6021]; fix potential buffer overflows in the interactive shell [CVE-2025-6170]; fix use-after-free issue in xmlSchematronReportOutput [CVE-2025-49794]; fix type confusion issue in xmlSchematronReportOutput [CVE-2025-49796] in 12.12
  • security libyaml-libyaml-perl: Fix arbitrary file edit issue [CVE-2025-40908] in 12.12
  • security luajit: Fix buffer overflow issue [CVE-2024-25176]; fix denial of service issue [CVE-2024-25177]; fix out-of-bounds read issue [CVE-2024-25178] in 12.12
  • security mariadb: New upstream stable release; security fixes [CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-30693 CVE-2025-30722]; fix restart after out of memory; new upstream stable release; fix variable name in debian-start.sh in 12.12

Every release in between

12.15 Jul 11, 2026 Release notes ↗
security84 security advisories included: DLA-4627 kernel-wedge, DLA-4628 linux-base, DLA-4632 atril, DLA-4633 libreoffice, DLA-4635 firefox-esr, DLA-4636 thunderbird, DLA-4637 libconfig-inifiles-perl, DLA-4638 libgd-perl, DLA-4639 libhttp-daemon-perl, DLA-4642 u-boot, DLA-4643 imagemagick, …
security7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104]
securityapache2: Fix HTTP/2 request DoS and file handle exhaustion [CVE-2026-49975 CVE-2026-48913]; fix proxy, DAV, LDAP, SSL, XML and header memory/crash issues [CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44185]; fix proxy FTP directory listing XSS…
securitybeets: Fix XSS vulnerability [CVE-2026-42052]; fix build-time test failures
securitycalibre: Fix various potential security issues; read resources only from book contents [CVE-2026-33206]; keep extracted files within container dir [CVE-2026-30853]; prevent reading background images from outside the config dir [CVE-2026-33205]
securitycomposer: Fix support for new GitHub token format [CVE-2026-45793]
securitycurl: Fix cache poisoning issue [CVE-2025-10148]; fix data leak issues [CVE-2025-14524 CVE-2026-3783]; fix incorrect connection re-use issues [CVE-2025-14819 CVE-2026-3784 CVE-2026-5773 CVE-2026-7168]
securitydcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805]
securitydhcpcd5: Fix NULL pointer dereference issue [CVE-2025-70102]; fix out-of-bounds write issue [CVE-2026-56114]
securityfirewalld: Fix DBUS policy checking [CVE-2026-4948]
securitygiflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740]
securitygraphite2: Fix out-of-bounds write [CVE-2026-50593]
securityironic: Fix file disclosure via image sources [CVE-2025-44021]; fix console command injection [CVE-2026-42510]; fix Swift token disclosure [CVE-2026-42997]; fix unsafe template execution [CVE-2026-44916]
securitykeystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551]
securitylibbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625]
securitylibcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046]
securitylibcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240]
securitylibhtml-gumbo-perl: Fix uninitialized memory access [CVE-2025-15646]
securitylibhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829]
securitylibnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191]
securitylibvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538]
securitylibxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177]
securitylibxml2: Fix catalogue recursion and duplicate-catalog handling [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; limit RelaxNG include recursion [CVE-2026-0989]; fix xmllint shell memory leak [CVE-2026-1757]; correct schematron regression-test outputs [CVE-2025-49794 CVE-2025-49796]; fix XML writer…
securitymariadb: New upstream stable release; fix code execution issues [CVE-2025-13699 CVE-2026-44168 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261]; fix denial of service issues [CVE-2026-21968 CVE-2026-34303]; fix logging bypass issue [CVE-2026-3494]; fix path traversal issue [CVE-2026-44171]; fix SQL…
securitymesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393]
securitymodsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268]
securitymxml: Fix out-of-bounds read [CVE-2026-5037]
securitynode-flatted: Fix prototype pollution issue [CVE-2026-33228]
securityopenslide: Fix possible code execution issue [CVE-2026-48977]
securityp7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104]
securityphp-guzzlehttp-psr7: Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers
securityphpunit: Fix unsafe deserialization in PHPT code coverage handling [CVE-2026-24765]
securityprotobuf: Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409]
securitypydantic: Fix denial of service in email verification [CVE-2024-3772]
securitypymatgen: Fix denial of service in GaussianInput.from_string [CVE-2022-42964]
securitypython-filelock: Fix symlink vulnerabilies [CVE-2025-68146 CVE-2026-22701]
securitypython-markdown: Fix parsing of bogus HTML markup [CVE-2025-69534]
securitypython-pyramid: Fix information disclosure issue [CVE-2023-40587]
securitypython-xmltodict: Fix XML injection issue [CVE-2025-9375]
securitypython3.11: Prevent incorrect tar archive handling [CVE-2025-13462]; ensure bytecode-only imports use normal security checks [CVE-2026-2297]; reject unsafe cookie values [CVE-2026-3644]; prevent XML parser crashes [CVE-2026-4224]; prevent browser command injection [CVE-2026-4519]; prevent bz2/lzma…
+49 more items in the release notes
12.14 May 16, 2026 Release notes ↗
security131 security advisories included: DSA-6003 firefox-esr, DSA-6025 firefox-esr, DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …
security7zip: New upstream stable release; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links…
securityapache2: New upstream release: fix http2 regression; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue…
securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]
securityaugeas: Fix NULL pointer dereference issue [CVE-2025-2588]
securityawstats: Prevent command injection [CVE-2025-63261]
securitybusybox: Fix stack overflow [CVE-2022-48174] and use-after-free [CVE-2023-42363 CVE-2023-42364 CVE-2023-42365] errors
securityc3p0: Fix recursive entity expansion issue [CVE-2019-5427]
securitycalibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824]
securitycomposer: Fix code execution issue [CVE-2023-43655]; fix command injection issues [CVE-2026-40261 CVE-2026-40176]
securitycontainerd: Fix CRI Attach implementation [CVE-2025-64329]; fix overly broad directory permissions [CVE-2024-25621]; fix large UID:GID (> 32bit) overflow [CVE-2024-40635]
securitydovecot: Correct incomplete backport of CVE-2026-27855 fix; fix memory leak in CVE-2026-27857 fix
securitydpkg: New upstream stable release; fix insufficient permissions check leading to possible denial of service issue [CVE-2025-6297]; fix denial of service issue [CVE-2026-2219]; fix buffer over-read issue; fix uninitialized variable warning with Rules-Requires-Root; fix segmentation fault in…
securityerlang: Fix denial of service issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix HTTP request smuggling issue [CVE-2026-23941]; fix path traversal issues [CVE-2026-23942 CVE-2026-21620]; fix compression bomb issue [CVE-2026-23943]
securityexim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687]
securityfonttools: Fix XML External Entity injection issue [CVE-2023-45139]; fix code execution issue [CVE-2025-66034]
securityglance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure
securityglib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode…
securityglibc: Fix integer overflow issue [CVE-2026-0861]; fix uninitialised memory use issue [CVE-2025-15281]; fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix performance bottleneck with ASAN on…
securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix integer underflow issue [CVE-2025-67269]
securitygrub-efi-amd64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…
securitygrub-efi-arm64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…
securitygrub-efi-ia32-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…
securitygrub2: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix commands/extcmd:…
securitygvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296]
securitykissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445]
securitylibarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121]
securitylibcap2: Fix time of check / time of use issue [CVE-2026-4878]; rebuild with updated glibc
securitylibexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385]
securitylibnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199]
securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]
securitylibreoffice: Fix incomplete fix for CVE-2024-12426
securitylibuev: Fix buffer overrun issue [CVE-2022-48620]
securitylibvncserver: Fix out-of-bounds read issue [CVE-2026-32853]; fix null pointer dereference issue [CVE-2026-32854]
securitylibxml-security-java: Fix private key disclosure issue [CVE-2023-44483]
securitylxc: Fix authorisation bypass issue [CVE-2026-39402]
securitymapserver: Fix SQL injection issue [CVE-2025-59431]; fix buffer overflow issue [CVE-2026-33721]; fix heap-buffer-overflow and double-free issues in maplexer
securitymodsecurity-crs: Fix rule bypass issue [CVE-2023-38199]; fix file extension blocking bypass issue [CVE-2026-33691]
securitymongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files
securitynginx: Fix buffer overflow issues [CVE-2026-27654 CVE-2026-27784 CVE-2026-32647]; fix session authentication issues [CVE-2026-27651 CVE-2026-28753]; fix OCSP result bypass issue [CVE-2026-28755]; use $host instead of $http_host
+60 more items in the release notes
12.13 Jan 10, 2026 Release notes ↗
security77 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, DSA-6003 firefox-esr, DSA-6004 chromium, …
securityangular.js: Fix regular expression-based denial of service issues [CVE-2022-25844 CVE-2023-26116 CVE-2023-26117 CVE-2023-26118]; fix restriction bypass issues [CVE-2024-8372 CVE-2024-8373]; fix denial of service issue [CVE-2024-21490]; fix improper sanitization issues [CVE-2025-0716 CVE-2025-2336]
securityapache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200]
securitycalibre: Fix code execution issue [CVE-2025-64486]
securitycomposer: Fix ANSI sequence injection [CVE-2025-67746]
securitycups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524]
securityfreerdp2: New upstream release; fix multiple memory-safety vulnerabilities: integer overflow/underflow and out-of-bounds write in NSC, Clear, and GDI bitmap codecs [CVE-2024-22211 CVE-2024-32037 CVE-2024-32038 CVE-2024-32039 CVE-2024-32040]; out-of-bounds reads in ZGFX, Planar, NCRUSH,…
securitygdk-pixbuf: Fix buffer overflow issue [CVE-2025-7345]
securitygit: Fix arbitrary file creation/truncation in gitk [CVE-2025-27613]; prevent arbitrary file overwrite in git-gui with crafted directory names [CVE-2025-46835]; correct submodule path parsing with trailing CR [CVE-2025-48384]; validate bundle-uri to prevent protocol injection during clone…
securityglib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]
securitygnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename
securityimagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-62171 CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]
securitylemonldap-ng: Fix sessions tablename when not default; fix oidc flow when user encountered an error on server side; fix Kerberos JavaScript when used with Choice; improve CORS checking; fix path_info handling; fix shell injection issue [CVE-2025-59518]; hide session id from Ajax responses
securitylibcommons-lang-java: Fix uncontrolled recursion issue [CVE-2025-48924]
securitylibcommons-lang3-java: Fix uncontrolled recursion issue [CVE-2025-48924]
securitylibhtp: Fix denial of service issue via unbounded HTTP header processing [CVE-2024-23837 CVE-2024-45797]
securitylibnginx-mod-http-lua: Fix HTTP HEAD request smuggling [CVE-2024-33452]
securitylibphp-adodb: Fix SQL injection in sqlite and sqlite3 metadata lookups [CVE-2025-54119]
securitylibssh: Fix integer overflow issue [CVE-2025-4877]; fix use of uninitialized variable [CVE-2025-4878]; fix out of bounds memory access issue [CVE-2025-5318]; fix double free issue [CVE-2025-5351]; fix use of uninitialized memory [CVE-2025-5372 CVE-2025-5987]; fix null pointer dereference issue…
securitylibxml2: Fix denial of service issue [CVE-2025-9714]
securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]
securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]
securitymodsecurity-apache: Fix request body error handling to propagate Apache filter/read failures correctly [CVE-2025-54571]; map request body read failures to appropriate HTTP status codes; simplify request body error propagation in mod_security2
securitymongo-c-driver: Avoid invalid memory reads [CVE-2025-12119]
securitymydumper: Fix arbitrary file read issue [CVE-2025-30224]
securitynvidia-graphics-drivers: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]
securitynvidia-open-gpu-kernel-modules: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]
securityopen-vm-tools: Disable SDMP service version collection by default to mitigate local privilege escalation [CVE-2025-41244]
securityopenrefine: Fix MySQL host parameter injection in JDBC URL parsing [CVE-2024-23833]; fix reflected XSS in gdata OAuth callback handler [CVE-2024-47878]; fix content-type confusion XSS in ExportRows endpoint [CVE-2024-47880]; prevent remote or extension loading via SQLite connection URL…
securitypam: Fix local privilege escalation in pam_namespace [CVE-2025-6020]
securitypgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]; fix expired password use issue [CVE-2025-2291]
securitypostgresql-15: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]
securityqemu: New upstream stable release; fix qemu-img info https://example.com; fix migration of guests using virtio-net; fix use after free issue [CVE-2025-11234]
securityr-cran-gh: Fix sensitive data leak issue [CVE-2025-54956]
securityrear: Prevent created initrd from being world-readable when GRUB_RESCUE=y [CVE-2024-23301]
securityrlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]
securityrsync: Improve test coverage for future updates; fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]
securityruby-sinatra: Fix regular expression-based denial of service issue [CVE-2025-61921]
securitysamba: Fix information leak issue [CVE-2018-14628]; fix command injection issue [CVE-2025-10230]; fix uninitialized memory disclosure issue [CVE-2025-9640]
securitysogo: Fix HTML injection issue [CVE-2023-48104]; fix CSS injection issue [CVE-2024-24510]; fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]; fix crash on invalid mailIdentities
+57 more items in the release notes
12.12 Sep 6, 2025 Release notes ↗
security75 security advisories included: DSA-5914 chromium, DSA-5916 chromium, DSA-5918 varnish, DSA-5919 open-vm-tools, DSA-5920 chromium, DSA-5921 thunderbird, DSA-5922 firefox-esr, DSA-5923 net-tools, DSA-5924 intel-microcode, DSA-5925 linux-signed-amd64 +3, DSA-5926 firefox-esr, …
securityamd64-microcode: Update AMD-SEV firmware [CVE-2024-56161]; update included microcode
securityapache2: New upstream stable release; fix HTTP response splitting issue [CVE-2024-42516]; fix server-side request forgery issue [CVE-2024-43204 CVE-2024-43394]; fix log injection issue [CVE-2024-47252]; fix access control bypass issue [CVE-2025-23048]; fix denial of service issue [CVE-2025-49630];…
securitybotan: Fix denial of service issues [CVE-2024-34702 CVE-2024-34703]; fix improper parsing of name constraints [CVE-2024-39312]; fix compiler-induced secret-dependent operation issue [CVE-2024-50383]
securitycjson: Fix denial of service issue [CVE-2023-26819]; fix buffer overflow issue [CVE-2023-53154]
securityclamav: New upstream stable release; fix buffer overflow issues [CVE-2025-20128 CVE-2025-20260]
securitycloud-init: Make hotplug socket writable only by root [CVE-2024-11584]; don't attempt to identify non-x86 OpenStack instances [CVE-2024-6174]
securitycommons-beanutils: Fix improper access control issue [CVE-2025-48734]
securitycommons-vfs: Fix path traversal issue [CVE-2025-27553]
securitycorosync: Fix buffer overflow vulnerability on large UDP packets [CVE-2025-30472]
securitydjvulibre: Fix denial of service issues [CVE-2021-46310 CVE-2021-46312]
securitydropbear: Fix shell injection vulnerability in multihop handling [CVE-2025-47203]
securityerlang: ssh: fix strict KEX hardening [CVE-2025-46712]; zip: sanitize pathnames when extracting files with absolute pathnames [CVE-2025-4748]; fix documentation build failure with newer xsltproc versions
securityexpat: Fix denial of service issues [CVE-2023-52425 CVE-2024-8176]; fix parser crash [CVE-2024-50602]
securityfig2dev: Detect nan in spline control values [CVE-2025-46397]; permit \0 in 2nd line in fig file [CVE-2025-46398]; ge output: correct spline computation [CVE-2025-46399]; reject arcs with a radius smaller than 3 [CVE-2025-46400]
securityfirebird3.0: Fix NULL pointer dereference issue [CVE-2025-54989]
securityfort-validator: Fix denial of service issues [CVE-2024-45234 CVE-2024-45235 CVE-2024-45236 CVE-2024-45238 CVE-2024-45239 CVE-2024-48943]; fix buffer overflow issue [CVE-2024-45237]
securityglib2.0: Fix buffer underflow issue [CVE-2025-4373 CVE-2025-7039]; improve upgrade safety
securityglibc: Fix incorrect LD_LIBRARY_PATH search in dlopen for static setuid binaries [CVE-2025-4802]; improve memory layout of structures in exp/exp10/expf functions; add an SVE implementation of memset on aarch64; improve generic implementation of memset on aarch64; fix double free issue…
securitygolang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211]
securitygst-plugins-base1.0: Fix buffer overrun issue [CVE-2025-47806]; fix NULL pointer dereference issues [CVE-2025-47807 CVE-2025-47808]
securitygst-plugins-good1.0: Fix possible information disclosure issue [CVE-2025-47219]
securityiperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350]
securityjinja2: Fix arbitrary code execution issue [CVE-2025-27516]
securityjq: Zero-terminate string in jv.c [CVE-2025-48060]
securitykmail-account-wizard: Fix man in the middle attack issue [CVE-2024-50624]
securitykrb5: Fix message tampering issue [CVE-2025-3576]; disable issuance of tickets using RC4 or triple-DES session keys by default
securitykubernetes: Sanitise raw data output to terminal [CVE-2021-25743]; hide long and multi-line strings when printing
securitylibarchive: Fix integer overflow issues [CVE-2025-5914 CVE-2025-5916], buffer over read issue [CVE-2025-5915], buffer overlow issue [CVE-2025-5917]
securitylibcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927]
securitylibfcgi: Fix integer overflow issue [CVE-2025-23016]
securitylibphp-adodb: Fix SQL injection vulnerability in pg_insert_id() [CVE-2025-46337]
securitylibraw: Fix out-of-bounds read issues [CVE-2025-43961 CVE-2025-43962 CVE-2025-43963]; enforce minimum w0 and w1 values [CVE-2025-43964]
securitylibsndfile: Fix integer overflow issues [CVE-2022-33065]; fix out of bounds read issue [CVE-2024-50612]
securitylibsoup3: New upstream bug-fix release; fix buffer overrun issue [CVE-2024-52531]; fix denial of service issues [CVE-2024-52532 CVE-2025-32051]; fix heap overflow issues [CVE-2025-32052 CVE-2025-32053]; fix integer overflow issue [CVE-2025-32050]; fix heap buffer overflow issues [CVE-2025-2784];…
securitylibtpms: Fix out of bounds read issue [CVE-2025-49133]
securitylibxml2: Fix integer overflow issue in xmlBuildQName [CVE-2025-6021]; fix potential buffer overflows in the interactive shell [CVE-2025-6170]; fix use-after-free issue in xmlSchematronReportOutput [CVE-2025-49794]; fix type confusion issue in xmlSchematronReportOutput [CVE-2025-49796]
securitylibyaml-libyaml-perl: Fix arbitrary file edit issue [CVE-2025-40908]
securityluajit: Fix buffer overflow issue [CVE-2024-25176]; fix denial of service issue [CVE-2024-25177]; fix out-of-bounds read issue [CVE-2024-25178]
securitymariadb: New upstream stable release; security fixes [CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-30693 CVE-2025-30722]; fix restart after out of memory; new upstream stable release; fix variable name in debian-start.sh
+96 more items in the release notes
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status