Debian GNU/Linux 13.1 → 13.4

3 releases · 0 breaking changes · 92 security fixes · 0 advisories fixed

92security0breaking0deprecated0feature28fix

Is 13.1 affected? · What changed up to 13.7

Breaking changes

None in the release notes.

Security changes

security 62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 13.4
security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 13.4
security augeas: Fix null pointer dereference issue [CVE-2025-2588] in 13.4
security capstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114] in 13.4
security civetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763] in 13.4
security direwolf: Fix stack buffer overflow [CVE-2025-34457] in 13.4
security dpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219] in 13.4
security erlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107] in 13.4
security fluidsynth: Fix null pointer dereference issue [CVE-2025-56225] in 13.4
security fonttools: Fix arbitrary file write issue [CVE-2025-66034] in 13.4
security glibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the… in 13.4
security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269] in 13.4
security jaraco.context: Prevent path traversal [CVE-2026-23949] in 13.4
security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 13.4
security libsndfile: Fix memory leak issue [CVE-2025-56226] in 13.4
security mariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support in 13.4
security node-proxy-agents: Fix path traversal issue [CVE-2026-27699] in 13.4
security openssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985] in 13.4
security pcsx2: Fix code execution issue [CVE-2025-49589] in 13.4
security phpunit: Fix unsafe deserialization issue [CVE-2026-24765] in 13.4
security postgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006] in 13.4
security python-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007] in 13.4
security python-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146] in 13.4
security python-multipart: Fix arbitrary file write issue [CVE-2026-24486] in 13.4
security qemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665] in 13.4
security requests: Fix credential leak issue [CVE-2024-47081] in 13.4
security rust-ntp-proto: Fix excessive load issue [CVE-2026-26076] in 13.4
security rust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076 in 13.4
security sqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf in 13.4
security starlette: Fix denial of service issue [CVE-2025-62727] in 13.4
security suricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264] in 13.4
security wget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195] in 13.4
security wireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203] in 13.4
security xen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553] in 13.4
security zabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643] in 13.4
security 36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, … in 13.3
security apache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200] in 13.3
security calibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486] in 13.3
security composer: Fix ANSI sequence injection [CVE-2025-67746] in 13.3
security cups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524] in 13.3
security edk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770] in 13.3
security freedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462] in 13.3
security glib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512] in 13.3
security gnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc in 13.3
security gnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback in 13.3
security imagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950] in 13.3
security libcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499] in 13.3
security libcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503] in 13.3
security libphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119] in 13.3
security libvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the… in 13.3
security lxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507] in 13.3
security mbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438] in 13.3
security mongo-c-driver: Avoid invalid memory reads [CVE-2025-12119] in 13.3
security node-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033] in 13.3
security pgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819] in 13.3
security postgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818] in 13.3
security qemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464] in 13.3
security r-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation in 13.3
security rlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075] in 13.3
security rsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158] in 13.3
security rust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897] in 13.3
security sogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499] in 13.3
security suricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344] in 13.3
security symfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries in 13.3
security 52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, … in 13.2
security 7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001] in 13.2
security curl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563] in 13.2
security dnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187] in 13.2
security imagemagick: Fix integer overflow issue [CVE-2025-62171] in 13.2
security lemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication in 13.2
security libcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
security libhtp: Prevent memory leak with lzma [CVE-2025-53537] in 13.2
security libsmb2: Fix buffer overflow issue [CVE-2025-57632] in 13.2
security libssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277] in 13.2
security libwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678] in 13.2
security libxml2: Fix XPath recursion depth DoS [CVE-2025-9714] in 13.2
security libyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683] in 13.2
security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 13.2
security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 13.2
security mapserver: Fix SQL injection issue [CVE-2025-59431] in 13.2
security modsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571] in 13.2
security nvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345] in 13.2
security open-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244] in 13.2
security phpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573] in 13.2
security poppler: Fix infinite recursion [CVE-2025-50420] in 13.2
security python-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068] in 13.2
security qemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls in 13.2
security rabbitmq-server: Fix logging on sensitive data [CVE-2025-50200] in 13.2
security sail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510] in 13.2
security samba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230] in 13.2
security suricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147] in 13.2

Every release in between

13.4 Mar 14, 2026 Release notes ↗

security62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …

fixakonadi: Show all folders in kmail

fixapache2: Fix HTTP/2 regression

securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]

fixasahi-scripts: Fix SD card reader autosuspend

securityaugeas: Fix null pointer dereference issue [CVE-2025-2588]

fixbase-files: Update for the point release

fixbash: Rebuild with updated glibc

securitycapstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114]

securitycivetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763]

securitydirewolf: Fix stack buffer overflow [CVE-2025-34457]

securitydpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219]

securityerlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107]

securityfluidsynth: Fix null pointer dereference issue [CVE-2025-56225]

securityfonttools: Fix arbitrary file write issue [CVE-2025-66034]

securityglibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the…

securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269]

securityjaraco.context: Prevent path traversal [CVE-2026-23949]

securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]

securitylibsndfile: Fix memory leak issue [CVE-2025-56226]

securitymariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support

securitynode-proxy-agents: Fix path traversal issue [CVE-2026-27699]

securityopenssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985]

securitypcsx2: Fix code execution issue [CVE-2025-49589]

securityphpunit: Fix unsafe deserialization issue [CVE-2026-24765]

securitypostgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006]

securitypython-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007]

securitypython-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146]

securitypython-multipart: Fix arbitrary file write issue [CVE-2026-24486]

securityqemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665]

securityrequests: Fix credential leak issue [CVE-2024-47081]

securityrust-ntp-proto: Fix excessive load issue [CVE-2026-26076]

securityrust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076

securitysqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf

securitystarlette: Fix denial of service issue [CVE-2025-62727]

securitysuricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264]

securitywget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195]

securitywireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203]

securityxen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553]

securityzabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643]

+72 more items in the release notes

13.3 Jan 10, 2026 Release notes ↗

security36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, …

fixansible: New upstream stable release

securityapache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200]

fixat-spi2-core: Ensure xkb group is taken into account for key events

fixawffull: Fix systemd timer invocation to avoid premature cron-script exit

fixbase-files: Update for the point release

fixbash: Rebuild with updated glibc

fixbglibs: Rebuild with updated glibc

fixbusybox: Rebuild with updated glibc

securitycalibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486]

fixcatatonit: Rebuild with updated glibc

fixcdebootstrap: Rebuild with updated glibc

fixchkrootkit: Rebuild with updated glibc

fixcloud-init: Ensure deb822 sources.list template renders correctly

securitycomposer: Fix ANSI sequence injection [CVE-2025-67746]

securitycups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524]

securityedk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770]

securityfreedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462]

securityglib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]

securitygnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc

securitygnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback

securityimagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]

securitylibcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499]

securitylibcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]

securitylibphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119]

securitylibvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the…

securitylxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507]

securitymbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438]

securitymongo-c-driver: Avoid invalid memory reads [CVE-2025-12119]

securitynode-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033]

securitypgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]

securitypostgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]

securityqemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464]

securityr-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation

securityrlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]

securityrsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]

securityrust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897]

securitysogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]

securitysuricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344]

securitysymfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries

+69 more items in the release notes

13.2 Nov 15, 2025 Release notes ↗

security52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, …

security7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001]

fix7zip-rar: Add missing CRC table constructor

fixaide: Fix bin/buildcache use by running it from a root timer; various updates and fixes to included rules

fixallow-html-temp: New upstream version to support newer Thunderbird releases

fixalsa-ucm-conf-asahi: Install missing aop_audio UCM configs

fixansible: Update collections to maintain compatibility with ansible-core 2.19

fixansible-core: New upstream stable release; fix regression from 2.18 regarding handlers and play tags

fixasahi-scripts: Fix the macaudio default profile check; add the apple_nvmem_spmi module to the initramfs explicitly; make update-m1n1 idempotent

fixbase-files: Update for the point release

fixbrltty: atSpi2: do not manage widgets without text interface; avoid excessive verbose bluetooth/usbfs messages

fixconsole-setup: Update keyboard layouts dz(la) into dz(azerty-oss) and Use ca/multix variant instead of ca/multi; fix dz(azerty-oss/deadkeys) into dz, which is what xkb really provides; fix dz default layout

fixcups: Fix operation of checkboxes in admin interface

securitycurl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563]

fixdebian-edu-config: Use SERVER_ADDRESS in RewriteRule instead of hard-coded 'www'; drop desktop bundle from bundlesequence

securitydnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187]

securityimagemagick: Fix integer overflow issue [CVE-2025-62171]

securitylemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication

securitylibcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924]

securitylibhtp: Prevent memory leak with lzma [CVE-2025-53537]

securitylibsmb2: Fix buffer overflow issue [CVE-2025-57632]

securitylibssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277]

securitylibwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678]

securitylibxml2: Fix XPath recursion depth DoS [CVE-2025-9714]

securitylibyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683]

securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]

securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]

securitymapserver: Fix SQL injection issue [CVE-2025-59431]

securitymodsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571]

securitynvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345]

securityopen-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244]

securityphpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573]

securitypoppler: Fix infinite recursion [CVE-2025-50420]

securitypython-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068]

securityqemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls

securityrabbitmq-server: Fix logging on sensitive data [CVE-2025-50200]

securitysail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510]

securitysamba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230]

securitysuricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147]

+84 more items in the release notes