Debian GNU/Linux 13.6 → 13.7

Breaking changes

None in the release notes.

Security changes

• security 92 security advisories included: DSA-6381 linux-signed-amd64 +2, DSA-6382 postfix, DSA-6383 imagemagick, DSA-6385 pgextwlist, DSA-6386 opam, DSA-6387 chromium, DSA-6388 libxfont, DSA-6389 ntfs-3g, DSA-6390 chromium, DSA-6391 roundcube, DSA-6392 tiff, DSA-6393 linux-signed-amd64 +2, … in 13.7
• security alsa-lib: Fix heap overflow issue [CVE-2026-25068] in 13.7
• security ansible-core: New upstream stable release; fix arbitrary code injection issue [CVE-2026-11332] in 13.7
• security bettercap: Fix mysql.server module remote DoS via crafted client handshake [CVE-2026-8276]; stop installing systemd service by default in 13.7
• security binwalk: Fix path traversal issue [CVE-2026-7179] in 13.7
• security cyrus-imapd: Allow JMAP EventSource without WebSocket/wslay; fix insufficient access check issues [CVE-2026-47084 CVE-2026-47086 CVE-2026-47087 CVE-2026-47081 CVE-2026-47089 CVE-2026-47085 CVE-2026-47083 CVE-2026-47082]; fix out of bounds read issue [CVE-2026-47088] in 13.7
• security dcmtk: Fix denial of service issues [CVE-2026-35505 CVE-2026-44628 CVE-2026-50254]; fix path traversal issues [CVE-2026-50003 CVE-2026-52868] in 13.7
• security dhcpcd: Fix IPv6 Neighbor Discovery option parsing to discard advertisements with zero-length options [CVE-2026-14258] in 13.7
• security dnsmasq: Fix buffer overflow issue [CVE-2026-12725]; fix out of bounds read issue [CVE-2026-12969] in 13.7
• security flask: Ensure Vary: Cookie is set on session access [CVE-2026-27205] in 13.7
• security fluidsynth: Fix buffer overflow issues [CVE-2026-58264 CVE-2026-61714] in 13.7
• security glib2.0: Fix out of bounds access issues [CVE-2026-58010 CVE-2026-58011 CVE-2026-58012 CVE-2026-58013 CVE-2026-58014]; fix file content disclosure issue [CVE-2026-58015]; fix denial of service issue [CVE-2026-15588]; fix integer underflow issue [CVE-2026-58016]; fix out of bounds write issue… in 13.7
• security glibc: Fix buffer overflow/underflow issues [CVE-2026-5928 CVE-2026-5450]; ensure compatibility with linux 7.0 headers in 13.7
• security goaccess: Fix out of bounds write issue [CVE-2026-54715]; fix denial of service issue [CVE-2026-55768 CVE-2026-55777] in 13.7
• security gpsd: Fix gpsprof command and code injection in gnuplot script generation [CVE-2026-58459 CVE-2026-60122] in 13.7
• security gzip: Fix insecure temporary file handling issue [CVE-2026-41991]; fix buffer overflow issue [CVE-2026-41992] in 13.7
• security imagemagick: Fix buffer overflow issues [CVE-2026-56362 CVE-2026-56372 CVE-2026-56374 CVE-2026-61464]; fix memory leak issues [CVE-2026-56366 CVE-2026-56375 CVE-2026-61863 CVE-2026-61864 CVE-2026-61865 CVE-2026-61866 CVE-2026-61867 CVE-2026-61868 CVE-2026-61869 CVE-2026-61870 CVE-2026-61871… in 13.7
• security incus: Fix path traversal issue [CVE-2026-81500]; fix insufficent access check issue [CVE-2026-81501] in 13.7
• security libhttp-tiny-perl: Fix CRLF validation issue [CVE-2026-7010]; fix credential forwarding on redirects issue [CVE-2026-7017] in 13.7
• security libio-compress-perl: Fix header parsing issue [CVE-2025-15649]; fix denial of service issue [CVE-2026-48959]; fix crash in zipdetails [CVE-2026-48961]; fix code execution issue [CVE-2026-48962] in 13.7
• security libmongocrypt: Fix missing input validation issue [CVE-2026-81523] in 13.7
• security libnet-cidr-set-perl: Fix IPv4/IPv6 CIDR parsing validation [CVE-2026-49940 CVE-2026-49941 CVE-2026-49942] in 13.7
• security libnfs: Fix integer overflow [CVE-2026-53689] in 13.7
• security libraw: Fix out of bounds read issue [CVE-2026-5342]; fix integer overflow issues [CVE-2026-20884 CVE-2026-24450]; fix buffer overflow issues [CVE-2026-20889 CVE-2026-21413 CVE-2026-24660] in 13.7
• security libsdl2-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
• security libsdl3-image: Fix out of bounds read issue [CVE-2026-35444]; improve parser robustness in 13.7
• security libsocket-perl: Fix out of bounds read issue [CVE-2026-12087] in 13.7
• security libssh2: Fix buffer overflow issues [CVE-2026-58050 CVE-2026-66035 CVE-2026-58051]; fix double free issue [CVE-2026-66032]; fix integer underflow issue [CVE-2026-66033]; fix data leak issue [CVE-2026-66034] in 13.7
• security libvirt: Fix buffer overflow issue [CVE-2026-18917]; fix record injection issue [CVE-2026-61477]; fix denial of service issue [CVE-2026-61478]; fix privilege escalation issue [CVE-2026-63622]; fix information disclosure issue [CVE-2026-63623] in 13.7
• security libwebsockets: Fix denial of service issue [CVE-2026-10650]; fix out of bounds write issue [CVE-2026-78161] in 13.7
• security lwip: Fix SNMPv3 authentication buffer overflow [CVE-2026-8836] in 13.7
• security mbedtls: Fix signature algorithm injection issue [CVE-2026-25834]; fix PSA random generator cloning issue [CVE-2026-25835]; fix improper validation issue [CVE-2026-34872]; fix client impersonation issue [CVE-2026-34873]; fix NULL pointer dereference issue [CVE-2026-34874]; fix buffer overflow… in 13.7
• security mongo-c-driver: Fix missing input validation issue [CVE-2026-81524] in 13.7
• security mrtg: Fix privilege escalation issue [CVE-2026-72694] in 13.7
• security node-lodash: Fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800] in 13.7
• security onionshare: Prevent writing files in Receive mode when file uploads are disabled [CVE-2026-54707]; Prevent empty folder from being created when no file is uploaded [CVE-2026-54706] in 13.7
• security opencryptoki: Fix privilege escalation issue [CVE-2026-23893]; fix out of bounds read issue [CVE-2026-40253] in 13.7
• security patool: Fix path traversal vulnerability [CVE-2026-29509] in 13.7
• security perl: Fix credential forwarding on redirects issue [CVE-2026-7017]; fix symlink extraction issue [CVE-2026-42496]; fix hardlink extraction issue [CVE-2026-42497]; fix out of bounds read issues [CVE-2026-12087 CVE-2026-57432]; fix incorrect regular expression match issue [CVE-2026-13221]; fix… in 13.7
• security php-guzzlehttp-psr7: Fix CRLF injection in HTTP start-line parsing [CVE-2026-55766] in 13.7

Every release in between