Debian GNU/Linux 12.2 → 13.7

19 releases · 0 breaking changes · 625 security fixes · 0 advisories fixed

625security0breaking0deprecated0feature135fix

Is 12.2 affected?

Breaking changes

None in the release notes.

Security changes

security 92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, … in 13.7
security alsa-lib: Fix heap overflow issue [CVE-2026-25068] in 13.7
security ansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332] in 13.7
security bettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default in 13.7
security binwalk: Fix path traversal issue [CVE-2026-7179] in 13.7
security cyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088] in 13.7
security dcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868] in 13.7
security dhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258] in 13.7
security dnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969] in 13.7
security flask: Ensure Vary: Cookie is set on session access [CVE-2026-27205] in 13.7
security fluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714] in 13.7
security glib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue… in 13.7
security glibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers in 13.7
security goaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777] in 13.7
security gpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122] in 13.7
security gzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992] in 13.7
security imagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871… in 13.7
security incus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501] in 13.7
security libhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017] in 13.7
security libio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962] in 13.7
security libmongocrypt: Fix missing input validation issue [CVE-2026-81523] in 13.7
security libnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942] in 13.7
security libnfs: Fix integer overflow [CVE-2026-53689] in 13.7
security libraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660] in 13.7
security libsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
security libsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
security libsocket-perl: Fix out of bounds read issue [CVE-2026-12087] in 13.7
security libssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034] in 13.7
security libvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623] in 13.7
security libwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161] in 13.7
security lwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836] in 13.7
security mbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow… in 13.7
security mongo-c-driver: Fix missing input validation issue [CVE-2026-81524] in 13.7
security mrtg: Fix privilege escalation issue [CVE-2026-72694] in 13.7
security node-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800] in 13.7
security onionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706] in 13.7
security opencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253] in 13.7
security patool: Fix path traversal vulnerability [CVE-2026-29509] in 13.7
security perl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix… in 13.7
security php-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766] in 13.7
security 109 security advisories included: DSA-6250 chromium, DSA-6256 php8.4, DSA-6266 nghttp2, DSA-6267 thunderbird, DSA-6268 ffmpeg, DSA-6270 postgresql-17, DSA-6271 gsasl, DSA-6273 chromium, DSA-6274 linux-signed-amd64 +2, DSA-6277 openjpeg2, DSA-6278 nginx, DSA-6279 redis, DSA-6280 netatalk, … in 13.6
security apache2: Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of service issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues… in 13.6
security beets: Fix XSS vulnerability [CVE-2026-42052] in 13.6
security calibre: Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader-background endpoint path… in 13.6
security ckermit: Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check in 13.6
security composer: Fix support for new GitHub token format [CVE-2026-45793] in 13.6
security curl: Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use-after-free and… in 13.6
security dcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] in 13.6
security debusine: Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853] in 13.6
security deepdiff: Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155] in 13.6
security dhcpcd: Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117] in 13.6
security dolphin: Fix sandbox escape issue [CVE-2026-41525] in 13.6
security errands: Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063] in 13.6
security gdown: Fix arbitray file write issue [CVE-2026-40491] in 13.6
security giflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] in 13.6
security gimp: Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915] in 13.6
security graphite2: Fix out-of-bounds write [CVE-2026-50593] in 13.6
security ironic: Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths;… in 13.6
security isc-kea: Fix denial of service issue [CVE-2026-3608] in 13.6
security keystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] in 13.6
security libapache-session-browseable-perl: Improve entropy source [CVE-2026-8503] in 13.6
security libbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625] in 13.6
security libcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046] in 13.6
security libcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240] in 13.6
security libcrypt-urandom-perl: Fix buffer overflow issue [CVE-2026-2474] in 13.6
security libhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829] in 13.6
security libnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] in 13.6
security libslirp: Fix memory disclosure issue [CVE-2026-9539] in 13.6
security libtasn1-6: Fix buffer overflow issue [CVE-2025-13151] in 13.6
security libvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] in 13.6
security libxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177] in 13.6
security libxml2: Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation… in 13.6
security libxpm: Fix out of bounds read issue [CVE-2026-4367] in 13.6
security lxml-html-clean: Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350] in 13.6
security mesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] in 13.6
security miniupnpd: Fix integer underflow issue [CVE-2026-5720] in 13.6
security modsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] in 13.6
security mutt: Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864] in 13.6
security mxml: Fix out-of-bounds read [CVE-2026-5037] in 13.6
security nbconvert: Fix arbitrary file read/write issues [CVE-2026-39377 CVE-2026-39378] in 13.6
security 96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, … in 13.5
security 389-ds-base: Fix heap overflow issue [CVE-2025-14905] in 13.5
security apache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue… in 13.5
security awstats: Prevent command injection [CVE-2025-63261] in 13.5
security black: Fix arbitrary file write issue [CVE-2026-32274] in 13.5
security bubblewrap: Fix privilege escalation issue [CVE-2026-41163] in 13.5
security calibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] in 13.5
security cimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146] in 13.5
security cockpit: Fix code execution issue [CVE-2026-4631] in 13.5
security composer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176] in 13.5
security curl: Fix server certificate verification issue [CVE-2025-13034] in 13.5
security dovecot: Fix memory leak in CVE-2026-27857 fix in 13.5
security erlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943] in 13.5
security exim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] in 13.5
security firewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948] in 13.5
security freerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680… in 13.5
security git-lfs: Fix arbitrary file write issue [CVE-2025-26625] in 13.5
security glance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure in 13.5
security glib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode… in 13.5
security glibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;… in 13.5
security gvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] in 13.5
security harfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693] in 13.5
security jpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures in 13.5
security jq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164] in 13.5
security kissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] in 13.5
security libarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] in 13.5
security libcap2: Fix time of check / time of use issue [CVE-2026-4878] in 13.5
security libcdio: Fix buffer overflow issue [CVE-2024-36600] in 13.5
security libcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468] in 13.5
security libcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564] in 13.5
security libexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] in 13.5
security libnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] in 13.5
security libtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111] in 13.5
security libvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854] in 13.5
security libxml-security-java: Fix private key disclosure issue [CVE-2023-44483] in 13.5
security lxc: Fix authorisation bypass issue [CVE-2026-39402] in 13.5
security mapserver: Fix buffer overflow issue [CVE-2026-33721] in 13.5
security modsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691] in 13.5
security mongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files in 13.5
security musl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200] in 13.5
security 62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 13.4
security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 13.4
security augeas: Fix null pointer dereference issue [CVE-2025-2588] in 13.4
security capstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114] in 13.4
security civetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763] in 13.4
security direwolf: Fix stack buffer overflow [CVE-2025-34457] in 13.4
security dpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219] in 13.4
security erlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107] in 13.4
security fluidsynth: Fix null pointer dereference issue [CVE-2025-56225] in 13.4
security fonttools: Fix arbitrary file write issue [CVE-2025-66034] in 13.4
security glibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the… in 13.4
security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269] in 13.4
security jaraco.context: Prevent path traversal [CVE-2026-23949] in 13.4
security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 13.4
security libsndfile: Fix memory leak issue [CVE-2025-56226] in 13.4
security mariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support in 13.4
security node-proxy-agents: Fix path traversal issue [CVE-2026-27699] in 13.4
security openssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985] in 13.4
security pcsx2: Fix code execution issue [CVE-2025-49589] in 13.4
security phpunit: Fix unsafe deserialization issue [CVE-2026-24765] in 13.4
security postgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006] in 13.4
security python-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007] in 13.4
security python-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146] in 13.4
security python-multipart: Fix arbitrary file write issue [CVE-2026-24486] in 13.4
security qemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665] in 13.4
security requests: Fix credential leak issue [CVE-2024-47081] in 13.4
security rust-ntp-proto: Fix excessive load issue [CVE-2026-26076] in 13.4
security rust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076 in 13.4
security sqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf in 13.4
security starlette: Fix denial of service issue [CVE-2025-62727] in 13.4
security suricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264] in 13.4
security wget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195] in 13.4
security wireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203] in 13.4
security xen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553] in 13.4
security zabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643] in 13.4
security 36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, … in 13.3
security apache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200] in 13.3
security calibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486] in 13.3
security composer: Fix ANSI sequence injection [CVE-2025-67746] in 13.3
security cups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524] in 13.3
security edk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770] in 13.3
security freedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462] in 13.3
security glib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512] in 13.3
security gnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc in 13.3
security gnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback in 13.3
security imagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950] in 13.3
security libcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499] in 13.3
security libcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503] in 13.3
security libphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119] in 13.3
security libvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the… in 13.3
security lxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507] in 13.3
security mbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438] in 13.3
security mongo-c-driver: Avoid invalid memory reads [CVE-2025-12119] in 13.3
security node-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033] in 13.3
security pgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819] in 13.3
security postgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818] in 13.3
security qemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464] in 13.3
security r-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation in 13.3
security rlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075] in 13.3
security rsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158] in 13.3
security rust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897] in 13.3
security sogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499] in 13.3
security suricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344] in 13.3
security symfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries in 13.3
security 52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, … in 13.2
security 7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001] in 13.2
security curl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563] in 13.2
security dnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187] in 13.2
security imagemagick: Fix integer overflow issue [CVE-2025-62171] in 13.2
security lemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication in 13.2
security libcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libhtp: Prevent memory leak with lzma [CVE-2025-53537] in 13.2
security libsmb2: Fix buffer overflow issue [CVE-2025-57632] in 13.2
security libssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277] in 13.2
security libwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678] in 13.2
security libxml2: Fix XPath recursion depth DoS [CVE-2025-9714] in 13.2
security libyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683] in 13.2
security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 13.2
security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 13.2
security mapserver: Fix SQL injection issue [CVE-2025-59431] in 13.2
security modsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571] in 13.2
security nvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345] in 13.2
security open-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244] in 13.2
security phpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573] in 13.2
security poppler: Fix infinite recursion [CVE-2025-50420] in 13.2
security python-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068] in 13.2
security qemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls in 13.2
security rabbitmq-server: Fix logging on sensitive data [CVE-2025-50200] in 13.2
security sail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510] in 13.2
security samba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230] in 13.2
security suricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147] in 13.2
security 14 security advisories included: DSA-5975 linux-signed-amd64 +2, DSA-5976 chromium, DSA-5977 aide, DSA-5978 webkit2gtk, DSA-5979 libxslt, DSA-5980 firefox-esr, DSA-5981 chromium, DSA-5983 qemu, DSA-5984 thunderbird, DSA-5986 node-cipher-base, DSA-5988 chromium, DSA-5989 udisks2, … in 13.1
security firebird3.0: Fix null pointer dereference in XDR message parsing [CVE-2025-54989] in 13.1
security git: New upstream bug-fix release; fix arbitrary file write issues [CVE-2025-27613 CVE-2025-46835]; fix code execution issues [CVE-2025-27614 CVE-2025-48384]; fix protocol injection issue, possibly leading to arbitrary code execution [CVE-2025-48385] in 13.1
security golang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211] in 13.1
security imagemagick: Security fixes: heap buffer overflow in the InterpretImageFilename function [CVE-2025-53014]; infinite loop when writing during a specific XMP file conversion command [CVE-2025-53015]; memory leak in the magick stream command [CVE-2025-53019]; stack overflow through vsnprintf()… in 13.1
security iperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350] in 13.1
security libcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927] in 13.1
security libcoap3: Fix buffer overflow issue [CVE-2024-0962]; fix integer overflow issue [CVE-2024-31031] in 13.1
security mozjs128: New upstream stable release; fix uninitialised memory issue [CVE-2025-9181], memory safety issues [CVE-2025-9185] in 13.1
security nginx: Fix potential information leak in ngx_mail_smtp_module [CVE-2025-53859] in 13.1
security node-tmp: Fix arbitrary file write issue [CVE-2025-54798] in 13.1
security openjpeg2: Fix out-of-bounds write issue [CVE-2025-54874] in 13.1
security pcre2: New upstream stable release; fix potential information disclosure issue [CVE-2025-58050] in 13.1
security postgresql-17: New upstream stable release; tighten security checks in planner estimation functions [CVE-2025-8713]; prevent pg_dump scripts from being used to attack the user running the restore [CVE-2025-8714]; convert newlines to spaces in names included in comments in pg_dump output… in 13.1
security shaarli: Fix cross site scripting issue [CVE-2025-55291] in 13.1
security wolfssl: Avoid weak and predictable random numbers [CVE-2025-7394] in 13.1
security 84 security advisories included: DLA-4627 kernel-wedge, DLA-4628 linux-base, DLA-4632 atril, DLA-4633 libreoffice, DLA-4635 firefox-esr, DLA-4636 thunderbird, DLA-4637 libconfig-inifiles-perl, DLA-4638 libgd-perl, DLA-4639 libhttp-daemon-perl, DLA-4642 u-boot, DLA-4643 imagemagick, … in 12.15
security 7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] in 12.15
security apache2: Fix HTTP/2 request DoS and file handle exhaustion [CVE-2026-49975 CVE-2026-48913]; fix proxy, DAV, LDAP, SSL, XML and header memory/crash issues [CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44185]; fix proxy FTP directory listing XSS… in 12.15
security beets: Fix XSS vulnerability [CVE-2026-42052]; fix build-time test failures in 12.15
security calibre: Fix various potential security issues; read resources only from book contents [CVE-2026-33206]; keep extracted files within container dir [CVE-2026-30853]; prevent reading background images from outside the config dir [CVE-2026-33205] in 12.15
security composer: Fix support for new GitHub token format [CVE-2026-45793] in 12.15
security curl: Fix cache poisoning issue [CVE-2025-10148]; fix data leak issues [CVE-2025-14524 CVE-2026-3783]; fix incorrect connection re-use issues [CVE-2025-14819 CVE-2026-3784 CVE-2026-5773 CVE-2026-7168] in 12.15
security dcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] in 12.15
security dhcpcd5: Fix NULL pointer dereference issue [CVE-2025-70102]; fix out-of-bounds write issue [CVE-2026-56114] in 12.15
security firewalld: Fix DBUS policy checking [CVE-2026-4948] in 12.15
security giflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] in 12.15
security graphite2: Fix out-of-bounds write [CVE-2026-50593] in 12.15
security ironic: Fix file disclosure via image sources [CVE-2025-44021]; fix console command injection [CVE-2026-42510]; fix Swift token disclosure [CVE-2026-42997]; fix unsafe template execution [CVE-2026-44916] in 12.15
security keystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] in 12.15
security libbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625] in 12.15
security libcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046] in 12.15
security libcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240] in 12.15
security libhtml-gumbo-perl: Fix uninitialized memory access [CVE-2025-15646] in 12.15
security libhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829] in 12.15
security libnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] in 12.15
security libvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] in 12.15
security libxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177] in 12.15
security libxml2: Fix catalogue recursion and duplicate-catalog handling [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; limit RelaxNG include recursion [CVE-2026-0989]; fix xmllint shell memory leak [CVE-2026-1757]; correct schematron regression-test outputs [CVE-2025-49794 CVE-2025-49796]; fix XML writer… in 12.15
security mariadb: New upstream stable release; fix code execution issues [CVE-2025-13699 CVE-2026-44168 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261]; fix denial of service issues [CVE-2026-21968 CVE-2026-34303]; fix logging bypass issue [CVE-2026-3494]; fix path traversal issue [CVE-2026-44171]; fix SQL… in 12.15
security mesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] in 12.15
security modsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] in 12.15
security mxml: Fix out-of-bounds read [CVE-2026-5037] in 12.15
security node-flatted: Fix prototype pollution issue [CVE-2026-33228] in 12.15
security openslide: Fix possible code execution issue [CVE-2026-48977] in 12.15
security p7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] in 12.15
security php-guzzlehttp-psr7: Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers in 12.15
security phpunit: Fix unsafe deserialization in PHPT code coverage handling [CVE-2026-24765] in 12.15
security protobuf: Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409] in 12.15
security pydantic: Fix denial of service in email verification [CVE-2024-3772] in 12.15
security pymatgen: Fix denial of service in GaussianInput.from_string [CVE-2022-42964] in 12.15
security python-filelock: Fix symlink vulnerabilies [CVE-2025-68146 CVE-2026-22701] in 12.15
security python-markdown: Fix parsing of bogus HTML markup [CVE-2025-69534] in 12.15
security python-pyramid: Fix information disclosure issue [CVE-2023-40587] in 12.15
security python-xmltodict: Fix XML injection issue [CVE-2025-9375] in 12.15
security python3.11: Prevent incorrect tar archive handling [CVE-2025-13462]; ensure bytecode-only imports use normal security checks [CVE-2026-2297]; reject unsafe cookie values [CVE-2026-3644]; prevent XML parser crashes [CVE-2026-4224]; prevent browser command injection [CVE-2026-4519]; prevent bz2/lzma… in 12.15
security 131 security advisories included: DSA-6003 firefox-esr, DSA-6025 firefox-esr, DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 12.14
security 7zip: New upstream stable release; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links… in 12.14
security apache2: New upstream release: fix http2 regression; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue… in 12.14
security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 12.14
security augeas: Fix NULL pointer dereference issue [CVE-2025-2588] in 12.14
security awstats: Prevent command injection [CVE-2025-63261] in 12.14
security busybox: Fix stack overflow [CVE-2022-48174] and use-after-free [CVE-2023-42363 CVE-2023-42364 CVE-2023-42365] errors in 12.14
security c3p0: Fix recursive entity expansion issue [CVE-2019-5427] in 12.14
security calibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] in 12.14
security composer: Fix code execution issue [CVE-2023-43655]; fix command injection issues [CVE-2026-40261 CVE-2026-40176] in 12.14
security containerd: Fix CRI Attach implementation [CVE-2025-64329]; fix overly broad directory permissions [CVE-2024-25621]; fix large UID:GID (> 32bit) overflow [CVE-2024-40635] in 12.14
security dovecot: Correct incomplete backport of CVE-2026-27855 fix; fix memory leak in CVE-2026-27857 fix in 12.14
security dpkg: New upstream stable release; fix insufficient permissions check leading to possible denial of service issue [CVE-2025-6297]; fix denial of service issue [CVE-2026-2219]; fix buffer over-read issue; fix uninitialized variable warning with Rules-Requires-Root; fix segmentation fault in… in 12.14
security erlang: Fix denial of service issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix HTTP request smuggling issue [CVE-2026-23941]; fix path traversal issues [CVE-2026-23942 CVE-2026-21620]; fix compression bomb issue [CVE-2026-23943] in 12.14
security exim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] in 12.14
security fonttools: Fix XML External Entity injection issue [CVE-2023-45139]; fix code execution issue [CVE-2025-66034] in 12.14
security glance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure in 12.14
security glib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode… in 12.14
security glibc: Fix integer overflow issue [CVE-2026-0861]; fix uninitialised memory use issue [CVE-2025-15281]; fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix performance bottleneck with ASAN on… in 12.14
security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix integer underflow issue [CVE-2025-67269] in 12.14
security grub-efi-amd64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
security grub-efi-arm64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
security grub-efi-ia32-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix… in 12.14
security grub2: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix commands/extcmd:… in 12.14
security gvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] in 12.14
security kissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] in 12.14
security libarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] in 12.14
security libcap2: Fix time of check / time of use issue [CVE-2026-4878]; rebuild with updated glibc in 12.14
security libexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] in 12.14
security libnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] in 12.14
security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 12.14
security libreoffice: Fix incomplete fix for CVE-2024-12426 in 12.14
security libuev: Fix buffer overrun issue [CVE-2022-48620] in 12.14
security libvncserver: Fix out-of-bounds read issue [CVE-2026-32853]; fix null pointer dereference issue [CVE-2026-32854] in 12.14
security libxml-security-java: Fix private key disclosure issue [CVE-2023-44483] in 12.14
security lxc: Fix authorisation bypass issue [CVE-2026-39402] in 12.14
security mapserver: Fix SQL injection issue [CVE-2025-59431]; fix buffer overflow issue [CVE-2026-33721]; fix heap-buffer-overflow and double-free issues in maplexer in 12.14
security modsecurity-crs: Fix rule bypass issue [CVE-2023-38199]; fix file extension blocking bypass issue [CVE-2026-33691] in 12.14
security mongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files in 12.14
security nginx: Fix buffer overflow issues [CVE-2026-27654 CVE-2026-27784 CVE-2026-32647]; fix session authentication issues [CVE-2026-27651 CVE-2026-28753]; fix OCSP result bypass issue [CVE-2026-28755]; use $host instead of $http_host in 12.14
security 77 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, DSA-6003 firefox-esr, DSA-6004 chromium, … in 12.13
security angular.js: Fix regular expression-based denial of service issues [CVE-2022-25844 CVE-2023-26116 CVE-2023-26117 CVE-2023-26118]; fix restriction bypass issues [CVE-2024-8372 CVE-2024-8373]; fix denial of service issue [CVE-2024-21490]; fix improper sanitization issues [CVE-2025-0716 CVE-2025-2336] in 12.13
security apache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200] in 12.13
security calibre: Fix code execution issue [CVE-2025-64486] in 12.13
security composer: Fix ANSI sequence injection [CVE-2025-67746] in 12.13
security cups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524] in 12.13
security freerdp2: New upstream release; fix multiple memory-safety vulnerabilities: integer overflow/underflow and out-of-bounds write in NSC, Clear, and GDI bitmap codecs [CVE-2024-22211 CVE-2024-32037 CVE-2024-32038 CVE-2024-32039 CVE-2024-32040]; out-of-bounds reads in ZGFX, Planar, NCRUSH,… in 12.13
security gdk-pixbuf: Fix buffer overflow issue [CVE-2025-7345] in 12.13
security git: Fix arbitrary file creation/truncation in gitk [CVE-2025-27613]; prevent arbitrary file overwrite in git-gui with crafted directory names [CVE-2025-46835]; correct submodule path parsing with trailing CR [CVE-2025-48384]; validate bundle-uri to prevent protocol injection during clone… in 12.13
security glib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512] in 12.13
security gnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename in 12.13
security imagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-62171 CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950] in 12.13
security lemonldap-ng: Fix sessions tablename when not default; fix oidc flow when user encountered an error on server side; fix Kerberos JavaScript when used with Choice; improve CORS checking; fix path_info handling; fix shell injection issue [CVE-2025-59518]; hide session id from Ajax responses in 12.13
security libcommons-lang-java: Fix uncontrolled recursion issue [CVE-2025-48924] in 12.13
security libcommons-lang3-java: Fix uncontrolled recursion issue [CVE-2025-48924] in 12.13
security libhtp: Fix denial of service issue via unbounded HTTP header processing [CVE-2024-23837 CVE-2024-45797] in 12.13
security libnginx-mod-http-lua: Fix HTTP HEAD request smuggling [CVE-2024-33452] in 12.13
security libphp-adodb: Fix SQL injection in sqlite and sqlite3 metadata lookups [CVE-2025-54119] in 12.13
security libssh: Fix integer overflow issue [CVE-2025-4877]; fix use of uninitialized variable [CVE-2025-4878]; fix out of bounds memory access issue [CVE-2025-5318]; fix double free issue [CVE-2025-5351]; fix use of uninitialized memory [CVE-2025-5372 CVE-2025-5987]; fix null pointer dereference issue… in 12.13
security libxml2: Fix denial of service issue [CVE-2025-9714] in 12.13
security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 12.13
security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 12.13
security modsecurity-apache: Fix request body error handling to propagate Apache filter/read failures correctly [CVE-2025-54571]; map request body read failures to appropriate HTTP status codes; simplify request body error propagation in mod_security2 in 12.13
security mongo-c-driver: Avoid invalid memory reads [CVE-2025-12119] in 12.13
security mydumper: Fix arbitrary file read issue [CVE-2025-30224] in 12.13
security nvidia-graphics-drivers: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286] in 12.13
security nvidia-open-gpu-kernel-modules: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286] in 12.13
security open-vm-tools: Disable SDMP service version collection by default to mitigate local privilege escalation [CVE-2025-41244] in 12.13
security openrefine: Fix MySQL host parameter injection in JDBC URL parsing [CVE-2024-23833]; fix reflected XSS in gdata OAuth callback handler [CVE-2024-47878]; fix content-type confusion XSS in ExportRows endpoint [CVE-2024-47880]; prevent remote or extension loading via SQLite connection URL… in 12.13
security pam: Fix local privilege escalation in pam_namespace [CVE-2025-6020] in 12.13
security pgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]; fix expired password use issue [CVE-2025-2291] in 12.13
security postgresql-15: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818] in 12.13
security qemu: New upstream stable release; fix qemu-img info https://example.com; fix migration of guests using virtio-net; fix use after free issue [CVE-2025-11234] in 12.13
security r-cran-gh: Fix sensitive data leak issue [CVE-2025-54956] in 12.13
security rear: Prevent created initrd from being world-readable when GRUB_RESCUE=y [CVE-2024-23301] in 12.13
security rlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075] in 12.13
security rsync: Improve test coverage for future updates; fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158] in 12.13
security ruby-sinatra: Fix regular expression-based denial of service issue [CVE-2025-61921] in 12.13
security samba: Fix information leak issue [CVE-2018-14628]; fix command injection issue [CVE-2025-10230]; fix uninitialized memory disclosure issue [CVE-2025-9640] in 12.13
security sogo: Fix HTML injection issue [CVE-2023-48104]; fix CSS injection issue [CVE-2024-24510]; fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]; fix crash on invalid mailIdentities in 12.13
security 75 security advisories included: DSA-5914 chromium, DSA-5916 chromium, DSA-5918 varnish, DSA-5919 open-vm-tools, DSA-5920 chromium, DSA-5921 thunderbird, DSA-5922 firefox-esr, DSA-5923 net-tools, DSA-5924 intel-microcode, DSA-5925 linux-signed-amd64 +3, DSA-5926 firefox-esr, … in 12.12
security amd64-microcode: Update AMD-SEV firmware [CVE-2024-56161]; update included microcode in 12.12
security apache2: New upstream stable release; fix HTTP response splitting issue [CVE-2024-42516]; fix server-side request forgery issue [CVE-2024-43204 CVE-2024-43394]; fix log injection issue [CVE-2024-47252]; fix access control bypass issue [CVE-2025-23048]; fix denial of service issue [CVE-2025-49630];… in 12.12
security botan: Fix denial of service issues [CVE-2024-34702 CVE-2024-34703]; fix improper parsing of name constraints [CVE-2024-39312]; fix compiler-induced secret-dependent operation issue [CVE-2024-50383] in 12.12
security cjson: Fix denial of service issue [CVE-2023-26819]; fix buffer overflow issue [CVE-2023-53154] in 12.12
security clamav: New upstream stable release; fix buffer overflow issues [CVE-2025-20128 CVE-2025-20260] in 12.12
security cloud-init: Make hotplug socket writable only by root [CVE-2024-11584]; don't attempt to identify non-x86 OpenStack instances [CVE-2024-6174] in 12.12
security commons-beanutils: Fix improper access control issue [CVE-2025-48734] in 12.12
security commons-vfs: Fix path traversal issue [CVE-2025-27553] in 12.12
security corosync: Fix buffer overflow vulnerability on large UDP packets [CVE-2025-30472] in 12.12
security djvulibre: Fix denial of service issues [CVE-2021-46310 CVE-2021-46312] in 12.12
security dropbear: Fix shell injection vulnerability in multihop handling [CVE-2025-47203] in 12.12
security erlang: ssh: fix strict KEX hardening [CVE-2025-46712]; zip: sanitize pathnames when extracting files with absolute pathnames [CVE-2025-4748]; fix documentation build failure with newer xsltproc versions in 12.12
security expat: Fix denial of service issues [CVE-2023-52425 CVE-2024-8176]; fix parser crash [CVE-2024-50602] in 12.12
security fig2dev: Detect nan in spline control values [CVE-2025-46397]; permit \0 in 2nd line in fig file [CVE-2025-46398]; ge output: correct spline computation [CVE-2025-46399]; reject arcs with a radius smaller than 3 [CVE-2025-46400] in 12.12
security firebird3.0: Fix NULL pointer dereference issue [CVE-2025-54989] in 12.12
security fort-validator: Fix denial of service issues [CVE-2024-45234 CVE-2024-45235 CVE-2024-45236 CVE-2024-45238 CVE-2024-45239 CVE-2024-48943]; fix buffer overflow issue [CVE-2024-45237] in 12.12
security glib2.0: Fix buffer underflow issue [CVE-2025-4373 CVE-2025-7039]; improve upgrade safety in 12.12
security glibc: Fix incorrect LD_LIBRARY_PATH search in dlopen for static setuid binaries [CVE-2025-4802]; improve memory layout of structures in exp/exp10/expf functions; add an SVE implementation of memset on aarch64; improve generic implementation of memset on aarch64; fix double free issue… in 12.12
security golang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211] in 12.12
security gst-plugins-base1.0: Fix buffer overrun issue [CVE-2025-47806]; fix NULL pointer dereference issues [CVE-2025-47807 CVE-2025-47808] in 12.12
security gst-plugins-good1.0: Fix possible information disclosure issue [CVE-2025-47219] in 12.12
security iperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350] in 12.12
security jinja2: Fix arbitrary code execution issue [CVE-2025-27516] in 12.12
security jq: Zero-terminate string in jv.c [CVE-2025-48060] in 12.12
security kmail-account-wizard: Fix man in the middle attack issue [CVE-2024-50624] in 12.12
security krb5: Fix message tampering issue [CVE-2025-3576]; disable issuance of tickets using RC4 or triple-DES session keys by default in 12.12
security kubernetes: Sanitise raw data output to terminal [CVE-2021-25743]; hide long and multi-line strings when printing in 12.12
security libarchive: Fix integer overflow issues [CVE-2025-5914 CVE-2025-5916], buffer over read issue [CVE-2025-5915], buffer overlow issue [CVE-2025-5917] in 12.12
security libcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927] in 12.12
security libfcgi: Fix integer overflow issue [CVE-2025-23016] in 12.12
security libphp-adodb: Fix SQL injection vulnerability in pg_insert_id() [CVE-2025-46337] in 12.12
security libraw: Fix out-of-bounds read issues [CVE-2025-43961 CVE-2025-43962 CVE-2025-43963]; enforce minimum w0 and w1 values [CVE-2025-43964] in 12.12
security libsndfile: Fix integer overflow issues [CVE-2022-33065]; fix out of bounds read issue [CVE-2024-50612] in 12.12
security libsoup3: New upstream bug-fix release; fix buffer overrun issue [CVE-2024-52531]; fix denial of service issues [CVE-2024-52532 CVE-2025-32051]; fix heap overflow issues [CVE-2025-32052 CVE-2025-32053]; fix integer overflow issue [CVE-2025-32050]; fix heap buffer overflow issues [CVE-2025-2784];… in 12.12
security libtpms: Fix out of bounds read issue [CVE-2025-49133] in 12.12
security libxml2: Fix integer overflow issue in xmlBuildQName [CVE-2025-6021]; fix potential buffer overflows in the interactive shell [CVE-2025-6170]; fix use-after-free issue in xmlSchematronReportOutput [CVE-2025-49794]; fix type confusion issue in xmlSchematronReportOutput [CVE-2025-49796] in 12.12
security libyaml-libyaml-perl: Fix arbitrary file edit issue [CVE-2025-40908] in 12.12
security luajit: Fix buffer overflow issue [CVE-2024-25176]; fix denial of service issue [CVE-2024-25177]; fix out-of-bounds read issue [CVE-2024-25178] in 12.12
security mariadb: New upstream stable release; security fixes [CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-30693 CVE-2025-30722]; fix restart after out of memory; new upstream stable release; fix variable name in debian-start.sh in 12.12
security 39 security advisories included: DSA-5877 chromium, DSA-5878 php8.2, DSA-5879 opensaml, DSA-5880 freetype, DSA-5881 rails, DSA-5882 chromium, DSA-5883 mercurial, DSA-5884 libxslt, DSA-5885 webkit2gtk, DSA-5886 ruby-rack, DSA-5887 exim4, DSA-5888 ghostscript, DSA-5889 firefox-esr, … in 12.11
security abseil: Fix heap buffer overflow issue [CVE-2025-0838]; fix build failure on ppc64el in 12.11
security fig2dev: Reject huge pattern lengths [CVE-2025-31162]; reject arcs with co-incident points [CVE-2025-31163]; allow an arc-box with zero radius [CVE-2025-31164] in 12.11
security fossil: Fix interaction with an Apache HTTP server including the fix for CVE-2024-24795 in 12.11
security gcc-12: Fix -fstack-protector handling of overflows on AArch64 [CVE-2023-4039] in 12.11
security glib2.0: Fix integer overflow in g_date_time_new_from_iso8601() [CVE-2025-3360] in 12.11
security haproxy: Fix heap buffer overflow issue [CVE-2025-32464] in 12.11
security imagemagick: Fix MIFF image depth mishandled after SetQuantumFormat [CVE-2025-43965] in 12.11
security krb5: Fix memory leak in ndr.c [CVE-2024-26462]; prevent buffer overflow when calculating ulog buffer size [CVE-2025-24528] in 12.11
security libbson-xs-perl: Fix security issues in embedded copy of libbson: denial of service [CVE-2017-14227]; buffer over-read [CVE-2018-16790]; infinite loop [CVE-2023-0437]; memory corruption [CVE-2024-6381]; buffer overflows [CVE-2024-6383 CVE-2025-0755] in 12.11
security libcap2: Fix incorrect recognition of group names [CVE-2025-1390] in 12.11
security libdata-entropy-perl: Seed entropy pool with urandom by default [CVE-2025-1860] in 12.11
security libsub-handlesvia-perl: Fix arbitrary code execution issue [CVE-2025-30673] in 12.11
security mongo-c-driver: Fix infinite loop issue [CVE-2023-0437]; fix integer overflow issue [CVE-2024-6381]; fix buffer overflow issues [CVE-2024-6383 CVE-2025-0755] in 12.11
security network-manager: Fix crash dereferencing NULL pointer during debug logging [CVE-2024-6501] in 12.11
security nginx: Fix buffer underread and unordered chunk vulnerabilities in mp4 [CVE-2024-7347] in 12.11
security node-send: Fix cross-site scripting issue [CVE-2024-43799] in 12.11
security node-serialize-javascript: Fix cross-site scripting issue [CVE-2024-11831] in 12.11
security nvidia-graphics-drivers: New upstream stable release; remove ppc64el support (migrated to src:nvidia-graphics-drivers-tesla-535); fix build issues with newer kernel versions; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244] in 12.11
security nvidia-open-gpu-kernel-modules: New upstream stable release; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244] in 12.11
security openrazer: Fix out of bounds read issue [CVE-2025-32776] in 12.11
security openssh: Fix the DisableForwarding directive [CVE-2025-32728] in 12.11
security openssl: New upstream stable release; fix timing side channel issue [CVE-2024-13176] in 12.11
security openvpn: Avoid possible ASSERT() on OpenVPN servers using --tls-crypt-v2 [CVE-2025-2704]; prevent malicious peer DoS or log-flooding [CVE-2024-5594]; refuse multiple exit notifications from authenticated clients [CVE-2024-28882]; update expired certificates in build tests in 12.11
security phpmyadmin: Fix XSS vulnerabilities [CVE-2025-24529 CVE-2025-24530] in 12.11
security poppler: Fix crash on malformed files [CVE-2023-34872]; fix out-of-bounds read issues [CVE-2024-56378 CVE-2025-32365]; fix floating point exception issue [CVE-2025-32364] in 12.11
security postgresql-15: New upstream stable release; fix buffer over-read issue [CVE-2025-4207] in 12.11
security python-h11: Fix request smuggling issue [CVE-2025-43859] in 12.11
security python3.11: Fix misparsing issues [CVE-2025-0938 CVE-2025-1795] in 12.11
security qtbase-opensource-src: Delay HTTP2 communication until encrypted() can be responded to [CVE-2024-39936]; fix crash with null checks in table iface methods in 12.11
security redis: Fix denial of service issue [CVE-2025-21605] in 12.11
security shadow: Fix password leak issue [CVE-2023-4641]; fix chfn control character injection issue [CVE-2023-29383] in 12.11
security twitter-bootstrap3: Fix cross-site scripting issues [CVE-2024-6485 CVE-2024-6484] in 12.11
security twitter-bootstrap4: Fix cross-site scripting issue [CVE-2024-6531] in 12.11
security varnish: Prevent HTTP/1 client-side desync [CVE-2025-30346] in 12.11
security xmedcon: Fix buffer overflow [CVE-2025-2581] in 12.11
security 40 security advisories included: DSA-5834 chromium, DSA-5836 xen, DSA-5839 firefox-esr, DSA-5840 chromium, DSA-5841 thunderbird, DSA-5842 openafs, DSA-5843 rsync, DSA-5844 chromium, DSA-5845 tomcat10, DSA-5846 libreoffice, DSA-5847 snapcast, DSA-5848 chromium, DSA-5849 git-lfs, … in 12.10
security 389-ds-base: Fix crash when modifying userPassword using malformed input [CVE-2024-2199 CVE-2024-8445]; prevent denial of service while attempting to log in with a user with a malformed hash in their password [CVE-2024-5953]; prevent denial of service on the directory server with specially-crafted… in 12.10
security curl: Fix unintended HTTPS upgrades or premature reversion to HTTP when both subdomains and parent domains are used [CVE-2024-9681]; prevent stopping of stunnel before retries in the built-time tests; fix possible credentials leakage issues [CVE-2024-11053 CVE-2025-0167]; fix test failures due to… in 12.10
security dcmtk: Fix issue when rendering an invalid monochrome DICOM image [CVE-2024-47796]; ensure: HighBit < BitsAllocated [CVE-2024-52333]; fix possible overflows when allocating memory [CVE-2024-27628]; fix two segmentation faults [CVE-2024-34508 CVE-2024-34509]; fix arbitrary code execution issue… in 12.10
security djoser: Fix authentication bypass [CVE-2024-21543] in 12.10
security edk2: Fix overflow condition in PeCoffLoaderRelocateImage() [CVE-2024-38796]; fix potential UINT32 overflow in S3 ResumeCount [CVE-2024-1298] in 12.10
security flightgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781] in 12.10
security glibc: Fix buffer overflow when printing assertion failure message [CVE-2025-0395]; fix memset performance for unaligned destinations; fix TLS performance degradation after dlopen() usage; avoid integer truncation when parsing CPUID data with large cache sizes; ensure data passed to the rseq… in 12.10
security intel-microcode: New upstream security release [CVE-2023-34440 CVE-2023-43758 CVE-2024-24582 CVE-2024-28047 CVE-2024-28127 CVE-2024-29214 CVE-2024-31068 CVE-2024-31157 CVE-2024-36293 CVE-2024-37020 CVE-2024-39279 CVE-2024-39355] in 12.10
security jinja2: Fix arbitrary code execution issues [CVE-2024-56201 CVE-2024-56326] in 12.10
security lemonldap-ng: Fix CSRF vulnerability on 2FA registration interface [CVE-2024-52948] in 12.10
security libapache-mod-jk: Set correct default permissions for shared memory [CVE-2024-46544] in 12.10
security libeconf: Fix buffer overflow vulnerability [CVE-2023-32181 CVE-2023-22652] in 12.10
security librabbitmq: Add option to read username/password from file [CVE-2023-35789] in 12.10
security libtar: Fix out-of-bounds read in gnu_longlink() [CVE-2021-33643]; fix out-of-bounds read in gnu_longname() [CVE-2021-33644]; fix memory leak in th_read() [CVE-2021-33645]; fix memory leak in th_read() [CVE-2021-33646] in 12.10
security mariadb: New upstream stable release; fix security issue [CVE-2024-21096]; fix denial of service issue [CVE-2025-21490] in 12.10
security monero: Impose response limits on HTTP server connections [CVE-2025-26819] in 12.10
security nginx: Fix possible bypass of client certificate authentication [CVE-2025-23419] in 12.10
security node-axios: Fix CSRF vulnerability [CVE-2023-45857]; fix potential vulnerability in URL when determining an origin [CVE-2024-57965] in 12.10
security node-postcss: Fix mishandling of non-integer values leading to denial of service in nanoid [CVE-2024-55565]; fix parsing of external untrusted CSS [CVE-2023-44270] in 12.10
security php-nesbot-carbon: Fix arbitrary file include issue [CVE-2025-22145] in 12.10
security postgresql-15: New upstream stable release; harden PQescapeString and allied functions against invalidly-encoded strings; improve behavior of libpq's quoting functions [CVE-2025-1094] in 12.10
security puma: Fix behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers [CVE-2023-40175]; limit size of chunk extensions [CVE-2024-21647]; prevent manipulation of headers set by intermediate proxies [CVE-2024-45614] in 12.10
security python-django: Fix regular expression-based denial of service issue [CVE-2023-36053], denial of service issues [CVE-2024-38875 CVE-2024-39614 CVE-2024-41990 CVE-2024-41991], user enumeration issue [CVE-2024-39329], directory traversal issue [CVE-2024-39330], excessive memory consumption issue… in 12.10
security simgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781] in 12.10
security sssd: Apply GPO policy consistently [CVE-2023-3758] in 12.10
security subversion: Fix vulnerable parsing of control characters in paths served by mod_dav_svn [CVE-2024-46901] in 12.10
security vim: Fix crash when expanding ~ in substitute [CVE-2023-2610]; fix buffer-overflow in vim_regsub_both() [CVE-2023-4738]; fix heap use after free in ins_compl_get_exp() [CVE-2023-4752]; fix heap-buffer-overflow in vim_regsub_both [CVE-2023-4781]; fix buffer-overflow in trunc_string()… in 12.10
security wget: Fix mishandling of semicolons in userinfo in URLs [CVE-2024-38428] in 12.10
security 35 security advisories included: DSA-5801 firefox-esr, DSA-5803 thunderbird, DSA-5804 webkit2gtk, DSA-5805 guix, DSA-5806 libarchive, DSA-5807 nss, DSA-5808 ghostscript, DSA-5809 symfony, DSA-5810 chromium, DSA-5811 mpg123, DSA-5812 postgresql-15, DSA-5813 symfony, DSA-5814 thunderbird, … in 12.9
security ansible-core: New upstream stable release; fix arbitrary code execution issue [CVE-2024-11079]; fix information disclosure issue [CVE-2024-8775]; fix file overwrite issue [CVE-2024-9902]; fix test failure in 12.9
security audiofile: Fix null pointer dereference issue [CVE-2019-13147]; fix information leak issue [CVE-2022-24599] in 12.9
security avahi: Fix denial of service issues [CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473]; fix browsing when invalid services are present in 12.9
security dnsmasq: Fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; set default maximum EDNS.0 UDP packet size to 1232 [CVE-2023-28450] in 12.9
security glib2.0: Fix buffer overflow when configured to use a SOCKS4a proxy with a very long username [CVE-2024-52533] in 12.9
security gnuchess: Fix arbitrary code execution issue [CVE-2021-30184] in 12.9
security gsl: Fix buffer overflow calculating the quantile value [CVE-2020-35357] in 12.9
security gst-plugins-base1.0: Don't try parsing extended header if not enough data is available (id3v2) [CVE-2024-47542] in 12.9
security gunicorn: Prevent HTTP request smuggling [CVE-2024-1135] in 12.9
security icinga2: Prevent TLS certificate bypass [CVE-2024-49369] in 12.9
security intel-microcode: New upstream security release [CVE-2024-21853 CVE-2024-23918 CVE-2024-24968 CVE-2024-23984] in 12.9
security jinja2: Prevent HTML attribute injection [CVE-2024-22195 CVE-2024-34064] in 12.9
security lemonldap-ng: Fix privilege escalation when adaptive auth levels used [CVE-2024-52946]; fix XSS in upgrade plugin [CVE-2024-52947] in 12.9
security libebml: Fix buffer overflow issue [CVE-2023-52339] in 12.9
security libpgjava: Fix SQL injection issue [CVE-2024-1597] in 12.9
security libsoup2.4: Prevent HTTP request smuggling [CVE-2024-52530]; fix buffer overflow in soup_header_parse_param_list_strict [CVE-2024-52531]; fix DoS reading from WebSocket clients [CVE-2024-52532] in 12.9
security libxstream-java: Fix denial of service issue [CVE-2024-47072] in 12.9
security nvidia-graphics-drivers: New upstream stable release [CVE-2024-0126] in 12.9
security nvidia-open-gpu-kernel-modules: New upstream LTS release [CVE-2024-0126] in 12.9
security opensc: Fix data leak issue [CVE-2023-5992]; fix use-after-free issue [CVE-2024-1454]; fix missing initialisation issue [CVE-2024-45615]; fix various issues with APDU buffer handling [CVE-2024-45616]; fix missing or incorrect function return value checks [CVE-2024-45617 CVE-2024-45618]; fix… in 12.9
security poco: Fix integer overflow issue [CVE-2023-52389] in 12.9
security pypy3: Fix email address parsing issue [CVE-2023-27043]; fix possible Server Side Request Forgery issue [CVE-2024-11168]; fix private IP address range parsing [CVE-2024-4032]; fix regular expression based Denial of Service issue [CVE-2024-6232]; fix header injection issue [CVE-2024-6923]; fix… in 12.9
security python-asyncssh: Fix rogue extension negotiation issue [CVE-2023-46445]; fix rogue session attack issue [CVE-2023-46446] in 12.9
security python-tornado: Fix open redirect issue [CVE-2023-28370]; fix denial of service issue [CVE-2024-52804] in 12.9
security python-urllib3: Fix possible information leak during cross-origin redirects [CVE-2023-43804]; fix request body not stripped after redirect from 303 status changes request method to GET [CVE-2023-45803]; fix Proxy-Authorization request header isn't stripped during cross-origin redirects… in 12.9
security python-werkzeug: Fix denial of service when file upload begins with CR or LF [CVE-2023-46136]; fix arbitrary code execution on developer's machine via the debugger [CVE-2024-34069]; fix denial of service when processing multipart/form-data requests [CVE-2024-49767] in 12.9
security python3.11: Reject malformed addresses in email.parseaddr() [CVE-2023-27043]; encode newlines in headers in the email module [CVE-2024-6923]; fix quadratic complexity parsing cookies with backslashes [CVE-2024-7592]; fix venv activation scripts failure to quote paths [CVE-2024-9287]; fix improper… in 12.9
security qemu: New upstream bugfix release [CVE-2024-7409]; mark internal codegen helper symbols as hidden, fixing build failure on arm64 in 12.9
security redis: Fix denial of service with malformed ACL selectors [CVE-2024-31227]; fix denial of service through unbound pattern matching [CVE-2024-31228]; fix stack overflow [CVE-202431449] in 12.9
security renderdoc: Fix integer overflows [CVE-2023-33863 CVE-2023-33864]; fix symlink attack vector [CVE-2023-33865] in 12.9
security ruby-doorkeeper: Prevent skipping of authorization steps [CVE-2023-34246] in 12.9
security setuptools: Fix remote code execution issue [CVE-2024-6345] in 12.9
security sqlparse: Fix regular expression-related denial of service issue [CVE-2023-30608]; fix denial of service issue [CVE-2024-4340] in 12.9
security texlive-bin: Fix data loss when using discretionaries with priorities; fix heap buffer overflow [CVE-2024-25262] in 12.9
security tiff: Fix buffer overflow issues [CVE-2023-25433 CVE-2023-26966]; fix use-after-free issue [CVE-2023-26965]; fix null pointer dereference issue [CVE-2023-2908]; fix denial of service issues [CVE-2023-3618 CVE-2023-52356 CVE-2024-7006] in 12.9
security util-linux: Fix wider mitigation for CVE-2024-28085 in 12.9
security zfs-linux: Add missing symbols in libzfs4linux and libzpool5linux; fix dnode dirty test [CVE-2023-49298]; fix sharenfs IPv6 address parsing [CVE-2013-20001]; fixes related to NULL pointer, memory allocation, etc. in 12.9
security zookeeper: Fix information disclosure in persistent watchers handling [CVE-2024-23944] in 12.9
security 47 security advisories included: DSA-5729 apache2, DSA-5733 thunderbird, DSA-5744 thunderbird, DSA-5758 trafficserver, DSA-5759 python3.11, DSA-5760 ghostscript, DSA-5761 chromium, DSA-5762 webkit2gtk, DSA-5763 pymatgen, DSA-5764 openssl, DSA-5765 firefox-esr, DSA-5766 chromium, … in 12.8
security 7zip: Fix heap buffer overflow in NTFS handler [CVE-2023-52168]; fix out-of-bounds read in NTFS handler [CVE-2023-52169] in 12.8
security amanda: Update incomplete fix for CVE-2022-37704, restoring operation with xfsdump in 12.8
security apr: Use 0600 perms for named shared mem consistently [CVE-2023-49582] in 12.8
security cjson: Fix segmentation violation issue [CVE-2024-31755] in 12.8
security clamav: New upstream stable release; fix denial of service issue [CVE-2024-20505], file corruption issue [CVE-2024-20506] in 12.8
security curl: Fix incorrect handling of some OCSP responses [CVE-2024-8096] in 12.8
security docker.io: Fix bypassing of AuthZ plugins in some circumstances [CVE-2024-41110] in 12.8
security intel-microcode: New upstream release; security fixes [CVE-2024-23984 CVE-2024-24968] in 12.8
security lemonldap-ng: Fix cross-site scripting vulnerability on login page [CVE-2024-48933] in 12.8
security nghttp2: Fix denial of service issue [CVE-2024-28182] in 12.8
security node-dompurify: Fix prototype pollution issues [CVE-2024-45801 CVE-2024-48910] in 12.8
security openssl: New upstream stable release; fix buffer overread issue [CVE-2024-5535], out of bounds memory access [CVE-2024-9143] in 12.8
security puredata: Fix privilege escalation issue [CVE-2023-47480] in 12.8
security python-cryptography: Fix NULL dereference when loading PKCS7 certificates [CVE-2023-49083]; fix NULL dereference when PKCS#12 key and cert don't match [CVE-2024-26130] in 12.8
security sqlite3: Fix a buffer overread issue [CVE-2023-7104], a stack overflow issue and an integer overflow issue in 12.8
security tgt: chap: Use proper entropy source [CVE-2024-45751] in 12.8
security wireshark: New upstream security release [CVE-2024-0208, CVE-2024-0209, CVE-2024-2955, CVE-2024-4853, CVE-2024-4854, CVE-2024-4855, CVE-2024-8250, CVE-2024-8645] in 12.8
security xfpt: Fix buffer overflow issue [CVE-2024-43700] in 12.8
security 51 security advisories included: DSA-5617 chromium, DSA-5629 chromium, DSA-5634 chromium, DSA-5636 chromium, DSA-5639 chromium, DSA-5648 chromium, DSA-5654 chromium, DSA-5656 chromium, DSA-5668 chromium, DSA-5675 chromium, DSA-5676 chromium, DSA-5683 chromium, DSA-5687 chromium, … in 12.7
security amd64-microcode: New upstream release; security fixes [CVE-2023-31315]; SEV firmware fixes [CVE-2023-20584 CVE-2023-31356] in 12.7
security ansible: New upstream stable release; fix key leakage issue [CVE-2023-4237] in 12.7
security ansible-core: New upstream stable release; fix information disclosure issue [CVE-2024-0690]; fix template injection issue [CVE-2023-5764]; fix path traversal issue [CVE-2023-5115] in 12.7
security apache2: New upstream stable release; fix content disclosure issue [CVE-2024-40725] in 12.7
security cacti: Fix remote code execution issues [CVE-2024-25641 CVE-2024-31459], cross site scripting issues [CVE-2024-29894 CVE-2024-31443 CVE-2024-31444], SQL injection issues [CVE-2024-31445 CVE-2024-31458 CVE-2024-31460], type juggling issue [CVE-2024-34340]; fix autopkgtest failure in 12.7
security calibre: Fix remote code execution issue [CVE-2024-6782, cross site scripting issue [CVE-2024-7008], SQL injection issue [CVE-2024-7009] in 12.7
security cockpit: Fix denial of service issue [CVE-2024-6126] in 12.7
security cups: Fix issues with domain socket handling [CVE-2024-35235] in 12.7
security curl: Fix ASN.1 date parser overread issue [CVE-2024-7264] in 12.7
security cyrus-imapd: Fix regression introduced in CVE-2024-34055 fix in 12.7
security dcm2niix: Fix potential code execution issue [CVE-2024-27629] in 12.7
security dmitry: Security fixes [CVE-2024-31837 CVE-2020-14931 CVE-2017-7938] in 12.7
security gettext.js: Fix server side request forgery issue [CVE-2024-43370] in 12.7
security gtk+2.0: Avoid looking for modules in the current working directory [CVE-2024-6655] in 12.7
security gtk+3.0: Avoid looking for modules in the current working directory [CVE-2024-6655] in 12.7
security imagemagick: Fix segmentation fault issue; fix incomplete fix for CVE-2023-34151 in 12.7
security intel-microcode: New upstream release; security fixes [CVE-2023-42667 CVE-2023-49141 CVE-2024-24853 CVE-2024-24980 CVE-2024-25939] in 12.7
security libvirt: birsh: Make domif-setlink work more than once; qemu: domain: Fix logic when tainting domain; fix denial of service issues [CVE-2023-3750 CVE-2024-1441 CVE-2024-2494 CVE-2024-2496] in 12.7
security newlib: Fix buffer overflow issue [CVE-2021-3420] in 12.7
security openssl: New upstream stable release; fix denial of service issues [CVE-2024-2511 CVE-2024-4603]; fix use after free issue [CVE-2024-4741] in 12.7
security putty: Fix weak ECDSA nonce generation allowing secret key recovery [CVE-2024-31497] in 12.7
security qemu: New upstream stable release; fix denial of service issue [CVE-2024-4467] in 12.7
security xmedcon: Fix buffer overflow issue [CVE-2024-29421] in 12.7
security 77 security advisories included: DSA-5575 webkit2gtk, DSA-5580 webkit2gtk, DSA-5589 nodejs, DSA-5609 slurm-wlm-contrib, DSA-5616 ruby-sanitize, DSA-5618 webkit2gtk, DSA-5619 libgit2, DSA-5620 unbound, DSA-5621 bind9, DSA-5623 postgresql-15, DSA-5624 edk2, DSA-5625 engrampa, … in 12.6
security amavisd-new: Handle multiple boundary parameters that contain conflicting values [CVE-2024-28054]; fix race condition in postinst in 12.6
security bluez: Fix remote code execution issues [CVE-2023-27349 CVE-2023-50229 CVE-2023-50230] in 12.6
security cjson: Fix missing NULL checks [CVE-2023-50471 CVE-2023-50472] in 12.6
security clamav: New upstream stable release; fix possible heap overflow issue [CVE-2024-20290], possible command injection issue [CVE-2024-20328] in 12.6
security curl: Do not keep default protocols when deselected [CVE-2024-2004]; fix memory leak [CVE-2024-2398] in 12.6
security emacs: Security fixes [CVE-2024-30202 CVE-2024-30203 CVE-2024-30204 CVE-2024-30205]; replace expired package-keyring.gpg with a current version in 12.6
security gdk-pixbuf: ANI: Reject files with multiple anih chunks [CVE-2022-48622]; ANI: Reject files with multiple INAM or IART chunks; ANI: Validate anih chunk size in 12.6
security glewlwyd: Fix potential buffer overflow during FIDO2 credential validation [CVE-2023-49208]; fix open redirection via redirect_uri [CVE-2024-25715] in 12.6
security gnutls28: Fix certtool crash when verifying a certificate chain with more than 16 certificates [CVE-2024-28835]; fix side-channel in the deterministic ECDSA [CVE-2024-28834]; fix a memory leak; fix two segfault issues in 12.6
security gross: Fix stack-based buffer overflow [CVE-2023-52159] in 12.6
security intel-microcode: Security mitigations [CVE-2023-22655 CVE-2023-28746 CVE-2023-38575 CVE-2023-39368 CVE-2023-43490]; mitigate for INTEL-SA-01051 [CVE-2023-45733], INTEL-SA-01052 [CVE-2023-46103], INTEL-SA-01036 [CVE-2023-45745, CVE-2023-47855] and unspecified functional issues on various Intel… in 12.6
security jose: Fix potential denial-of-service issue [CVE-2023-50967] in 12.6
security json-smart: Fix excessive recursion leading to stack overflow [CVE-2023-1370]; fix denial of service via crafted request [CVE-2021-31684] in 12.6
security libapache2-mod-auth-openidc: Fix mising input validation leading to DoS [CVE-2024-24814] in 12.6
security libjwt: Fix timing side channel attack [CVE-2024-25189] in 12.6
security libtommath: Fix integer overflow [CVE-2023-36328] in 12.6
security nsis: Don't allow unprivileged users to delete the uninstaller directory [CVE-2023-37378]; fix regression in disabling stub relocations; build reproducibly for arm64 in 12.6
security nvidia-graphics-drivers: Restore compatibility with newer Linux kernel builds; take over packages from nvidia-graphics-drivers-tesla; add new nvidia-suspend-common package; relax dh-dkms build-dependency for compatibility with bookworm; new upstream stable release [CVE-2023-0180 CVE-2023-0183… in 12.6
security nvidia-graphics-drivers-tesla-470: Restore compatibility with newer Linux kernel builds; stop building nvidia-cuda-mps; new upstream stable release; security fixes [CVE-2022-42265 CVE-2024-0074 CVE-2024-0078 CVE-2024-0090 CVE-2024-0092] in 12.6
security nvidia-open-gpu-kernel-modules: Update to 535 series LTS drivers [CVE-2023-0180 CVE-2023-0183 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199 CVE-2023-25515 CVE-2023-25516 CVE-2023-31022… in 12.6
security openssl: New upstream stable release; fix excessive time taken issues [CVE-2023-5678 CVE-2023-6237], vector register corruption issue on PowerPC [CVE-2023-6129], PKCS12 Decoding crashes [CVE-2024-0727] in 12.6
security ovn: New upstream stable version; fix insufficient validation of incoming BFD packets [CVE-2024-2182] in 12.6
security php-phpseclib: Guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength(); remove visibitility modifiers from static variables in 12.6
security php-phpseclib3: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength() in 12.6
security phpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength() in 12.6
security postgresql-15: New upstream stable release; restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner [CVE-2024-4317] in 12.6
security pymongo: Fix out-of-bounds read issue [CVE-2024-5629] in 12.6
security pypy3: Strip C0 control and space characters in urlsplit [CVE-2023-24329]; avoid bypass of TLS handshake protections on closed sockets [CVE-2023-40217]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450] in 12.6
security python-aiosmtpd: Fix SMTP smuggling issue [CVE-2024-27305]; fix STARTTLS unencrypted command injection issue [CVE-2024-34083] in 12.6
security python-idna: Fix denial of service issue [CVE-2024-3651] in 12.6
security python-jwcrypto: Fix denial of service issue [CVE-2024-28102] in 12.6
security python3.11: Fix use-after-free crash when deallocating a frame object; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; fix os.path.normpath(): Path truncation at null bytes [CVE-2023-41105]; avoid bypass of TLS… in 12.6
security qemu: New upstream stable release; security fixes [CVE-2024-26327 CVE-2024-26328 CVE-2024-3446 CVE-2024-3447] in 12.6
security qtbase-opensource-src: Fix regression in patch for CVE-2023-24607; avoid using system CA certificates when not wanted [CVE-2023-34410]; fix buffer overflow [CVE-2023-37369]; fix infinite loop in XML recursive entity expansion [CVE-2023-38197]; fix buffer overflow with crafted KTX image file… in 12.6
security sendmail: Fix SMTP smuggling issue [CVE-2023-51765] in 12.6
security systemd: New upstream stable release; fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; libnss-myhostname.nss: Install after files; libnss-mymachines.nss: Install before resolve and dns in 12.6
security wpa: Fix authentication bypass issue [CVE-2023-52160] in 12.6
security 39 security advisories included: DSA-5572 roundcube, DSA-5573 chromium, DSA-5574 libreoffice, DSA-5576 xorg-server, DSA-5577 chromium, DSA-5578 ghostscript, DSA-5579 freeimage, DSA-5581 firefox-esr, DSA-5582 thunderbird, DSA-5583 gst-plugins-bad1.0, DSA-5584 bluez, DSA-5585 chromium, … in 12.5
security apktool: Prevent arbitrary file writes with malicious resource names [CVE-2024-21633] in 12.5
security atril: Fix crash when opening some epub files; fix index loading for certain epub documents; add fallback for malformed epub files in check_mime_type; use libarchive instead of external command for extracting documents [CVE-2023-51698] in 12.5
security calibre: Fix HTML Input: Don't add resources that exist outside the folder hierarchy rooted at the parent folder of the input HTML file by default [CVE-2023-46303] in 12.5
security dropbear: Fix terrapin attack [CVE-2023-48795] in 12.5
security espeak-ng: Fix buffer overflow issues [CVE-2023-49990 CVE-2023-49992 CVE-2023-49993], buffer underflow issue [CVE-2023-49991], floating point exception issue [CVE-2023-49994] in 12.5
security filezilla: Prevent Terrapin exploit [CVE-2023-48795] in 12.5
security fish: Handle Unicode non-printing characters safely when given as command substitution [CVE-2023-49284] in 12.5
security gnutls28: Fix assertion failure when verifying a certificate chain with a cycle of cross signatures [CVE-2024-0567]; fix timing side-channel issue [CVE-2024-0553] in 12.5
security indent: Fix buffer under read issue [CVE-2024-0911] in 12.5
security libde265: Fix buffer overflow issues [CVE-2023-49465 CVE-2023-49467 CVE-2023-49468] in 12.5
security libspreadsheet-parsexlsx-perl: Fix possible memory bomb [CVE-2024-22368]; fix XML External Entity issue [CVE-2024-23525] in 12.5
security mariadb: New upstream stable release; fix denial of service issue [CVE-2023-22084] in 12.5
security postfix: New upstream stable release; address SMTP smuggling issue [CVE-2023-51764] in 12.5
security proftpd-dfsg: Implement fix for the Terrapin attack [CVE-2023-48795]; fix out-of-bounds read issue [CVE-2023-51713] in 12.5
security proftpd-mod-proxy: Implement fix for the Terrapin attack [CVE-2023-48795] in 12.5
security pypdf: Fix infinite loop issue [CVE-2023-36464] in 12.5
security pypdf2: Fix infinite loop issue [CVE-2023-36464] in 12.5
security qemu: New upstream stable release; virtio-net: correctly copy vnet header when flushing TX [CVE-2023-6693]; fix null pointer dereference issue [CVE-2023-6683]; revert patch causing regressions in suspend / resume functionality in 12.5
security systemd: New upstream stable release; fix missing verification issue in systemd-resolved [CVE-2023-7008] in 12.5
security tar: Fix boundary checking in base-256 decoder [CVE-2022-48303], handling of extended header prefixes [CVE-2023-39804] in 12.5
security tinyxml: Fix assertion issue [CVE-2023-34194] in 12.5
security wolfssl: Fix security issue when client sent neither PSK nor KSE extensions [CVE-2023-3724] in 12.5
security xen: New upstream stable release; security fixes [CVE-2023-46837 CVE-2023-46839 CVE-2023-46840] in 12.5
security 60 security advisories included: DSA-5499 chromium, DSA-5506 firefox-esr, DSA-5508 chromium, DSA-5511 mosquitto, DSA-5512 exim4, DSA-5513 thunderbird, DSA-5514 glibc, DSA-5515 chromium, DSA-5516 libxpm, DSA-5517 libx11, DSA-5518 libvpx, DSA-5519 grub-efi-amd64-signed +3, … in 12.4
security amanda: Fix local privilege escalation [CVE-2023-30577] in 12.4
security axis: Filter out unsupported protocols in the client class ServiceFactory [CVE-2023-40743] in 12.4
security exfatprogs: Fix out-of-bounds memory access issues [CVE-2023-45897] in 12.4
security exim4: Fix security issues relating to the proxy protocol [CVE-2023-42117] and DNSDB lookups [CVE-2023-42119]; add hardening for SPF lookups; disallow UTF-16 surrogates from ${utf8clean:...}; fix crash with tls_dhparam = none; fix $recipients expansion when used within ${run...}; fix expiry date… in 12.4
security gnutls28: Fix timing sidechannel issue [CVE-2023-5981] in 12.4
security libde265: Fix segmentation violation issue [CVE-2023-27102], buffer overflow issues [CVE-2023-27103 CVE-2023-47471], buffer over-read issue [CVE-2023-43887] in 12.4
security linux: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security linux-signed-amd64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security linux-signed-arm64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security linux-signed-i386: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121] in 12.4
security minizip: Fix integer and heap overflow issues [CVE-2023-45853] in 12.4
security node-undici: Delete cookie and host headers on cross-origin redirect [CVE-2023-45143] in 12.4
security nvidia-graphics-drivers: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security nvidia-graphics-drivers-tesla: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security nvidia-graphics-drivers-tesla-470: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security nvidia-open-gpu-kernel-modules: New upstream release; fix null pointer dereference issue [CVE-2023-31022] in 12.4
security opendkim: Fix removal of incoming Authentication-Results: headers [CVE-2022-48521] in 12.4
security openrefine: Fix remote code execution vulnerability [CVE-2023-41887 CVE-2023-41886] in 12.4
security opensc: Fix out-of-bounds read issue [CVE-2023-4535], potential PIN bypass [CVE-2023-40660], memory-handling issues [CVE-2023-40661] in 12.4
security perl: Fix buffer overrun issue [CVE-2023-47038] in 12.4
security php-phpseclib3: Fix denial of service issue [CVE-2023-49316] in 12.4
security postgresql-15: New upstream stable release; fix SQL injection issue [CVE-2023-39417]; fix MERGE to enforce row security policies properly [CVE-2023-39418] in 12.4
security qemu: Update to upstream stable release 7.2.7; hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467] in 12.4
security symfony: Fix session fixation issue [CVE-2023-46733]; add missing escaping [CVE-2023-46734] in 12.4
security unadf: Fix buffer overflow issue [CVE-2016-1243]; fix code execution issue [CVE-2016-1244] in 12.4
security vips: Fix null pointer dereference issue [CVE-2023-40032] in 12.4
security xen: New upstream stable update; fix several security issues [CVE-2022-40982 CVE-2023-20569 CVE-2023-20588 CVE-2023-20593 CVE-2023-34320 CVE-2023-34321 CVE-2023-34322 CVE-2023-34323 CVE-2023-34325 CVE-2023-34326 CVE-2023-34327 CVE-2023-34328 CVE-2023-46835 CVE-2023-46836] in 12.4

Every release in between

13.7 Sep 12, 2026 Release notes ↗

security92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, …

securityalsa-lib: Fix heap overflow issue [CVE-2026-25068]

securityansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332]

securitybettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default

securitybinwalk: Fix path traversal issue [CVE-2026-7179]

securitycyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088]

securitydcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868]

securitydhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258]

securitydnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969]

securityflask: Ensure Vary: Cookie is set on session access [CVE-2026-27205]

securityfluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714]

securityglib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue…

securityglibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers

securitygoaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777]

securitygpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122]

securitygzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992]

securityimagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871…

securityincus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501]

securitylibhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017]

securitylibio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962]

securitylibmongocrypt: Fix missing input validation issue [CVE-2026-81523]

securitylibnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942]

securitylibnfs: Fix integer overflow [CVE-2026-53689]

securitylibraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660]

securitylibsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness

securitylibsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness

securitylibsocket-perl: Fix out of bounds read issue [CVE-2026-12087]

securitylibssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034]

securitylibvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623]

securitylibwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161]

securitylwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836]

securitymbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow…

securitymongo-c-driver: Fix missing input validation issue [CVE-2026-81524]

securitymrtg: Fix privilege escalation issue [CVE-2026-72694]

securitynode-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800]

securityonionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706]

securityopencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253]

securitypatool: Fix path traversal vulnerability [CVE-2026-29509]

securityperl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix…

securityphp-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766]

+67 more items in the release notes

13.6 Jul 11, 2026 Release notes ↗

security109 security advisories included: DSA-6250 chromium, DSA-6256 php8.4, DSA-6266 nghttp2, DSA-6267 thunderbird, DSA-6268 ffmpeg, DSA-6270 postgresql-17, DSA-6271 gsasl, DSA-6273 chromium, DSA-6274 linux-signed-amd64 +2, DSA-6277 openjpeg2, DSA-6278 nginx, DSA-6279 redis, DSA-6280 netatalk, …

securityapache2: Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of service issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues…

securitybeets: Fix XSS vulnerability [CVE-2026-42052]

securitycalibre: Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader-background endpoint path…

securityckermit: Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check

securitycomposer: Fix support for new GitHub token format [CVE-2026-45793]

securitycurl: Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use-after-free and…

securitydcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805]

securitydebusine: Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853]

securitydeepdiff: Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155]

securitydhcpcd: Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117]

securitydolphin: Fix sandbox escape issue [CVE-2026-41525]

securityerrands: Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063]

securitygdown: Fix arbitray file write issue [CVE-2026-40491]

securitygiflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740]

securitygimp: Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915]

securitygraphite2: Fix out-of-bounds write [CVE-2026-50593]

securityironic: Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths;…

securityisc-kea: Fix denial of service issue [CVE-2026-3608]

securitykeystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551]

securitylibapache-session-browseable-perl: Improve entropy source [CVE-2026-8503]

securitylibbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625]

securitylibcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046]

securitylibcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240]

securitylibcrypt-urandom-perl: Fix buffer overflow issue [CVE-2026-2474]

securitylibhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829]

securitylibnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191]

securitylibslirp: Fix memory disclosure issue [CVE-2026-9539]

securitylibtasn1-6: Fix buffer overflow issue [CVE-2025-13151]

securitylibvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538]

securitylibxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177]

securitylibxml2: Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation…

securitylibxpm: Fix out of bounds read issue [CVE-2026-4367]

securitylxml-html-clean: Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350]

securitymesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393]

securityminiupnpd: Fix integer underflow issue [CVE-2026-5720]

securitymodsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268]

securitymutt: Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864]

securitymxml: Fix out-of-bounds read [CVE-2026-5037]

securitynbconvert: Fix arbitrary file read/write issues [CVE-2026-39377 CVE-2026-39378]

+85 more items in the release notes

13.5 May 16, 2026 Release notes ↗

security96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, …

security389-ds-base: Fix heap overflow issue [CVE-2025-14905]

securityapache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue…

securityawstats: Prevent command injection [CVE-2025-63261]

securityblack: Fix arbitrary file write issue [CVE-2026-32274]

securitybubblewrap: Fix privilege escalation issue [CVE-2026-41163]

securitycalibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824]

securitycimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146]

securitycockpit: Fix code execution issue [CVE-2026-4631]

securitycomposer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176]

securitycurl: Fix server certificate verification issue [CVE-2025-13034]

securitydovecot: Fix memory leak in CVE-2026-27857 fix

securityerlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943]

securityexim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687]

securityfirewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948]

securityfreerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680…

securitygit-lfs: Fix arbitrary file write issue [CVE-2025-26625]

securityglance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure

securityglib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode…

securityglibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;…

securitygvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296]

securityharfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693]

securityjpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures

securityjq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164]

securitykissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445]

securitylibarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121]

securitylibcap2: Fix time of check / time of use issue [CVE-2026-4878]

securitylibcdio: Fix buffer overflow issue [CVE-2024-36600]

securitylibcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468]

securitylibcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564]

securitylibexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385]

securitylibnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199]

securitylibtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111]

securitylibvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854]

securitylibxml-security-java: Fix private key disclosure issue [CVE-2023-44483]

securitylxc: Fix authorisation bypass issue [CVE-2026-39402]

securitymapserver: Fix buffer overflow issue [CVE-2026-33721]

securitymodsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691]

securitymongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files

securitymusl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200]

+105 more items in the release notes

13.4 Mar 14, 2026 Release notes ↗

security62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …

fixakonadi: Show all folders in kmail

fixapache2: Fix HTTP/2 regression

securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]

fixasahi-scripts: Fix SD card reader autosuspend

securityaugeas: Fix null pointer dereference issue [CVE-2025-2588]

fixbase-files: Update for the point release

fixbash: Rebuild with updated glibc

securitycapstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114]

securitycivetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763]

securitydirewolf: Fix stack buffer overflow [CVE-2025-34457]

securitydpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219]

securityerlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107]

securityfluidsynth: Fix null pointer dereference issue [CVE-2025-56225]

securityfonttools: Fix arbitrary file write issue [CVE-2025-66034]

securityglibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the…

securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269]

securityjaraco.context: Prevent path traversal [CVE-2026-23949]

securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]

securitylibsndfile: Fix memory leak issue [CVE-2025-56226]

securitymariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support

securitynode-proxy-agents: Fix path traversal issue [CVE-2026-27699]

securityopenssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985]

securitypcsx2: Fix code execution issue [CVE-2025-49589]

securityphpunit: Fix unsafe deserialization issue [CVE-2026-24765]

securitypostgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006]

securitypython-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007]

securitypython-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146]

securitypython-multipart: Fix arbitrary file write issue [CVE-2026-24486]

securityqemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665]

securityrequests: Fix credential leak issue [CVE-2024-47081]

securityrust-ntp-proto: Fix excessive load issue [CVE-2026-26076]

securityrust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076

securitysqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf

securitystarlette: Fix denial of service issue [CVE-2025-62727]

securitysuricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264]

securitywget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195]

securitywireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203]

securityxen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553]

securityzabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643]

+72 more items in the release notes

13.3 Jan 10, 2026 Release notes ↗

security36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, …

fixansible: New upstream stable release

securityapache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200]

fixat-spi2-core: Ensure xkb group is taken into account for key events

fixawffull: Fix systemd timer invocation to avoid premature cron-script exit

fixbase-files: Update for the point release

fixbash: Rebuild with updated glibc

fixbglibs: Rebuild with updated glibc

fixbusybox: Rebuild with updated glibc

securitycalibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486]

fixcatatonit: Rebuild with updated glibc

fixcdebootstrap: Rebuild with updated glibc

fixchkrootkit: Rebuild with updated glibc

fixcloud-init: Ensure deb822 sources.list template renders correctly

securitycomposer: Fix ANSI sequence injection [CVE-2025-67746]

securitycups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524]

securityedk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770]

securityfreedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462]

securityglib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]

securitygnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc

securitygnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback

securityimagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]

securitylibcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499]

securitylibcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]

securitylibphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119]

securitylibvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the…

securitylxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507]

securitymbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438]

securitymongo-c-driver: Avoid invalid memory reads [CVE-2025-12119]

securitynode-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033]

securitypgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]

securitypostgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]

securityqemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464]

securityr-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation

securityrlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]

securityrsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]

securityrust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897]

securitysogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]

securitysuricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344]

securitysymfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries

+69 more items in the release notes

13.2 Nov 15, 2025 Release notes ↗

security52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, …

security7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001]

fix7zip-rar: Add missing CRC table constructor

fixaide: Fix bin/buildcache use by running it from a root timer; various updates and fixes to included rules

fixallow-html-temp: New upstream version to support newer Thunderbird releases

fixalsa-ucm-conf-asahi: Install missing aop_audio UCM configs

fixansible: Update collections to maintain compatibility with ansible-core 2.19

fixansible-core: New upstream stable release; fix regression from 2.18 regarding handlers and play tags

fixasahi-scripts: Fix the macaudio default profile check; add the apple_nvmem_spmi module to the initramfs explicitly; make update-m1n1 idempotent

fixbase-files: Update for the point release

fixbrltty: atSpi2: do not manage widgets without text interface; avoid excessive verbose bluetooth/usbfs messages

fixconsole-setup: Update keyboard layouts dz(la) into dz(azerty-oss) and Use ca/multix variant instead of ca/multi; fix dz(azerty-oss/deadkeys) into dz, which is what xkb really provides; fix dz default layout

fixcups: Fix operation of checkboxes in admin interface

securitycurl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563]

fixdebian-edu-config: Use SERVER_ADDRESS in RewriteRule instead of hard-coded 'www'; drop desktop bundle from bundlesequence

securitydnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187]

securityimagemagick: Fix integer overflow issue [CVE-2025-62171]

securitylemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication

securitylibcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibhtp: Prevent memory leak with lzma [CVE-2025-53537]

securitylibsmb2: Fix buffer overflow issue [CVE-2025-57632]

securitylibssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277]

securitylibwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678]

securitylibxml2: Fix XPath recursion depth DoS [CVE-2025-9714]

securitylibyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683]

securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]

securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]

securitymapserver: Fix SQL injection issue [CVE-2025-59431]

securitymodsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571]

securitynvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345]

securityopen-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244]

securityphpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573]

securitypoppler: Fix infinite recursion [CVE-2025-50420]

securitypython-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068]

securityqemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls

securityrabbitmq-server: Fix logging on sensitive data [CVE-2025-50200]

securitysail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510]

securitysamba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230]

securitysuricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147]

+84 more items in the release notes

13.1 Sep 6, 2025 Release notes ↗

security14 security advisories included: DSA-5975 linux-signed-amd64 +2, DSA-5976 chromium, DSA-5977 aide, DSA-5978 webkit2gtk, DSA-5979 libxslt, DSA-5980 firefox-esr, DSA-5981 chromium, DSA-5983 qemu, DSA-5984 thunderbird, DSA-5986 node-cipher-base, DSA-5988 chromium, DSA-5989 udisks2, …

fixauto-apt-proxy: Check explicitly configured proxies before network gateway

fixbase-files: Update for the point release

fixcourier: Fix courier-webmin

fixdebian-installer: Increase Linux kernel ABI to 6.12.43+deb13; rebuild against proposed-updates; add a workaround for a GRUB graphics initialisation bug

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdesktop-base: Fix placement of plymouth prompts in multi-monitor setups

fixdevscripts: Update suite and codename mappings

fixdpdk: New upstream point release

fixethtool: netlink: fix print_string when the value is NULL

securityfirebird3.0: Fix null pointer dereference in XDR message parsing [CVE-2025-54989]

fixflvstreamer: Stop installing rtmpsrv and rtmpsuck, avoiding file conflict with the rtmpdump package

fixgalera-4: New upstream stable release

securitygit: New upstream bug-fix release; fix arbitrary file write issues [CVE-2025-27613 CVE-2025-46835]; fix code execution issues [CVE-2025-27614 CVE-2025-48384]; fix protocol injection issue, possibly leading to arbitrary code execution [CVE-2025-48385]

fixglib2.0: New upstream bugfix release; fix a corner case when upgrading from bookworm

fixgnome-control-center: Fix a UI issue and an error display issue; translation updates

fixgnome-online-accounts: New upstream bug-fix release; update translations

fixgnome-shell: New upstream bugfix release

securitygolang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211]

fixgssdp: New upstream bug-fix release; fix issues with Since: and Deprecated: declarations in documentation

securityimagemagick: Security fixes: heap buffer overflow in the InterpretImageFilename function [CVE-2025-53014]; infinite loop when writing during a specific XMP file conversion command [CVE-2025-53015]; memory leak in the magick stream command [CVE-2025-53019]; stack overflow through vsnprintf()…

fixinit-system-helpers: Fix handling of os-release diversions from live-build, ensuring they don't exist in non-live systems

fixinstallation-guide: Enable Hungarian and Ukrainian translations; fix boot-dev-select-arm64 and armhf-armmp-supported-platforms hyperlinks

securityiperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350]

fixkamailio: Relax OpenSSL version check to only match against major version

fixlibadwaita-1: New upstream bugfix release

securitylibcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927]

securitylibcoap3: Fix buffer overflow issue [CVE-2024-0962]; fix integer overflow issue [CVE-2024-31031]

fixlibreoffice: Add EUR support for Bulgaria; fix installation of Impress sound effects; fix playing of videos in Impress under Qt6

fixlibrepo: New upstream bug-fix release, fixing support for DNF5; improve handling of SELinux in the Debian packaging

fixlinux: New upstream stable release

fixlinux-signed-amd64: New upstream stable release

securitymozjs128: New upstream stable release; fix uninitialised memory issue [CVE-2025-9181], memory safety issues [CVE-2025-9185]

securitynginx: Fix potential information leak in ngx_mail_smtp_module [CVE-2025-53859]

securitynode-tmp: Fix arbitrary file write issue [CVE-2025-54798]

securityopenjpeg2: Fix out-of-bounds write issue [CVE-2025-54874]

securitypcre2: New upstream stable release; fix potential information disclosure issue [CVE-2025-58050]

securitypostgresql-17: New upstream stable release; tighten security checks in planner estimation functions [CVE-2025-8713]; prevent pg_dump scripts from being used to attack the user running the restore [CVE-2025-8714]; convert newlines to spaces in names included in comments in pg_dump output…

securityshaarli: Fix cross site scripting issue [CVE-2025-55291]

securitywolfssl: Avoid weak and predictable random numbers [CVE-2025-7394]

+32 more items in the release notes

12.15 Jul 11, 2026 Release notes ↗

security84 security advisories included: DLA-4627 kernel-wedge, DLA-4628 linux-base, DLA-4632 atril, DLA-4633 libreoffice, DLA-4635 firefox-esr, DLA-4636 thunderbird, DLA-4637 libconfig-inifiles-perl, DLA-4638 libgd-perl, DLA-4639 libhttp-daemon-perl, DLA-4642 u-boot, DLA-4643 imagemagick, …

security7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104]

securityapache2: Fix HTTP/2 request DoS and file handle exhaustion [CVE-2026-49975 CVE-2026-48913]; fix proxy, DAV, LDAP, SSL, XML and header memory/crash issues [CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44185]; fix proxy FTP directory listing XSS…

securitybeets: Fix XSS vulnerability [CVE-2026-42052]; fix build-time test failures

securitycalibre: Fix various potential security issues; read resources only from book contents [CVE-2026-33206]; keep extracted files within container dir [CVE-2026-30853]; prevent reading background images from outside the config dir [CVE-2026-33205]

securitycomposer: Fix support for new GitHub token format [CVE-2026-45793]

securitycurl: Fix cache poisoning issue [CVE-2025-10148]; fix data leak issues [CVE-2025-14524 CVE-2026-3783]; fix incorrect connection re-use issues [CVE-2025-14819 CVE-2026-3784 CVE-2026-5773 CVE-2026-7168]

securitydhcpcd5: Fix NULL pointer dereference issue [CVE-2025-70102]; fix out-of-bounds write issue [CVE-2026-56114]

securityfirewalld: Fix DBUS policy checking [CVE-2026-4948]

securitygiflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740]

securitygraphite2: Fix out-of-bounds write [CVE-2026-50593]

securityironic: Fix file disclosure via image sources [CVE-2025-44021]; fix console command injection [CVE-2026-42510]; fix Swift token disclosure [CVE-2026-42997]; fix unsafe template execution [CVE-2026-44916]

securitykeystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551]

securitylibbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625]

securitylibcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046]

securitylibhtml-gumbo-perl: Fix uninitialized memory access [CVE-2025-15646]

securitylibhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829]

securitylibnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191]

securitylibvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538]

securitylibxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177]

securitylibxml2: Fix catalogue recursion and duplicate-catalog handling [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; limit RelaxNG include recursion [CVE-2026-0989]; fix xmllint shell memory leak [CVE-2026-1757]; correct schematron regression-test outputs [CVE-2025-49794 CVE-2025-49796]; fix XML writer…

securitymariadb: New upstream stable release; fix code execution issues [CVE-2025-13699 CVE-2026-44168 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261]; fix denial of service issues [CVE-2026-21968 CVE-2026-34303]; fix logging bypass issue [CVE-2026-3494]; fix path traversal issue [CVE-2026-44171]; fix SQL…

securitymesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393]

securitymodsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268]

securitymxml: Fix out-of-bounds read [CVE-2026-5037]

securitynode-flatted: Fix prototype pollution issue [CVE-2026-33228]

securityopenslide: Fix possible code execution issue [CVE-2026-48977]

securityp7zip: New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104]

securityphp-guzzlehttp-psr7: Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers

securityphpunit: Fix unsafe deserialization in PHPT code coverage handling [CVE-2026-24765]

securityprotobuf: Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409]

securitypydantic: Fix denial of service in email verification [CVE-2024-3772]

securitypymatgen: Fix denial of service in GaussianInput.from_string [CVE-2022-42964]

securitypython-filelock: Fix symlink vulnerabilies [CVE-2025-68146 CVE-2026-22701]

securitypython-markdown: Fix parsing of bogus HTML markup [CVE-2025-69534]

securitypython-pyramid: Fix information disclosure issue [CVE-2023-40587]

securitypython-xmltodict: Fix XML injection issue [CVE-2025-9375]

securitypython3.11: Prevent incorrect tar archive handling [CVE-2025-13462]; ensure bytecode-only imports use normal security checks [CVE-2026-2297]; reject unsafe cookie values [CVE-2026-3644]; prevent XML parser crashes [CVE-2026-4224]; prevent browser command injection [CVE-2026-4519]; prevent bz2/lzma…

+49 more items in the release notes

12.14 May 16, 2026 Release notes ↗

security131 security advisories included: DSA-6003 firefox-esr, DSA-6025 firefox-esr, DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …

security7zip: New upstream stable release; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links…

securityapache2: New upstream release: fix http2 regression; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue…

securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]

securityaugeas: Fix NULL pointer dereference issue [CVE-2025-2588]

securityawstats: Prevent command injection [CVE-2025-63261]

securitybusybox: Fix stack overflow [CVE-2022-48174] and use-after-free [CVE-2023-42363 CVE-2023-42364 CVE-2023-42365] errors

securityc3p0: Fix recursive entity expansion issue [CVE-2019-5427]

securitycomposer: Fix code execution issue [CVE-2023-43655]; fix command injection issues [CVE-2026-40261 CVE-2026-40176]

securitycontainerd: Fix CRI Attach implementation [CVE-2025-64329]; fix overly broad directory permissions [CVE-2024-25621]; fix large UID:GID (> 32bit) overflow [CVE-2024-40635]

securitydovecot: Correct incomplete backport of CVE-2026-27855 fix; fix memory leak in CVE-2026-27857 fix

securitydpkg: New upstream stable release; fix insufficient permissions check leading to possible denial of service issue [CVE-2025-6297]; fix denial of service issue [CVE-2026-2219]; fix buffer over-read issue; fix uninitialized variable warning with Rules-Requires-Root; fix segmentation fault in…

securityerlang: Fix denial of service issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix HTTP request smuggling issue [CVE-2026-23941]; fix path traversal issues [CVE-2026-23942 CVE-2026-21620]; fix compression bomb issue [CVE-2026-23943]

securityfonttools: Fix XML External Entity injection issue [CVE-2023-45139]; fix code execution issue [CVE-2025-66034]

securityglance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure

securityglibc: Fix integer overflow issue [CVE-2026-0861]; fix uninitialised memory use issue [CVE-2025-15281]; fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix performance bottleneck with ASAN on…

securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix integer underflow issue [CVE-2025-67269]

securitygrub-efi-amd64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…

securitygrub-efi-arm64-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…

securitygrub-efi-ia32-signed: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix…

securitygrub2: Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set Protected: yes for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG [CVE-2024-45774]; fix commands/extcmd:…

securitygvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296]

securitykissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445]

securitylibarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121]

securitylibcap2: Fix time of check / time of use issue [CVE-2026-4878]; rebuild with updated glibc

securitylibexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385]

securitylibnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199]

securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]

securitylibreoffice: Fix incomplete fix for CVE-2024-12426

securitylibuev: Fix buffer overrun issue [CVE-2022-48620]

securitylibvncserver: Fix out-of-bounds read issue [CVE-2026-32853]; fix null pointer dereference issue [CVE-2026-32854]

securitylibxml-security-java: Fix private key disclosure issue [CVE-2023-44483]

securitylxc: Fix authorisation bypass issue [CVE-2026-39402]

securitymapserver: Fix SQL injection issue [CVE-2025-59431]; fix buffer overflow issue [CVE-2026-33721]; fix heap-buffer-overflow and double-free issues in maplexer

securitymodsecurity-crs: Fix rule bypass issue [CVE-2023-38199]; fix file extension blocking bypass issue [CVE-2026-33691]

securitynginx: Fix buffer overflow issues [CVE-2026-27654 CVE-2026-27784 CVE-2026-32647]; fix session authentication issues [CVE-2026-27651 CVE-2026-28753]; fix OCSP result bypass issue [CVE-2026-28755]; use $host instead of $http_host

+60 more items in the release notes

12.13 Jan 10, 2026 Release notes ↗

security77 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, DSA-6003 firefox-esr, DSA-6004 chromium, …

securityangular.js: Fix regular expression-based denial of service issues [CVE-2022-25844 CVE-2023-26116 CVE-2023-26117 CVE-2023-26118]; fix restriction bypass issues [CVE-2024-8372 CVE-2024-8373]; fix denial of service issue [CVE-2024-21490]; fix improper sanitization issues [CVE-2025-0716 CVE-2025-2336]

securitycalibre: Fix code execution issue [CVE-2025-64486]

securitycomposer: Fix ANSI sequence injection [CVE-2025-67746]

securityfreerdp2: New upstream release; fix multiple memory-safety vulnerabilities: integer overflow/underflow and out-of-bounds write in NSC, Clear, and GDI bitmap codecs [CVE-2024-22211 CVE-2024-32037 CVE-2024-32038 CVE-2024-32039 CVE-2024-32040]; out-of-bounds reads in ZGFX, Planar, NCRUSH,…

securitygdk-pixbuf: Fix buffer overflow issue [CVE-2025-7345]

securitygit: Fix arbitrary file creation/truncation in gitk [CVE-2025-27613]; prevent arbitrary file overwrite in git-gui with crafted directory names [CVE-2025-46835]; correct submodule path parsing with trailing CR [CVE-2025-48384]; validate bundle-uri to prevent protocol injection during clone…

securityglib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]

securityimagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-62171 CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]

securitylemonldap-ng: Fix sessions tablename when not default; fix oidc flow when user encountered an error on server side; fix Kerberos JavaScript when used with Choice; improve CORS checking; fix path_info handling; fix shell injection issue [CVE-2025-59518]; hide session id from Ajax responses

securitylibcommons-lang-java: Fix uncontrolled recursion issue [CVE-2025-48924]

securitylibcommons-lang3-java: Fix uncontrolled recursion issue [CVE-2025-48924]

securitylibhtp: Fix denial of service issue via unbounded HTTP header processing [CVE-2024-23837 CVE-2024-45797]

securitylibnginx-mod-http-lua: Fix HTTP HEAD request smuggling [CVE-2024-33452]

securitylibphp-adodb: Fix SQL injection in sqlite and sqlite3 metadata lookups [CVE-2025-54119]

securitylibssh: Fix integer overflow issue [CVE-2025-4877]; fix use of uninitialized variable [CVE-2025-4878]; fix out of bounds memory access issue [CVE-2025-5318]; fix double free issue [CVE-2025-5351]; fix use of uninitialized memory [CVE-2025-5372 CVE-2025-5987]; fix null pointer dereference issue…

securitylibxml2: Fix denial of service issue [CVE-2025-9714]

securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]

securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]

securitymodsecurity-apache: Fix request body error handling to propagate Apache filter/read failures correctly [CVE-2025-54571]; map request body read failures to appropriate HTTP status codes; simplify request body error propagation in mod_security2

securitymongo-c-driver: Avoid invalid memory reads [CVE-2025-12119]

securitymydumper: Fix arbitrary file read issue [CVE-2025-30224]

securitynvidia-graphics-drivers: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]

securitynvidia-open-gpu-kernel-modules: New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]

securityopen-vm-tools: Disable SDMP service version collection by default to mitigate local privilege escalation [CVE-2025-41244]

securityopenrefine: Fix MySQL host parameter injection in JDBC URL parsing [CVE-2024-23833]; fix reflected XSS in gdata OAuth callback handler [CVE-2024-47878]; fix content-type confusion XSS in ExportRows endpoint [CVE-2024-47880]; prevent remote or extension loading via SQLite connection URL…

securitypam: Fix local privilege escalation in pam_namespace [CVE-2025-6020]

securitypgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]; fix expired password use issue [CVE-2025-2291]

securitypostgresql-15: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]

securityqemu: New upstream stable release; fix qemu-img info https://example.com; fix migration of guests using virtio-net; fix use after free issue [CVE-2025-11234]

securityr-cran-gh: Fix sensitive data leak issue [CVE-2025-54956]

securityrear: Prevent created initrd from being world-readable when GRUB_RESCUE=y [CVE-2024-23301]

securityrlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]

securityrsync: Improve test coverage for future updates; fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]

securityruby-sinatra: Fix regular expression-based denial of service issue [CVE-2025-61921]

securitysamba: Fix information leak issue [CVE-2018-14628]; fix command injection issue [CVE-2025-10230]; fix uninitialized memory disclosure issue [CVE-2025-9640]

securitysogo: Fix HTML injection issue [CVE-2023-48104]; fix CSS injection issue [CVE-2024-24510]; fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]; fix crash on invalid mailIdentities

+57 more items in the release notes

12.12 Sep 6, 2025 Release notes ↗

security75 security advisories included: DSA-5914 chromium, DSA-5916 chromium, DSA-5918 varnish, DSA-5919 open-vm-tools, DSA-5920 chromium, DSA-5921 thunderbird, DSA-5922 firefox-esr, DSA-5923 net-tools, DSA-5924 intel-microcode, DSA-5925 linux-signed-amd64 +3, DSA-5926 firefox-esr, …

securityamd64-microcode: Update AMD-SEV firmware [CVE-2024-56161]; update included microcode

securityapache2: New upstream stable release; fix HTTP response splitting issue [CVE-2024-42516]; fix server-side request forgery issue [CVE-2024-43204 CVE-2024-43394]; fix log injection issue [CVE-2024-47252]; fix access control bypass issue [CVE-2025-23048]; fix denial of service issue [CVE-2025-49630];…

securitybotan: Fix denial of service issues [CVE-2024-34702 CVE-2024-34703]; fix improper parsing of name constraints [CVE-2024-39312]; fix compiler-induced secret-dependent operation issue [CVE-2024-50383]

securitycjson: Fix denial of service issue [CVE-2023-26819]; fix buffer overflow issue [CVE-2023-53154]

securityclamav: New upstream stable release; fix buffer overflow issues [CVE-2025-20128 CVE-2025-20260]

securitycloud-init: Make hotplug socket writable only by root [CVE-2024-11584]; don't attempt to identify non-x86 OpenStack instances [CVE-2024-6174]

securitycommons-beanutils: Fix improper access control issue [CVE-2025-48734]

securitycommons-vfs: Fix path traversal issue [CVE-2025-27553]

securitycorosync: Fix buffer overflow vulnerability on large UDP packets [CVE-2025-30472]

securitydjvulibre: Fix denial of service issues [CVE-2021-46310 CVE-2021-46312]

securitydropbear: Fix shell injection vulnerability in multihop handling [CVE-2025-47203]

securityerlang: ssh: fix strict KEX hardening [CVE-2025-46712]; zip: sanitize pathnames when extracting files with absolute pathnames [CVE-2025-4748]; fix documentation build failure with newer xsltproc versions

securityexpat: Fix denial of service issues [CVE-2023-52425 CVE-2024-8176]; fix parser crash [CVE-2024-50602]

securityfig2dev: Detect nan in spline control values [CVE-2025-46397]; permit \0 in 2nd line in fig file [CVE-2025-46398]; ge output: correct spline computation [CVE-2025-46399]; reject arcs with a radius smaller than 3 [CVE-2025-46400]

securityfirebird3.0: Fix NULL pointer dereference issue [CVE-2025-54989]

securityfort-validator: Fix denial of service issues [CVE-2024-45234 CVE-2024-45235 CVE-2024-45236 CVE-2024-45238 CVE-2024-45239 CVE-2024-48943]; fix buffer overflow issue [CVE-2024-45237]

securityglib2.0: Fix buffer underflow issue [CVE-2025-4373 CVE-2025-7039]; improve upgrade safety

securityglibc: Fix incorrect LD_LIBRARY_PATH search in dlopen for static setuid binaries [CVE-2025-4802]; improve memory layout of structures in exp/exp10/expf functions; add an SVE implementation of memset on aarch64; improve generic implementation of memset on aarch64; fix double free issue…

securitygolang-github-gin-contrib-cors: Fix mishandling of wildcards [CVE-2019-25211]

securitygst-plugins-base1.0: Fix buffer overrun issue [CVE-2025-47806]; fix NULL pointer dereference issues [CVE-2025-47807 CVE-2025-47808]

securitygst-plugins-good1.0: Fix possible information disclosure issue [CVE-2025-47219]

securityiperf3: Fix buffer overflow issue [CVE-2025-54349]; fix assertion failure [CVE-2025-54350]

securityjinja2: Fix arbitrary code execution issue [CVE-2025-27516]

securityjq: Zero-terminate string in jv.c [CVE-2025-48060]

securitykmail-account-wizard: Fix man in the middle attack issue [CVE-2024-50624]

securitykrb5: Fix message tampering issue [CVE-2025-3576]; disable issuance of tickets using RC4 or triple-DES session keys by default

securitykubernetes: Sanitise raw data output to terminal [CVE-2021-25743]; hide long and multi-line strings when printing

securitylibarchive: Fix integer overflow issues [CVE-2025-5914 CVE-2025-5916], buffer over read issue [CVE-2025-5915], buffer overlow issue [CVE-2025-5917]

securitylibcgi-simple-perl: Fix HTTP response splitting issue [CVE-2025-40927]

securitylibfcgi: Fix integer overflow issue [CVE-2025-23016]

securitylibphp-adodb: Fix SQL injection vulnerability in pg_insert_id() [CVE-2025-46337]

securitylibraw: Fix out-of-bounds read issues [CVE-2025-43961 CVE-2025-43962 CVE-2025-43963]; enforce minimum w0 and w1 values [CVE-2025-43964]

securitylibsndfile: Fix integer overflow issues [CVE-2022-33065]; fix out of bounds read issue [CVE-2024-50612]

securitylibsoup3: New upstream bug-fix release; fix buffer overrun issue [CVE-2024-52531]; fix denial of service issues [CVE-2024-52532 CVE-2025-32051]; fix heap overflow issues [CVE-2025-32052 CVE-2025-32053]; fix integer overflow issue [CVE-2025-32050]; fix heap buffer overflow issues [CVE-2025-2784];…

securitylibtpms: Fix out of bounds read issue [CVE-2025-49133]

securitylibxml2: Fix integer overflow issue in xmlBuildQName [CVE-2025-6021]; fix potential buffer overflows in the interactive shell [CVE-2025-6170]; fix use-after-free issue in xmlSchematronReportOutput [CVE-2025-49794]; fix type confusion issue in xmlSchematronReportOutput [CVE-2025-49796]

securitylibyaml-libyaml-perl: Fix arbitrary file edit issue [CVE-2025-40908]

securityluajit: Fix buffer overflow issue [CVE-2024-25176]; fix denial of service issue [CVE-2024-25177]; fix out-of-bounds read issue [CVE-2024-25178]

securitymariadb: New upstream stable release; security fixes [CVE-2023-52969 CVE-2023-52970 CVE-2023-52971 CVE-2025-30693 CVE-2025-30722]; fix restart after out of memory; new upstream stable release; fix variable name in debian-start.sh

+96 more items in the release notes

12.11 May 17, 2025 Release notes ↗

security39 security advisories included: DSA-5877 chromium, DSA-5878 php8.2, DSA-5879 opensaml, DSA-5880 freetype, DSA-5881 rails, DSA-5882 chromium, DSA-5883 mercurial, DSA-5884 libxslt, DSA-5885 webkit2gtk, DSA-5886 ruby-rack, DSA-5887 exim4, DSA-5888 ghostscript, DSA-5889 firefox-esr, …

securityabseil: Fix heap buffer overflow issue [CVE-2025-0838]; fix build failure on ppc64el

fixadonthell: Fix compatibility with SWIG 4.1

fixbase-files: Update for the point release

fixbash: Rebuild for outdated Built-Using (glibc/2.36-9+deb12u5)

fixbusybox: Rebuild for outdated Built-Using (glibc/2.36-9)

securityfig2dev: Reject huge pattern lengths [CVE-2025-31162]; reject arcs with co-incident points [CVE-2025-31163]; allow an arc-box with zero radius [CVE-2025-31164]

securityfossil: Fix interaction with an Apache HTTP server including the fix for CVE-2024-24795

securitygcc-12: Fix -fstack-protector handling of overflows on AArch64 [CVE-2023-4039]

securityglib2.0: Fix integer overflow in g_date_time_new_from_iso8601() [CVE-2025-3360]

securityhaproxy: Fix heap buffer overflow issue [CVE-2025-32464]

securityimagemagick: Fix MIFF image depth mishandled after SetQuantumFormat [CVE-2025-43965]

securitykrb5: Fix memory leak in ndr.c [CVE-2024-26462]; prevent buffer overflow when calculating ulog buffer size [CVE-2025-24528]

securitylibbson-xs-perl: Fix security issues in embedded copy of libbson: denial of service [CVE-2017-14227]; buffer over-read [CVE-2018-16790]; infinite loop [CVE-2023-0437]; memory corruption [CVE-2024-6381]; buffer overflows [CVE-2024-6383 CVE-2025-0755]

securitylibcap2: Fix incorrect recognition of group names [CVE-2025-1390]

securitylibdata-entropy-perl: Seed entropy pool with urandom by default [CVE-2025-1860]

securitylibsub-handlesvia-perl: Fix arbitrary code execution issue [CVE-2025-30673]

securitymongo-c-driver: Fix infinite loop issue [CVE-2023-0437]; fix integer overflow issue [CVE-2024-6381]; fix buffer overflow issues [CVE-2024-6383 CVE-2025-0755]

securitynetwork-manager: Fix crash dereferencing NULL pointer during debug logging [CVE-2024-6501]

securitynginx: Fix buffer underread and unordered chunk vulnerabilities in mp4 [CVE-2024-7347]

securitynode-send: Fix cross-site scripting issue [CVE-2024-43799]

securitynode-serialize-javascript: Fix cross-site scripting issue [CVE-2024-11831]

securitynvidia-graphics-drivers: New upstream stable release; remove ppc64el support (migrated to src:nvidia-graphics-drivers-tesla-535); fix build issues with newer kernel versions; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244]

securitynvidia-open-gpu-kernel-modules: New upstream stable release; security fixes [CVE-2024-0131 CVE-2024-0147 CVE-2024-0149 CVE-2024-0150 CVE-2024-53869 CVE-2025-23244]

securityopenrazer: Fix out of bounds read issue [CVE-2025-32776]

securityopenssh: Fix the DisableForwarding directive [CVE-2025-32728]

securityopenssl: New upstream stable release; fix timing side channel issue [CVE-2024-13176]

securityopenvpn: Avoid possible ASSERT() on OpenVPN servers using --tls-crypt-v2 [CVE-2025-2704]; prevent malicious peer DoS or log-flooding [CVE-2024-5594]; refuse multiple exit notifications from authenticated clients [CVE-2024-28882]; update expired certificates in build tests

securityphpmyadmin: Fix XSS vulnerabilities [CVE-2025-24529 CVE-2025-24530]

securitypoppler: Fix crash on malformed files [CVE-2023-34872]; fix out-of-bounds read issues [CVE-2024-56378 CVE-2025-32365]; fix floating point exception issue [CVE-2025-32364]

securitypostgresql-15: New upstream stable release; fix buffer over-read issue [CVE-2025-4207]

securitypython-h11: Fix request smuggling issue [CVE-2025-43859]

securitypython3.11: Fix misparsing issues [CVE-2025-0938 CVE-2025-1795]

securityqtbase-opensource-src: Delay HTTP2 communication until encrypted() can be responded to [CVE-2024-39936]; fix crash with null checks in table iface methods

securityredis: Fix denial of service issue [CVE-2025-21605]

securityshadow: Fix password leak issue [CVE-2023-4641]; fix chfn control character injection issue [CVE-2023-29383]

securitytwitter-bootstrap3: Fix cross-site scripting issues [CVE-2024-6485 CVE-2024-6484]

securitytwitter-bootstrap4: Fix cross-site scripting issue [CVE-2024-6531]

securityvarnish: Prevent HTTP/1 client-side desync [CVE-2025-30346]

securityxmedcon: Fix buffer overflow [CVE-2025-2581]

+42 more items in the release notes

12.10 Mar 15, 2025 Release notes ↗

security40 security advisories included: DSA-5834 chromium, DSA-5836 xen, DSA-5839 firefox-esr, DSA-5840 chromium, DSA-5841 thunderbird, DSA-5842 openafs, DSA-5843 rsync, DSA-5844 chromium, DSA-5845 tomcat10, DSA-5846 libreoffice, DSA-5847 snapcast, DSA-5848 chromium, DSA-5849 git-lfs, …

security389-ds-base: Fix crash when modifying userPassword using malformed input [CVE-2024-2199 CVE-2024-8445]; prevent denial of service while attempting to log in with a user with a malformed hash in their password [CVE-2024-5953]; prevent denial of service on the directory server with specially-crafted…

fixbase-files: Update for the point release

fixbup: New upstream bugfix release

fixcontainerd: Fix tests causing FTBFS on the auto-builder network

securitycurl: Fix unintended HTTPS upgrades or premature reversion to HTTP when both subdomains and parent domains are used [CVE-2024-9681]; prevent stopping of stunnel before retries in the built-time tests; fix possible credentials leakage issues [CVE-2024-11053 CVE-2025-0167]; fix test failures due to…

fixdacite: Do not cache result of get_default_value_for_field

securitydcmtk: Fix issue when rendering an invalid monochrome DICOM image [CVE-2024-47796]; ensure: HighBit < BitsAllocated [CVE-2024-52333]; fix possible overflows when allocating memory [CVE-2024-27628]; fix two segmentation faults [CVE-2024-34508 CVE-2024-34509]; fix arbitrary code execution issue…

fixdebian-installer: Increase Linux kernel ABI to 6.1.0-32; rebuild against proposed-updates

fixdebian-ports-archive-keyring: Add 2026 key; move 2023 and 2024 keys to the removed keyring

fixdgit: Add missing parameters for source upload target

securitydjoser: Fix authentication bypass [CVE-2024-21543]

fixdns-root-data: Add the DNSKEY record for KSK-2024

securityedk2: Fix overflow condition in PeCoffLoaderRelocateImage() [CVE-2024-38796]; fix potential UINT32 overflow in S3 ResumeCount [CVE-2024-1298]

fixelpa: Fix tests on machines with 2 vCPU or fewer

securityflightgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781]

fixgensim: Fix build failure on single-CPU machines

securityglibc: Fix buffer overflow when printing assertion failure message [CVE-2025-0395]; fix memset performance for unaligned destinations; fix TLS performance degradation after dlopen() usage; avoid integer truncation when parsing CPUID data with large cache sizes; ensure data passed to the rseq…

fixgolang-github-containers-buildah: Disable a test known to fail on the auto-builder network, fixing build failure

securityintel-microcode: New upstream security release [CVE-2023-34440 CVE-2023-43758 CVE-2024-24582 CVE-2024-28047 CVE-2024-28127 CVE-2024-29214 CVE-2024-31068 CVE-2024-31157 CVE-2024-36293 CVE-2024-37020 CVE-2024-39279 CVE-2024-39355]

securityjinja2: Fix arbitrary code execution issues [CVE-2024-56201 CVE-2024-56326]

securitylemonldap-ng: Fix CSRF vulnerability on 2FA registration interface [CVE-2024-52948]

securitylibapache-mod-jk: Set correct default permissions for shared memory [CVE-2024-46544]

securitylibeconf: Fix buffer overflow vulnerability [CVE-2023-32181 CVE-2023-22652]

securitylibrabbitmq: Add option to read username/password from file [CVE-2023-35789]

securitylibtar: Fix out-of-bounds read in gnu_longlink() [CVE-2021-33643]; fix out-of-bounds read in gnu_longname() [CVE-2021-33644]; fix memory leak in th_read() [CVE-2021-33645]; fix memory leak in th_read() [CVE-2021-33646]

securitymariadb: New upstream stable release; fix security issue [CVE-2024-21096]; fix denial of service issue [CVE-2025-21490]

securitymonero: Impose response limits on HTTP server connections [CVE-2025-26819]

securitynginx: Fix possible bypass of client certificate authentication [CVE-2025-23419]

securitynode-axios: Fix CSRF vulnerability [CVE-2023-45857]; fix potential vulnerability in URL when determining an origin [CVE-2024-57965]

securitynode-postcss: Fix mishandling of non-integer values leading to denial of service in nanoid [CVE-2024-55565]; fix parsing of external untrusted CSS [CVE-2023-44270]

securityphp-nesbot-carbon: Fix arbitrary file include issue [CVE-2025-22145]

securitypostgresql-15: New upstream stable release; harden PQescapeString and allied functions against invalidly-encoded strings; improve behavior of libpq's quoting functions [CVE-2025-1094]

securitypuma: Fix behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers [CVE-2023-40175]; limit size of chunk extensions [CVE-2024-21647]; prevent manipulation of headers set by intermediate proxies [CVE-2024-45614]

securitypython-django: Fix regular expression-based denial of service issue [CVE-2023-36053], denial of service issues [CVE-2024-38875 CVE-2024-39614 CVE-2024-41990 CVE-2024-41991], user enumeration issue [CVE-2024-39329], directory traversal issue [CVE-2024-39330], excessive memory consumption issue…

securitysimgear: Fix sandbox bypass vulnerability in Nasal scripts [CVE-2025-0781]

securitysssd: Apply GPO policy consistently [CVE-2023-3758]

securitysubversion: Fix vulnerable parsing of control characters in paths served by mod_dav_svn [CVE-2024-46901]

securityvim: Fix crash when expanding ~ in substitute [CVE-2023-2610]; fix buffer-overflow in vim_regsub_both() [CVE-2023-4738]; fix heap use after free in ins_compl_get_exp() [CVE-2023-4752]; fix heap-buffer-overflow in vim_regsub_both [CVE-2023-4781]; fix buffer-overflow in trunc_string()…

securitywget: Fix mishandling of semicolons in userinfo in URLs [CVE-2024-38428]

+27 more items in the release notes

12.9 Jan 11, 2025 Release notes ↗

security35 security advisories included: DSA-5801 firefox-esr, DSA-5803 thunderbird, DSA-5804 webkit2gtk, DSA-5805 guix, DSA-5806 libarchive, DSA-5807 nss, DSA-5808 ghostscript, DSA-5809 symfony, DSA-5810 chromium, DSA-5811 mpg123, DSA-5812 postgresql-15, DSA-5813 symfony, DSA-5814 thunderbird, …

fixallow-html-temp: Update for Thunderbird 128 compatibility

securityansible-core: New upstream stable release; fix arbitrary code execution issue [CVE-2024-11079]; fix information disclosure issue [CVE-2024-8775]; fix file overwrite issue [CVE-2024-9902]; fix test failure

securityaudiofile: Fix null pointer dereference issue [CVE-2019-13147]; fix information leak issue [CVE-2022-24599]

securityavahi: Fix denial of service issues [CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473]; fix browsing when invalid services are present

securitydnsmasq: Fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; set default maximum EDNS.0 UDP packet size to 1232 [CVE-2023-28450]

securityglib2.0: Fix buffer overflow when configured to use a SOCKS4a proxy with a very long username [CVE-2024-52533]

securitygnuchess: Fix arbitrary code execution issue [CVE-2021-30184]

securitygsl: Fix buffer overflow calculating the quantile value [CVE-2020-35357]

securitygst-plugins-base1.0: Don't try parsing extended header if not enough data is available (id3v2) [CVE-2024-47542]

securitygunicorn: Prevent HTTP request smuggling [CVE-2024-1135]

securityicinga2: Prevent TLS certificate bypass [CVE-2024-49369]

securityintel-microcode: New upstream security release [CVE-2024-21853 CVE-2024-23918 CVE-2024-24968 CVE-2024-23984]

securityjinja2: Prevent HTML attribute injection [CVE-2024-22195 CVE-2024-34064]

securitylemonldap-ng: Fix privilege escalation when adaptive auth levels used [CVE-2024-52946]; fix XSS in upgrade plugin [CVE-2024-52947]

securitylibebml: Fix buffer overflow issue [CVE-2023-52339]

securitylibpgjava: Fix SQL injection issue [CVE-2024-1597]

securitylibsoup2.4: Prevent HTTP request smuggling [CVE-2024-52530]; fix buffer overflow in soup_header_parse_param_list_strict [CVE-2024-52531]; fix DoS reading from WebSocket clients [CVE-2024-52532]

securitylibxstream-java: Fix denial of service issue [CVE-2024-47072]

securitynvidia-graphics-drivers: New upstream stable release [CVE-2024-0126]

securitynvidia-open-gpu-kernel-modules: New upstream LTS release [CVE-2024-0126]

securityopensc: Fix data leak issue [CVE-2023-5992]; fix use-after-free issue [CVE-2024-1454]; fix missing initialisation issue [CVE-2024-45615]; fix various issues with APDU buffer handling [CVE-2024-45616]; fix missing or incorrect function return value checks [CVE-2024-45617 CVE-2024-45618]; fix…

securitypoco: Fix integer overflow issue [CVE-2023-52389]

securitypypy3: Fix email address parsing issue [CVE-2023-27043]; fix possible Server Side Request Forgery issue [CVE-2024-11168]; fix private IP address range parsing [CVE-2024-4032]; fix regular expression based Denial of Service issue [CVE-2024-6232]; fix header injection issue [CVE-2024-6923]; fix…

securitypython-asyncssh: Fix rogue extension negotiation issue [CVE-2023-46445]; fix rogue session attack issue [CVE-2023-46446]

securitypython-tornado: Fix open redirect issue [CVE-2023-28370]; fix denial of service issue [CVE-2024-52804]

securitypython-urllib3: Fix possible information leak during cross-origin redirects [CVE-2023-43804]; fix request body not stripped after redirect from 303 status changes request method to GET [CVE-2023-45803]; fix Proxy-Authorization request header isn't stripped during cross-origin redirects…

securitypython-werkzeug: Fix denial of service when file upload begins with CR or LF [CVE-2023-46136]; fix arbitrary code execution on developer's machine via the debugger [CVE-2024-34069]; fix denial of service when processing multipart/form-data requests [CVE-2024-49767]

securitypython3.11: Reject malformed addresses in email.parseaddr() [CVE-2023-27043]; encode newlines in headers in the email module [CVE-2024-6923]; fix quadratic complexity parsing cookies with backslashes [CVE-2024-7592]; fix venv activation scripts failure to quote paths [CVE-2024-9287]; fix improper…

securityqemu: New upstream bugfix release [CVE-2024-7409]; mark internal codegen helper symbols as hidden, fixing build failure on arm64

securityredis: Fix denial of service with malformed ACL selectors [CVE-2024-31227]; fix denial of service through unbound pattern matching [CVE-2024-31228]; fix stack overflow [CVE-202431449]

securityrenderdoc: Fix integer overflows [CVE-2023-33863 CVE-2023-33864]; fix symlink attack vector [CVE-2023-33865]

securityruby-doorkeeper: Prevent skipping of authorization steps [CVE-2023-34246]

securitysetuptools: Fix remote code execution issue [CVE-2024-6345]

securitysqlparse: Fix regular expression-related denial of service issue [CVE-2023-30608]; fix denial of service issue [CVE-2024-4340]

securitytexlive-bin: Fix data loss when using discretionaries with priorities; fix heap buffer overflow [CVE-2024-25262]

securitytiff: Fix buffer overflow issues [CVE-2023-25433 CVE-2023-26966]; fix use-after-free issue [CVE-2023-26965]; fix null pointer dereference issue [CVE-2023-2908]; fix denial of service issues [CVE-2023-3618 CVE-2023-52356 CVE-2024-7006]

securityutil-linux: Fix wider mitigation for CVE-2024-28085

securityzfs-linux: Add missing symbols in libzfs4linux and libzpool5linux; fix dnode dirty test [CVE-2023-49298]; fix sharenfs IPv6 address parsing [CVE-2013-20001]; fixes related to NULL pointer, memory allocation, etc.

securityzookeeper: Fix information disclosure in persistent watchers handling [CVE-2024-23944]

+33 more items in the release notes

12.8 Nov 9, 2024 Release notes ↗

security47 security advisories included: DSA-5729 apache2, DSA-5733 thunderbird, DSA-5744 thunderbird, DSA-5758 trafficserver, DSA-5759 python3.11, DSA-5760 ghostscript, DSA-5761 chromium, DSA-5762 webkit2gtk, DSA-5763 pymatgen, DSA-5764 openssl, DSA-5765 firefox-esr, DSA-5766 chromium, …

security7zip: Fix heap buffer overflow in NTFS handler [CVE-2023-52168]; fix out-of-bounds read in NTFS handler [CVE-2023-52169]

securityamanda: Update incomplete fix for CVE-2022-37704, restoring operation with xfsdump

securityapr: Use 0600 perms for named shared mem consistently [CVE-2023-49582]

fixbase-files: Update for the point release

fixbtrfs-progs: Fix checksum calculation errors during volume conversion in btrfs-convert

fixcalamares-settings-debian: Fix missing launcher on KDE desktops; fix btrfs mounts

securitycjson: Fix segmentation violation issue [CVE-2024-31755]

securityclamav: New upstream stable release; fix denial of service issue [CVE-2024-20505], file corruption issue [CVE-2024-20506]

fixcloud-init: Add support for multiple networkd Route sections

fixcloud-initramfs-tools: Add missing dependencies in the initramfs

securitycurl: Fix incorrect handling of some OCSP responses [CVE-2024-8096]

fixdebian-installer: Reinstate some armel netboot targets (openrd); increase Linux kernel ABI to 6.1.0-27; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdevscripts: bts: always upgrade to STARTTLS on 587/tcp; build-rdeps: add support for non-free-firmware; chdist: update sources.list examples with non-free-firmware; build-rdeps: use all available distros by default

fixdiffoscope: Fix build failure when processing a deliberately overlapping zip file in tests

fixdistro-info-data: Add Ubuntu 25.04

securitydocker.io: Fix bypassing of AuthZ plugins in some circumstances [CVE-2024-41110]

fixdpdk: New upstream stable release

fixexim4: Fix crash in dbmnz when looking up keys with no content

fixfcgiwrap: Set proper ownership on repositories in git backend

fixgalera-4: New upstream stable release

fixglib2.0: Provide libgio-2.0-dev from libglib2.0-dev, and libgio-2.0-dev-bin from libglib2.0-dev-bin

fixglibc: Change Croatian locale to use Euro as currency; revert upstream commit that modified the GLIBC_PRIVATE ABI, causing crashes with some static binaries on arm64; vfscanf(): fix matches longer than INT_MAX; ungetc(): fix uninitialized read when putting into unused streams, backup buffer leak…

fixgtk+3.0: Fix letting Orca announce initial focus

fixikiwiki-hosting: Allow reading of all user repositories

securityintel-microcode: New upstream release; security fixes [CVE-2024-23984 CVE-2024-24968]

fixipmitool: Fix a buffer overrun in open interface; fix lan print fails on unsupported parameters; fix reading of temperature sensors; fix using hex values when sending raw data

fixiputils: Fix incorrect handling of ICMP responses intended for other processes

fixkexec-tools: Mask kexec.service to prevent the init.d script handling kexec process on a systemd enabled system

securitylemonldap-ng: Fix cross-site scripting vulnerability on login page [CVE-2024-48933]

securitynghttp2: Fix denial of service issue [CVE-2024-28182]

securitynode-dompurify: Fix prototype pollution issues [CVE-2024-45801 CVE-2024-48910]

securityopenssl: New upstream stable release; fix buffer overread issue [CVE-2024-5535], out of bounds memory access [CVE-2024-9143]

securitypuredata: Fix privilege escalation issue [CVE-2023-47480]

securitypython-cryptography: Fix NULL dereference when loading PKCS7 certificates [CVE-2023-49083]; fix NULL dereference when PKCS#12 key and cert don't match [CVE-2024-26130]

securitysqlite3: Fix a buffer overread issue [CVE-2023-7104], a stack overflow issue and an integer overflow issue

securitytgt: chap: Use proper entropy source [CVE-2024-45751]

securitywireshark: New upstream security release [CVE-2024-0208, CVE-2024-0209, CVE-2024-2955, CVE-2024-4853, CVE-2024-4854, CVE-2024-4855, CVE-2024-8250, CVE-2024-8645]

securityxfpt: Fix buffer overflow issue [CVE-2024-43700]

+29 more items in the release notes

12.7 Aug 31, 2024 Release notes ↗

security51 security advisories included: DSA-5617 chromium, DSA-5629 chromium, DSA-5634 chromium, DSA-5636 chromium, DSA-5639 chromium, DSA-5648 chromium, DSA-5654 chromium, DSA-5656 chromium, DSA-5668 chromium, DSA-5675 chromium, DSA-5676 chromium, DSA-5683 chromium, DSA-5687 chromium, …

securityamd64-microcode: New upstream release; security fixes [CVE-2023-31315]; SEV firmware fixes [CVE-2023-20584 CVE-2023-31356]

securityansible: New upstream stable release; fix key leakage issue [CVE-2023-4237]

securityansible-core: New upstream stable release; fix information disclosure issue [CVE-2024-0690]; fix template injection issue [CVE-2023-5764]; fix path traversal issue [CVE-2023-5115]

securityapache2: New upstream stable release; fix content disclosure issue [CVE-2024-40725]

fixbase-files: Update for the point release

securitycacti: Fix remote code execution issues [CVE-2024-25641 CVE-2024-31459], cross site scripting issues [CVE-2024-29894 CVE-2024-31443 CVE-2024-31444], SQL injection issues [CVE-2024-31445 CVE-2024-31458 CVE-2024-31460], type juggling issue [CVE-2024-34340]; fix autopkgtest failure

fixcalamares-settings-debian: Fix Xfce launcher permission issue

securitycalibre: Fix remote code execution issue [CVE-2024-6782, cross site scripting issue [CVE-2024-7008], SQL injection issue [CVE-2024-7009]

fixchoose-mirror: Update list of available mirrors

securitycockpit: Fix denial of service issue [CVE-2024-6126]

securitycups: Fix issues with domain socket handling [CVE-2024-35235]

securitycurl: Fix ASN.1 date parser overread issue [CVE-2024-7264]

securitycyrus-imapd: Fix regression introduced in CVE-2024-34055 fix

securitydcm2niix: Fix potential code execution issue [CVE-2024-27629]

fixdebian-installer: Increase Linux kernel ABI to 6.1.0-25; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

securitydmitry: Security fixes [CVE-2024-31837 CVE-2020-14931 CVE-2017-7938]

fixdropbear: Fix noremotetcp behaviour of keepalive packets in combination with the no-port-forwarding authorized_keys(5) restriction

securitygettext.js: Fix server side request forgery issue [CVE-2024-43370]

fixglibc: Fix freeing uninitialized memory in libc_freeres_fn(); fix several performance issues and possible crashses

fixglogic: Require Gtk 3.0 and PangoCairo 1.0

fixgraphviz: Fix broken scale

securitygtk+2.0: Avoid looking for modules in the current working directory [CVE-2024-6655]

securitygtk+3.0: Avoid looking for modules in the current working directory [CVE-2024-6655]

securityimagemagick: Fix segmentation fault issue; fix incomplete fix for CVE-2023-34151

fixinitramfs-tools: hook_functions: Fix copy_file with source including a directory symlink; hook-functions: copy_file: Canonicalise target filename; install hid-multitouch module for Surface Pro 4 Keyboard; add hyper-keyboard module, needed to enter LUKS password in Hyper-V; auto_add_modules: Add…

securityintel-microcode: New upstream release; security fixes [CVE-2023-42667 CVE-2023-49141 CVE-2024-24853 CVE-2024-24980 CVE-2024-25939]

fixipmitool: Add missing enterprise-numbers.txt file

fixlibapache2-mod-auth-openidc: Avoid crash when the Forwarded header is not present but OIDCXForwardedHeaders is configured for it

fixlibnvme: Fix buffer overflow during scanning devices that do not support sub-4k reads

securitylibvirt: birsh: Make domif-setlink work more than once; qemu: domain: Fix logic when tainting domain; fix denial of service issues [CVE-2023-3750 CVE-2024-1441 CVE-2024-2494 CVE-2024-2496]

fixlinux: New upstream release; bump ABI to 25

fixlinux-signed-amd64: New upstream release; bump ABI to 25

fixlinux-signed-arm64: New upstream release; bump ABI to 25

securitynewlib: Fix buffer overflow issue [CVE-2021-3420]

securityopenssl: New upstream stable release; fix denial of service issues [CVE-2024-2511 CVE-2024-4603]; fix use after free issue [CVE-2024-4741]

securityputty: Fix weak ECDSA nonce generation allowing secret key recovery [CVE-2024-31497]

securityqemu: New upstream stable release; fix denial of service issue [CVE-2024-4467]

securityxmedcon: Fix buffer overflow issue [CVE-2024-29421]

+12 more items in the release notes

12.6 Jun 29, 2024 Release notes ↗

security77 security advisories included: DSA-5575 webkit2gtk, DSA-5580 webkit2gtk, DSA-5589 nodejs, DSA-5609 slurm-wlm-contrib, DSA-5616 ruby-sanitize, DSA-5618 webkit2gtk, DSA-5619 libgit2, DSA-5620 unbound, DSA-5621 bind9, DSA-5623 postgresql-15, DSA-5624 edk2, DSA-5625 engrampa, …

fixaide: Fix concurrent reading of extended attributes

securityamavisd-new: Handle multiple boundary parameters that contain conflicting values [CVE-2024-28054]; fix race condition in postinst

fixarchlinux-keyring: Switch to pre-built keyrings; sync with upstream

securitybluez: Fix remote code execution issues [CVE-2023-27349 CVE-2023-50229 CVE-2023-50230]

securitycjson: Fix missing NULL checks [CVE-2023-50471 CVE-2023-50472]

securityclamav: New upstream stable release; fix possible heap overflow issue [CVE-2024-20290], possible command injection issue [CVE-2024-20328]

securitycurl: Do not keep default protocols when deselected [CVE-2024-2004]; fix memory leak [CVE-2024-2398]

securityemacs: Security fixes [CVE-2024-30202 CVE-2024-30203 CVE-2024-30204 CVE-2024-30205]; replace expired package-keyring.gpg with a current version

securitygdk-pixbuf: ANI: Reject files with multiple anih chunks [CVE-2022-48622]; ANI: Reject files with multiple INAM or IART chunks; ANI: Validate anih chunk size

securityglewlwyd: Fix potential buffer overflow during FIDO2 credential validation [CVE-2023-49208]; fix open redirection via redirect_uri [CVE-2024-25715]

securitygnutls28: Fix certtool crash when verifying a certificate chain with more than 16 certificates [CVE-2024-28835]; fix side-channel in the deterministic ECDSA [CVE-2024-28834]; fix a memory leak; fix two segfault issues

securitygross: Fix stack-based buffer overflow [CVE-2023-52159]

securityintel-microcode: Security mitigations [CVE-2023-22655 CVE-2023-28746 CVE-2023-38575 CVE-2023-39368 CVE-2023-43490]; mitigate for INTEL-SA-01051 [CVE-2023-45733], INTEL-SA-01052 [CVE-2023-46103], INTEL-SA-01036 [CVE-2023-45745, CVE-2023-47855] and unspecified functional issues on various Intel…

securityjose: Fix potential denial-of-service issue [CVE-2023-50967]

securityjson-smart: Fix excessive recursion leading to stack overflow [CVE-2023-1370]; fix denial of service via crafted request [CVE-2021-31684]

securitylibapache2-mod-auth-openidc: Fix mising input validation leading to DoS [CVE-2024-24814]

securitylibjwt: Fix timing side channel attack [CVE-2024-25189]

securitylibtommath: Fix integer overflow [CVE-2023-36328]

securitynsis: Don't allow unprivileged users to delete the uninstaller directory [CVE-2023-37378]; fix regression in disabling stub relocations; build reproducibly for arm64

securitynvidia-graphics-drivers: Restore compatibility with newer Linux kernel builds; take over packages from nvidia-graphics-drivers-tesla; add new nvidia-suspend-common package; relax dh-dkms build-dependency for compatibility with bookworm; new upstream stable release [CVE-2023-0180 CVE-2023-0183…

securitynvidia-graphics-drivers-tesla-470: Restore compatibility with newer Linux kernel builds; stop building nvidia-cuda-mps; new upstream stable release; security fixes [CVE-2022-42265 CVE-2024-0074 CVE-2024-0078 CVE-2024-0090 CVE-2024-0092]

securitynvidia-open-gpu-kernel-modules: Update to 535 series LTS drivers [CVE-2023-0180 CVE-2023-0183 CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 CVE-2023-0199 CVE-2023-25515 CVE-2023-25516 CVE-2023-31022…

securityopenssl: New upstream stable release; fix excessive time taken issues [CVE-2023-5678 CVE-2023-6237], vector register corruption issue on PowerPC [CVE-2023-6129], PKCS12 Decoding crashes [CVE-2024-0727]

securityovn: New upstream stable version; fix insufficient validation of incoming BFD packets [CVE-2024-2182]

securityphp-phpseclib: Guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength(); remove visibitility modifiers from static variables

securityphp-phpseclib3: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength()

securityphpseclib: Force system dependency loading; guard isPrime() and randomPrime() for BigInteger [CVE-2024-27354]; limit OID length in ASN1 [CVE-2024-27355]; fix BigInteger getLength()

securitypostgresql-15: New upstream stable release; restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner [CVE-2024-4317]

securitypymongo: Fix out-of-bounds read issue [CVE-2024-5629]

securitypypy3: Strip C0 control and space characters in urlsplit [CVE-2023-24329]; avoid bypass of TLS handshake protections on closed sockets [CVE-2023-40217]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450]

securitypython-aiosmtpd: Fix SMTP smuggling issue [CVE-2024-27305]; fix STARTTLS unencrypted command injection issue [CVE-2024-34083]

securitypython-idna: Fix denial of service issue [CVE-2024-3651]

securitypython-jwcrypto: Fix denial of service issue [CVE-2024-28102]

securitypython3.11: Fix use-after-free crash when deallocating a frame object; protect zipfile from quoted-overlap zipbomb [CVE-2024-0450]; tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; fix os.path.normpath(): Path truncation at null bytes [CVE-2023-41105]; avoid bypass of TLS…

securityqemu: New upstream stable release; security fixes [CVE-2024-26327 CVE-2024-26328 CVE-2024-3446 CVE-2024-3447]

securityqtbase-opensource-src: Fix regression in patch for CVE-2023-24607; avoid using system CA certificates when not wanted [CVE-2023-34410]; fix buffer overflow [CVE-2023-37369]; fix infinite loop in XML recursive entity expansion [CVE-2023-38197]; fix buffer overflow with crafted KTX image file…

securitysendmail: Fix SMTP smuggling issue [CVE-2023-51765]

securitysystemd: New upstream stable release; fix denial of service issues [CVE-2023-50387 CVE-2023-50868]; libnss-myhostname.nss: Install after files; libnss-mymachines.nss: Install before resolve and dns

securitywpa: Fix authentication bypass issue [CVE-2023-52160]

+123 more items in the release notes

12.5 Feb 10, 2024 Release notes ↗

security39 security advisories included: DSA-5572 roundcube, DSA-5573 chromium, DSA-5574 libreoffice, DSA-5576 xorg-server, DSA-5577 chromium, DSA-5578 ghostscript, DSA-5579 freeimage, DSA-5581 firefox-esr, DSA-5582 thunderbird, DSA-5583 gst-plugins-bad1.0, DSA-5584 bluez, DSA-5585 chromium, …

securityapktool: Prevent arbitrary file writes with malicious resource names [CVE-2024-21633]

securityatril: Fix crash when opening some epub files; fix index loading for certain epub documents; add fallback for malformed epub files in check_mime_type; use libarchive instead of external command for extracting documents [CVE-2023-51698]

fixbase-files: Update for the 12.5 point release

fixcaja: Fix desktop rendering artifacts after resolution changes; fix use of informal date format

securitycalibre: Fix HTML Input: Don't add resources that exist outside the folder hierarchy rooted at the parent folder of the input HTML file by default [CVE-2023-46303]

fixcompton: Remove recommendation of picom

fixcryptsetup: cryptsetup-initramfs: Add support for compressed kernel modules; cryptsetup-suspend-wrapper: Don't error out on missing /lib/systemd/system-sleep directory; add_modules(): Change suffix drop logic to match initramfs-tools

fixdebian-edu-artwork: Provide an Emerald theme based artwork for Debian Edu 12

fixdebian-edu-config: New upstream release

fixdebian-edu-doc: Update included documentation and translations

fixdebian-edu-fai: New upstream release

fixdebian-edu-install: New upstream release; fix security sources.list

fixdebian-installer: Increase Linux kernel ABI to 6.1.0-18; rebuild against proposed-updates

fixdebian-installer-netboot-images: Rebuild against proposed-updates

fixdebian-ports-archive-keyring: Add Debian Ports Archive Automatic Signing Key (2025)

fixdpdk: New upstream stable release

securitydropbear: Fix terrapin attack [CVE-2023-48795]

fixengrampa: Fix several memory leaks; fix archive save as functionality

securityespeak-ng: Fix buffer overflow issues [CVE-2023-49990 CVE-2023-49992 CVE-2023-49993], buffer underflow issue [CVE-2023-49991], floating point exception issue [CVE-2023-49994]

securityfilezilla: Prevent Terrapin exploit [CVE-2023-48795]

securityfish: Handle Unicode non-printing characters safely when given as command substitution [CVE-2023-49284]

fixfssync: Disable flaky tests

securitygnutls28: Fix assertion failure when verifying a certificate chain with a cycle of cross signatures [CVE-2024-0567]; fix timing side-channel issue [CVE-2024-0553]

securityindent: Fix buffer under read issue [CVE-2024-0911]

fixisl: Fix use on older CPUs

securitylibde265: Fix buffer overflow issues [CVE-2023-49465 CVE-2023-49467 CVE-2023-49468]

securitylibspreadsheet-parsexlsx-perl: Fix possible memory bomb [CVE-2024-22368]; fix XML External Entity issue [CVE-2024-23525]

securitymariadb: New upstream stable release; fix denial of service issue [CVE-2023-22084]

securitypostfix: New upstream stable release; address SMTP smuggling issue [CVE-2023-51764]

securityproftpd-dfsg: Implement fix for the Terrapin attack [CVE-2023-48795]; fix out-of-bounds read issue [CVE-2023-51713]

securityproftpd-mod-proxy: Implement fix for the Terrapin attack [CVE-2023-48795]

securitypypdf: Fix infinite loop issue [CVE-2023-36464]

securitypypdf2: Fix infinite loop issue [CVE-2023-36464]

securityqemu: New upstream stable release; virtio-net: correctly copy vnet header when flushing TX [CVE-2023-6693]; fix null pointer dereference issue [CVE-2023-6683]; revert patch causing regressions in suspend / resume functionality

securitysystemd: New upstream stable release; fix missing verification issue in systemd-resolved [CVE-2023-7008]

securitytar: Fix boundary checking in base-256 decoder [CVE-2022-48303], handling of extended header prefixes [CVE-2023-39804]

securitytinyxml: Fix assertion issue [CVE-2023-34194]

securitywolfssl: Fix security issue when client sent neither PSK nor KSE extensions [CVE-2023-3724]

securityxen: New upstream stable release; security fixes [CVE-2023-46837 CVE-2023-46839 CVE-2023-46840]

+29 more items in the release notes

12.4 Dec 10, 2023 Release notes ↗

security60 security advisories included: DSA-5499 chromium, DSA-5506 firefox-esr, DSA-5508 chromium, DSA-5511 mosquitto, DSA-5512 exim4, DSA-5513 thunderbird, DSA-5514 glibc, DSA-5515 chromium, DSA-5516 libxpm, DSA-5517 libx11, DSA-5518 libvpx, DSA-5519 grub-efi-amd64-signed +3, …

fixadequate: Skip symbol-size-mismatch test on architectures where array symbols don't include a specific length; disable deprecation warnings about smartmatch, given, when in Perl 5.38; fix warnings from version comparison about smartmatch being experimental

securityamanda: Fix local privilege escalation [CVE-2023-30577]

fixarctica-greeter: Move logo away from border when greeting

fixawstats: Avoid prompts on upgrade due to logrotate configuration cleanup

securityaxis: Filter out unsupported protocols in the client class ServiceFactory [CVE-2023-40743]

fixbase-files: Update for the 12.4 point release

fixca-certificates-java: Remove circular dependencies

fixcalibre: Fix crash in Get Books when regenerating UIC files

fixcrun: Fix containers with systemd as their init system, when using newer kernel versions

fixcups: Take into account that on some printers the ColorModel option's choice for color printing is CMYK and not RGB

fixdav4tbsync: New upstream version, restoring compatibility with newer Thunderbird versions

fixdebian-edu-artwork: Provide an Emerald theme based artwork for Debian Edu 12

fixdebian-edu-config: New upstream stable version; fix setting and changing of LDAP passwords

fixdebian-edu-doc: Update included documentation and translations

securityexfatprogs: Fix out-of-bounds memory access issues [CVE-2023-45897]

securityexim4: Fix security issues relating to the proxy protocol [CVE-2023-42117] and DNSDB lookups [CVE-2023-42119]; add hardening for SPF lookups; disallow UTF-16 surrogates from ${utf8clean:...}; fix crash with tls_dhparam = none; fix $recipients expansion when used within ${run...}; fix expiry date…

securitygnutls28: Fix timing sidechannel issue [CVE-2023-5981]

securitylibde265: Fix segmentation violation issue [CVE-2023-27102], buffer overflow issues [CVE-2023-27103 CVE-2023-47471], buffer over-read issue [CVE-2023-43887]

securitylinux: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securitylinux-signed-amd64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securitylinux-signed-arm64: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securitylinux-signed-i386: Update to upstream stable release 6.1.66; update ABI to 15; [rt] Update to 6.1.59-rt16; enable X86_PLATFORM_DRIVERS_HP; nvmet: nul-terminate the NQNs passed in the connect command [CVE-2023-6121]

securityminizip: Fix integer and heap overflow issues [CVE-2023-45853]

securitynode-undici: Delete cookie and host headers on cross-origin redirect [CVE-2023-45143]

securitynvidia-graphics-drivers: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securitynvidia-graphics-drivers-tesla: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securitynvidia-graphics-drivers-tesla-470: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securitynvidia-open-gpu-kernel-modules: New upstream release; fix null pointer dereference issue [CVE-2023-31022]

securityopendkim: Fix removal of incoming Authentication-Results: headers [CVE-2022-48521]

securityopenrefine: Fix remote code execution vulnerability [CVE-2023-41887 CVE-2023-41886]

securityopensc: Fix out-of-bounds read issue [CVE-2023-4535], potential PIN bypass [CVE-2023-40660], memory-handling issues [CVE-2023-40661]

securityperl: Fix buffer overrun issue [CVE-2023-47038]

securityphp-phpseclib3: Fix denial of service issue [CVE-2023-49316]

securitypostgresql-15: New upstream stable release; fix SQL injection issue [CVE-2023-39417]; fix MERGE to enforce row security policies properly [CVE-2023-39418]

securityqemu: Update to upstream stable release 7.2.7; hw/scsi/scsi-disk: Disallow block sizes smaller than 512 [CVE-2023-42467]

securitysymfony: Fix session fixation issue [CVE-2023-46733]; add missing escaping [CVE-2023-46734]

securityunadf: Fix buffer overflow issue [CVE-2016-1243]; fix code execution issue [CVE-2016-1244]

securityvips: Fix null pointer dereference issue [CVE-2023-40032]

securityxen: New upstream stable update; fix several security issues [CVE-2022-40982 CVE-2023-20569 CVE-2023-20588 CVE-2023-20593 CVE-2023-34320 CVE-2023-34321 CVE-2023-34322 CVE-2023-34323 CVE-2023-34325 CVE-2023-34326 CVE-2023-34327 CVE-2023-34328 CVE-2023-46835 CVE-2023-46836]

+55 more items in the release notes