---------------------------------------------------------------------------- Debian Stable Updates Announcement SUA 283-1 https://www.debian.org/ [email protected] Jonathan Wiltshire July 7th, 2026 ----------------------------------------------------------------------------
Upcoming Debian 13 Update (13.6) An update to Debian 13 is scheduled for Saturday, July 11th, 2026. As of now it will include the following bug fixes. They can be found in "trixie-proposed-updates", which is carried by all official mirrors. Please note that packages published through security.debian.org are not listed, but will be included if possible. Testing and feedback would be appreciated. Bugs should be filed in the Debian Bug Tracking System, but please make the Release Team aware of them by copying "[email protected]" on your mails. The point release will also include a rebuild of debian-installer. Miscellaneous Bugfixes ---------------------- This stable update adds a few important corrections to the following packages: Package Reason ------- ------ apache2 Fix use-after-free issues [CVE-2026-29167 CVE-2026-48913]; fix cross-site scripting issue [CVE-2026-29170]; fix buffer overflow issues [CVE-2026-34355 CVE-2026-34356 CVE-2026-42536]; fix denial of serice issues [CVE-2026-42535 CVE-2026-44186 CVE-2026-49975]; fix out of bounds read issues [CVE-2026-43951 CVE-2026-44185]; fix file read issue [CVE-2026-44119]; fix buffer underwrite issue [CVE-2026-44631] archlinux-keyring Update keys awstats Prevent freezing on keyword stat base-files Update for the point release beets Fix XSS vulnerability [CVE-2026-42052] calibre Fix unsafe e-book extraction and resource path handling [CVE-2026-30853 CVE-2026-33206]; prevent e-book viewer local file reads and SSRF/exfiltration [CVE-2026-33205]; avoid unsafe catalog rule evaluation; correct XPath and SQL query handling; fix reader background endpoint path normalisation; improve exception diagnostics cdebootstrap Rebuild with updated xz-utils chrony Ensure that if-up/down hook scripts exit successfully ckermit Block remote control of the local kermit by default [CVE-2025-68920]; disable unnecessary OpenSSL version check composer Fix support for new GitHub token format [CVE-2026-45793] courier Fix webadmin paths to imapd and imapd-ssl curl Fix bearer token redirect leaks [CVE-2025-14524 CVE-2026-3783]; correct OpenSSL CA cache reuse [CVE-2025-14819]; fix HTTP Negotiate and proxy connection reuse [CVE-2026-1965 CVE-2026-3784 CVE-2026-5545]; prevent clear-text STARTTLS connection reuse [CVE-2026-4873]; fix SMB use- after-free and wrong share reuse [CVE-2026-3805 CVE-2026-5773]; clear redirected host/proxy/netrc credentials [CVE-2026-6253 CVE-2026-6429]; prevent stale cookie leaks [CVE-2026-6276]; clear proxy Digest state when switching proxies [CVE-2026-7168] dar Rebuild with updated libgcrypt20, openssl, curl dcmtk Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] debusine Enforce file upload permissions; restrict artifact relation creation/deletion [CVE-2026-11852]; harden sbuild repository command quoting; reject unsafe .dsc/.changes checksum paths [CVE-2026-11853] deepdiff Fix class pollution issue [CVE-2025-58367]; fix denial of service issue [CVE-2026-33155] dhcpcd Fix memory safety issues [CVE-2025-70102 CVE-2026-56113 CVE-2026-56114]; fix IPv6 Router Advertisement information leakage [CVE-2026-56116]; correct control socket lifetime handling [CVE-2026-56117] distrobuilder Rebuild with updated incus dolphin Fix sandbox escape issue [CVE-2026-41525] errands Fix verification of TLS certificates for CalDAV servers [CVE-2025-71063] execnet Disable unreliable build-time tests fldigi Force LC_NUMERIC=C.UTF-8 to use proper decimal separator in API and ADIF log files freecad Fix fanuc post processor; fix build failure on arm64 fwupd Enable UEFI CA/db/KEK updates for the 2026 Secure Boot certificate transition; fix UEFI PK/KEK/dbx enumeration; fix Thunderbolt controller deployment; correct firmware update regressions; update fwupd hardware support and tests gambas3 Fix Qt component loading gdown Fix arbitray file write issue [CVE-2026-40491] geoip Reinstate generator scripts, relied upon by geoip-database geoip-database Revert to a DFSG-compatible version giflib Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] gimp Fix integer overflow issues [CVE-2026-4154 CVE-2026-40915] gnupg2 Rebuild with updated libgcrypt20 gnustep-sqlclient Remove Multi-Arch: same graphite2 Fix out-of-bounds write [CVE-2026-50593] horizon Fix escaping of special characters in project ironic Fix credential forwarding from configuration molds [CVE-2026-42997]; fix IPMI console command injection [CVE-2026-42510]; sandbox kickstart template rendering [CVE-2026-44916]; prevent conductor thread exhaustion from file special devices [CVE-2026-44919]; restrict unsafe file image paths; improve image download validation and checksumming; correct Redfish power, boot and firmware workflows; fix inspection rule validation and hook failures; avoid stuck service/deploy states isc-kea Fix denial of service issue [CVE-2026-3608] isenkram Handle usr-merge migration in update-fw-list; update generated firmware lists keystone Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] libapache-session-browseable-perl Improve entropy source [CVE-2026-8503] libass Fix out of bounds read and write issues libbytes-random-secure-perl Fix incorrect usage of seed in PRNG [CVE-2026-11625] libcaca Prevent undefined behaviour in overflow check [CVE-2026-42046] libcrypt-pbkdf2-perl Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant- time comparison in `validate` to avoid timing attacks [CVE-2017-20240] libcrypt-urandom-perl Fix buffer overflow issue [CVE-2026-2474] libhtml-parser-perl Fix heap-use-after-free in _decode_entities [CVE-2026-8829] libnet-cidr-lite-perl Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] libreoffice Gracefully handle failure in graphite2 libslirp Fix memory disclosure issue [CVE-2026-9539] libtasn1-6 Fix buffer overflow issue [CVE-2025-13151] libvncserver Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] libxml-libxml-perl Fix out-of-bounds read [CVE-2026-8177] libxml2 Fix RelaxNG include recursion limits [CVE-2026-0989]; prevent XML and SGML catalog recursion/resource exhaustion [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; fix xmllint shell memory leak [CVE-2026-1757]; correct XML writer and Schematron error-path leaks; avoid RelaxNG validation use-after-free; update regression tests libxpm Fix out of bounds read issue [CVE-2026-4367] linuxcnc Sanitize module names lxml-html-clean Fix filter bypass issue [CVE-2026-28348]; fix tag injection issue [CVE-2026-28350] mariadb New upstream stable release; fix code execution issues [CVE-2026-44168 CVE-2026-48163 CVE-2026-48165]; fix authorization bypass [CVE-2026-44169]; fix shell interpolation vulnerability [CVE-2026-44170]; fix path traversal issue [CVE-2026-44171]; fix SQL injection issue [CVE-2026-44172]; fix incomplete privilege check issue [CVE-2026-44173]; fix "Illegal mix of collations" error; fix "Mroonga hangs on invalid index flag"; fix crash in information_schema.table_constraints mesa Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] miniupnpd Fix integer underflow issue [CVE-2026-5720] modsecurity Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] mutt Fix buffer truncation issues [CVE-2026-43859 CVE-2026-43860 CVE-2026-43861]; fix mishandling of imap_auth_gss security level [CVE-2026-43862]; fix denial of service issue [CVE-2026-43863]; fix NULL pointer dereference issue [CVE-2026-43864] mxml Fix out-of-bounds read [CVE-2026-5037] nbconvert Fix arbitrary file write issue [CVE-2026-39377]; fix arbitrary file read issue [CVE-2026-39378] neutron Fix tagging policy bypass nss Improve handling of escape sequences in pk11uri_ParseAttributes [CVE-2026-12318] ojalgo Reduce frequency of built-time test failures opencc Fix out-of-bounds read issue [CVE-2025-15536] openslide Fix possible code execution issue [CVE-2026-48977] php-guzzlehttp-psr7 Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers php-league-csv Fix build time test with PHP >=8.4.14 pillow Followup fix for CVE-2026-42310 poco Fix segmentation fault [CVE-2025-6375] poetry Fix arbitrary file write issue [CVE-2026-34591] poppler Fix invalid signature creation issue postfix New upstream stable release; fix denial of service issue [CVE-2026-43964]; keep daemon running during upgrades protobuf Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409] psd-tools Fix denial of service issue [CVE-2026-27809] pupnp Fix SSRF port confusion issue [CVE-2026-41682] pymdown-extensions Fix regular expression-based denial of service issue [CVE-2025-68142] pyopenssl Fix handling of exceptions and connection cancelling [CVE-2026-27448]; fix buffer overflow in DTLS cookie callback [CVE-2026-27459] pytest-httpbin Disable unreliable build-time test python-daphne Fix denial of service issue [CVE-2026-44545]; fix header injection issue [CVE-2026-44546] python-django Update test suite following changes in python3.13 python-dynaconf Fix Server-Side Template Injection issue [CVE-2026-33154] python-grpc-tools Fix TypeError in command.build_package_protos python-handy-archives Fix end of central diretory locator for Zip64 python-idna Fix denial of service issue [CVE-2026-45409] python-iniparse Fix race condition in build-time tests python-jwcrypto Fix denial of service issue [CVE-2026-39373] python-markdown Adapt to changes in Python's html.parser module python-marshmallow Fix denial of service issue [CVE-2025-68480] python-memray Fix cross-site scripting issue [CVE-2026-32722] python-virtualenv Fix time-of-check / time-of-use issues [CVE-2026-22702] python-webob Fix open redirect issue [CVE-2026-44889] python-xmltodict Fix XML injectin issue [CVE-2025-9375] python3.13 Fix a crash in SNI callback when the SSL object is gone; fix reference leaks in ssl.SSLContext objects; avoid garbage collecting objects too early when sharing __dict__; fix "CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host" [CVE-2026-1502]; fix denial of service issues [CVE-2026-3276 CVE-2026-9669]; fix insufficient escaping issue [CVE-2026-6019]; fix path traversal issue [CVE-2026-7774]; fix server-side request forgery issue [CVE-2026-8328] qemu New upstream stable release; security fixes [CVE-2024-6519 CVE-2026-2243 CVE-2026-3195 CVE-2026-3196 CVE-2026-3842 CVE-2026-3886 CVE-2026-3890 CVE-2026-41435 CVE-2026-41436 CVE-2026-41437 CVE-2026-41438 CVE-2026-41439 CVE-2026-41440 CVE-2026-5744 CVE-2026-5761 CVE-2026-5763 CVE-2026-6502 CVE-2026-8341 CVE-2026-48002 CVE-2026-48003 CVE-2026-48004 CVE-2026-48914 CVE-2026-48915 CVE-2026-6425 CVE-2026-8343] qtmir Fix Lomiri rendering, scaling, focus handling, and session crash issues; correct stale window and dead surface cleanup; ensure Xwayland applications inherit DISPLAY; improve Asahi Linux rendering provider selection rauc Fix improper signing of large bundles [CVE-2026-34155] resource-agents Fix syntax error rhino Fix denial of service issue [CVE-2025-66453] rlottie Fix out-of-bounds read issue [CVE-2026-10305]; fix denial of service issues [CVE-2026-47319 CVE-2026-47320] rsync Reject excessively long HTTP proxy response lines [CVE-2026-45232] rtl-433 Fix buffer overflow issue [CVE-2025-34450] ruby-css-parser Fix validation of HTTPS certificates for remote CSS [CVE-2026-44312] rust-time Fix denial of service [CVE-2026-25727] samba New upstream stable release shim New upstream release; build with default gcc; set SBAT revocation level to 2025021800 shim-helpers-amd64-signed Update to shim 16.1-2~deb13u1 shim-helpers-arm64-signed Update to shim 16.1-2~deb13u1 shim-signed Ensure Secure Boot compatibility with 2023 Microsoft UEFI CA; check for likely boot issues before installation; combine and verify multiple shim signatures; update signed shim binaries skanpage Fix data leakage issue [CVE-2025-55174] smartdns Fix buffer overflow issue [CVE-2026-1425] squirrel3 Fix sandbox escape [CVE-2021-41556] sshfs-fuse Add contain_symlinks option to prevent symlink escape attacks [CVE-2026-47187]; reject hostname option injection via bracketed mount source [CVE-2026-48711] starman Fix request smuggling issue [CVE-2026-40560] symfony Security update tigervnc Prevent other users reading x0vncserver screen [CVE-2026-34352] user-mode-linux Rebuild with updated linux vitrage Fix remote code execution vulnerability [CVE-2026-28370] wireless-regdb New upstream stable release; update regulatory information for several countries wireshark New upstream stable release; fix denial of service issue [CVE-2026-9759] xz-utils Fix buffer overflow issue [CVE-2026-34743] A complete list of all accepted and rejected packages together with rationale is on the preparation page for this revision: <https://release.debian.org/proposed-updates/stable.html> If you encounter any issues, please don't hesitate to get in touch with the Debian Release Team at "[email protected]".
signature.asc
Description: PGP signature
