| Newsgroups |
gmane.linux.debian.user.announce |
| Message-ID |
<[email protected]> |
--=-VHgSmODdTZEKeilR03rD
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
------------------------------------------------------------------------
The Debian Project https://www.debian.org/
Updated Debian 13: 13.5 released [email protected]
May 16th, 2026 https://www.debian.org/News/2026/20260516
------------------------------------------------------------------------
The Debian project is pleased to announce the fifth update of its stable
distribution Debian 13 (codename "trixie"). This point release mainly
adds corrections for security issues, along with a few adjustments for
serious problems. Security advisories have already been published
separately and are referenced where available.
Please note that the point release does not constitute a new version of
Debian 13 but only updates some of the packages included. There is no
need to throw away old "trixie" media. After installation, packages can
be upgraded to the current versions using an up-to-date Debian mirror.
Those who frequently install updates from security.debian.org won't have
to update many packages, and most such updates are included in the point
release.
New installation images will be available soon at the regular locations.
Upgrading an existing installation to this revision can be achieved by
pointing the package management system at one of Debian's many HTTP
mirrors. A comprehensive list of mirrors is available at:
https://www.debian.org/mirror/list
Miscellaneous Bugfixes
----------------------
This stable update adds a few important corrections to the following
packages:
+-----------------------+---------------------------------------------+
| Package | Reason |
+-----------------------+---------------------------------------------+
| 389-ds-base=C2=A0[1] | Fix heap overflow issue [CVE-2025-14905] =
|
| | |
| 7zip=C2=A0[2] | Relax Breaks / Replaces versions to ease =
|
| | upgrades from bookworm |
| | |
| apache2=C2=A0[3] | New upstream stable release; fix use-after- =
|
| | free issue [CVE-2026-23918]; fix privilege |
| | escalation issue [CVE-2026-24072]; fix NULL |
| | pointer dereference issues [CVE-2026-29169 |
| | CVE-2026-33007]; fix authentication bypass |
| | issue [CVE-2026-33006]; fix HTTP response |
| | splitting issue [CVE-2026-33523]; fix out- |
| | of-bounds read issues [CVE-2026-33857 |
| | CVE-2026-34032]; fix buffer over-read issue |
| | [CVE-2026-34059] |
| | |
| awstats=C2=A0[4] | Prevent command injection [CVE-2025-63261] =
|
| | |
| base-files=C2=A0[5] | Update for the point release =
|
| | |
| bash=C2=A0[6] | Rebuild with updated glibc =
|
| | |
| beads=C2=A0[7] | Rebuild with updated cimg =
|
| | |
| bepasty=C2=A0[8] | Fix loading pygments CSS =
|
| | |
| bglibs=C2=A0[9] | Rebuild with updated glibc =
|
| | |
| bird2=C2=A0[10] | ASPA: Fix downstream validation; BGP: Fix =
|
| | restart behavior on reconfiguration; |
| | filters: Fix string attributes; logging: |
| | Fix error handling |
| | |
| black=C2=A0[11] | Fix arbitrary file write issue [CVE-2026- =
|
| | 32274] |
| | |
| bubblewrap=C2=A0[12] | Fix privilege escalation issue [CVE-2026- =
|
| | 41163] |
| | |
| busybox=C2=A0[13] | Rebuild with updated glibc =
|
| | |
| calibre=C2=A0[14] | Fix path traversal issues [CVE-2026-25635 =
|
| | CVE-2026-25636 CVE-2026-26064 CVE-2026- |
| | 26065]; fix code execution issue [CVE-2026- |
| | 25731]; fix HTTP response header injection |
| | issue [CVE-2026-27810]; fix IP ban bypass |
| | issue [CVE-2026-27824] |
| | |
| catatonit=C2=A0[15] | Rebuild with updated glibc =
|
| | |
| cdebootstrap=C2=A0[16] | Rebuild with updated glibc =
|
| | |
| chkrootkit=C2=A0[17] | Rebuild with updated glibc =
|
| | |
| cimg=C2=A0[18] | Fix overflow issue [CVE-2026-42144]; fix =
|
| | out of memory issue with crafted files |
| | [CVE-2026-42146] |
| | |
| cockpit=C2=A0[19] | Fix code execution issue [CVE-2026-4631] =
|
| | |
| composer=C2=A0[20] | Fix command injection issues [CVE-2026- =
|
| | 40261 CVE-2026-40176] |
| | |
| condor=C2=A0[21] | Rebuild with updated glibc =
|
| | |
| curl=C2=A0[22] | Fix server certificate verification issue =
|
| | [CVE-2025-13034] |
| | |
| dar=C2=A0[23] | Rebuild with updated glibc, libcap2, =
|
| | openssl |
| | |
| debian-installer=C2=A0[24] | Bump linux ABI to 6.12.86+deb13 =
|
| | |
| debian-installer- | Rebuild against proposed-updates |
| netboot-images=C2=A0[25] | =
|
| | |
| debmirror=C2=A0[26] | Add debmirror-specific User-Agent header =
|
| | |
| distribution-gpg- | Update included keys |
| keys=C2=A0[27] | =
|
| | |
| distro-info-data=C2=A0[28] | Add Ubuntu 26.10 "Stonking Stingray" =
|
| | |
| distrobuilder=C2=A0[29] | Rebuild with updated incus =
|
| | |
| docker.io=C2=A0[30] | Rebuild with updated glibc =
|
| | |
| dovecot=C2=A0[31] | Fix memory leak in CVE-2026-27857 fix =
|
| | |
| e2fsprogs=C2=A0[32] | Rebuild with updated glibc =
|
| | |
| efibootguard=C2=A0[33] | Rebuild against gnu-efi with #1086705 fixed =
|
| | |
| ejabberd=C2=A0[34] | Ignore certificate purpose for incoming s2s =
|
| | connections |
| | |
| ejabberd-contrib=C2=A0[35] | Rebuild with updated ejabberd =
|
| | |
| epics-base=C2=A0[36] | Skip failing build-time test =
|
| | |
| erlang=C2=A0[37] | Fix path traversal issues [CVE-2026-21620 =
|
| | CVE-2026-23942[; fix HTTP request smuggling |
| | issue [CVE-2026-23941]; fix denial of |
| | service issue [CVE-2026-23943] |
| | |
| erlang-p1-tls=C2=A0[38] | Accept client certificates without =
|
| | sslpurpose flag |
| | |
| exim4=C2=A0[39] | Fix GnuTLS hostname verify of a server =
|
| | certificate with a zero-length Subject; fix |
| | denial of service issue [CVE-2026-40684]; |
| | fix out-of-bounds read/write issues |
| | [CVE-2026-40685 CVE-2026-40686 CVE-2026- |
| | 40687] |
| | |
| feed2toot=C2=A0[40] | Ensure compatibility with Python 3.13 =
|
| | |
| firewalld=C2=A0[41] | Prevent local users from being able to =
|
| | modify runtime firewall state without prior |
| | authentication if the desktop policy is |
| | active [CVE-2026-4948] |
| | |
| freerdp3=C2=A0[42] | Fix issues with large certificates; fix =
|
| | clipboard paste issue; fix segmentation |
| | fault issue [CVE-2025-4478]; fix use-after- |
| | free issues [CVE-2026-22851 CVE-2026-22856 |
| | CVE-2026-22857 CVE-2026-23883 CVE-2026- |
| | 23884 CVE-2026-24491 CVE-2026-24675 |
| | CVE-2026-24676 CVE-2026-24678 CVE-2026- |
| | 24680 CVE-2026-24681 CVE-2026-24683 |
| | CVE-2026-24684 CVE-2026-25952 CVE-2026- |
| | 25953 CVE-2026-25954 CVE-2026-25955 |
| | CVE-2026-25959 CVE-2026-25997 CVE-2026- |
| | 26986]; fix buffer overflow issues |
| | [CVE-2026-22852 CVE-2026-22853 CVE-2026- |
| | 22854 CVE-2026-23530 CVE-2026-23531 |
| | CVE-2026-23532 CVE-2026-23533 CVE-2026- |
| | 23534 CVE-2026-23732]; fix out-of-bounds |
| | read issues [CVE-2026-22855 CVE-2026-22859 |
| | CVE-2026-24677 CVE-2026-24679 CVE-2026- |
| | 24682 CVE-2026-25941 CVE-2026-25942]; fix |
| | buffer underflow issues [CVE-2026-22858 |
| | CVE-2026-26955]; fix null pointer |
| | dereference issue [CVE-2026-23948]; fix |
| | buffer over-read issue [CVE-2026-26271; fix |
| | out-of-bounds write issue [CVE-2026-26965]; |
| | fix denial of service issue [CVE-2026- |
| | 27015]; fix buffer overflow issues |
| | [CVE-2026-29774 CVE-2026-31806 CVE-2026- |
| | 31883 CVE-2026-33982 CVE-2026-33984]; fix |
| | out-of-bounds read/write issues [CVE-2026- |
| | 29775 CVE-2026-31885 CVE-2026-31897 |
| | CVE-2026-33986 CVE-2026-33987]; fix integer |
| | underflow issue [CVE-2026-29776]; fix |
| | denial of service issues [CVE-2026-31884 |
| | CVE-2026-33952 CVE-2026-33977 CVE-2026- |
| | 33983]; fix data leak issue [CVE-2026- |
| | 33985]; fix double free issue [CVE-2026- |
| | 33995]; fix path traversal issue [CVE-2026- |
| | 40254] |
| | |
| fwupd=C2=A0[43] | Thunderbolt: Fix deploying the thunderbolt =
|
| | controller on the X280 |
| | |
| git-lfs=C2=A0[44] | Fix arbitrary file write issue [CVE-2025- =
|
| | 26625] |
| | |
| glance=C2=A0[45] | Fix server-side request forgery issue =
|
| | [CVE-2026-34881]; fix build failure |
| | |
| glib2.0=C2=A0[46] | Fix timezone handling with Debian & =
|
| | Ubuntu's symlinks; fix missing input |
| | validation in g_buffered_input_stream_peek |
| | [CVE-2026-0988]; fix integer overflow in |
| | base64 encoding [CVE-2026-1484]; fix buffer |
| | underflow issue in content type parsing |
| | [CVE-2026-1485]; fix integer overflow in |
| | unicode conversion [CVE-2026-1489] |
| | |
| glibc=C2=A0[47] | Fix incorrect handling of DNS responses =
|
| | [CVE-2026-4437]; fix return of invalid DNS |
| | hostnames [CVE-2026-4438]; fix assertion |
| | failure [CVE-2026-4046]; fix a null pointer |
| | dereference in the |
| | nss_database_check_reload_and_get function; |
| | fix invalid pointer arithmetic in |
| | ANSI_X3.110 iconv module; various test |
| | suite fixes |
| | |
| gnupg2=C2=A0[48] | Rebuild with updated glibc =
|
| | |
| gnutls28=C2=A0[49] | Preserve extension order across client =
|
| | Hello retry |
| | |
| grub-efi-amd64- | Fix an illegal instruction on riscv64 |
| signed=C2=A0[50] | =
|
| | |
| grub-efi-arm64- | Fix an illegal instruction on riscv64 |
| signed=C2=A0[51] | =
|
| | |
| grub-efi-ia32- | Fix an illegal instruction on riscv64 |
| signed=C2=A0[52] | =
|
| | |
| grub2=C2=A0[53] | Fix an illegal instruction on riscv64 =
|
| | |
| gvfs=C2=A0[54] | Use control connection address for PASV =
|
| | data [CVE-2026-28295]; reject paths |
| | containing CR/LF characters [CVE-2026- |
| | 28296] |
| | |
| harfbuzz=C2=A0[55] | Fix NULL pointer dereference issue =
|
| | [CVE-2026-22693] |
| | |
| heimdal=C2=A0[56] | Fix memory leak in heimdal-clients; add =
|
| | build dependency on libcrypt-dev |
| | |
| initramfs-tools=C2=A0[57] | Include Cadence driver, fixing failure to =
|
| | boot from USB storage on boards using |
| | Starfive SoC; unmkinitramfs: Accept lower- |
| | case hex digits in cpio headers, fixing |
| | compatibility with some other tools |
| | |
| integrit=C2=A0[58] | Rebuild with updated glibc =
|
| | |
| jpeg-xl=C2=A0[59] | Fix uninitialised memory read issues =
|
| | [CVE-2025-12474 CVE-2026-1837]; fix cross |
| | build failure; fix "nojava" build |
| | profile; fix build on big-endian |
| | architectures |
| | |
| jq=C2=A0[60] | Fix buffer overflow issue [CVE-2026-32316]; =
|
| | fix denial of service issues [CVE-2026- |
| | 33947 CVE-2026-39956]; fix validation |
| | bypass issue [CVE-2026-33948]; fix out-of- |
| | bounds read issue [CVE-2026-39979]; fix use |
| | of hardcoded seed [CVE-2026-40164] |
| | |
| kissfft=C2=A0[61] | Fix integer overflow issues [CVE-2025-34297 =
|
| | CVE-2026-41445] |
| | |
| kpackage=C2=A0[62] | Skip unreliable build-time test =
|
| | |
| lemonldap-ng=C2=A0[63] | OIDC: don't ignore non default signature =
|
| | algorithm; OIDC: register Front-Channel- |
| | Logout URL; really hide passwords in |
| | session-explorer when stored in session; |
| | update documentation to avoid using |
| | unsecured Nginx variable |
| | |
| libarchive=C2=A0[64] | Fix out-of-bounds read issues [CVE-2025- =
|
| | 5918 CVE-2026-4424]; fix denial of service |
| | issues [CVE-2026-4111 CVE-2026-4426]; fix |
| | possible code execution issue [CVE-2026- |
| | 5121] |
| | |
| libcap2=C2=A0[65] | Fix time of check / time of use issue =
|
| | [CVE-2026-4878] |
| | |
| libcdio=C2=A0[66] | Fix buffer overflow issue [CVE-2024-36600] =
|
| | |
| libcoap3=C2=A0[67] | Fix out-of-bounds read issue [CVE-2026- =
|
| | 29013]; fix buffer overflow issue |
| | [CVE-2025-34468] |
| | |
| libcryptx-perl=C2=A0[68] | Fix "Crypt::PK key generation is not fork =
|
| | safe and will generate identical |
| | keys" [CVE-2026-41564] |
| | |
| libdatetime-timezone- | Update to database 2026a; update included |
| perl=C2=A0[69] | timezone data =
|
| | |
| libexif=C2=A0[70] | Fix integer underflow issues [CVE-2026- =
|
| | 40386 CVE-2026-32775]; fix integer overflow |
| | issue [CVE-2026-40385] |
| | |
| libfinance-quote- | Fix date in quotes retrieved from XETRA |
| perl=C2=A0[71] | source =
|
| | |
| libnet-cidr-lite- | Fix ACL bypass issues [CVE-2026-40198 |
| perl=C2=A0[72] | CVE-2026-40199] =
|
| | |
| libreoffice- | Add dependency on dvipng/dvisvgm |
| texmaths=C2=A0[73] | =
|
| | |
| libtext-csv-xs- | Fix stack corruption issue [CVE-2026-7111] |
| perl=C2=A0[74] | =
|
| | |
| libvncserver=C2=A0[75] | Fix out of bounds read issue [CVE-2026- =
|
| | 32853]; fix NULL pointer dereference issue |
| | [CVE-2026-32854] |
| | |
| libxml-security- | Fix private key disclosure issue [CVE-2023- |
| java=C2=A0[76] | 44483] =
|
| | |
| libxslt=C2=A0[77] | Fix deterministic generate-id() regression =
|
| | causing build failures in other packages |
| | |
| lxc=C2=A0[78] | Fix authorisation bypass issue [CVE-2026- =
|
| | 39402] |
| | |
| mailman-suite=C2=A0[79] | Add django.contrib.humanize to recommended =
|
| | apps in sample config |
| | |
| mapserver=C2=A0[80] | Fix buffer overflow issue [CVE-2026-33721] =
|
| | |
| mksh=C2=A0[81] | Rebuild with updated musl =
|
| | |
| modsecurity-crs=C2=A0[82] | Fix file extension blocking bypass issue =
|
| | [CVE-2026-33691] |
| | |
| mongo-c-driver=C2=A0[83] | Fix insufficient validation issues =
|
| | [CVE-2025-14911 CVE-2026-6231]; fix denial |
| | of service issue [CVE-2026-4359]; fix |
| | buffer overflow issue [CVE-2026-6691]; |
| | improve handling of corrupt GridFS files |
| | |
| mumble=C2=A0[84] | Fix Opus buffer overrun leading to crash =
|
| | |
| musl=C2=A0[85] | Fix denial of service issue [CVE-2026- =
|
| | 6042]; fix stack corruption issue |
| | [CVE-2026-40200] |
| | |
| nano=C2=A0[86] | Fix overly broad permissions issue =
|
| | [CVE-2026-6842]; fix format string issue |
| | [CVE-2026-6843] |
| | |
| nautilus-wipe=C2=A0[87] | Remove Multi-Arch: same =
|
| | |
| netatalk=C2=A0[88] | Fix authentication in complex AD =
|
| | environments |
| | |
| nginx=C2=A0[89] | Fix buffer overflow issues [CVE-2026-27654 =
|
| | CVE-2026-27784 CVE-2026-32647]; fix session |
| | authentication issues [CVE-2026-27651 |
| | CVE-2026-28753]; fix OCSP result bypass |
| | issue [CVE-2026-28755]; use "$host" |
| | instead of "$http_host" |
| | |
| node-flatted=C2=A0[90] | Fix prototype pollution issue [CVE-2026- =
|
| | 33228] |
| | |
| node-node-rsa=C2=A0[91] | Fix builds with OpenSSL 3 =
|
| | |
| node-tar=C2=A0[92] | Properly sanitize absolute linkpaths =
|
| | [CVE-2026-23745]; normalize out unicode |
| | ligatures [CVE-2026-23950]; properly |
| | sanitize hard links containing |
| | '..' [CVE-2026-24842]; prevent hardlinking |
| | to files outside the extraction root |
| | [CVE-2026-26960]; strip leading '/' before |
| | sanitizing '..' [CVE-2026-29786]; prevent |
| | escaping symlinks with drive-relative paths |
| | [CVE-2026-31802] |
| | |
| numba=C2=A0[93] | Conditionally skip tests requiring more =
|
| | CPUs than available |
| | |
| openssh=C2=A0[94] | Ensure scp does not unexpectedly make =
|
| | transferred files setuid or setgid |
| | [CVE-2026-35385]; fix command execution |
| | issue [CVE-2026-35386]; fix incomplete |
| | application of PubkeyAcceptedAlgorithms and |
| | HostbasedAcceptedAlgorithms with regard to |
| | ECDSA keys [CVE-2026-35387]; use connection |
| | multiplexing confirmation for proxy-mode |
| | multiplexing sessions [CVE-2026-35388]; fix |
| | handling of the authorized_keys |
| | "principals" option [CVE-2026-35414]; |
| | validate user and host names for |
| | ProxyJump/-J options passed via the command |
| | line; IPQoS handling improvements; don't |
| | reuse c->isatty for signalling that the |
| | remote channel has a tty attached |
| | |
| openssl=C2=A0[95] | New upstream stable release =
|
| | |
| orca=C2=A0[96] | Remove lightdm wrapper on package removal =
|
| | |
| osdlyrics=C2=A0[97] | Add missing runtime dependency python3- =
|
| | pycurl; rebuild in a clean environment |
| | |
| pgbouncer=C2=A0[98] | Fix integer overflow issue [CVE-2026-6664]; =
|
| | fix stack overflow issues [CVE-2026-6665]; |
| | fix NULL pointer dereference issue |
| | [CVE-2026-6666]; fix missing authorization |
| | check [CVE-2026-6667] |
| | |
| phosh=C2=A0[99] | Cell-broadcast-prompt: close dialog on =
|
| | swipe; strip whitespace; wifi-network: |
| | don't unconditionally overwrite active |
| | access point; don't set active indicator |
| | visible |
| | |
| php-league- | Fix DisallowedRawHtml bypass via newline/ |
| commonmark=C2=A0[100] | tab in tag names [CVE-2026-30838]; fix =
|
| | DomainFilteringAdapter hostname boundary |
| | bypass [CVE-2026-33347] |
| | |
| php-phpseclib=C2=A0[101] | Fix denial of service issue [CVE-2024- =
|
| | 27355]; fix variable time comparison issue |
| | [CVE-2026-40194] |
| | |
| php-phpseclib3=C2=A0[102] | Fix denial of service issue [CVE-2024- =
|
| | 27355]; fix variable time comparison issue |
| | [CVE-2026-40194] |
| | |
| phpseclib=C2=A0[103] | Fix denial of service issue [CVE-2024- =
|
| | 27355]; fix variable time comparison issue |
| | [CVE-2026-40194] |
| | |
| proftpd-dfsg=C2=A0[104] | Fix SQL injection issue [CVE-2026-42167] =
|
| | |
| pymupdf=C2=A0[105] | Improve safety of 'pymupdf embed-extract' =
|
| | when dealing with existing files [CVE-2026- |
| | 3029] |
| | |
| python-authlib=C2=A0[106] | Fix cross-site request forgery issue =
|
| | [CVE-2025-68158]; fix denial of service |
| | issues [CVE-2025-62706 CVE-2025-61920]; fix |
| | policy bypass issue [CVE-2025-59420] |
| | |
| python-bottle- | Fix compaibility with Python 3.11+ |
| sqlite=C2=A0[107] | =
|
| | |
| python-certbot=C2=A0[108] | Re-use selected profile for renewals =
|
| | |
| python-ldap=C2=A0[109] | Fix insufficient escaping issue [CVE-2025- =
|
| | 61911]; fix denial of service issue |
| | [CVE-2025-61912] |
| | |
| python-mapbox- | Remove "Multi-Arch: same" annotation |
| earcut=C2=A0[110] | =
|
| | |
| python-oslo.db=C2=A0[111] | Fix compatibility with newer mariadb =
|
| | versions |
| | |
| python3-lxc=C2=A0[112] | Fix compatibility with Python 3.13 =
|
| | |
| python3.13=C2=A0[113] | Fix header injection issues [CVE-2025-11468 =
|
| | CVE-2025-15282 CVE-2026-0672 CVE-2026-0865 |
| | CVE-2026-1299]; fix denial of service |
| | issues [CVE-2025-12084 CVE-2025-13836 |
| | CVE-2025-13837 CVE-2025-6069 CVE-2025-6075 |
| | CVE-2025-8194]; fix incorrect parsing of |
| | TarInfo header [CVE-2025-13462]; fix |
| | insufficient validation in zipFile |
| | [CVE-2025-8291]; fix missing sys.audit |
| | invocation [CVE-2026-2297]; fix early halt |
| | of base64 processing [CVE-2026-3446]; fix |
| | validation bypass issue [CVE-2026-3644]; |
| | fix stack overflow issue [CVE-2026-4224]; |
| | fix insufficient validation issue |
| | [CVE-2026-4519]; fix insufficient escaping |
| | issue [CVE-2026-6019]; fix use-after-free |
| | issue |
| | |
| qcoro=C2=A0[114] | Skip unreliable build-time tests =
|
| | |
| qemu=C2=A0[115] | Rebuild with updated glib2.0, glibc =
|
| | |
| qt6-base=C2=A0[116] | Fix data race issues =
|
| | |
| remmina=C2=A0[117] | Disable "phone home" functionality =
|
| | |
| request- | Fix builds of CKEditor when firefox is >=3D |
| tracker5=C2=A0[118] | 148 =
|
| | |
| rsync=C2=A0[119] | Fix symlink handling on the receiver; fix =
|
| | use-after-free issue [CVE-2026-41035] |
| | |
| sash=C2=A0[120] | Rebuild with updated glibc =
|
| | |
| sed=C2=A0[121] | Fix time of check / time of use issue =
|
| | [CVE-2026-5958] |
| | |
| snapd=C2=A0[122] | Rebuild with updated libcap2, glibc =
|
| | |
| starlet=C2=A0[123] | Fix HTTP request smuggling issue [CVE-2026- =
|
| | 40561] |
| | |
| stayrtr=C2=A0[124] | Stop serving stale VRPs when the validator =
|
| | is stuck; use Restart=3Don-abnormal instead |
| | of on-abort |
| | |
| sudo=C2=A0[125] | Fix privilege escalation issue [CVE-2026- =
|
| | 35535] |
| | |
| supermin=C2=A0[126] | Rebuild with updated musl =
|
| | |
| superqt=C2=A0[127] | Skip unreliable font metrics test =
|
| | |
| suricata=C2=A0[128] | Fix denial of service issues [CVE-2026- =
|
| | 31932 CVE-2026-31933 CVE-2026-31935 |
| | CVE-2026-31937] |
| | |
| swupdate=C2=A0[129] | Fix denial of service issue [CVE-2026- =
|
| | 28525] |
| | |
| sylpheed=C2=A0[130] | Add link check to address [CVE-2021-37746] =
|
| | |
| systemd=C2=A0[131] | New upstream stable release; ensure /tmp =
|
| | workaround does not override local unit/ |
| | fstab; fix assert and freeze [CVE-2026- |
| | 29111]; fix code execution issues |
| | [CVE-2026-40225 CVE-2026-4105]; fix nspawn |
| | escape-to-host issue [CVE-2026-40226] |
| | |
| systemd-boot-efi- | New upstream stable release; ensure /tmp |
| amd64-signed=C2=A0[132] | workaround does not override local unit/ =
|
| | fstab; fix assert and freeze [CVE-2026- |
| | 29111]; fix code execution issues |
| | [CVE-2026-40225 CVE-2026-4105]; fix nspawn |
| | escape-to-host issue [CVE-2026-40226] |
| | |
| systemd-boot-efi- | New upstream stable release; ensure /tmp |
| arm64-signed=C2=A0[133] | workaround does not override local unit/ =
|
| | fstab; fix assert and freeze [CVE-2026- |
| | 29111]; fix code execution issues |
| | [CVE-2026-40225 CVE-2026-4105]; fix nspawn |
| | escape-to-host issue [CVE-2026-40226] |
| | |
| tini=C2=A0[134] | Rebuild with updated glibc =
|
| | |
| tiv=C2=A0[135] | Rebuild with updated cimg =
|
| | |
| toil=C2=A0[136] | Conditionally skip build-time tests =
|
| | requiring more CPUs than available |
| | |
| tripwire=C2=A0[137] | Rebuild with updated glibc =
|
| | |
| tsocks=C2=A0[138] | Rebuild with updated glibc =
|
| | |
| tzdata=C2=A0[139] | New upstream release; update data for =
|
| | British Columbia |
| | |
| unbound=C2=A0[140] | Never try TLS to reach root nameservers =
|
| | |
| user-mode-linux=C2=A0[141] | Rebuild with updated linux =
|
| | |
| vips=C2=A0[142] | Fix buffer overflow issues [CVE-2026-2913 =
|
| | CVE-2026-3147 CVE-2026-3281]; fix memory |
| | corruption issue [CVE-2026-3145]; fix null |
| | pointer dereference issue [CVE-2026-3146]; |
| | fix out of bound read issues [CVE-2026-3282 |
| | CVE-2026-3283]; fix integer overflow issue |
| | [CVE-2026-3284] |
| | |
| xorg-server=C2=A0[143] | Fix buffer re-use issue [CVE-2026-33999]; =
|
| | fix / improve bounds checking [CVE-2026- |
| | 34000 CVE-2026-34003]; fix use after free |
| | issue [CVE-2026-34001]; fix out-of-bounds |
| | read issue [CVE-2026-34002] |
| | |
| zsh=C2=A0[144] | Rebuild with updated libcap2, glibc =
|
| | |
+-----------------------+---------------------------------------------+
1: https://packages.debian.org/src:389-ds-base
2: https://packages.debian.org/src:7zip
3: https://packages.debian.org/src:apache2
4: https://packages.debian.org/src:awstats
5: https://packages.debian.org/src:base-files
6: https://packages.debian.org/src:bash
7: https://packages.debian.org/src:beads
8: https://packages.debian.org/src:bepasty
9: https://packages.debian.org/src:bglibs
10: https://packages.debian.org/src:bird2
11: https://packages.debian.org/src:black
12: https://packages.debian.org/src:bubblewrap
13: https://packages.debian.org/src:busybox
14: https://packages.debian.org/src:calibre
15: https://packages.debian.org/src:catatonit
16: https://packages.debian.org/src:cdebootstrap
17: https://packages.debian.org/src:chkrootkit
18: https://packages.debian.org/src:cimg
19: https://packages.debian.org/src:cockpit
20: https://packages.debian.org/src:composer
21: https://packages.debian.org/src:condor
22: https://packages.debian.org/src:curl
23: https://packages.debian.org/src:dar
24: https://packages.debian.org/src:debian-installer
25: https://packages.debian.org/src:debian-installer-netboot-images
26: https://packages.debian.org/src:debmirror
27: https://packages.debian.org/src:distribution-gpg-keys
28: https://packages.debian.org/src:distro-info-data
29: https://packages.debian.org/src:distrobuilder
30: https://packages.debian.org/src:docker.io
31: https://packages.debian.org/src:dovecot
32: https://packages.debian.org/src:e2fsprogs
33: https://packages.debian.org/src:efibootguard
34: https://packages.debian.org/src:ejabberd
35: https://packages.debian.org/src:ejabberd-contrib
36: https://packages.debian.org/src:epics-base
37: https://packages.debian.org/src:erlang
38: https://packages.debian.org/src:erlang-p1-tls
39: https://packages.debian.org/src:exim4
40: https://packages.debian.org/src:feed2toot
41: https://packages.debian.org/src:firewalld
42: https://packages.debian.org/src:freerdp3
43: https://packages.debian.org/src:fwupd
44: https://packages.debian.org/src:git-lfs
45: https://packages.debian.org/src:glance
46: https://packages.debian.org/src:glib2.0
47: https://packages.debian.org/src:glibc
48: https://packages.debian.org/src:gnupg2
49: https://packages.debian.org/src:gnutls28
50: https://packages.debian.org/src:grub-efi-amd64-signed
51: https://packages.debian.org/src:grub-efi-arm64-signed
52: https://packages.debian.org/src:grub-efi-ia32-signed
53: https://packages.debian.org/src:grub2
54: https://packages.debian.org/src:gvfs
55: https://packages.debian.org/src:harfbuzz
56: https://packages.debian.org/src:heimdal
57: https://packages.debian.org/src:initramfs-tools
58: https://packages.debian.org/src:integrit
59: https://packages.debian.org/src:jpeg-xl
60: https://packages.debian.org/src:jq
61: https://packages.debian.org/src:kissfft
62: https://packages.debian.org/src:kpackage
63: https://packages.debian.org/src:lemonldap-ng
64: https://packages.debian.org/src:libarchive
65: https://packages.debian.org/src:libcap2
66: https://packages.debian.org/src:libcdio
67: https://packages.debian.org/src:libcoap3
68: https://packages.debian.org/src:libcryptx-perl
69: https://packages.debian.org/src:libdatetime-timezone-perl
70: https://packages.debian.org/src:libexif
71: https://packages.debian.org/src:libfinance-quote-perl
72: https://packages.debian.org/src:libnet-cidr-lite-perl
73: https://packages.debian.org/src:libreoffice-texmaths
74: https://packages.debian.org/src:libtext-csv-xs-perl
75: https://packages.debian.org/src:libvncserver
76: https://packages.debian.org/src:libxml-security-java
77: https://packages.debian.org/src:libxslt
78: https://packages.debian.org/src:lxc
79: https://packages.debian.org/src:mailman-suite
80: https://packages.debian.org/src:mapserver
81: https://packages.debian.org/src:mksh
82: https://packages.debian.org/src:modsecurity-crs
83: https://packages.debian.org/src:mongo-c-driver
84: https://packages.debian.org/src:mumble
85: https://packages.debian.org/src:musl
86: https://packages.debian.org/src:nano
87: https://packages.debian.org/src:nautilus-wipe
88: https://packages.debian.org/src:netatalk
89: https://packages.debian.org/src:nginx
90: https://packages.debian.org/src:node-flatted
91: https://packages.debian.org/src:node-node-rsa
92: https://packages.debian.org/src:node-tar
93: https://packages.debian.org/src:numba
94: https://packages.debian.org/src:openssh
95: https://packages.debian.org/src:openssl
96: https://packages.debian.org/src:orca
97: https://packages.debian.org/src:osdlyrics
98: https://packages.debian.org/src:pgbouncer
99: https://packages.debian.org/src:phosh
100: https://packages.debian.org/src:php-league-commonmark
101: https://packages.debian.org/src:php-phpseclib
102: https://packages.debian.org/src:php-phpseclib3
103: https://packages.debian.org/src:phpseclib
104: https://packages.debian.org/src:proftpd-dfsg
105: https://packages.debian.org/src:pymupdf
106: https://packages.debian.org/src:python-authlib
107: https://packages.debian.org/src:python-bottle-sqlite
108: https://packages.debian.org/src:python-certbot
109: https://packages.debian.org/src:python-ldap
110: https://packages.debian.org/src:python-mapbox-earcut
111: https://packages.debian.org/src:python-oslo.db
112: https://packages.debian.org/src:python3-lxc
113: https://packages.debian.org/src:python3.13
114: https://packages.debian.org/src:qcoro
115: https://packages.debian.org/src:qemu
116: https://packages.debian.org/src:qt6-base
117: https://packages.debian.org/src:remmina
118: https://packages.debian.org/src:request-tracker5
119: https://packages.debian.org/src:rsync
120: https://packages.debian.org/src:sash
121: https://packages.debian.org/src:sed
122: https://packages.debian.org/src:snapd
123: https://packages.debian.org/src:starlet
124: https://packages.debian.org/src:stayrtr
125: https://packages.debian.org/src:sudo
126: https://packages.debian.org/src:supermin
127: https://packages.debian.org/src:superqt
128: https://packages.debian.org/src:suricata
129: https://packages.debian.org/src:swupdate
130: https://packages.debian.org/src:sylpheed
131: https://packages.debian.org/src:systemd
132: https://packages.debian.org/src:systemd-boot-efi-amd64-signed
133: https://packages.debian.org/src:systemd-boot-efi-arm64-signed
134: https://packages.debian.org/src:tini
135: https://packages.debian.org/src:tiv
136: https://packages.debian.org/src:toil
137: https://packages.debian.org/src:tripwire
138: https://packages.debian.org/src:tsocks
139: https://packages.debian.org/src:tzdata
140: https://packages.debian.org/src:unbound
141: https://packages.debian.org/src:user-mode-linux
142: https://packages.debian.org/src:vips
143: https://packages.debian.org/src:xorg-server
144: https://packages.debian.org/src:zsh
Security Updates
----------------
This revision adds the following security updates to the stable release.
The Security Team has already released an advisory for each of these
updates:
+----------------+---------------------------+
| Advisory ID | Package |
+----------------+---------------------------+
| DSA-6088=C2=A0[145] | php8.4=C2=A0[146] |
| | |
| DSA-6158=C2=A0[147] | imagemagick=C2=A0[148] |
| | |
| DSA-6160=C2=A0[149] | netty=C2=A0[150] |
| | |
| DSA-6161=C2=A0[151] | multipart=C2=A0[152] |
| | |
| DSA-6162=C2=A0[153] | linux-signed-amd64=C2=A0[154] |
| | |
| DSA-6162=C2=A0[155] | linux-signed-arm64=C2=A0[156] |
| | |
| DSA-6162=C2=A0[157] | linux=C2=A0[158] |
| | |
| DSA-6164=C2=A0[159] | chromium=C2=A0[160] |
| | |
| DSA-6165=C2=A0[161] | chromium=C2=A0[162] |
| | |
| DSA-6166=C2=A0[163] | nodejs=C2=A0[164] |
| | |
| DSA-6167=C2=A0[165] | gst-plugins-base1.0=C2=A0[166] |
| | |
| DSA-6168=C2=A0[167] | freetype=C2=A0[168] |
| | |
| DSA-6169=C2=A0[169] | imagemagick=C2=A0[170] |
| | |
| DSA-6170=C2=A0[171] | snapd=C2=A0[172] |
| | |
| DSA-6171=C2=A0[173] | chromium=C2=A0[174] |
| | |
| DSA-6172=C2=A0[175] | webkit2gtk=C2=A0[176] |
| | |
| DSA-6173=C2=A0[177] | freeciv=C2=A0[178] |
| | |
| DSA-6174=C2=A0[179] | spip=C2=A0[180] |
| | |
| DSA-6175=C2=A0[181] | libyaml-syck-perl=C2=A0[182] |
| | |
| DSA-6176=C2=A0[183] | strongswan=C2=A0[184] |
| | |
| DSA-6177=C2=A0[185] | chromium=C2=A0[186] |
| | |
| DSA-6178=C2=A0[187] | firefox-esr=C2=A0[188] |
| | |
| DSA-6179=C2=A0[189] | thunderbird=C2=A0[190] |
| | |
| DSA-6180=C2=A0[191] | ruby-rack=C2=A0[192] |
| | |
| DSA-6181=C2=A0[193] | bind9=C2=A0[194] |
| | |
| DSA-6182=C2=A0[195] | libxml-parser-perl=C2=A0[196] |
| | |
| DSA-6183=C2=A0[197] | nodejs=C2=A0[198] |
| | |
| DSA-6184=C2=A0[199] | incus=C2=A0[200] |
| | |
| DSA-6185=C2=A0[201] | phpseclib=C2=A0[202] |
| | |
| DSA-6186=C2=A0[203] | php-phpseclib=C2=A0[204] |
| | |
| DSA-6187=C2=A0[205] | php-phpseclib3=C2=A0[206] |
| | |
| DSA-6188=C2=A0[207] | lxd=C2=A0[208] |
| | |
| DSA-6189=C2=A0[209] | libpng1.6=C2=A0[210] |
| | |
| DSA-6190=C2=A0[211] | gst-plugins-bad1.0=C2=A0[212] |
| | |
| DSA-6191=C2=A0[213] | gst-plugins-ugly1.0=C2=A0[214] |
| | |
| DSA-6192=C2=A0[215] | chromium=C2=A0[216] |
| | |
| DSA-6193=C2=A0[217] | inetutils=C2=A0[218] |
| | |
| DSA-6194=C2=A0[219] | pyasn1=C2=A0[220] |
| | |
| DSA-6195=C2=A0[221] | python-tornado=C2=A0[222] |
| | |
| DSA-6196=C2=A0[223] | roundcube=C2=A0[224] |
| | |
| DSA-6197=C2=A0[225] | dovecot=C2=A0[226] |
| | |
| DSA-6198=C2=A0[227] | valkey=C2=A0[228] |
| | |
| DSA-6200=C2=A0[229] | tor=C2=A0[230] |
| | |
| DSA-6201=C2=A0[231] | openssl=C2=A0[232] |
| | |
| DSA-6202=C2=A0[233] | firefox-esr=C2=A0[234] |
| | |
| DSA-6203=C2=A0[235] | tiff=C2=A0[236] |
| | |
| DSA-6204=C2=A0[237] | openssh=C2=A0[238] |
| | |
| DSA-6205=C2=A0[239] | chromium=C2=A0[240] |
| | |
| DSA-6206=C2=A0[241] | gdk-pixbuf=C2=A0[242] |
| | |
| DSA-6207=C2=A0[243] | flatpak=C2=A0[244] |
| | |
| DSA-6208=C2=A0[245] | mediawiki=C2=A0[246] |
| | |
| DSA-6209=C2=A0[247] | xdg-dbus-proxy=C2=A0[248] |
| | |
| DSA-6211=C2=A0[249] | thunderbird=C2=A0[250] |
| | |
| DSA-6212=C2=A0[251] | incus=C2=A0[252] |
| | |
| DSA-6213=C2=A0[253] | lxd=C2=A0[254] |
| | |
| DSA-6214=C2=A0[255] | chromium=C2=A0[256] |
| | |
| DSA-6215=C2=A0[257] | gimp=C2=A0[258] |
| | |
| DSA-6216=C2=A0[259] | opam=C2=A0[260] |
| | |
| DSA-6217=C2=A0[261] | luanti=C2=A0[262] |
| | |
| DSA-6218=C2=A0[263] | mupdf=C2=A0[264] |
| | |
| DSA-6219=C2=A0[265] | pillow=C2=A0[266] |
| | |
| DSA-6220=C2=A0[267] | simpleeval=C2=A0[268] |
| | |
| DSA-6221=C2=A0[269] | ntfs-3g=C2=A0[270] |
| | |
| DSA-6222=C2=A0[271] | ngtcp2=C2=A0[272] |
| | |
| DSA-6225=C2=A0[273] | firefox-esr=C2=A0[274] |
| | |
| DSA-6226=C2=A0[275] | packagekit=C2=A0[276] |
| | |
| DSA-6227=C2=A0[277] | strongswan=C2=A0[278] |
| | |
| DSA-6228=C2=A0[279] | cpp-httplib=C2=A0[280] |
| | |
| DSA-6229=C2=A0[281] | thunderbird=C2=A0[282] |
| | |
| DSA-6230=C2=A0[283] | chromium=C2=A0[284] |
| | |
| DSA-6231=C2=A0[285] | jtreg7=C2=A0[286] |
| | |
| DSA-6231=C2=A0[287] | openjdk-21=C2=A0[288] |
| | |
| DSA-6232=C2=A0[289] | webkit2gtk=C2=A0[290] |
| | |
| DSA-6233=C2=A0[291] | pdns=C2=A0[292] |
| | |
| DSA-6234=C2=A0[293] | pdns-recursor=C2=A0[294] |
| | |
| DSA-6235=C2=A0[295] | dnsdist=C2=A0[296] |
| | |
| DSA-6236=C2=A0[297] | firefox-esr=C2=A0[298] |
| | |
| DSA-6238=C2=A0[299] | linux-signed-amd64=C2=A0[300] |
| | |
| DSA-6238=C2=A0[301] | linux-signed-arm64=C2=A0[302] |
| | |
| DSA-6238=C2=A0[303] | linux=C2=A0[304] |
| | |
| DSA-6239=C2=A0[305] | chromium=C2=A0[306] |
| | |
| DSA-6240=C2=A0[307] | imagemagick=C2=A0[308] |
| | |
| DSA-6241=C2=A0[309] | python-aiohttp=C2=A0[310] |
| | |
| DSA-6242=C2=A0[311] | thunderbird=C2=A0[312] |
| | |
| DSA-6244=C2=A0[313] | incus=C2=A0[314] |
| | |
| DSA-6246=C2=A0[315] | openjdk-25=C2=A0[316] |
| | |
| DSA-6247=C2=A0[317] | lxd=C2=A0[318] |
| | |
| DSA-6248=C2=A0[319] | apache2=C2=A0[320] |
| | |
| DSA-6249=C2=A0[321] | wireshark=C2=A0[322] |
| | |
| DSA-6251=C2=A0[323] | libreoffice=C2=A0[324] |
| | |
| DSA-6252=C2=A0[325] | prosody=C2=A0[326] |
| | |
| DSA-6253=C2=A0[327] | linux-signed-amd64=C2=A0[328] |
| | |
| DSA-6253=C2=A0[329] | linux-signed-arm64=C2=A0[330] |
| | |
| DSA-6253=C2=A0[331] | linux=C2=A0[332] |
| | |
| DSA-6254=C2=A0[333] | firefox-esr=C2=A0[334] |
| | |
| DSA-6257=C2=A0[335] | postorius=C2=A0[336] |
| | |
| DSA-6259=C2=A0[337] | pyjwt=C2=A0[338] |
| | |
| DSA-6260=C2=A0[339] | tor=C2=A0[340] |
| | |
| DSA-6261=C2=A0[341] | corosync=C2=A0[342] |
| | |
| DSA-6262=C2=A0[343] | lcms2=C2=A0[344] |
| | |
| DSA-6263=C2=A0[345] | libpng1.6=C2=A0[346] |
| | |
| DSA-6264=C2=A0[347] | dnsmasq=C2=A0[348] |
| | |
| DSA-6265=C2=A0[349] | exim4=C2=A0[350] |
| | |
+----------------+---------------------------+
145: https://www.debian.org/security/2025/dsa-6088
146: https://packages.debian.org/src:php8.4
147: https://www.debian.org/security/2026/dsa-6158
148: https://packages.debian.org/src:imagemagick
149: https://www.debian.org/security/2026/dsa-6160
150: https://packages.debian.org/src:netty
151: https://www.debian.org/security/2026/dsa-6161
152: https://packages.debian.org/src:multipart
153: https://www.debian.org/security/2026/dsa-6162
154: https://packages.debian.org/src:linux-signed-amd64
155: https://www.debian.org/security/2026/dsa-6162
156: https://packages.debian.org/src:linux-signed-arm64
157: https://www.debian.org/security/2026/dsa-6162
158: https://packages.debian.org/src:linux
159: https://www.debian.org/security/2026/dsa-6164
160: https://packages.debian.org/src:chromium
161: https://www.debian.org/security/2026/dsa-6165
162: https://packages.debian.org/src:chromium
163: https://www.debian.org/security/2026/dsa-6166
164: https://packages.debian.org/src:nodejs
165: https://www.debian.org/security/2026/dsa-6167
166: https://packages.debian.org/src:gst-plugins-base1.0
167: https://www.debian.org/security/2026/dsa-6168
168: https://packages.debian.org/src:freetype
169: https://www.debian.org/security/2026/dsa-6169
170: https://packages.debian.org/src:imagemagick
171: https://www.debian.org/security/2026/dsa-6170
172: https://packages.debian.org/src:snapd
173: https://www.debian.org/security/2026/dsa-6171
174: https://packages.debian.org/src:chromium
175: https://www.debian.org/security/2026/dsa-6172
176: https://packages.debian.org/src:webkit2gtk
177: https://www.debian.org/security/2026/dsa-6173
178: https://packages.debian.org/src:freeciv
179: https://www.debian.org/security/2026/dsa-6174
180: https://packages.debian.org/src:spip
181: https://www.debian.org/security/2026/dsa-6175
182: https://packages.debian.org/src:libyaml-syck-perl
183: https://www.debian.org/security/2026/dsa-6176
184: https://packages.debian.org/src:strongswan
185: https://www.debian.org/security/2026/dsa-6177
186: https://packages.debian.org/src:chromium
187: https://www.debian.org/security/2026/dsa-6178
188: https://packages.debian.org/src:firefox-esr
189: https://www.debian.org/security/2026/dsa-6179
190: https://packages.debian.org/src:thunderbird
191: https://www.debian.org/security/2026/dsa-6180
192: https://packages.debian.org/src:ruby-rack
193: https://www.debian.org/security/2026/dsa-6181
194: https://packages.debian.org/src:bind9
195: https://www.debian.org/security/2026/dsa-6182
196: https://packages.debian.org/src:libxml-parser-perl
197: https://www.debian.org/security/2026/dsa-6183
198: https://packages.debian.org/src:nodejs
199: https://www.debian.org/security/2026/dsa-6184
200: https://packages.debian.org/src:incus
201: https://www.debian.org/security/2026/dsa-6185
202: https://packages.debian.org/src:phpseclib
203: https://www.debian.org/security/2026/dsa-6186
204: https://packages.debian.org/src:php-phpseclib
205: https://www.debian.org/security/2026/dsa-6187
206: https://packages.debian.org/src:php-phpseclib3
207: https://www.debian.org/security/2026/dsa-6188
208: https://packages.debian.org/src:lxd
209: https://www.debian.org/security/2026/dsa-6189
210: https://packages.debian.org/src:libpng1.6
211: https://www.debian.org/security/2026/dsa-6190
212: https://packages.debian.org/src:gst-plugins-bad1.0
213: https://www.debian.org/security/2026/dsa-6191
214: https://packages.debian.org/src:gst-plugins-ugly1.0
215: https://www.debian.org/security/2026/dsa-6192
216: https://packages.debian.org/src:chromium
217: https://www.debian.org/security/2026/dsa-6193
218: https://packages.debian.org/src:inetutils
219: https://www.debian.org/security/2026/dsa-6194
220: https://packages.debian.org/src:pyasn1
221: https://www.debian.org/security/2026/dsa-6195
222: https://packages.debian.org/src:python-tornado
223: https://www.debian.org/security/2026/dsa-6196
224: https://packages.debian.org/src:roundcube
225: https://www.debian.org/security/2026/dsa-6197
226: https://packages.debian.org/src:dovecot
227: https://www.debian.org/security/2026/dsa-6198
228: https://packages.debian.org/src:valkey
229: https://www.debian.org/security/2026/dsa-6200
230: https://packages.debian.org/src:tor
231: https://www.debian.org/security/2026/dsa-6201
232: https://packages.debian.org/src:openssl
233: https://www.debian.org/security/2026/dsa-6202
234: https://packages.debian.org/src:firefox-esr
235: https://www.debian.org/security/2026/dsa-6203
236: https://packages.debian.org/src:tiff
237: https://www.debian.org/security/2026/dsa-6204
238: https://packages.debian.org/src:openssh
239: https://www.debian.org/security/2026/dsa-6205
240: https://packages.debian.org/src:chromium
241: https://www.debian.org/security/2026/dsa-6206
242: https://packages.debian.org/src:gdk-pixbuf
243: https://www.debian.org/security/2026/dsa-6207
244: https://packages.debian.org/src:flatpak
245: https://www.debian.org/security/2026/dsa-6208
246: https://packages.debian.org/src:mediawiki
247: https://www.debian.org/security/2026/dsa-6209
248: https://packages.debian.org/src:xdg-dbus-proxy
249: https://www.debian.org/security/2026/dsa-6211
250: https://packages.debian.org/src:thunderbird
251: https://www.debian.org/security/2026/dsa-6212
252: https://packages.debian.org/src:incus
253: https://www.debian.org/security/2026/dsa-6213
254: https://packages.debian.org/src:lxd
255: https://www.debian.org/security/2026/dsa-6214
256: https://packages.debian.org/src:chromium
257: https://www.debian.org/security/2026/dsa-6215
258: https://packages.debian.org/src:gimp
259: https://www.debian.org/security/2026/dsa-6216
260: https://packages.debian.org/src:opam
261: https://www.debian.org/security/2026/dsa-6217
262: https://packages.debian.org/src:luanti
263: https://www.debian.org/security/2026/dsa-6218
264: https://packages.debian.org/src:mupdf
265: https://www.debian.org/security/2026/dsa-6219
266: https://packages.debian.org/src:pillow
267: https://www.debian.org/security/2026/dsa-6220
268: https://packages.debian.org/src:simpleeval
269: https://www.debian.org/security/2026/dsa-6221
270: https://packages.debian.org/src:ntfs-3g
271: https://www.debian.org/security/2026/dsa-6222
272: https://packages.debian.org/src:ngtcp2
273: https://www.debian.org/security/2026/dsa-6225
274: https://packages.debian.org/src:firefox-esr
275: https://www.debian.org/security/2026/dsa-6226
276: https://packages.debian.org/src:packagekit
277: https://www.debian.org/security/2026/dsa-6227
278: https://packages.debian.org/src:strongswan
279: https://www.debian.org/security/2026/dsa-6228
280: https://packages.debian.org/src:cpp-httplib
281: https://www.debian.org/security/2026/dsa-6229
282: https://packages.debian.org/src:thunderbird
283: https://www.debian.org/security/2026/dsa-6230
284: https://packages.debian.org/src:chromium
285: https://www.debian.org/security/2026/dsa-6231
286: https://packages.debian.org/src:jtreg7
287: https://www.debian.org/security/2026/dsa-6231
288: https://packages.debian.org/src:openjdk-21
289: https://www.debian.org/security/2026/dsa-6232
290: https://packages.debian.org/src:webkit2gtk
291: https://www.debian.org/security/2026/dsa-6233
292: https://packages.debian.org/src:pdns
293: https://www.debian.org/security/2026/dsa-6234
294: https://packages.debian.org/src:pdns-recursor
295: https://www.debian.org/security/2026/dsa-6235
296: https://packages.debian.org/src:dnsdist
297: https://www.debian.org/security/2026/dsa-6236
298: https://packages.debian.org/src:firefox-esr
299: https://www.debian.org/security/2026/dsa-6238
300: https://packages.debian.org/src:linux-signed-amd64
301: https://www.debian.org/security/2026/dsa-6238
302: https://packages.debian.org/src:linux-signed-arm64
303: https://www.debian.org/security/2026/dsa-6238
304: https://packages.debian.org/src:linux
305: https://www.debian.org/security/2026/dsa-6239
306: https://packages.debian.org/src:chromium
307: https://www.debian.org/security/2026/dsa-6240
308: https://packages.debian.org/src:imagemagick
309: https://www.debian.org/security/2026/dsa-6241
310: https://packages.debian.org/src:python-aiohttp
311: https://www.debian.org/security/2026/dsa-6242
312: https://packages.debian.org/src:thunderbird
313: https://www.debian.org/security/2026/dsa-6244
314: https://packages.debian.org/src:incus
315: https://www.debian.org/security/2026/dsa-6246
316: https://packages.debian.org/src:openjdk-25
317: https://www.debian.org/security/2026/dsa-6247
318: https://packages.debian.org/src:lxd
319: https://www.debian.org/security/2026/dsa-6248
320: https://packages.debian.org/src:apache2
321: https://www.debian.org/security/2026/dsa-6249
322: https://packages.debian.org/src:wireshark
323: https://www.debian.org/security/2026/dsa-6251
324: https://packages.debian.org/src:libreoffice
325: https://www.debian.org/security/2026/dsa-6252
326: https://packages.debian.org/src:prosody
327: https://www.debian.org/security/2026/dsa-6253
328: https://packages.debian.org/src:linux-signed-amd64
329: https://www.debian.org/security/2026/dsa-6253
330: https://packages.debian.org/src:linux-signed-arm64
331: https://www.debian.org/security/2026/dsa-6253
332: https://packages.debian.org/src:linux
333: https://www.debian.org/security/2026/dsa-6254
334: https://packages.debian.org/src:firefox-esr
335: https://www.debian.org/security/2026/dsa-6257
336: https://packages.debian.org/src:postorius
337: https://www.debian.org/security/2026/dsa-6259
338: https://packages.debian.org/src:pyjwt
339: https://www.debian.org/security/2026/dsa-6260
340: https://packages.debian.org/src:tor
341: https://www.debian.org/security/2026/dsa-6261
342: https://packages.debian.org/src:corosync
343: https://www.debian.org/security/2026/dsa-6262
344: https://packages.debian.org/src:lcms2
345: https://www.debian.org/security/2026/dsa-6263
346: https://packages.debian.org/src:libpng1.6
347: https://www.debian.org/security/2026/dsa-6264
348: https://packages.debian.org/src:dnsmasq
349: https://www.debian.org/security/2026/dsa-6265
350: https://packages.debian.org/src:exim4
Removed packages
----------------
The following packages were removed due to circumstances beyond our
control:
+------------------+-------------------------------+
| Package | Reason |
+------------------+-------------------------------+
| dav4tbsync=C2=A0[351] | Superseded by Thunderbird 140 |
| | |
+------------------+-------------------------------+
351: https://packages.debian.org/src:dav4tbsync
Debian Installer
----------------
The installer has been updated to include the fixes incorporated into
stable by the point release.
URLs
----
The complete lists of packages that have changed with this revision:
https://deb.debian.org/debian/dists/trixie/ChangeLog
The current stable distribution:
https://deb.debian.org/debian/dists/stable/
Proposed updates to the stable distribution:
https://deb.debian.org/debian/dists/proposed-updates
stable distribution information (release notes, errata etc.):
https://www.debian.org/releases/stable/
Security announcements and information:
https://www.debian.org/security/
About Debian
------------
The Debian Project is an association of Free Software developers who
volunteer their time and effort in order to produce the completely free
operating system Debian.
Contact Information
-------------------
For further information, please visit the Debian web pages at
https://www.debian.org/, send mail to <[email protected]>, or contact the
stable release team at <[email protected]>.
--=-VHgSmODdTZEKeilR03rD
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcH/R3vmpi4JWBoDfeBP2a44wMXIFAmoIdrsACgkQeBP2a44w
MXIrcg//UrXG7F5Ped9uaiw6tmnd/qEf+Tgsiunwj6GR+nuhSobwIPp6tDRMyJLY
mfaqDJe2BfSq2jmFnvBEdqatphuWtp8cmAqol/Zkl1PwZmRRoFlUcQOjNWrXgxVz
ijm5xQ5bzIoXZBi5jkk+dLiYpRGb5LpLjS5o5NHkYvTfofdlThjMcct/xIJ4w1mp
G3Wdb/Hw3ycbIkKwbnUPiernK0HclznDeD7Soe5hbNr160VUsebyQ47FiJbrE3IQ
TvXdyEKdD36h46lGaFzdANLZVQ8VxJzaSs6J0MhczZddoi1uM9X9A/Rn1nFlJKDQ
8FcmX1NEGVKXUk5DSCgY3prRxf7T0Fb08wv0wHH5EhJK7fjLMFSxDJulHUX/iyGc
av71K0EyWdmAgXKz3D7KpxVCUY2KADBflsOKEDMvRuWVgtfA07t/77qREDE5X22b
BCBV2LW5CZrV2jvuWfpU3G51F6zhly4QY48/DmuA7+HpPPoy3oQOttPTeFLZ72xe
i61rf4ufq15n5bm0PcAOSXFzRyaIXR3NrtK5VvFVdOJt4j/WV9bTqGYPUD9hplj8
gp/WdOETNRks9njkUxWHO6UYiZqkIZIZYXxwmVwnIMjTDxK3F5YVdezkmYv3EI9p
6F8k8/ILYYqoXynP83yCI18bbNq7uMm3EMO+tNgARHlLwXelWtQ=
=nBKd
-----END PGP SIGNATURE-----
--=-VHgSmODdTZEKeilR03rD--