Debian GNU/Linux 13.5 → 13.7

Breaking changes

None in the release notes.

Security changes

• security 92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, … in 13.7
• security alsa-lib: Fix heap overflow issue [CVE-2026-25068] in 13.7
• security ansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332] in 13.7
• security bettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default in 13.7
• security binwalk: Fix path traversal issue [CVE-2026-7179] in 13.7
• security cyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088] in 13.7
• security dcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868] in 13.7
• security dhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258] in 13.7
• security dnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969] in 13.7
• security flask: Ensure Vary: Cookie is set on session access [CVE-2026-27205] in 13.7
• security fluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714] in 13.7
• security glib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue… in 13.7
• security glibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers in 13.7
• security goaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777] in 13.7
• security gpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122] in 13.7
• security gzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992] in 13.7
• security imagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871… in 13.7
• security incus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501] in 13.7
• security libhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017] in 13.7
• security libio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962] in 13.7
• security libmongocrypt: Fix missing input validation issue [CVE-2026-81523] in 13.7
• security libnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942] in 13.7
• security libnfs: Fix integer overflow [CVE-2026-53689] in 13.7
• security libraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660] in 13.7
• security libsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
• security libsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
• security libsocket-perl: Fix out of bounds read issue [CVE-2026-12087] in 13.7
• security libssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034] in 13.7
• security libvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623] in 13.7
• security libwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161] in 13.7
• security lwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836] in 13.7
• security mbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow… in 13.7
• security mongo-c-driver: Fix missing input validation issue [CVE-2026-81524] in 13.7
• security mrtg: Fix privilege escalation issue [CVE-2026-72694] in 13.7
• security node-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800] in 13.7
• security onionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706] in 13.7
• security opencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253] in 13.7
• security patool: Fix path traversal vulnerability [CVE-2026-29509] in 13.7
• security perl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix… in 13.7
• security php-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766] in 13.7
• security 109 security advisories included: DSA-6250 chromium, DSA-6256 php8.4, DSA-6266 nghttp2, DSA-6267 thunderbird, DSA-6268 ffmpeg, DSA-6270 postgresql-17, DSA-6271 gsasl, DSA-6273 chromium, DSA-6274 linux-signed-amd64 +2, DSA-6277 openjpeg2, DSA-6278 nginx, DSA-6279 redis, DSA-6280 netatalk, … in 13.6
• security apache2: Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of service issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues… in 13.6
• security beets: Fix XSS vulnerability [CVE-2026-42052] in 13.6
• security calibre: Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader-background endpoint path… in 13.6
• security ckermit: Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check in 13.6
• security composer: Fix support for new GitHub token format [CVE-2026-45793] in 13.6
• security curl: Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use-after-free and… in 13.6
• security dcmtk: Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] in 13.6
• security debusine: Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853] in 13.6
• security deepdiff: Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155] in 13.6
• security dhcpcd: Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117] in 13.6
• security dolphin: Fix sandbox escape issue [CVE-2026-41525] in 13.6
• security errands: Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063] in 13.6
• security gdown: Fix arbitray file write issue [CVE-2026-40491] in 13.6
• security giflib: Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] in 13.6
• security gimp: Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915] in 13.6
• security graphite2: Fix out-of-bounds write [CVE-2026-50593] in 13.6
• security ironic: Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths;… in 13.6
• security isc-kea: Fix denial of service issue [CVE-2026-3608] in 13.6
• security keystone: Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] in 13.6
• security libapache-session-browseable-perl: Improve entropy source [CVE-2026-8503] in 13.6
• security libbytes-random-secure-perl: Fix incorrect usage of seed in PRNG [CVE-2026-11625] in 13.6
• security libcaca: Prevent undefined behaviour in overflow check [CVE-2026-42046] in 13.6
• security libcrypt-pbkdf2-perl: Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant-time comparison in validate to avoid timing attacks [CVE-2017-20240] in 13.6
• security libcrypt-urandom-perl: Fix buffer overflow issue [CVE-2026-2474] in 13.6
• security libhtml-parser-perl: Fix heap-use-after-free in _decode_entities [CVE-2026-8829] in 13.6
• security libnet-cidr-lite-perl: Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] in 13.6
• security libslirp: Fix memory disclosure issue [CVE-2026-9539] in 13.6
• security libtasn1-6: Fix buffer overflow issue [CVE-2025-13151] in 13.6
• security libvncserver: Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] in 13.6
• security libxml-libxml-perl: Fix out-of-bounds read [CVE-2026-8177] in 13.6
• security libxml2: Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation… in 13.6
• security libxpm: Fix out of bounds read issue [CVE-2026-4367] in 13.6
• security lxml-html-clean: Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350] in 13.6
• security mesa: Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] in 13.6
• security miniupnpd: Fix integer underflow issue [CVE-2026-5720] in 13.6
• security modsecurity: Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] in 13.6
• security mutt: Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864] in 13.6
• security mxml: Fix out-of-bounds read [CVE-2026-5037] in 13.6
• security nbconvert: Fix arbitrary file read/write issues [CVE-2026-39377 CVE-2026-39378] in 13.6

Every release in between