VersionDrift
Product

Debian GNU/Linux 13.3 → 13.7

4 releases · 0 breaking changes · 155 security fixes · 0 advisories fixed

155security0breaking0deprecated0feature5fix

Is 13.3 affected?

Breaking changes

None in the release notes.

Security changes

  • security 92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, … in 13.7
  • security alsa-lib: Fix heap overflow issue [CVE-2026-25068] in 13.7
  • security ansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332] in 13.7
  • security bettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default in 13.7
  • security binwalk: Fix path traversal issue [CVE-2026-7179] in 13.7
  • security cyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088] in 13.7
  • security dcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868] in 13.7
  • security dhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258] in 13.7
  • security dnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969] in 13.7
  • security flask: Ensure Vary: Cookie is set on session access [CVE-2026-27205] in 13.7
  • security fluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714] in 13.7
  • security glib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue… in 13.7
  • security glibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers in 13.7
  • security goaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777] in 13.7
  • security gpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122] in 13.7
  • security gzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992] in 13.7
  • security imagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871… in 13.7
  • security incus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501] in 13.7
  • security libhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017] in 13.7
  • security libio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962] in 13.7
  • security libmongocrypt: Fix missing input validation issue [CVE-2026-81523] in 13.7
  • security libnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942] in 13.7
  • security libnfs: Fix integer overflow [CVE-2026-53689] in 13.7
  • security libraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660] in 13.7
  • security libsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
  • security libsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
  • security libsocket-perl: Fix out of bounds read issue [CVE-2026-12087] in 13.7
  • security libssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034] in 13.7
  • security libvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623] in 13.7
  • security libwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161] in 13.7
  • security lwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836] in 13.7
  • security mbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow… in 13.7
  • security mongo-c-driver: Fix missing input validation issue [CVE-2026-81524] in 13.7
  • security mrtg: Fix privilege escalation issue [CVE-2026-72694] in 13.7
  • security node-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800] in 13.7
  • security onionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706] in 13.7
  • security opencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253] in 13.7
  • security patool: Fix path traversal vulnerability [CVE-2026-29509] in 13.7
  • security perl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix… in 13.7
  • security php-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766] in 13.7
  • security 109 security advisories included: DSA-6250 chromium, DSA-6256 php8.4, DSA-6266 nghttp2, DSA-6267 thunderbird, DSA-6268 ffmpeg, DSA-6270 postgresql-17, DSA-6271 gsasl, DSA-6273 chromium, DSA-6274 linux-signed-amd64 +2, DSA-6277 openjpeg2, DSA-6278 nginx, DSA-6279 redis, DSA-6280 netatalk, … in 13.6
  • security apache2: Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of service issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues… in 13.6
  • security beets: Fix XSS vulnerability [CVE-2026-42052] in 13.6
  • security calibre: Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader-background endpoint path… in 13.6
  • security ckermit: Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check in 13.6
  • security composer: Fix support for new GitHub token format [CVE-2026-45793] in 13.6
  • security curl: Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use-after-free and… in 13.6
  • security dcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] in 13.6
  • security debusine: Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853] in 13.6
  • security deepdiff: Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155] in 13.6
  • security dhcpcd: Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117] in 13.6
  • security dolphin: Fix sandbox escape issue [CVE-2026-41525] in 13.6
  • security errands: Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063] in 13.6
  • security gdown: Fix arbitray file write issue [CVE-2026-40491] in 13.6
  • security giflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] in 13.6
  • security gimp: Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915] in 13.6
  • security graphite2: Fix out-of-bounds write [CVE-2026-50593] in 13.6
  • security ironic: Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths;… in 13.6
  • security isc-kea: Fix denial of service issue [CVE-2026-3608] in 13.6
  • security keystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] in 13.6
  • security libapache-session-browseable-perl: Improve entropy source [CVE-2026-8503] in 13.6
  • security libbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625] in 13.6
  • security libcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046] in 13.6
  • security libcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240] in 13.6
  • security libcrypt-urandom-perl: Fix buffer overflow issue [CVE-2026-2474] in 13.6
  • security libhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829] in 13.6
  • security libnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] in 13.6
  • security libslirp: Fix memory disclosure issue [CVE-2026-9539] in 13.6
  • security libtasn1-6: Fix buffer overflow issue [CVE-2025-13151] in 13.6
  • security libvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] in 13.6
  • security libxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177] in 13.6
  • security libxml2: Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation… in 13.6
  • security libxpm: Fix out of bounds read issue [CVE-2026-4367] in 13.6
  • security lxml-html-clean: Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350] in 13.6
  • security mesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] in 13.6
  • security miniupnpd: Fix integer underflow issue [CVE-2026-5720] in 13.6
  • security modsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] in 13.6
  • security mutt: Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864] in 13.6
  • security mxml: Fix out-of-bounds read [CVE-2026-5037] in 13.6
  • security nbconvert: Fix arbitrary file read/write issues [CVE-2026-39377 CVE-2026-39378] in 13.6
  • security 96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, … in 13.5
  • security 389-ds-base: Fix heap overflow issue [CVE-2025-14905] in 13.5
  • security apache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue… in 13.5
  • security awstats: Prevent command injection [CVE-2025-63261] in 13.5
  • security black: Fix arbitrary file write issue [CVE-2026-32274] in 13.5
  • security bubblewrap: Fix privilege escalation issue [CVE-2026-41163] in 13.5
  • security calibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] in 13.5
  • security cimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146] in 13.5
  • security cockpit: Fix code execution issue [CVE-2026-4631] in 13.5
  • security composer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176] in 13.5
  • security curl: Fix server certificate verification issue [CVE-2025-13034] in 13.5
  • security dovecot: Fix memory leak in CVE-2026-27857 fix in 13.5
  • security erlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943] in 13.5
  • security exim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] in 13.5
  • security firewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948] in 13.5
  • security freerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680… in 13.5
  • security git-lfs: Fix arbitrary file write issue [CVE-2025-26625] in 13.5
  • security glance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure in 13.5
  • security glib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode… in 13.5
  • security glibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;… in 13.5
  • security gvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] in 13.5
  • security harfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693] in 13.5
  • security jpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures in 13.5
  • security jq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164] in 13.5
  • security kissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] in 13.5
  • security libarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] in 13.5
  • security libcap2: Fix time of check / time of use issue [CVE-2026-4878] in 13.5
  • security libcdio: Fix buffer overflow issue [CVE-2024-36600] in 13.5
  • security libcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468] in 13.5
  • security libcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564] in 13.5
  • security libexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] in 13.5
  • security libnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] in 13.5
  • security libtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111] in 13.5
  • security libvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854] in 13.5
  • security libxml-security-java: Fix private key disclosure issue [CVE-2023-44483] in 13.5
  • security lxc: Fix authorisation bypass issue [CVE-2026-39402] in 13.5
  • security mapserver: Fix buffer overflow issue [CVE-2026-33721] in 13.5
  • security modsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691] in 13.5
  • security mongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files in 13.5
  • security musl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200] in 13.5
  • security 62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, … in 13.4
  • security arduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209] in 13.4
  • security augeas: Fix null pointer dereference issue [CVE-2025-2588] in 13.4
  • security capstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114] in 13.4
  • security civetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763] in 13.4
  • security direwolf: Fix stack buffer overflow [CVE-2025-34457] in 13.4
  • security dpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219] in 13.4
  • security erlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107] in 13.4
  • security fluidsynth: Fix null pointer dereference issue [CVE-2025-56225] in 13.4
  • security fonttools: Fix arbitrary file write issue [CVE-2025-66034] in 13.4
  • security glibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the… in 13.4
  • security gpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269] in 13.4
  • security jaraco.context: Prevent path traversal [CVE-2026-23949] in 13.4
  • security libpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] in 13.4
  • security libsndfile: Fix memory leak issue [CVE-2025-56226] in 13.4
  • security mariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support in 13.4
  • security node-proxy-agents: Fix path traversal issue [CVE-2026-27699] in 13.4
  • security openssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985] in 13.4
  • security pcsx2: Fix code execution issue [CVE-2025-49589] in 13.4
  • security phpunit: Fix unsafe deserialization issue [CVE-2026-24765] in 13.4
  • security postgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006] in 13.4
  • security python-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007] in 13.4
  • security python-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146] in 13.4
  • security python-multipart: Fix arbitrary file write issue [CVE-2026-24486] in 13.4
  • security qemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665] in 13.4
  • security requests: Fix credential leak issue [CVE-2024-47081] in 13.4
  • security rust-ntp-proto: Fix excessive load issue [CVE-2026-26076] in 13.4
  • security rust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076 in 13.4
  • security sqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf in 13.4
  • security starlette: Fix denial of service issue [CVE-2025-62727] in 13.4
  • security suricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264] in 13.4
  • security wget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195] in 13.4
  • security wireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203] in 13.4
  • security xen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553] in 13.4
  • security zabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643] in 13.4

Every release in between

13.7 Sep 12, 2026 Release notes ↗
security92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, …
securityalsa-lib: Fix heap overflow issue [CVE-2026-25068]
securityansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332]
securitybettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default
securitybinwalk: Fix path traversal issue [CVE-2026-7179]
securitycyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088]
securitydcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868]
securitydhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258]
securitydnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969]
securityflask: Ensure Vary: Cookie is set on session access [CVE-2026-27205]
securityfluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714]
securityglib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue…
securityglibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers
securitygoaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777]
securitygpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122]
securitygzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992]
securityimagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871…
securityincus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501]
securitylibhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017]
securitylibio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962]
securitylibmongocrypt: Fix missing input validation issue [CVE-2026-81523]
securitylibnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942]
securitylibnfs: Fix integer overflow [CVE-2026-53689]
securitylibraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660]
securitylibsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness
securitylibsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness
securitylibsocket-perl: Fix out of bounds read issue [CVE-2026-12087]
securitylibssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034]
securitylibvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623]
securitylibwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161]
securitylwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836]
securitymbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow…
securitymongo-c-driver: Fix missing input validation issue [CVE-2026-81524]
securitymrtg: Fix privilege escalation issue [CVE-2026-72694]
securitynode-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800]
securityonionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706]
securityopencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253]
securitypatool: Fix path traversal vulnerability [CVE-2026-29509]
securityperl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix…
securityphp-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766]
+67 more items in the release notes
13.6 Jul 11, 2026 Release notes ↗
security109 security advisories included: DSA-6250 chromium, DSA-6256 php8.4, DSA-6266 nghttp2, DSA-6267 thunderbird, DSA-6268 ffmpeg, DSA-6270 postgresql-17, DSA-6271 gsasl, DSA-6273 chromium, DSA-6274 linux-signed-amd64 +2, DSA-6277 openjpeg2, DSA-6278 nginx, DSA-6279 redis, DSA-6280 netatalk, …
securityapache2: Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of service issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues…
securitybeets: Fix XSS vulnerability [CVE-2026-42052]
securitycalibre: Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader-background endpoint path…
securityckermit: Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check
securitycomposer: Fix support for new GitHub token format [CVE-2026-45793]
securitycurl: Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use-after-free and…
securitydcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805]
securitydebusine: Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853]
securitydeepdiff: Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155]
securitydhcpcd: Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117]
securitydolphin: Fix sandbox escape issue [CVE-2026-41525]
securityerrands: Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063]
securitygdown: Fix arbitray file write issue [CVE-2026-40491]
securitygiflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740]
securitygimp: Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915]
securitygraphite2: Fix out-of-bounds write [CVE-2026-50593]
securityironic: Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths;…
securityisc-kea: Fix denial of service issue [CVE-2026-3608]
securitykeystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551]
securitylibapache-session-browseable-perl: Improve entropy source [CVE-2026-8503]
securitylibbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625]
securitylibcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046]
securitylibcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240]
securitylibcrypt-urandom-perl: Fix buffer overflow issue [CVE-2026-2474]
securitylibhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829]
securitylibnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191]
securitylibslirp: Fix memory disclosure issue [CVE-2026-9539]
securitylibtasn1-6: Fix buffer overflow issue [CVE-2025-13151]
securitylibvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538]
securitylibxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177]
securitylibxml2: Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation…
securitylibxpm: Fix out of bounds read issue [CVE-2026-4367]
securitylxml-html-clean: Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350]
securitymesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393]
securityminiupnpd: Fix integer underflow issue [CVE-2026-5720]
securitymodsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268]
securitymutt: Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864]
securitymxml: Fix out-of-bounds read [CVE-2026-5037]
securitynbconvert: Fix arbitrary file read/write issues [CVE-2026-39377 CVE-2026-39378]
+85 more items in the release notes
13.5 May 16, 2026 Release notes ↗
security96 security advisories included: DSA-6088 php8.4, DSA-6158 imagemagick, DSA-6160 netty, DSA-6161 multipart, DSA-6162 linux-signed-amd64 +2, DSA-6164 chromium, DSA-6165 chromium, DSA-6166 nodejs, DSA-6167 gst-plugins-base1.0, DSA-6168 freetype, DSA-6169 imagemagick, DSA-6170 snapd, …
security389-ds-base: Fix heap overflow issue [CVE-2025-14905]
securityapache2: New upstream stable release; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue…
securityawstats: Prevent command injection [CVE-2025-63261]
securityblack: Fix arbitrary file write issue [CVE-2026-32274]
securitybubblewrap: Fix privilege escalation issue [CVE-2026-41163]
securitycalibre: Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824]
securitycimg: Fix overflow issue [CVE-2026-42144]; fix out of memory issue with crafted files [CVE-2026-42146]
securitycockpit: Fix code execution issue [CVE-2026-4631]
securitycomposer: Fix command injection issues [CVE-2026-40261 CVE-2026-40176]
securitycurl: Fix server certificate verification issue [CVE-2025-13034]
securitydovecot: Fix memory leak in CVE-2026-27857 fix
securityerlang: Fix path traversal issues [CVE-2026-21620 CVE-2026-23942[; fix HTTP request smuggling issue [CVE-2026-23941]; fix denial of service issue [CVE-2026-23943]
securityexim4: Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687]
securityfirewalld: Prevent local users from being able to modify runtime firewall state without prior authentication if the desktop policy is active [CVE-2026-4948]
securityfreerdp3: Fix issues with large certificates; fix clipboard paste issue; fix segmentation fault issue [CVE-2025-4478]; fix use-after-free issues [CVE-2026-22851 CVE-2026-22856 CVE-2026-22857 CVE-2026-23883 CVE-2026-23884 CVE-2026-24491 CVE-2026-24675 CVE-2026-24676 CVE-2026-24678 CVE-2026-24680…
securitygit-lfs: Fix arbitrary file write issue [CVE-2025-26625]
securityglance: Fix server-side request forgery issue [CVE-2026-34881]; fix build failure
securityglib2.0: Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow issue in content type parsing [CVE-2026-1485]; fix integer overflow in unicode…
securityglibc: Fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix a null pointer dereference in the nss_database_check_reload_and_get function; fix invalid pointer arithmetic in ANSI_X3.110 iconv module;…
securitygvfs: Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296]
securityharfbuzz: Fix NULL pointer dereference issue [CVE-2026-22693]
securityjpeg-xl: Fix uninitialised memory read issues [CVE-2025-12474 CVE-2026-1837]; fix cross build failure; fix nojava build profile; fix build on big-endian architectures
securityjq: Fix buffer overflow issue [CVE-2026-32316]; fix denial of service issues [CVE-2026-33947 CVE-2026-39956]; fix validation bypass issue [CVE-2026-33948]; fix out-of-bounds read issue [CVE-2026-39979]; fix use of hardcoded seed [CVE-2026-40164]
securitykissfft: Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445]
securitylibarchive: Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121]
securitylibcap2: Fix time of check / time of use issue [CVE-2026-4878]
securitylibcdio: Fix buffer overflow issue [CVE-2024-36600]
securitylibcoap3: Fix out-of-bounds read issue [CVE-2026-29013]; fix buffer overflow issue [CVE-2025-34468]
securitylibcryptx-perl: Fix Crypt::PK key generation is not fork safe and will generate identical keys [CVE-2026-41564]
securitylibexif: Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385]
securitylibnet-cidr-lite-perl: Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199]
securitylibtext-csv-xs-perl: Fix stack corruption issue [CVE-2026-7111]
securitylibvncserver: Fix out of bounds read issue [CVE-2026-32853]; fix NULL pointer dereference issue [CVE-2026-32854]
securitylibxml-security-java: Fix private key disclosure issue [CVE-2023-44483]
securitylxc: Fix authorisation bypass issue [CVE-2026-39402]
securitymapserver: Fix buffer overflow issue [CVE-2026-33721]
securitymodsecurity-crs: Fix file extension blocking bypass issue [CVE-2026-33691]
securitymongo-c-driver: Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files
securitymusl: Fix denial of service issue [CVE-2026-6042]; fix stack corruption issue [CVE-2026-40200]
+105 more items in the release notes
13.4 Mar 14, 2026 Release notes ↗
security62 security advisories included: DSA-6054 firefox-esr, DSA-6078 firefox-esr, DSA-6093 gimp, DSA-6094 libsodium, DSA-6095 foomuuri, DSA-6096 vlc, DSA-6097 chromium, DSA-6098 net-snmp, DSA-6099 python-parsl, DSA-6100 chromium, DSA-6101 firefox-esr, DSA-6102 python-urllib3, …
fixakonadi: Show all folders in kmail
fixapache2: Fix HTTP/2 regression
securityarduino-core-avr: New upstream stable release; fix buffer overflow issue [CVE-2025-69209]
fixasahi-scripts: Fix SD card reader autosuspend
securityaugeas: Fix null pointer dereference issue [CVE-2025-2588]
fixbase-files: Update for the point release
fixbash: Rebuild with updated glibc
securitycapstone: New upstream stable release; fix buffer overflow issue [CVE-2025-67873]; fix buffer underflow and overflow issue [CVE-2025-68114]
securitycivetweb: Fix denial of service issue [CVE-2025-9648]; fix buffer overflow issue [CVE-2025-55763]
securitydirewolf: Fix stack buffer overflow [CVE-2025-34457]
securitydpkg: dpkg-query: Fix segfault with empty -S argument; Dpkg::OpenPGP: Do not run verify with no keyrings; Dpkg::Shlibs::Objdump::Object: Add support for Version References symbols; Dpkg::OpenPGP::Backend::GnuPG: Add missing Dpkg::Gettext import; fix denial of service issue [CVE-2026-2219]
securityerlang: Fix excessive resource use issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix traffic redirection issue [CVE-2016-1000107]
securityfluidsynth: Fix null pointer dereference issue [CVE-2025-56225]
securityfonttools: Fix arbitrary file write issue [CVE-2025-66034]
securityglibc: Update from upstream stable branch; fix heap corruption issue [CVE-2026-0861]; fix stack contents leak issue [CVE-2026-0915]; fix uninitialized memory use issue [CVE-2025-15281]; switch currency symbol for the bg_BG locale to euro; fix a null pointer dereference in symbol lookup when the…
securitygpsd: Fix out-of-bounds write issue [CVE-2025-67268]; fix denial of service issue [CVE-2025-67269]
securityjaraco.context: Prevent path traversal [CVE-2026-23949]
securitylibpng1.6: Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695]
securitylibsndfile: Fix memory leak issue [CVE-2025-56226]
securitymariadb: New upstream stable release; fix arbitrary code execution issue [CVE-2025-13699]; fix denial of service issue [CVE-CVE-2026-21968]; use tmpfiles.d to generate runtime directory; fix upgrades from version 10.4 when encryption is enabled; fix innodb_linux_aio support
securitynode-proxy-agents: Fix path traversal issue [CVE-2026-27699]
securityopenssh: Fix mistracking of MaxStartups process exits in some situations; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985]
securitypcsx2: Fix code execution issue [CVE-2025-49589]
securityphpunit: Fix unsafe deserialization issue [CVE-2026-24765]
securitypostgresql-17: New upstream stable release; fix buffer overrun issue [CVE-2026-2006]
securitypython-cryptography: Fix missing validation in EC public key creation [CVE-2026-26007]
securitypython-filelock: Fix TOCTOU symlink handling vulnerability in lock file creation [CVE-2025-68146]
securitypython-multipart: Fix arbitrary file write issue [CVE-2026-24486]
securityqemu: New upstream stable release; fix denial of service issues [CVE-2025-14876 CVE-2026-0665]
securityrequests: Fix credential leak issue [CVE-2024-47081]
securityrust-ntp-proto: Fix excessive load issue [CVE-2026-26076]
securityrust-ntpd: Rebuild with rust-ntp-proto 1.4.0-4+deb13u1 to fix CVE-2026-26076
securitysqlite3: Prevent integer overflow in FTSS extension [CVE-2025-7709]; add missing build dependency on pkgconf
securitystarlette: Fix denial of service issue [CVE-2025-62727]
securitysuricata: Fix denial of service issues [CVE-2026-22258 CVE-2026-22259 CVE-2026-22261]; fix stack overflow issue [CVE-2026-22262]; fix heap overflow issue [CVE-2026-22264]
securitywget2: Fix file overwrite issue with metalink [CVE-2025-69194]; fix remote buffer overflow [CVE-2025-69195]
securitywireshark: New upstream stable release; fix USB HID dissector memory exhaustion [CVE-2026-3201]; fix RF4CE Profile dissector crash [CVE-2026-3203]
securityxen: New upstream stable release; fix buffer overrun issue [CVE-2025-58150]; fix incomplete vCPU isolation issue [CVE-2026-23553]
securityzabbix: New upstream stable release; fix data leakage issues [CVE-2025-27231 CVE-2025-27233 CVE-2025-27236 CVE-2025-27238 CVE-2025-49641]; fix denial of service issue [CVE-2025-49643]
+72 more items in the release notes
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status