During the month of October 2026 and on behalf of Freexian, I worked on the following:
### xserver-xorg Debian ELTS: Uploaded `2:1.20.4-1+deb10u19` in buster and `2:1.19.2-1+deb9u24` in stretch, issued ELA-1866-1, fixing: * CVE-2022-49737 * CVE-2026-33999 * CVE-2026-34000 * CVE-2026-34001 * CVE-2026-34002 * CVE-2026-34003 * CVE-2026-50256 * CVE-2026-50257 * CVE-2026-50258 * CVE-2026-50259 * CVE-2026-50260 * CVE-2026-50261 * CVE-2026-50262 * CVE-2026-50263 * CVE-2026-50264 ### openssl Debian LTS: Uploaded `3.0.22-1~deb12u2` in bookworm, issued DLA-4859-1, fixing: * CVE-2026-35189 * CVE-2026-54872 * CVE-2026-75805 * CVE-2026-75806 * CVE-2026-77696 * CVE-2026-84782 ### perl Debian LTS: Uploaded `5.36.0-7+deb12u4` in bookworm, issued DLA-4821-1. Debian ELTS: Uploaded `5.32.1-4+deb11u6` in bullseye, `5.28.1-6+deb10u4` in buster and `5.24.1-3+deb9u10` in stretch, issued ELA-1856-1. The above uploads fix the following CVEs: * CVE-2026-8376 * CVE-2026-7017 * CVE-2026-7010 * CVE-2026-57433 * CVE-2026-57432 * CVE-2026-48962 * CVE-2026-48959 * CVE-2026-42497 * CVE-2026-42496 * CVE-2026-19487 * CVE-2026-13221 * CVE-2026-12087 * CVE-2025-15649 ### libio-compress-perl Debian LTS: Uploaded `2.204-1+deb12u1` in bookworm, issued DLA-4812-1. Debian ELTS: Uploaded `2.101-1+deb11u1` in bullseye, issued ELA-1858-1. The above uploads fix the following CVEs: * CVE-2025-15649 * CVE-2026-48959 * CVE-2026-48962 ### libmodule-cpants-analyse-perl Debian LTS: Uploaded `1.01-1+deb12u1` in bookworm, issued DLA-4821-2. Debian ELTS: Uploaded `1.01-1+deb11u1` in bullseye, `0.99-1+deb10u1` in buster and `0.96-1+deb9u1` in stretch, issued ELA-1856-2. This is a regression update to fix the test suite, broken by the security fix for CVE-2026-42496 (symlink escape in Archive::Tar) in perl. ### libcpan-reporter-smoker-perl Debian ELTS: Uploaded `0.29-1+deb11u1` in bullseye, issued ELA-1859-1. This is a regression update to fix the build and the test suite, broken by a perl upload some time ago. The regression was fixed for buster and stretch, but bullseye was left out, and the build failure was caught during QA for the perl upload mentioned above. ### Misc / Debusine Investigate false positive in regression tracking (rev-deps autopkgtests), turns out the reference tests pick the package from the base suite, rather than the `-security` suite. Filed a bug to track this issue: <https://salsa.debian.org/freexian-team/debusine.debian.net/support/-/work_items/24> Investigate some autopkgtests that didn't run autodep8 tests, turns out it was caused by new workers where autodep8 wasn't installed. Quickly fixed by the Debusine admin team. ### Misc / Packages Check a flaky test for `glib2.0`, seems like it's an easy fix, filed <https://salsa.debian.org/gnome-team/glib/-/merge_requests/74> to clarify. ### Thanks Thanks to our sponsors for making this possible, and to Freexian for handling the offering: <https://www.freexian.com/lts/debian/#sponsors>. -- Arnaud
