[RFR] wml://publicity/announcements/pt/2025/20251115.wml

<define-tag pagetitle>Atualização Debian 13: 13.2 lançado</define-tag>
<define-tag release_date>2025-11-15</define-tag>
#use wml::debian::news
# $Id:

<define-tag release>13</define-tag>
<define-tag codename>trixie</define-tag>
<define-tag revision>13.2</define-tag>

<define-tag dsa>
    <tr><td align="center"><a href="$(HOME)/security/%0/dsa-%1">DSA-%1</a></td>
        <td align="center"><:
    my @p = ();
    for my $p (split (/,\s*/, "%2")) {
	push (@p, sprintf ('<a href="https://packages.debian.org/src:%s">%s</a>', $p, $p));
    }
    print join (", ", @p);
:></td></tr>
</define-tag>

<define-tag correction>
    <tr><td><a href="https://packages.debian.org/src:%0">%0</a></td>              <td>%1</td></tr>
</define-tag>

<define-tag srcpkg><a href="https://packages.debian.org/src:%0">%0</a></define-tag>

<p>O projeto Debian está feliz em anunciar a segunda atualização de sua
versão estável (stable) do Debian <release> (codinome <q><codename></q>).
Esta versão pontual adiciona principalmente correções para problemas de
segurança, além de pequenos ajustes para problemas mais sérios. Avisos de
segurança já foram publicados em separado e são referenciados quando
necessário.</p>

<p>Por favor, note que a versão pontual não constitui uma nova versão do Debian
<release>, mas apenas atualiza alguns dos pacotes já incluídos. Não há
necessidade de jogar fora as antigas mídias da <q><codename></q>. Após a
instalação, os pacotes podem ser atualizados para as versões atuais usando um
espelho atualizado do Debian.</p>

<p>Aquelas pessoas que frequentemente instalam atualizações a partir de
security.debian.org não terão que atualizar muitos pacotes, e a maioria de tais
atualizações estão incluídas na versão pontual.</p>

<p>Novas imagens de instalação logo estarão disponíveis nos locais
habituais.</p>

<p>A atualização de uma instalação existente para esta revisão pode ser feita
apontando o sistema de gerenciamento de pacotes para um dos muitos espelhos
HTTP do Debian. Uma lista abrangente de espelhos está disponível em:</p>

<div class="center">
  <a href="$(HOME)/mirror/list">https://www.debian.org/mirror/list</a>
</div>


<h2>Correções gerais de bugs</h2>

<p>Esta atualização da versão estável (stable) adiciona algumas correções
importantes para os seguintes pacotes:</p>

<table border=0>
<tr><th>Pacote</th>               <th>Justificativa</th></tr>
<correction 7zip "New upstream release; security fixes [CVE-2025-55188 CVE-2025-11002 CVE-2025-11001]">
<correction 7zip-rar "Add missing CRC table constructor">
<correction aide "Fix bin/buildcache use by running it from a root timer; various updates and fixes to included rules">
<correction allow-html-temp "New upstream version to support newer Thunderbird releases">
<correction alsa-ucm-conf-asahi "Install missing aop_audio UCM configs">
<correction ansible "Update collections to maintain compatibility with ansible-core 2.19">
<correction ansible-core "New upstream stable release; fix regression from 2.18 regarding handlers and play tags">
<correction asahi-scripts "Fix the macaudio default profile check; add the apple_nvmem_spmi module to the initramfs explicitly; make update-m1n1 idempotent">
<correction base-files "Update for the point release">
<correction brltty "atSpi2: do not manage widgets without text interface; avoid excessive verbose bluetooth/usbfs messages">
<correction console-setup "Update keyboard layouts dz(la) into dz(azerty-oss) and Use ca/multix variant instead of ca/multi; fix dz(azerty-oss/deadkeys) into dz, which is what xkb really provides; fix dz default layout">
<correction cups "Fix operation of checkboxes in admin interface">
<correction curl "Fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-11563]; allow --output to be overridden by --curl-options; fix manpage example for <q>continue-at</q>; fix path traversal issue [CVE-2025-11563]">
<correction debian-edu-config "Use SERVER_ADDRESS in RewriteRule instead of hard-coded 'www'; drop desktop bundle from bundlesequence">
<correction debian-installer "Increase Linux kernel ABI to 6.12.57+deb13; rebuild against proposed-updates">
<correction debian-installer-netboot-images "Increase Linux kernel ABI to 6.12.57+deb13; rebuild against proposed-updates">
<correction dhcpcd "Fix crash when an address is deleted; prevent failure to start if wpasupplicant is not installed">
<correction distro-info-data "Update EoL date for bookworm; add Ubuntu 26.04 LTS <q>Resolute Raccoon</q>">
<correction dkms "New upstream release; stop shipping dkms.service, fixing dependency cycle with cloud-init-network.service; emit a warning if no kernel headers were found">
<correction dns-root-data "Update root-anchors.p7s (the signature of root-anchors.xml) with a new expiration date">
<correction dnsdist "Fix denial of service issues [CVE-2025-8671 CVE-2025-30187]">
<correction dolphin-emu "Fix interaction with RetroAchievements; fix translations">
<correction dovecot "Ensure default lmtpd auth_username_format matches the global value; fix oauth configuration parsing; lib-sieve: correctly handle errors; clean up a few typos in default/example configuration">
<correction eas4tbsync "New upstream version to support newer Thunderbird releases">
<correction eperl "Avoid passing a truncated environment on Perl 5.40">
<correction epiphany-browser "New upstream stable release; fix various crashes; fix PKCS#11 login for invalid cert/priv pairs">
<correction evolution "New upstream stable release">
<correction evolution-data-server "New upstream stable release; fix busy loop when using the MH format mail archive">
<correction fangfrisch "Update sanesecurity mirror as the old one will stop working soon">
<correction fluidsynth "Set the default samplerate to 48000 and buffer size to 512 in the service configuration, fixing high CPU usage and distorted sound">
<correction folder-account "New upstream version to support newer Thunderbird releases">
<correction fonts-noto-color-emoji "New upstream release; add support for the Unicode 17.0 standard">
<correction freeradius "Fix compatibility with OpenSSL 3.5.2">
<correction gnome-maps "New upstream stable release; fix a regression when requesting route planning from transitous.org; add address format for Austria and Paraguay">
<correction gnome-session "Fix default app priority for early adopters of Papers and Showtime">
<correction google-recaptcha "Fix PHP 8.4 deprecation warnings">
<correction ikvswitch "Use Trixie as default distro for the setup; don't fail on errors when taking down an IPMI bridge; use a sysctl.d fragment file rather than sysctl.conf">
<correction imagemagick "Fix integer overflow issue [CVE-2025-62171]">
<correction input-remapper "Add missing python3-psutil runtime dependency">
<correction irqbalance "Enable write access to /proc/irq in service definition">
<correction jdupes "Fix detection of unique files">
<correction jing-trang "Re-import upstream release, to remove incorrectly included files">
<correction keepassxc-browser "Fix compatibility with Chromium">
<correction kmail-account-wizard "Enable automatic QML dependency detection">
<correction lemonldap-ng "Fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication">
<correction libcommons-lang-java "Fix an uncontrolled recursion issue [CVE-2025-48924]">
<correction libcommons-lang3-java "Fix an uncontrolled recursion issue [CVE-2025-48924]">
<correction libgpiod "Remove unnecessary Breaks/Replaces on libgpiod2 and libgpiod2t64">
<correction libhtp "Prevent memory leak with lzma [CVE-2025-53537]">
<correction libsmb2 "Fix buffer overflow issue [CVE-2025-57632]">
<correction libssh "Fix NULL pointer dereference issue [CVE-2025-8114]; fix denial of service issue [CVE-2025-8277]">
<correction libvirt "Don't require TLS certificates to support keyEncipherment; lower log level of a message, avoiding journal spam when using the LXC driver; fix a daemon crash that occurs when probing capabilities for a QEMU binary that doesn't report information about CPU models">
<correction libwebsockets "Fix denial of service issue [CVE-2025-11677]; fix buffer overflow issue [CVE-2025-11678]">
<correction libxml2 "Fix XPath recursion depth DoS [CVE-2025-9714]">
<correction libyaml-syck-perl "Prevent memory corruption leading to <q>str</q> value being set on empty keys [CVE-2025-11683]">
<correction linux "New upstream stable release">
<correction linux-signed-amd64 "New upstream stable release">
<correction linux-signed-arm64 "New upstream stable release">
<correction lnav "Handle failure to set cregs from tmux">
<correction log4cxx "Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]">
<correction logcheck "Update ignore.d.paranoid/ssh and ignore.d.server/ssh">
<correction lttng-modules "Fix potential kernel crash with syscall tracing">
<correction luksmeta "Fix data corruption issue with LUKS1 [CVE-2025-11568]">
<correction lxcfs "Add missing dependency on fuse3">
<correction magit "Ship missing magit-dired.el in elpa-magit">
<correction mailfromd "Rebuild to fix symbol lookup error">
<correction mailmindr "New upstream version to support newer Thunderbird releases">
<correction malcontent "Fix filtering snaps after snapd 2.72; fix listing flatpaks in parental control UI; fix memory leak when checking snaps">
<correction mapserver "Fix SQL injection issue [CVE-2025-59431]">
<correction mc "Fix accidental use of &gt;&amp;10 for subshells, avoiding delays at startup">
<correction modsecurity-apache "Fix security issues relating to response Content-Type handling [CVE-2025-54571]">
<correction monitoring-plugins "Fix check_users in combination with systemd; fix check_mysql plugin with newer MySQL versions">
<correction mpv "Create missing folders for watch history">
<correction mrtg "Fix duplicate WorkDir lines in cfgmaker output">
<correction nextcloud-desktop "New upstream stable release">
<correction nfdump "Honour subdir (-S) when usng dynamic FlowSource (-M)">
<correction nova "Fix information disclosure issue">
<correction nvidia-graphics-drivers-tesla-535 "Fix use after free issue [CVE-2025-23280]; fix privilege escalation issue [CVE-2025-23282]; fix denial of service issues [CVE-2025-23300 CVE-2025-23330 CVE-2025-23332 CVE-2025-23345]">
<correction onetbb "Fix test failures on single-CPU test machines; skip flaky mutex tests">
<correction open-vm-tools "Disable (default) the execution of the SDMP get-versions.sh script [CVE-2025-41244]">
<correction openssl "New upstream stable release">
<correction openvpn-auth-radius "Fix packet authentication">
<correction orphan-sysvinit-scripts "Add haveged init script">
<correction patroni "New upstream stable release">
<correction pdns-recursor "Switch to dpkg/default.mk; drop CARGO_REGISTRY override">
<correction phpmyadmin "Address XSS vulnerability in bundled jquery.validate.js [CVE-2025-3573]">
<correction poppler "Fix infinite recursion [CVE-2025-50420]">
<correction postfix "New upstream stable release; fix typo which caused recreation of cadir in chroot and excessive logging">
<correction presage "Prevent crash with apostrophes in completion suggestions">
<correction privatebin-cli "Fix connections to pastebins using GCM ciphers">
<correction proftpd-dfsg "Don't remove /srv/ftp on package purge">
<correction puppet-module-puppetlabs-rabbitmq "Fix list_users provider; setup all nodes as disk nodes">
<correction puppet-module-tempest "Fix autoloading of openstack provider">
<correction python-eventlet "Fix HTTP request smuggling by discarding HTTP chunk trailers [CVE-2025-58068]">
<correction qemu "New upstream stable release; fix denial of service issue [CVE-2024-8354]; fix wrong emulation of FIBMAP and FIGETBSZ ioctls">
<correction qt6-base "Fix high CPU usage of kwin_x11 on screen lock (X11)">
<correction quicktext "New upstream version to support newer Thunderbird releases">
<correction rabbitmq-server "Fix logging on sensitive data [CVE-2025-50200]">
<correction riseup-vpn "Add dependency on qml6-module-qtcore">
<correction rocm-hipamd "Fix linking for programs that include &lt;hip/hip_bf16.h&gt; in more than one translation unit; fix spelling error in roc-obj-ls manpage">
<correction rsyslog-doc "Switch documentation theme to sphinx_rtd_theme">
<correction ruby-sys-filesystem "Fix detection of 64-bit OS on s390x and alpha">
<correction rust-virtiofsd "Add missing dependency on uidmap">
<correction sail "Fix memory corruption issues [CVE-2025-32468 CVE-2025-35984 CVE-2025-46407 CVE-2025-50129 CVE-2025-52456 CVE-2025-52930 CVE-2025-53085 CVE-2025-53510]">
<correction samba "New upstream stable release; fix uninitialized memory disclosure issue [CVE-2025-9640], command injection issue [CVE-2025-10230]">
<correction samhain "Disable dnmalloc, preventing possible segfaults">
<correction spip "Fix open redirect issue on AJAX login form">
<correction stardict "Split plugin in to a new stardict-plugin-network-dictionary package; disable stardict_dictdotcn.so plugin">
<correction suricata "Fix uncontrolled memory use issue [CVE-2025-53538]; fix detection bypass issue [CVE-2025-59147]">
<correction syslog-ng "Disable writing of log statistics by default">
<correction systemd "New upstream stable release; fix DNS-over-TLS handling in systemd-resolved; improve service and unit lifecycle stability; handle TPM2 and pcrlock corner cases; update documentation; refresh hwdb data; sync with Linux UAPI headers">
<correction systemd-boot-efi-amd64-signed "New upstream stable release; fix DNS-over-TLS handling in systemd-resolved; improve service and unit lifecycle stability; handle TPM2 and pcrlock corner cases; update documentation; refresh hwdb data; sync with Linux UAPI headers">
<correction systemd-boot-efi-arm64-signed "New upstream stable release; fix DNS-over-TLS handling in systemd-resolved; improve service and unit lifecycle stability; handle TPM2 and pcrlock corner cases; update documentation; refresh hwdb data; sync with Linux UAPI headers">
<correction tango "Fix broken communication between versions 9 and 10">
<correction tbsync "New upstream version to support newer Thunderbird releases">
<correction ublock-origin "New upstream release; improve user experience and add new filter capabilities">
<correction virt-manager "Fix <q>Browse local</q> function">
<correction watcher "Fix information disclosure issue">
<correction wike "Set a User Agent, to ensure that the mobile version of Wikipedia is used">
<correction wtmpdb "Rotate and prune logs using logrotate; store logs in system log directory">
<correction xnote "New upstream version to support newer Thunderbird releases">
<correction xorg "Fix login failure with sessions using multiple words in invocation">
<correction xssproxy "Fix compatibility with Chromium and xdg-desktop-portal-gtk">
</table>


<h2>Atualizações de segurança</h2>

<p>Esta revisão adiciona as seguintes atualizações de segurança para a versão
estável (stable).
A equipe de segurança já lançou um aviso para cada uma dessas atualizações:</p>

<table border=0>
<tr><th>ID do aviso</th>  <th>Pacote</th></tr>
<dsa 2025 5979 libxslt>
<dsa 2025 5993 chromium>
<dsa 2025 5994 shibboleth-sp>
<dsa 2025 5995 hsqldb1.8.0>
<dsa 2025 5996 chromium>
<dsa 2025 5997 imagemagick>
<dsa 2025 5998 cups>
<dsa 2025 5999 libjson-xs-perl>
<dsa 2025 6000 libcpanel-json-xs-perl>
<dsa 2025 6001 cjson>
<dsa 2025 6002 node-sha.js>
<dsa 2025 6003 firefox-esr>
<dsa 2025 6004 chromium>
<dsa 2025 6005 jetty9>
<dsa 2025 6006 jetty12>
<dsa 2025 6007 ffmpeg>
<dsa 2026 6008 linux-signed-amd64>
<dsa 2026 6008 linux-signed-arm64>
<dsa 2025 6008 linux>
<dsa 2025 6010 chromium>
<dsa 2025 6012 nncp>
<dsa 2025 6013 node-tar-fs>
<dsa 2025 6014 gimp>
<dsa 2025 6015 openssl>
<dsa 2025 6016 chromium>
<dsa 2025 6017 haproxy>
<dsa 2025 6018 gegl>
<dsa 2025 6019 dovecot>
<dsa 2025 6020 redis>
<dsa 2025 6021 chromium>
<dsa 2025 6022 valkey>
<dsa 2025 6023 tiff>
<dsa 2025 6024 ghostscript>
<dsa 2025 6025 firefox-esr>
<dsa 2025 6026 chromium>
<dsa 2025 6027 incus>
<dsa 2025 6028 lxd>
<dsa 2025 6030 intel-microcode>
<dsa 2025 6031 request-tracker5>
<dsa 2025 6033 bind9>
<dsa 2025 6034 tryton-sao>
<dsa 2025 6035 python-internetarchive>
<dsa 2025 6036 chromium>
<dsa 2025 6037 openjdk-21>
<dsa 2025 6039 openjdk-25>
<dsa 2025 6040 thunderbird>
<dsa 2026 6042 evolution>
<dsa 2025 6042 webkit2gtk>
<dsa 2025 6044 xorg-server>
<dsa 2025 6045 pdns-recursor>
<dsa 2025 6046 chromium>
<dsa 2025 6047 squid>
<dsa 2025 6048 ruby-rack>
<dsa 2025 6049 gimp>
<dsa 2025 6050 chromium>
</table>


<h2>Pacotes removidos</h2>

<p>Os seguintes pacotes foram removidos por circunstâncias fora de nosso
controle:</p>

<table border=0>
<tr><th>Pacote</th>               <th>Justificativa</th></tr>
<correction rust-profiling-procmacros "Unused">
</table>


<h2>Instalador do Debian</h2>

<p>O instalador foi atualizado para incluir as correções incorporadas
na versão estável (stable) pela versão pontual.</p>


<h2>URLs</h2>

<p>As listas completas dos pacotes que foram alterados por esta revisão:</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/<downcase <codename>>/ChangeLog">
</div>

<p>A atual versão estável (stable):</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/stable/">
</div>

<p>Atualizações propostas (proposed updates) para a versão estável (stable):</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/proposed-updates">
</div>

<p>Informações da versão estável (stable) (notas de lançamento, errata, etc):</p>

<div class="center">
  <a
  href="$(HOME)/releases/stable/">https://www.debian.org/releases/stable/</a>
</div>

<p>Anúncios de segurança e informações:</p>

<div class="center">
  <a href="$(HOME)/security/">https://www.debian.org/security/</a>
</div>


<h2>Sobre o Debian</h2>

<p>O projeto Debian é uma associação de desenvolvedores(as) de Software Livre
que dedicam seu tempo e esforço como voluntários(as) para produzir o sistema
operacional completamente livre Debian.</p>


<h2>Informações de contato</h2>

<p>Para mais informações, por favor visite as páginas web do Debian em
<a href="$(HOME)/">https://www.debian.org/</a>, envie um e-mail (em inglês) para
&lt;[email protected]&gt;, ou entre em contato (em inglês) com a equipe de
lançamento da versão estável (stable) em
&lt;[email protected]&gt;.</p>