I've worked during September 2026 on the below listed packages, for Freexian LTS/ELTS [1]
Many thanks to Freexian and sponsors [2] for providing this opportunity! nvidia-graphics-driver (tesla variant) ====================================== Follow up from August work to determine how handle the Tesla version. This concluded with the suggestion not to update the Tesla drivers at this point in time, considering the limited demand and the efforts needed for the update. libde265 (DLA-4789-1, ELA-1828-1) ================================= 14 CVEs for LTS (bookworm) and 11 for ELTS (stretch, buster and bullseye) have been fixed in the H.265 codec. Fixes have been backported, including two vulnerabilities where the CVE numbers have not yet been assigned. For the individual list of vulnerabilities, please see individual announcments. freecad (DLA-4815-1) ==================== CVE-2026-34789, CVE-2026-73234, CVE-2026-73235 have been backported, with the security upload started in September and completed this weekend. This included carefully triaging CVE-2026-73233, which was found not to affect the version in bookworm. The vulnerable code originally belonged to a different FreeCAD workbench (the Arch workbench), which was later merged into the affected BIM Workbench. FreeCAD 0.20 already contained the Arch workbench, but the affected BIM components were only introduced later, in version 0.21rc1a. zlib (WIP) ========== An important CVE, CVE-2026-85091, was reported for zlib. Due to some indications in the Debian bug tracker and upstream, I investigated the issue in more detail. The initial analysis showed that the issue as described could not be triggered in the version shipped in Debian: support for non-blocking operation of the gz* functions was not yet present. When using a file descriptor with O_NONBLOCK, a stalled operation is instead treated as a regular I/O error, putting the stream into an error state; subsequent operations are rejected unless the application explicitly clears the error. Further investigation of the underlying state handling showed that the same state corruption can also be reached through other, less typical error paths. The assessment of the affected version range and the appropriate handling of the CVE is therefore still ongoing. [1] https://www.freexian.com/lts/ [2] https://www.freexian.com/lts/debian/#sponsors Cheers, -- tobi
signature.asc
Description: PGP signature
