Debian GNU/Linux 13.1 → 13.2

1 release · 0 breaking changes · 28 security fixes · 0 advisories fixed

28security0breaking0deprecated0feature12fix

Is 13.1 affected? · What changed up to 13.7

Breaking changes

None in the release notes.

Security changes

security 52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, … in 13.2
security 7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001] in 13.2
security curl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563] in 13.2
security dnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187] in 13.2
security imagemagick: Fix integer overflow issue [CVE-2025-62171] in 13.2
security lemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication in 13.2
security libcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libhtp: Prevent memory leak with lzma [CVE-2025-53537] in 13.2
security libsmb2: Fix buffer overflow issue [CVE-2025-57632] in 13.2
security libssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277] in 13.2
security libwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678] in 13.2
security libxml2: Fix XPath recursion depth DoS [CVE-2025-9714] in 13.2
security libyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683] in 13.2
security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 13.2
security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 13.2
security mapserver: Fix SQL injection issue [CVE-2025-59431] in 13.2
security modsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571] in 13.2
security nvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345] in 13.2
security open-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244] in 13.2
security phpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573] in 13.2
security poppler: Fix infinite recursion [CVE-2025-50420] in 13.2
security python-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068] in 13.2
security qemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls in 13.2
security rabbitmq-server: Fix logging on sensitive data [CVE-2025-50200] in 13.2
security sail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510] in 13.2
security samba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230] in 13.2
security suricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147] in 13.2

Every release in between

13.2 Nov 15, 2025 Release notes ↗

security52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, …

security7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001]

fix7zip-rar: Add missing CRC table constructor

fixaide: Fix bin/buildcache use by running it from a root timer; various updates and fixes to included rules

fixallow-html-temp: New upstream version to support newer Thunderbird releases

fixalsa-ucm-conf-asahi: Install missing aop_audio UCM configs

fixansible: Update collections to maintain compatibility with ansible-core 2.19

fixansible-core: New upstream stable release; fix regression from 2.18 regarding handlers and play tags

fixasahi-scripts: Fix the macaudio default profile check; add the apple_nvmem_spmi module to the initramfs explicitly; make update-m1n1 idempotent

fixbase-files: Update for the point release

fixbrltty: atSpi2: do not manage widgets without text interface; avoid excessive verbose bluetooth/usbfs messages

fixconsole-setup: Update keyboard layouts dz(la) into dz(azerty-oss) and Use ca/multix variant instead of ca/multi; fix dz(azerty-oss/deadkeys) into dz, which is what xkb really provides; fix dz default layout

fixcups: Fix operation of checkboxes in admin interface

securitycurl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563]

fixdebian-edu-config: Use SERVER_ADDRESS in RewriteRule instead of hard-coded 'www'; drop desktop bundle from bundlesequence

securitydnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187]

securityimagemagick: Fix integer overflow issue [CVE-2025-62171]

securitylemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication

securitylibcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibhtp: Prevent memory leak with lzma [CVE-2025-53537]

securitylibsmb2: Fix buffer overflow issue [CVE-2025-57632]

securitylibssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277]

securitylibwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678]

securitylibxml2: Fix XPath recursion depth DoS [CVE-2025-9714]

securitylibyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683]

securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]

securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]

securitymapserver: Fix SQL injection issue [CVE-2025-59431]

securitymodsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571]

securitynvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345]

securityopen-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244]

securityphpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573]

securitypoppler: Fix infinite recursion [CVE-2025-50420]

securitypython-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068]

securityqemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls

securityrabbitmq-server: Fix logging on sensitive data [CVE-2025-50200]

securitysail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510]

securitysamba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230]

securitysuricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147]

+84 more items in the release notes