VersionDrift
Product

Debian GNU/Linux 13.1 → 13.5

4 releases · 0 breaking changes · 132 security fixes · 0 advisories fixed

132security0breaking0deprecated0feature28fix

Is 13.1 affected? · What changed up to 13.7

Breaking changes

None in the release notes.

Security changes

  • security 96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, … in 13.5
  • security 389-ds-base: Fix heap overflow issue [CVE-2025-14905] in 13.5
  • security apache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue… in 13.5
  • security awstats: Prevent command injection [CVE-2025-63261] in 13.5
  • security black: Fix arbitrary file write issue [CVE-2026-32274] in 13.5
  • security bubblewrap: Fix privilege escalation issue [CVE-2026-41163] in 13.5
  • security calibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] in 13.5
  • security cimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146] in 13.5
  • security cockpit: Fix code execution issue [CVE-2026-4631] in 13.5
  • security composer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176] in 13.5
  • security curl: Fix server certificate verification issue [CVE-2025-13034] in 13.5
  • security dovecot: Fix memory leak in CVE-2026-27857 fix in 13.5
  • security erlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943] in 13.5
  • security exim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] in 13.5
  • security firewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948] in 13.5
  • security freerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680… in 13.5
  • security git-lfs: Fix arbitrary file write issue [CVE-2025-26625] in 13.5
  • security glance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure in 13.5
  • security glib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode… in 13.5
  • security glibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;… in 13.5
  • security gvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] in 13.5
  • security harfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693] in 13.5
  • security jpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures in 13.5
  • security jq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164] in 13.5
  • security kissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] in 13.5
  • security libarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] in 13.5
  • security libcap2: Fix time of check / time of use issue [CVE-2026-4878] in 13.5
  • security libcdio: Fix buffer overflow issue [CVE-2024-36600] in 13.5
  • security libcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468] in 13.5
  • security libcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564] in 13.5
  • security libexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] in 13.5
  • security libnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] in 13.5
  • security libtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111] in 13.5
  • security libvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854] in 13.5
  • security libxml-security-java: Fix private key disclosure issue [CVE-2023-44483] in 13.5
  • security lxc: Fix authorisation bypass issue [CVE-2026-39402] in 13.5
  • security mapserver: Fix buffer overflow issue [CVE-2026-33721] in 13.5
  • security modsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691] in 13.5
  • security mongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files in 13.5
  • security musl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200] in 13.5
  • security 62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 13.4
  • security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 13.4
  • security augeas: Fix null pointer dereference issue [CVE-2025-2588] in 13.4
  • security capstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114] in 13.4
  • security civetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763] in 13.4
  • security direwolf: Fix stack buffer overflow [CVE-2025-34457] in 13.4
  • security dpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219] in 13.4
  • security erlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107] in 13.4
  • security fluidsynth: Fix null pointer dereference issue [CVE-2025-56225] in 13.4
  • security fonttools: Fix arbitrary file write issue [CVE-2025-66034] in 13.4
  • security glibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the… in 13.4
  • security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269] in 13.4
  • security jaraco.context: Prevent path traversal [CVE-2026-23949] in 13.4
  • security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 13.4
  • security libsndfile: Fix memory leak issue [CVE-2025-56226] in 13.4
  • security mariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support in 13.4
  • security node-proxy-agents: Fix path traversal issue [CVE-2026-27699] in 13.4
  • security openssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985] in 13.4
  • security pcsx2: Fix code execution issue [CVE-2025-49589] in 13.4
  • security phpunit: Fix unsafe deserialization issue [CVE-2026-24765] in 13.4
  • security postgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006] in 13.4
  • security python-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007] in 13.4
  • security python-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146] in 13.4
  • security python-multipart: Fix arbitrary file write issue [CVE-2026-24486] in 13.4
  • security qemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665] in 13.4
  • security requests: Fix credential leak issue [CVE-2024-47081] in 13.4
  • security rust-ntp-proto: Fix excessive load issue [CVE-2026-26076] in 13.4
  • security rust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076 in 13.4
  • security sqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf in 13.4
  • security starlette: Fix denial of service issue [CVE-2025-62727] in 13.4
  • security suricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264] in 13.4
  • security wget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195] in 13.4
  • security wireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203] in 13.4
  • security xen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553] in 13.4
  • security zabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643] in 13.4
  • security 36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, … in 13.3
  • security apache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200] in 13.3
  • security calibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486] in 13.3
  • security composer: Fix ANSI sequence injection [CVE-2025-67746] in 13.3
  • security cups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524] in 13.3
  • security edk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770] in 13.3
  • security freedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462] in 13.3
  • security glib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512] in 13.3
  • security gnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc in 13.3
  • security gnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback in 13.3
  • security imagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950] in 13.3
  • security libcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499] in 13.3
  • security libcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503] in 13.3
  • security libphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119] in 13.3
  • security libvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the… in 13.3
  • security lxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507] in 13.3
  • security mbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438] in 13.3
  • security mongo-c-driver: Avoid invalid memory reads [CVE-2025-12119] in 13.3
  • security node-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033] in 13.3
  • security pgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819] in 13.3
  • security postgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818] in 13.3
  • security qemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464] in 13.3
  • security r-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation in 13.3
  • security rlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075] in 13.3
  • security rsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158] in 13.3
  • security rust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897] in 13.3
  • security sogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499] in 13.3
  • security suricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344] in 13.3
  • security symfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries in 13.3
  • security 52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, … in 13.2
  • security 7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001] in 13.2
  • security curl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563] in 13.2
  • security dnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187] in 13.2
  • security imagemagick: Fix integer overflow issue [CVE-2025-62171] in 13.2
  • security lemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication in 13.2
  • security libcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
  • security libcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924] in 13.2
  • security libhtp: Prevent memory leak with lzma [CVE-2025-53537] in 13.2
  • security libsmb2: Fix buffer overflow issue [CVE-2025-57632] in 13.2
  • security libssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277] in 13.2
  • security libwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678] in 13.2
  • security libxml2: Fix XPath recursion depth DoS [CVE-2025-9714] in 13.2
  • security libyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683] in 13.2
  • security log4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813] in 13.2
  • security luksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568] in 13.2
  • security mapserver: Fix SQL injection issue [CVE-2025-59431] in 13.2
  • security modsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571] in 13.2
  • security nvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345] in 13.2
  • security open-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244] in 13.2
  • security phpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573] in 13.2
  • security poppler: Fix infinite recursion [CVE-2025-50420] in 13.2
  • security python-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068] in 13.2
  • security qemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls in 13.2
  • security rabbitmq-server: Fix logging on sensitive data [CVE-2025-50200] in 13.2
  • security sail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510] in 13.2
  • security samba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230] in 13.2
  • security suricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147] in 13.2

Every release in between

13.5 May 16, 2026 Release notes ↗
security96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, …
security389-ds-base: Fix heap overflow issue [CVE-2025-14905]
securityapache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue…
securityawstats: Prevent command injection [CVE-2025-63261]
securityblack: Fix arbitrary file write issue [CVE-2026-32274]
securitybubblewrap: Fix privilege escalation issue [CVE-2026-41163]
securitycalibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824]
securitycimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146]
securitycockpit: Fix code execution issue [CVE-2026-4631]
securitycomposer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176]
securitycurl: Fix server certificate verification issue [CVE-2025-13034]
securitydovecot: Fix memory leak in CVE-2026-27857 fix
securityerlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943]
securityexim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687]
securityfirewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948]
securityfreerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680…
securitygit-lfs: Fix arbitrary file write issue [CVE-2025-26625]
securityglance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure
securityglib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode…
securityglibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;…
securitygvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296]
securityharfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693]
securityjpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures
securityjq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164]
securitykissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445]
securitylibarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121]
securitylibcap2: Fix time of check / time of use issue [CVE-2026-4878]
securitylibcdio: Fix buffer overflow issue [CVE-2024-36600]
securitylibcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468]
securitylibcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564]
securitylibexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385]
securitylibnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199]
securitylibtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111]
securitylibvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854]
securitylibxml-security-java: Fix private key disclosure issue [CVE-2023-44483]
securitylxc: Fix authorisation bypass issue [CVE-2026-39402]
securitymapserver: Fix buffer overflow issue [CVE-2026-33721]
securitymodsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691]
securitymongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files
securitymusl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200]
+105 more items in the release notes
13.4 Mar 14, 2026 Release notes ↗
security62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …
fixakonadi: Show all folders in kmail
fixapache2: Fix HTTP/2 regression
securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]
fixasahi-scripts: Fix SD card reader autosuspend
securityaugeas: Fix null pointer dereference issue [CVE-2025-2588]
fixbase-files: Update for the point release
fixbash: Rebuild with updated glibc
securitycapstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114]
securitycivetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763]
securitydirewolf: Fix stack buffer overflow [CVE-2025-34457]
securitydpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219]
securityerlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107]
securityfluidsynth: Fix null pointer dereference issue [CVE-2025-56225]
securityfonttools: Fix arbitrary file write issue [CVE-2025-66034]
securityglibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the…
securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269]
securityjaraco.context: Prevent path traversal [CVE-2026-23949]
securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]
securitylibsndfile: Fix memory leak issue [CVE-2025-56226]
securitymariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support
securitynode-proxy-agents: Fix path traversal issue [CVE-2026-27699]
securityopenssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985]
securitypcsx2: Fix code execution issue [CVE-2025-49589]
securityphpunit: Fix unsafe deserialization issue [CVE-2026-24765]
securitypostgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006]
securitypython-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007]
securitypython-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146]
securitypython-multipart: Fix arbitrary file write issue [CVE-2026-24486]
securityqemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665]
securityrequests: Fix credential leak issue [CVE-2024-47081]
securityrust-ntp-proto: Fix excessive load issue [CVE-2026-26076]
securityrust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076
securitysqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf
securitystarlette: Fix denial of service issue [CVE-2025-62727]
securitysuricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264]
securitywget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195]
securitywireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203]
securityxen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553]
securityzabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643]
+72 more items in the release notes
13.3 Jan 10, 2026 Release notes ↗
security36 security advisories included: DSA-6041 strongswan, DSA-6051 incus, DSA-6052 rust-sudo-rs, DSA-6055 chromium, DSA-6056 keystone +1, DSA-6058 lasso, DSA-6059 thunderbird, DSA-6060 chromium, DSA-6061 tryton-sao, DSA-6062 pdfminer, DSA-6063 kdeconnect, DSA-6064 tryton-server, …
fixansible: New upstream stable release
securityapache2: New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200]
fixat-spi2-core: Ensure xkb group is taken into account for key events
fixawffull: Fix systemd timer invocation to avoid premature cron-script exit
fixbase-files: Update for the point release
fixbash: Rebuild with updated glibc
fixbglibs: Rebuild with updated glibc
fixbusybox: Rebuild with updated glibc
securitycalibre: Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486]
fixcatatonit: Rebuild with updated glibc
fixcdebootstrap: Rebuild with updated glibc
fixchkrootkit: Rebuild with updated glibc
fixcloud-init: Ensure deb822 sources.list template renders correctly
securitycomposer: Fix ANSI sequence injection [CVE-2025-67746]
securitycups-filters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524]
securityedk2: Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770]
securityfreedombox: distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462]
securityglib2.0: Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]
securitygnupg2: Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc
securitygnutls28: Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback
securityimagemagick: Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]
securitylibcoap3: Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499]
securitylibcupsfilters: Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]
securitylibphp-adodb: Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119]
securitylibvirt: Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the…
securitylxd: Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507]
securitymbedtls: New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438]
securitymongo-c-driver: Avoid invalid memory reads [CVE-2025-12119]
securitynode-nodemailer: Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033]
securitypgbouncer: Fix arbitary SQL execution issue [CVE-2025-12819]
securitypostgresql-17: New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]
securityqemu: New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464]
securityr-cran-gh: Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation
securityrlottie: Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]
securityrsync: Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]
securityrust-sequoia-openpgp: Fix buffer underflow in aes_key_unwrap [CVE-2025-67897]
securitysogo: Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]
securitysuricata: Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344]
securitysymfony: Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries
+69 more items in the release notes
13.2 Nov 15, 2025 Release notes ↗
security52 security advisories included: DSA-5979 libxslt, DSA-5993 chromium, DSA-5994 shibboleth-sp, DSA-5995 hsqldb1.8.0, DSA-5996 chromium, DSA-5997 imagemagick, DSA-5998 cups, DSA-5999 libjson-xs-perl, DSA-6000 libcpanel-json-xs-perl, DSA-6001 cjson, DSA-6002 node-sha.js, …
security7zip: New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001]
fix7zip-rar: Add missing CRC table constructor
fixaide: Fix bin/buildcache use by running it from a root timer; various updates and fixes to included rules
fixallow-html-temp: New upstream version to support newer Thunderbird releases
fixalsa-ucm-conf-asahi: Install missing aop_audio UCM configs
fixansible: Update collections to maintain compatibility with ansible-core 2.19
fixansible-core: New upstream stable release; fix regression from 2.18 regarding handlers and play tags
fixasahi-scripts: Fix the macaudio default profile check; add the apple_nvmem_spmi module to the initramfs explicitly; make update-m1n1 idempotent
fixbase-files: Update for the point release
fixbrltty: atSpi2: do not manage widgets without text interface; avoid excessive verbose bluetooth/usbfs messages
fixconsole-setup: Update keyboard layouts dz(la) into dz(azerty-oss) and Use ca/multix variant instead of ca/multi; fix dz(azerty-oss/deadkeys) into dz, which is what xkb really provides; fix dz default layout
fixcups: Fix operation of checkboxes in admin interface
securitycurl: Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for continue-at; fix path traversal issue [CVE-2025-11563]
fixdebian-edu-config: Use SERVER_ADDRESS in RewriteRule instead of hard-coded 'www'; drop desktop bundle from bundlesequence
securitydnsdist: Fix denial of service issues [CVE-2025-8671 CVE-2025-30187]
securityimagemagick: Fix integer overflow issue [CVE-2025-62171]
securitylemonldap-ng: Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication
securitylibcommons-lang-java: Fix an uncontrolled recursion issue [CVE-2025-48924]
securitylibcommons-lang3-java: Fix an uncontrolled recursion issue [CVE-2025-48924]
securitylibhtp: Prevent memory leak with lzma [CVE-2025-53537]
securitylibsmb2: Fix buffer overflow issue [CVE-2025-57632]
securitylibssh: Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277]
securitylibwebsockets: Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678]
securitylibxml2: Fix XPath recursion depth DoS [CVE-2025-9714]
securitylibyaml-syck-perl: Prevent memory corruption leading to str value being set on empty keys [CVE-2025-11683]
securitylog4cxx: Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]
securityluksmeta: Fix data corruption issue with LUKS1 [CVE-2025-11568]
securitymapserver: Fix SQL injection issue [CVE-2025-59431]
securitymodsecurity-apache: Fix security issues relating to response Content-Type handling [CVE-2025-54571]
securitynvidia-graphics-drivers-tesla-535: Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345]
securityopen-vm-tools: Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244]
securityphpmyadmin: Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573]
securitypoppler: Fix infinite recursion [CVE-2025-50420]
securitypython-eventlet: Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068]
securityqemu: New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls
securityrabbitmq-server: Fix logging on sensitive data [CVE-2025-50200]
securitysail: Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510]
securitysamba: New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230]
securitysuricata: Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147]
+84 more items in the release notes
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status