[RFR] wml://publicity/announcements/pt/2026/{20260110,2026011002}.wml

<define-tag pagetitle>Atualização Debian 13: 13.3 lançado</define-tag>
<define-tag release_date>2026-01-10</define-tag>
#use wml::debian::news
# $Id:

<define-tag release>13</define-tag>
<define-tag codename>trixie</define-tag>
<define-tag revision>13.3</define-tag>

<define-tag dsa>
    <tr><td align="center"><a href="$(HOME)/security/%0/dsa-%1">DSA-%1</a></td>
        <td align="center"><:
    my @p = ();
    for my $p (split (/,\s*/, "%2")) {
	push (@p, sprintf ('<a href="https://packages.debian.org/src:%s">%s</a>', $p, $p));
    }
    print join (", ", @p);
:></td></tr>
</define-tag>

<define-tag correction>
    <tr><td><a href="https://packages.debian.org/src:%0">%0</a></td>              <td>%1</td></tr>
</define-tag>

<define-tag srcpkg><a href="https://packages.debian.org/src:%0">%0</a></define-tag>

<p>O projeto Debian está feliz em anunciar a terceira atualização de sua
versão estável (stable) do Debian <release> (codinome <q><codename></q>).
Esta versão pontual adiciona principalmente correções para problemas de
segurança, além de pequenos ajustes para problemas mais sérios. Avisos de
segurança já foram publicados em separado e são referenciados quando
necessário.</p>

<p>Por favor, note que a versão pontual não constitui uma nova versão do Debian
<release>, mas apenas atualiza alguns dos pacotes já incluídos. Não há
necessidade de jogar fora as antigas mídias da <q><codename></q>. Após a
instalação, os pacotes podem ser atualizados para as versões atuais usando um
espelho atualizado do Debian.</p>

<p>Aquelas pessoas que frequentemente instalam atualizações a partir de
security.debian.org não terão que atualizar muitos pacotes, e a maioria de tais
atualizações estão incluídas na versão pontual.</p>

<p>Novas imagens de instalação logo estarão disponíveis nos locais
habituais.</p>

<p>A atualização de uma instalação existente para esta revisão pode ser feita
apontando o sistema de gerenciamento de pacotes para um dos muitos espelhos
HTTP do Debian. Uma lista abrangente de espelhos está disponível em:</p>

<div class="center">
  <a href="$(HOME)/mirror/list">https://www.debian.org/mirror/list</a>
</div>


<h2>Correções gerais de bugs</h2>

<p>Esta atualização da versão estável (stable) adiciona algumas correções
importantes para os seguintes pacotes:</p>

<table border=0>
<tr><th>Pacote</th>               <th>Justificativa</th></tr>
<correction ansible "New upstream stable release">
<correction apache2 "New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200]">
<correction at-spi2-core "Ensure xkb group is taken into account for key events">
<correction awffull "Fix systemd timer invocation to avoid premature cron-script exit">
<correction base-files "Update for the point release">
<correction bash "Rebuild with updated glibc">
<correction bglibs "Rebuild with updated glibc">
<correction busybox "Rebuild with updated glibc">
<correction calibre "Fix FB2 embedded binary handling in conversion plugin [CVE-2025-64486]">
<correction catatonit "Rebuild with updated glibc">
<correction cdebootstrap "Rebuild with updated glibc">
<correction chkrootkit "Rebuild with updated glibc">
<correction cloud-init "Ensure deb822 sources.list template renders correctly">
<correction composer "Fix ANSI sequence injection [CVE-2025-67746]">
<correction condor "Rebuild with updated glibc">
<correction cups-filters "Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524]">
<correction dar "Rebuild with updated curl, glibc, openssl">
<correction debian-installer "Increase Linux kernel ABI to 6.12.63+deb13; rebuild against proposed updates">
<correction debian-installer-netboot-images "Rebuild against proposed-updates">
<correction debian-security-support "Mark hdf5 and zabbix as receiving limited support; mark wpewebkit as unsupported">
<correction debos "Move systemd-resolved from Recommends to Depends">
<correction dgit "git-debrebase: use different directory for nested workareas">
<correction dhcpcd "Re-enable ntp_servers option by default">
<correction diffoscope "Fix tests when ukify is newer">
<correction distribution-gpg-keys "Update included keys">
<correction distrobuilder "Rebuild with updated containerd, incus">
<correction docker.io "Rebuild with updated containerd, glibc">
<correction dpdk "New upstream stable release">
<correction e2fsprogs "Rebuild with updated glibc">
<correction edk2 "Fix timing side-channel issue in ECDSA signature computation [CVE-2024-13176]; fix out-of-bounds memory access issue [CVE-2024-38805]; fix code execution issue [CVE-2025-3770]">
<correction exfatprogs "Ensure mkfs.exfat defaults to 512-byte sectors for Windows compatibility">
<correction extrepo-data "Update repository information; fix handling for future Debian releases">
<correction flatpak "New upstream stable release">
<correction fpdf2 "Fix use of variable fonts">
<correction freedombox "distupgrade: Handle comments in sources.list file; update trixie's release date; backups: Set proper permissions for backups-data directory [CVE-2025-68462]">
<correction freeradius "Fix TLS verification segfault when certificate chains include multiple intermediate certificates">
<correction glib2.0 "Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]">
<correction glibc "Fix a double lock init issue after fork(); fix SYSCALL_CANCEL for return values larger than INT_MAX; fix crash in ifunc functions on arm64 when hardening with -ftrivial-auto-var-init=zero; fix _dl_find_object when ld.so has LOAD segment gaps, causing wrong backtrace unwinding; optimize inverse trig function, SVE exp, hyperbolic, and log1p functions on arm64">
<correction gnome-shell "New upstream bugfix release">
<correction gnupg2 "Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename; rebuild with updated glibc">
<correction gnutls28 "Fix PKCS#11 token label bounds in gnutls_pkcs11_token_init [CVE-2025-9820]; initialise PKCS#11 modules in thread-safe mode with fallback">
<correction golang-github-awslabs-soci-snapshotter "Rebuild with updated containerd">
<correction golang-github-containerd-imgcrypt "Rebuild with updated containerd">
<correction golang-github-containerd-nydus-snapshotter "Rebuild with updated containerd">
<correction golang-github-containerd-stargz-snapshotter "Rebuild with updated containerd">
<correction golang-github-containers-buildah "Rebuild with updated containerd">
<correction golang-github-openshift-imagebuilder "Rebuild with updated containerd">
<correction imagemagick "Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]">
<correction incus "Fix AppArmor profile generation for nested containers">
<correction integrit "Rebuild with updated glibc">
<correction intel-microcode "Update Intel processor microcode to 20251111">
<correction iperf3 "Fix authentication RSA encryption buffer length initialisation for OpenSSL 3.5.3+; avoid build failures with newer OpenSSL">
<correction kleopatra "Fix failure to start with a file argument on GNOME">
<correction libcap2 "Rebuild with updated glibc">
<correction libcoap3 "Fix configuration file parsing issue [CVE-2025-59391]; fix NULL pointer dereference issues [CVE-2025-65493 CVE-2025-65494 CVE-2025-65496 CVE-2025-65497 CVE-2025-65498 CVE-2025-65500 CVE-2025-65501]; fix integer signedness issue [CVE-2025-65495]; fix array index error issue [CVE-2025-65499]">
<correction libcupsfilters "Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]">
<correction libphp-adodb "Fix SQL injection issue in sqlite(3) drivers [CVE-2025-54119]">
<correction libreoffice "Set Bulgaria locale default currency to EUR">
<correction libvirt "Perform ACL checks earlier, preventing malicious users from potentially being able to crash the daemon [CVE-2025-12748]; ensure that newly-created snapshots are not world-readable [CVE-2025-13193]; apply the detect_zeroes settings across all layers of the backing chain instead of just the topmost one">
<correction linux "New upstream stable release">
<correction linux-signed-amd64 "New upstream stable release">
<correction linux-signed-arm64 "New upstream stable release">
<correction lua-wsapi "Fix Lua 5.1 support">
<correction lxc "Add lxc-net dependency to sysvinit script; stop printing misleading errors in enter_net_ns(); fix generation of apparmor.d/abstractions/lxc/container-base; fix restarting unprivileged containers">
<correction lxd "Fix broken idmapping with kernel 6.9+; tighten storage pool volume permissions [CVE-2025-64507]">
<correction matlab-support "Avoid renaming MATLAB vendored Vulkan/FreeType libraries">
<correction mbedtls "New upstream stable release; fix timing issues [CVE-2025-54764 CVE-2025-59438]">
<correction mirrorbits "Fix fallback redirects when Redis/file metadata is unavailable; normalise fallback mirror URLs to avoid malformed redirects">
<correction mongo-c-driver "Avoid invalid memory reads [CVE-2025-12119]">
<correction mutter "New upstream bugfix release">
<correction node-nodemailer "Fix addressparser recipient parsing for quoted nested addresses [CVE-2025-13033]">
<correction openconnect "Respect path in AnyConnect/OpenConnect XML form handling; fix failure to build with MinGW32/64; use RFC9266 'tls-exporter' channel bindings for Cisco STRAP with TLSv1.3">
<correction pgbouncer "Fix arbitary SQL execution issue [CVE-2025-12819]">
<correction podman "Rebuild with updated containerd">
<correction postgresql-17 "New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]">
<correction pylint-django "Fix use with new astroid">
<correction qemu "New upstream stable release; fix use after free issue [CVE-2025-11234]; fix buffer overflow issue [CVE-2025-12464]">
<correction qiv "Fix Wayland startup crash by forcing X11 GDK backend">
<correction r-bioc-beachmat "Fix test that depends on the <q>beachmat.hdf5</q> R package, which is not yet in Debian">
<correction r-cran-gh "Fix exposure of request headers in returned response objects [CVE-2025-54956]; ensure pagination passes authentication context explicitly; update tests and documentation">
<correction reform-tools "Fix building lpc with Linux &gt;= 6.17">
<correction rlottie "Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]">
<correction rsync "Fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]">
<correction rust-repro-env "Rebuild with updated rust-sequoia-openpgp">
<correction rust-ripasso-cursive "Rebuild with updated rust-sequoia-openpgp">
<correction rust-sequoia-chameleon-gnupg "Rebuild with updated rust-sequoia-openpgp">
<correction rust-sequoia-git "Rebuild with updated rust-sequoia-openpgp">
<correction rust-sequoia-keystore-server "Rebuild with updated rust-sequoia-openpgp">
<correction rust-sequoia-octopus-librnp "Rebuild with updated rust-sequoia-openpgp">
<correction rust-sequoia-openpgp "Fix buffer underflow in aes_key_unwrap [CVE-2025-67897]">
<correction rust-sequoia-sop "Rebuild with updated rust-sequoia-openpgp">
<correction rust-sequoia-sq "Rebuild with updated rust-sequoia-openpgp">
<correction rust-sequoia-sqv "Rebuild with updated rust-sequoia-openpgp">
<correction sash "Rebuild with updated glibc">
<correction sbuild "Explicitly select the sbuild-build-depends-main-dummy package architecture; preserve TMPDIR when running autopkgtest; lib/Sbuild/Build.pm: preserve TMPDIR for piuparts; obey $TMPDIR for autopkgtest dsc mkdtemp">
<correction snapd "Rebuild with updated glibc">
<correction sogo "Fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]">
<correction suricata "Fix verdict logging bounds checks [CVE-2025-64330]; fix various logging stack overflows [CVE-2025-64331 CVE-2025-64332 CVE-2025-64333 CVE-2025-64344]">
<correction survex "Fix the width of the <q>find stations</q> search box to make it actually usable again">
<correction swupdate "Fix suricatta reboot-mode signalling via progress interface">
<correction symfony "Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries">
<correction tini "Rebuild with updated glibc">
<correction tripwire "Rebuild with updated glibc">
<correction tsocks "Rebuild with updated glibc">
<correction tzsetup "Fix timezone for Argentina and Ukraine">
<correction user-mode-linux "Rebuild with Linux 6.12.63-1">
<correction yorick-gy "Fix GIR module version loading for Gtk/Gdk; switch to multiarch-friendly libgirepository-1.0-dev build-dependency; incorporate GCC-14/15 build fixes; update watch file and metadata">
<correction zsh "Rebuild with updated glibc, pcre">
</table>


<h2>Atualizações de segurança</h2>

<p>Esta revisão adiciona as seguintes atualizações de segurança para a versão
estável (stable).
A equipe de segurança já lançou um aviso para cada uma dessas atualizações:</p>

<table border=0>
<tr><th>ID do aviso</th>  <th>Pacote</th></tr>
<dsa 2025 6041 strongswan>
<dsa 2025 6051 incus>
<dsa 2025 6052 rust-sudo-rs>
<dsa 2025 6055 chromium>
<dsa 2025 6056 keystone>
<dsa 2025 6056 swift>
<dsa 2025 6058 lasso>
<dsa 2025 6059 thunderbird>
<dsa 2025 6060 chromium>
<dsa 2025 6061 tryton-sao>
<dsa 2025 6062 pdfminer>
<dsa 2025 6063 kdeconnect>
<dsa 2025 6064 tryton-server>
<dsa 2025 6065 krita>
<dsa 2025 6066 gnome-shell-extension-gsconnect>
<dsa 2025 6067 containerd>
<dsa 2025 6068 xen>
<dsa 2025 6069 openvpn>
<dsa 2025 6070 webkit2gtk>
<dsa 2025 6071 unbound>
<dsa 2025 6072 chromium>
<dsa 2025 6073 ffmpeg>
<dsa 2025 6074 webkit2gtk>
<dsa 2025 6076 libpng1.6>
<dsa 2025 6077 pdns-recursor>
<dsa 2025 6080 chromium>
<dsa 2025 6081 thunderbird>
<dsa 2025 6082 vlc>
<dsa 2025 6083 webkit2gtk>
<dsa 2025 6084 c-ares>
<dsa 2025 6085 mediawiki>
<dsa 2025 6086 dropbear>
<dsa 2025 6087 roundcube>
<dsa 2025 6089 chromium>
<dsa 2025 6090 rails>
<dsa 2025 6091 wordpress>
<dsa 2026 6092 smb4k>
</table>


<h2>Instalador do Debian</h2>

<p>O instalador foi atualizado para incluir as correções incorporadas
na versão estável (stable) pela versão pontual.</p>


<h2>URLs</h2>

<p>As listas completas dos pacotes que foram alterados por esta revisão:</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/<downcase <codename>>/ChangeLog">
</div>

<p>A atual versão estável (stable):</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/stable/">
</div>

<p>Atualizações propostas (proposed updates) para a versão estável (stable):</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/proposed-updates">
</div>

<p>Informações da versão estável (stable) (notas de lançamento, errata, etc):</p>

<div class="center">
  <a
  href="$(HOME)/releases/stable/">https://www.debian.org/releases/stable/</a>
</div>

<p>Anúncios de segurança e informações:</p>

<div class="center">
  <a href="$(HOME)/security/">https://www.debian.org/security/</a>
</div>


<h2>Sobre o Debian</h2>

<p>O projeto Debian é uma associação de desenvolvedores(as) de Software Livre
que dedicam seu tempo e esforço como voluntários(as) para produzir o sistema
operacional completamente livre Debian.</p>


<h2>Informações de contato</h2>

<p>Para mais informações, por favor visite as páginas web do Debian em
<a href="$(HOME)/">https://www.debian.org/</a>, envie um e-mail (em inglês) para
&lt;[email protected]&gt;, ou entre em contato (em inglês) com a equipe de
lançamento da versão estável (stable) em
&lt;[email protected]&gt;.</p>

<define-tag pagetitle>Atualização Debian 12: 12.13 lançado</define-tag>
<define-tag release_date>2026-01-10</define-tag>
#use wml::debian::news
# $Id:

<define-tag release>12</define-tag>
<define-tag codename>bookworm</define-tag>
<define-tag revision>12.13</define-tag>

<define-tag dsa>
    <tr><td align="center"><a href="$(HOME)/security/%0/dsa-%1">DSA-%1</a></td>
        <td align="center"><:
    my @p = ();
    for my $p (split (/,\s*/, "%2")) {
	push (@p, sprintf ('<a href="https://packages.debian.org/src:%s">%s</a>', $p, $p));
    }
    print join (", ", @p);
:></td></tr>
</define-tag>

<define-tag correction>
    <tr><td><a href="https://packages.debian.org/src:%0">%0</a></td>              <td>%1</td></tr>
</define-tag>

<define-tag srcpkg><a href="https://packages.debian.org/src:%0">%0</a></define-tag>

<p>O projeto Debian está feliz em anunciar a décima terceira atualização de sua
versão estável (stable) do Debian <release> (codinome <q><codename></q>).
Esta versão pontual adiciona principalmente correções para problemas de
segurança, além de pequenos ajustes para problemas mais sérios. Avisos de
segurança já foram publicados em separado e são referenciados quando
necessário.</p>

<p>Por favor, note que a versão pontual não constitui uma nova versão do Debian
<release>, mas apenas atualiza alguns dos pacotes já incluídos. Não há
necessidade de jogar fora as antigas mídias do <q><codename></q>. Após a
instalação, os pacotes podem ser atualizados para as versões atuais usando um
espelho atualizado do Debian.</p>

<p>Aquelas pessoas que frequentemente instalam atualizações a partir de
security.debian.org não terão que atualizar muitos pacotes, e a maioria de tais
atualizações estão incluídas na versão pontual.</p>

<p>Novas imagens de instalação logo estarão disponíveis nos locais
habituais.</p>

<p>A atualização de uma instalação existente para esta revisão pode ser feita
apontando o sistema de gerenciamento de pacotes para um dos muitos espelhos
HTTP do Debian. Uma lista abrangente de espelhos está disponível em:</p>

<div class="center">
  <a href="$(HOME)/mirror/list">https://www.debian.org/mirror/list</a>
</div>


<h2>Correções gerais de bugs</h2>

<p>Esta atualização da versão estável (stable) adiciona algumas correções
importantes para os seguintes pacotes:</p>

<table border=0>
<tr><th>Pacote</th>               <th>Justificativa</th></tr>
<correction allow-html-temp "New upstream version to support newer Thunderbird releases">
<correction angular.js "Fix regular expression-based denial of service issues [CVE-2022-25844 CVE-2023-26116 CVE-2023-26117 CVE-2023-26118]; fix restriction bypass issues [CVE-2024-8372 CVE-2024-8373]; fix denial of service issue [CVE-2024-21490]; fix improper sanitization issues [CVE-2025-0716 CVE-2025-2336]">
<correction apache2 "New upstream stable release; fix integer overflow issue [CVE-2025-55753]; don't pass querystring to #exec directives [CVE-2025-58098]; fix improper parsing of environment variables [CVE-2025-65082]; fix mod_userdir+suexec bypass issue [CVE-2025-66200]">
<correction base-files "Update for the point release">
<correction bash "Rebuild with updated glibc">
<correction btrfs-progs "Device stats: fix printing wrong values in tabular output">
<correction busybox "Rebuild with updated glibc">
<correction c-icap-modules "Rebuild against libclamav12; disable clamav support on armel, mipsel and mips64el">
<correction calibre "Fix code execution issue [CVE-2025-64486]">
<correction cdebootstrap "Rebuild with updated glibc">
<correction chkrootkit "Rebuild with updated glibc">
<correction clamav "New upstream long term support release">
<correction composer "Fix ANSI sequence injection [CVE-2025-67746]">
<correction cups-filters "Fix TIFF parser bounds/validation issues [CVE-2025-57812]; clamp oversized PDF MediaBox-derived page size in pdftoraster [CVE-2025-64503]; avoid rastertopclx infinite loop and heap overflow on crafted raster input [CVE-2025-64524]">
<correction cyrus-imapd "Rebuild against libclamav12; disable clamav support on armel, mipsel and mips64el">
<correction dar "Rebuild with updated glibc">
<correction debian-installer "Increase Linux kernel ABI to 6.1.0-42; rebuild against oldstable-proposed-updates">
<correction debian-installer-netboot-images "Rebuild against oldstable-proposed-updates">
<correction debian-security-support "Mark hdf5, libsoup2.4, libsoup3 and zabbix as receiving limited support; mark dnsdist, pdns, pdns-recursor as unsupported">
<correction distro-info-data "Update bookworm EoL date; add Ubuntu 26.04 LTS <q>Resolute Raccoon</q>">
<correction docker.io "Rebuild with updated containerd, glibc">
<correction dpdk "New upstream stable release">
<correction e2guardian "Disable clamav support on armel, mipsel and mips64el">
<correction freerdp2 "New upstream release; fix multiple memory-safety vulnerabilities: integer overflow/underflow and out-of-bounds write in NSC, Clear, and GDI bitmap codecs [CVE-2024-22211 CVE-2024-32037 CVE-2024-32038 CVE-2024-32039 CVE-2024-32040]; out-of-bounds reads in ZGFX, Planar, NCRUSH, Interleaved, and RFX codecs [CVE-2024-32041 CVE-2024-32457 CVE-2024-32458 CVE-2024-32459 CVE-2024-32460]; invalid memory access in freerdp_peer_get_logon_info [CVE-2024-32661]; bounds-check and overflow fixes; update for GCC 14 / FFmpeg 7 build compatibility">
<correction gcc-bpf "Rebuild with updated glibc">
<correction gcc-or1k-elf "Rebuild with updated glibc">
<correction gcc-riscv64-unknown-elf "Rebuild with updated glibc">
<correction gcc-xtensa-lx106 "Rebuild with updated glibc">
<correction gdk-pixbuf "Fix buffer overflow issue [CVE-2025-7345]">
<correction ghdl "Rebuild with updated glibc">
<correction git "Fix arbitrary file creation/truncation in gitk [CVE-2025-27613]; prevent arbitrary file overwrite in git-gui with crafted directory names [CVE-2025-46835]; correct submodule path parsing with trailing CR [CVE-2025-48384]; validate bundle-uri to prevent protocol injection during clone [CVE-2025-48385]">
<correction glib2.0 "Fix various integer overflow issues [CVE-2025-13601 CVE-2025-14087 CVE-2025-14512]">
<correction gnupg2 "Avoid potential downgrade to SHA1 in 3rd party key signatures; error out on unverified output for non-detached signatures; fix possible memory corruption in the armor parser [CVE-2025-68973]; do not use a default when asking for another output filename">
<correction golang-github-containerd-stargz-snapshotter "Rebuild with updated containerd">
<correction golang-github-containers-buildah "Rebuild with updated containerd">
<correction golang-github-openshift-imagebuilder "Rebuild with updated containerd">
<correction imagemagick "Fix denial of service issues [CVE-2025-62594 CVE-2025-68618]; fix use-after-free issue [CVE-2025-65955]; fix integer overflow issues [CVE-2025-62171 CVE-2025-66628 CVE-2025-69204]; fix infinite loop issue [CVE-2025-68950]">
<correction intel-microcode "Update Intel processor microcode to 20251111">
<correction lemonldap-ng "Fix sessions tablename when not default; fix oidc flow when user encountered an error on server side; fix Kerberos JavaScript when used with <q>Choice</q>; improve CORS checking; fix path_info handling; fix shell injection issue [CVE-2025-59518]; hide session id from Ajax responses">
<correction libcap2 "Rebuild with updated glibc">
<correction libclamunrar "New upstream release, aligning with clamav 1.4.3">
<correction libcommons-lang-java "Fix uncontrolled recursion issue [CVE-2025-48924]">
<correction libcommons-lang3-java "Fix uncontrolled recursion issue [CVE-2025-48924]">
<correction libhtp "Fix denial of service issue via unbounded HTTP header processing [CVE-2024-23837 CVE-2024-45797]">
<correction libnginx-mod-http-lua "Fix HTTP HEAD request smuggling [CVE-2024-33452]">
<correction libphp-adodb "Fix SQL injection in sqlite and sqlite3 metadata lookups [CVE-2025-54119]">
<correction libpod "Rebuild with updated containerd">
<correction libreoffice "Set Bulgaria locale default currency to EUR">
<correction libssh "Fix integer overflow issue [CVE-2025-4877]; fix use of uninitialized variable [CVE-2025-4878]; fix out of bounds memory access issue [CVE-2025-5318]; fix double free issue [CVE-2025-5351]; fix use of uninitialized memory [CVE-2025-5372 CVE-2025-5987]; fix null pointer dereference issue [CVE-2025-8114]; fix memory leak [CVE-2025-8277]">
<correction libxml2 "Fix denial of service issue [CVE-2025-9714]">
<correction libyaml-syck-perl "Fix memory corruption leading to <q>str</q> value being set on empty keys">
<correction linux "New upstream stable release">
<correction linux-signed-amd64 "New upstream stable release">
<correction linux-signed-arm64 "New upstream stable release">
<correction linux-signed-i386 "New upstream stable release">
<correction log4cxx "Fix improper escaping issues [CVE-2025-54812 CVE-2025-54813]">
<correction luksmeta "Fix data corruption issue with LUKS1 [CVE-2025-11568]">
<correction modsecurity-apache "Fix request body error handling to propagate Apache filter/read failures correctly [CVE-2025-54571]; map request body read failures to appropriate HTTP status codes; simplify request body error propagation in mod_security2">
<correction mongo-c-driver "Avoid invalid memory reads [CVE-2025-12119]">
<correction mydumper "Fix arbitrary file read issue [CVE-2025-30224]">
<correction nvidia-graphics-drivers "New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]">
<correction nvidia-open-gpu-kernel-modules "New upstream bugfix release [CVE-2025-23279 CVE-2025-23286]">
<correction onetbb "Fix build failure on single-CPU and CI environments by skipping problematic tests">
<correction open-vm-tools "Disable SDMP service version collection by default to mitigate local privilege escalation [CVE-2025-41244]">
<correction openrefine "Fix MySQL host parameter injection in JDBC URL parsing [CVE-2024-23833]; fix reflected XSS in gdata OAuth callback handler [CVE-2024-47878]; fix content-type confusion XSS in ExportRows endpoint [CVE-2024-47880]; prevent remote or extension loading via SQLite connection URL [CVE-2024-47881]; escape HTML in error stack traces [CVE-2024-47882]; prevent path traversal in language file loading [CVE-2024-49760]">
<correction openssl "New upstream stable release">
<correction pam "Fix local privilege escalation in pam_namespace [CVE-2025-6020]">
<correction pg-snakeoil "Rebuild against libclamav12">
<correction pgbouncer "Fix arbitary SQL execution issue [CVE-2025-12819]; fix expired password use issue [CVE-2025-2291]">
<correction postgresql-15 "New upstream stable release; check for CREATE privileges on the schema in CREATE STATISTICS [CVE-2025-12817]; avoid integer overflow in allocation-size calculations within libpq [CVE-2025-12818]">
<correction qemu "New upstream stable release; fix <q>qemu-img info https://example.com</q>; fix migration of guests using virtio-net; fix use after free issue [CVE-2025-11234]">
<correction qpwgraph "Add missing dependency on libqt6svg6">
<correction r-cran-gh "Fix sensitive data leak issue [CVE-2025-54956]">
<correction rear "Prevent created initrd from being world-readable when GRUB_RESCUE=y [CVE-2024-23301]">
<correction rescue "Improve btrfs support">
<correction rlottie "Fix outlying coordinate rejection in FreeType rasteriser [CVE-2025-0634 CVE-2025-53074 CVE-2025-53075]">
<correction rsync "Improve test coverage for future updates; fix out-of-bounds read via negative array index in sender file list handling [CVE-2025-10158]">
<correction ruby-sinatra "Fix regular expression-based denial of service issue [CVE-2025-61921]">
<correction samba "Fix information leak issue [CVE-2018-14628]; fix command injection issue [CVE-2025-10230]; fix uninitialized memory disclosure issue [CVE-2025-9640]">
<correction sash "Rebuild with updated glibc">
<correction shadow "Fix segmentation fault in groupmod">
<correction skeema "Rebuild with updated containerd">
<correction snapd "Rebuild with updated containerd">
<correction sogo "Fix HTML injection issue [CVE-2023-48104]; fix CSS injection issue [CVE-2024-24510]; fix cross-site scripting issues [CVE-2025-63498 CVE-2025-63499]; fix crash on invalid mailIdentities">
<correction squid "Fix denial of service issue [CVE-2023-46728]; fix mishandling of long SNMP OIDs in ASN.1 [CVE-2025-59362]; disable ESI feature support, fixing several issues [CVE-2024-45802]; remove Gopher support">
<correction sudo "Enable Intel CET on amd64 only">
<correction supermin "Rebuild with updated glibc">
<correction symfony "Fix PATH_INFO parsing [CVE-2025-64500]; drop failing Finder testsuite data entries">
<correction syslog-ng "Fix incorrect wildcard matching in certificate names [CVE-2024-47619]">
<correction tripwire "Rebuild with updated glibc">
<correction u-boot "Fix integer overflow issues [CVE-2024-57254 CVE-2024-57255 CVE-2024-57256 CVE-2024-57258]; fix stack consumption issue [CVE-2024-57257]; fix heap corruption issue [CVE-2024-57259]">
<correction ublock-origin "New upstream release; improve user experience and add new filter capabilities; fix denial of service issue [CVE-2025-4215]">
<correction unbound "Fix denial of service issue [CVE-2024-33655]; fix possible domain hijack issue [CVE-2025-11411]; fix <q>unbound-anchor cannot deal with full disk</q>; fix potential amplification DDoS attacks; fix incorrect return of NODATA for some ANY queries">
<correction user-mode-linux "Rebuild with updated linux">
<correction vtk9 "Fix inability to read VTK XML files with appended data on newer expat">
<correction zsh "Rebuild with updated glibc, libcap2">
</table>


<h2>Atualizações de segurança</h2>

<p>Esta revisão adiciona as seguintes atualizações de segurança para a versão
estável (stable).
A equipe de segurança já lançou um aviso para cada uma dessas atualizações:</p>

<table border=0>
<tr><th>ID do aviso</th>  <th>Pacote</th></tr>
<dsa 2025 5979 libxslt>
<dsa 2025 5993 chromium>
<dsa 2025 5994 shibboleth-sp>
<dsa 2025 5996 chromium>
<dsa 2025 5997 imagemagick>
<dsa 2025 5998 cups>
<dsa 2025 5999 libjson-xs-perl>
<dsa 2025 6000 libcpanel-json-xs-perl>
<dsa 2025 6001 cjson>
<dsa 2025 6002 node-sha.js>
<dsa 2025 6003 firefox-esr>
<dsa 2025 6004 chromium>
<dsa 2025 6005 jetty9>
<dsa 2025 6009 linux-signed-amd64>
<dsa 2025 6009 linux-signed-arm64>
<dsa 2025 6009 linux-signed-i386>
<dsa 2025 6009 linux>
<dsa 2025 6010 chromium>
<dsa 2025 6012 nncp>
<dsa 2025 6013 node-tar-fs>
<dsa 2025 6015 openssl>
<dsa 2025 6016 chromium>
<dsa 2025 6017 haproxy>
<dsa 2025 6018 gegl>
<dsa 2025 6020 redis>
<dsa 2025 6021 chromium>
<dsa 2025 6023 tiff>
<dsa 2025 6024 ghostscript>
<dsa 2025 6025 firefox-esr>
<dsa 2025 6026 chromium>
<dsa 2025 6028 lxd>
<dsa 2025 6029 ark>
<dsa 2025 6030 intel-microcode>
<dsa 2025 6031 request-tracker5>
<dsa 2025 6032 request-tracker4>
<dsa 2025 6033 bind9>
<dsa 2025 6034 tryton-sao>
<dsa 2025 6035 python-internetarchive>
<dsa 2025 6036 chromium>
<dsa 2025 6038 openjdk-17>
<dsa 2025 6040 thunderbird>
<dsa 2025 6041 strongswan>
<dsa 2025 6042 evolution>
<dsa 2025 6042 webkit2gtk>
<dsa 2025 6043 gimp>
<dsa 2025 6044 xorg-server>
<dsa 2025 6046 chromium>
<dsa 2025 6047 squid>
<dsa 2025 6048 ruby-rack>
<dsa 2025 6049 gimp>
<dsa 2025 6050 chromium>
<dsa 2025 6053 linux-signed-amd64>
<dsa 2025 6053 linux-signed-arm64>
<dsa 2025 6053 linux-signed-i386>
<dsa 2025 6053 linux>
<dsa 2025 6054 firefox-esr>
<dsa 2025 6055 chromium>
<dsa 2025 6056 keystone>
<dsa 2025 6056 swift>
<dsa 2025 6057 lxd>
<dsa 2025 6058 lasso>
<dsa 2025 6059 thunderbird>
<dsa 2025 6060 chromium>
<dsa 2025 6061 tryton-sao>
<dsa 2025 6062 pdfminer>
<dsa 2025 6064 tryton-server>
<dsa 2025 6065 krita>
<dsa 2025 6067 containerd>
<dsa 2025 6068 xen>
<dsa 2025 6069 openvpn>
<dsa 2025 6070 webkit2gtk>
<dsa 2025 6072 chromium>
<dsa 2025 6074 webkit2gtk>
<dsa 2025 6075 wordpress>
<dsa 2025 6076 libpng1.6>
<dsa 2025 6078 firefox-esr>
<dsa 2025 6079 ffmpeg>
<dsa 2025 6080 chromium>
<dsa 2025 6081 thunderbird>
<dsa 2025 6082 vlc>
<dsa 2025 6083 webkit2gtk>
<dsa 2025 6085 mediawiki>
<dsa 2025 6087 roundcube>
<dsa 2025 6089 chromium>
<dsa 2025 6090 rails>
</table>


<h2>Pacotes removidos</h2>

<p>Os seguintes pacotes foram removidos por circunstâncias fora de nosso
controle:</p>

<table border=0>
<tr><th>Pacote</th>               <th>Justificativa</th></tr>
<correction clamav "[armel mipsel mips64el] No longer supportable on architectures without newer Rust support">
<correction clamsmtp "[armel mipsel mips64el] Depends on to-be-removed clamav">
<correction libc-icap-mod-virus-scan "[armel mipsel mips64el] Depends on to-be-removed clamav">
<correction libclamunrar "[armel mipsel mips64el] Depends on to-be-removed clamav">
<correction pagure "Broken, security issues">
<correction pg-snakeoil "[armel mipsel mips64el] Depends on to-be-removed clamav">
</table>


<h2>Instalador do Debian</h2>

<p>O instalador foi atualizado para incluir as correções incorporadas
na versão estável (stable) pela versão pontual.</p>


<h2>URLs</h2>

<p>As listas completas dos pacotes que foram alterados por esta revisão:</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/<downcase <codename>>/ChangeLog">
</div>

<p>A atual versão estável (stable):</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/stable/">
</div>

<p>Atualizações propostas (proposed updates) para a versão estável (stable):</p>

<div class="center">
  <url "https://deb.debian.org/debian/dists/proposed-updates">
</div>

<p>Informações da versão estável (stable) (notas de lançamento, errata, etc):</p>

<div class="center">
  <a
  href="$(HOME)/releases/stable/">https://www.debian.org/releases/stable/</a>
</div>

<p>Anúncios de segurança e informações:</p>

<div class="center">
  <a href="$(HOME)/security/">https://www.debian.org/security/</a>
</div>


<h2>Sobre o Debian</h2>

<p>O projeto Debian é uma associação de desenvolvedores(as) de Software Livre
que dedicam seu tempo e esforço como voluntários(as) para produzir o sistema
operacional completamente livre Debian.</p>


<h2>Informações de contato</h2>

<p>Para mais informações, por favor visite as páginas web do Debian em
<a href="$(HOME)/">https://www.debian.org/</a>, envie um e-mail (em inglês) para
&lt;[email protected]&gt;, ou entre em contato (em inglês) com a equipe de
lançamento da versão estável (stable) em
&lt;[email protected]&gt;.</p>