---------------------------------------------------------------------------- Debian Stable Updates Announcement SUA 281-1 https://www.debian.org/ [email protected] Jonathan Wiltshire May 11th, 2026 ----------------------------------------------------------------------------
Upcoming Debian 12 Update (12.14) An update to Debian 12 is scheduled for Saturday, May 16th, 2026. As of now it will include the following bug fixes. They can be found in "bookworm- proposed-updates", which is carried by all official mirrors. Please note that packages published through security.debian.org are not listed, but will be included if possible. Testing and feedback would be appreciated. Bugs should be filed in the Debian Bug Tracking System, but please make the Release Team aware of them by copying "[email protected]" on your mails. The point release will also include a rebuild of debian-installer. Miscellaneous Bugfixes ---------------------- This oldstable update adds a few important corrections to the following packages: Package Reason ------- ------ 7zip New upstream stable release; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links [CVE-2025-55188] apache2 New upstream stable release: Fix http2 regression; fix use-after-free issue [CVE-2026-23918]; fix privilege escalation issue [CVE-2026-24072]; fix NULL pointer dereference issues [CVE-2026-29169 CVE-2026-33007]; fix authentication bypass issue [CVE-2026-33006]; fix HTTP response splitting issue [CVE-2026-33523]; fix out-of- bounds read issues [CVE-2026-33857 CVE-2026-34032]; fix buffer over-read issue [CVE-2026-34059] arduino-core-avr New upstream stable release; fix buffer overflow issue [CVE-2025-69209] augeas Fix NULL pointer dereference issue [CVE-2025-2588] awstats Prevent command injection [CVE-2025-63261] base-files Update for the point release bash Rebuild with updated glibc busybox Fix stack overflow [CVE-2022-48174] and use- after-free [CVE-2023-42363 CVE-2023-42364 CVE-2023-42365] errors c3p0 Fix recursive entity expansion issue [CVE-2019-5427] calibre Fix path traversal issues [CVE-2026-25635 CVE-2026-25636 CVE-2026-26064 CVE-2026-26065]; fix code execution issue [CVE-2026-25731]; fix HTTP response header injection issue [CVE-2026-27810]; fix IP ban bypass issue [CVE-2026-27824] cdebootstrap Rebuild with updated glibc chkrootkit Rebuild with updated glibc chrony Open the PHC reference clock with the O_RDWR flag when enabling the extpps option composer Fix code execution issue [CVE-2023-43655]; fix command injection issues [CVE-2026-40261 CVE-2026-40176] containerd Fix CRI Attach implementation [CVE-2025-64329]; fix overly broad directory permissions [CVE-2024-25621]; fix large UID:GID (> 32bit) overflow [CVE-2024-40635] dar Rebuild with updated glibc debsig-verify Rebuild with updated dpkg deets Rebuild with updated dpkg distro-info-data Add Ubuntu 26.10 "Stonking Stingray" docker.io Rebuild with updated containerd, glibc dovecot Correct incomplete backport of CVE-2026-27855 fix; fix memory leak in CVE-2026-27857 fix dpkg New upstream stable release; fix insufficient permissions check leading to possible denial of service issue [CVE-2025-6297]; fix denial of service issue [CVE-2026-2219]; fix buffer over- read issue; fix uninitialized variable warning with Rules-Requires-Root; fix segmentation fault in dpkg-trigger; translation fixes erlang Fix denial of service issues [CVE-2025-48038 CVE-2025-48039 CVE-2025-48040 CVE-2025-48041]; fix HTTP request smuggling issue [CVE-2026-23941]; fix path traversal issues [CVE-2026-23942 CVE-2026-21620]; fix compression bomb issue [CVE-2026-23943] exim4 Fix GnuTLS hostname verify of a server certificate with a zero-length Subject; fix denial of service issue [CVE-2026-40684]; fix out-of-bounds read/write issues [CVE-2026-40685 CVE-2026-40686 CVE-2026-40687] fonttools Fix XML External Entity injection issue [CVE-2023-45139]; fix code execution issue [CVE-2025-66034] glance Fix server-side request forgery issue [CVE-2026-34881]; fix build failure glib2.0 Fix timezone handling with Debian & Ubuntu's symlinks; fix missing input validation in g_buffered_input_stream_peek [CVE-2026-0988]; fix integer overflow in base64 encoding [CVE-2026-1484]; fix buffer underflow vulnerability in content type parsing [CVE-2026-1485]; fix integer overflow in unicode conversion [CVE-2026-1489] glibc Fix integer overflow issue [CVE-2026-0861]; fix uninitialised memory use issue [CVE-2025-15281]; fix incorrect handling of DNS responses [CVE-2026-4437]; fix return of invalid DNS hostnames [CVE-2026-4438]; fix assertion failure [CVE-2026-4046]; fix performance bottleneck with ASAN on 32-bit arm; fix incorrect backtrace unwinding; fix typo in wmemset ifunc selector that caused AVX2/AVX512 paths to be skipped; fix POWER optimized rawmemchr function; fix stack content leak issue [CVE-2026-0915] gnuais Fix displaying map in gnuaisgui golang-github-containerd-stargz-snapshotter Rebuild with updated containerd golang-github-containers-buildah Rebuild with updated containerd golang-github-openshift-imagebuilder Rebuild with updated containerd gpsd Fix out-of-bounds write issue [CVE-2025-67268]; fix integer underflow issue [CVE-2025-67269] grub-efi-amd64-signed Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set "Protected: yes" for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix "video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG" [CVE-2024-45774]; fix "commands/extcmd: Missing check for failed allocation" [CVE-2024-45775]; fix "commands/dump: The dump command is not in lockdown when secure boot is enabled" [CVE-2025-1118]; fix integer overflow issues [CVE-2024-45776 CVE-2024-45777 CVE-2024-45778 CVE-2024-45779 CVE-2024-45780 CVE-2025-0677 CVE-2025-0678 CVE-2025-0684 CVE-2025-0685 CVE-2025-0690 CVE-2025-1125]; fix out-of- bounds write issues [CVE-2024-45781 CVE-2024-45782 CVE-2025-0624]; fix use-after- free issues [CVE-2024-45783 CVE-2025-0622]; fix buffer overflow issue [CVE-2025-0689] grub-efi-arm64-signed Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set "Protected: yes" for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix "video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG" [CVE-2024-45774]; fix "commands/extcmd: Missing check for failed allocation" [CVE-2024-45775]; fix "commands/dump: The dump command is not in lockdown when secure boot is enabled" [CVE-2025-1118]; fix integer overflow issues [CVE-2024-45776 CVE-2024-45777 CVE-2024-45778 CVE-2024-45779 CVE-2024-45780 CVE-2025-0677 CVE-2025-0678 CVE-2025-0684 CVE-2025-0685 CVE-2025-0690 CVE-2025-1125]; fix out-of- bounds write issues [CVE-2024-45781 CVE-2024-45782 CVE-2025-0624]; fix use-after- free issues [CVE-2024-45783 CVE-2025-0622]; fix buffer overflow issue [CVE-2025-0689] grub-efi-ia32-signed Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set "Protected: yes" for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix "video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG" [CVE-2024-45774]; fix "commands/extcmd: Missing check for failed allocation" [CVE-2024-45775]; fix "commands/dump: The dump command is not in lockdown when secure boot is enabled" [CVE-2025-1118]; fix integer overflow issues [CVE-2024-45776 CVE-2024-45777 CVE-2024-45778 CVE-2024-45779 CVE-2024-45780 CVE-2025-0677 CVE-2025-0678 CVE-2025-0684 CVE-2025-0685 CVE-2025-0690 CVE-2025-1125]; fix out-of- bounds write issues [CVE-2024-45781 CVE-2024-45782 CVE-2025-0624]; fix use-after- free issues [CVE-2024-45783 CVE-2025-0622]; fix buffer overflow issue [CVE-2025-0689] grub2 Remove NTFS and jfs from monolithic EFI image; update SBAT levels; set "Protected: yes" for -signed packages so they cannot easily be removed; backport upstream regression fixes; fix "video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG" [CVE-2024-45774]; fix "commands/extcmd: Missing check for failed allocation" [CVE-2024-45775]; fix "commands/dump: The dump command is not in lockdown when secure boot is enabled" [CVE-2025-1118]; fix integer overflow issues [CVE-2024-45776 CVE-2024-45777 CVE-2024-45778 CVE-2024-45779 CVE-2024-45780 CVE-2025-0677 CVE-2025-0678 CVE-2025-0684 CVE-2025-0685 CVE-2025-0690 CVE-2025-1125]; fix out-of- bounds write issues [CVE-2024-45781 CVE-2024-45782 CVE-2025-0624]; fix use-after- free issues [CVE-2024-45783 CVE-2025-0622]; fix buffer overflow issue [CVE-2025-0689] gvfs Use control connection address for PASV data [CVE-2026-28295]; reject paths containing CR/LF characters [CVE-2026-28296] kissfft Fix integer overflow issues [CVE-2025-34297 CVE-2026-41445] kpackage Skip flaky test lemonldap-ng Update documentation to avoid using unsecured Nginx variable libarchive Fix out-of-bounds read issues [CVE-2025-5918 CVE-2026-4424]; fix denial of service issues [CVE-2026-4111 CVE-2026-4426]; fix possible code execution issue [CVE-2026-5121] libcap2 Fix time of check / time of use issue [CVE-2026-4878] libexif Fix integer underflow issues [CVE-2026-40386 CVE-2026-32775]; fix integer overflow issue [CVE-2026-40385] libnet-cidr-lite-perl Fix ACL bypass issues [CVE-2026-40198 CVE-2026-40199] libpng1.6 Fix heap buffer overflow issues [CVE-2026-22801 CVE-2026-22695] libpod Rebuild with updated containerd libreoffice Fix incomplete fix for CVE-2024-12426 libreoffice-texmaths Add dependency on dvipng/dvisvgm libuev Fix buffer overrun issue [CVE-2022-48620] libvncserver Fix out-of-bounds read issue [CVE-2026-32853]; fix null pointer dereference issue [CVE-2026-32854] libxml-security-java Fix private key disclosure issue [CVE-2023-44483] libxslt Fix deterministic generate-id() regression causing build failures in other packages lxc Fix authorisation bypass issue [CVE-2026-39402] mapserver Fix SQL injection issue [CVE-2025-59431]; fix buffer overflow issue [CVE-2026-33721]; fix heap-buffer-overflow and double-free issues in maplexer modsecurity-crs Fix rule bypass issue [CVE-2023-38199]; fix file extension blocking bypass issue [CVE-2026-33691] mongo-c-driver Fix insufficient validation issues [CVE-2025-14911 CVE-2026-6231]; fix denial of service issue [CVE-2026-4359]; fix buffer overflow issue [CVE-2026-6691]; improve handling of corrupt GridFS files nginx Fix buffer overflow issues [CVE-2026-27654 CVE-2026-27784 CVE-2026-32647]; fix session authentication issues [CVE-2026-27651 CVE-2026-28753]; fix OCSP result bypass issue [CVE-2026-28755]; use "$host" instead of "$http_host" openssh Ensure scp does not unexpectedly make transferred files setuid or setgid [CVE-2026-35385]; fix command execution issue [CVE-2026-35386]; fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys [CVE-2026-35387]; use connection multiplexing confirmation for proxy-mode multiplexing sessions [CVE-2026-35388]; fix handling of the authorized_keys "principals" option [CVE-2026-35414]; validate user and host names for ProxyJump/-J options passed via the command line; fix possible code execution issues [CVE-2025-61984 CVE-2025-61985] openssl New upstream stable release p7zip Rebase onto newer 7zip version; fix integer underflow issue [CVE-2023-31102]; fix code execution issues [CVE-2023-40481 CVE-2025-11001 CVE-2025-11002]; fix denial of service issue [CVE-2024-11612]; fix null pointer dereference issue [CVE-2025-53817]; fix handling of symbolic links [CVE-2025-55188]; fix buffer overflow issue [CVE-2023-52168]; fix out-of- bounds read issues [CVE-2023-52169 CVE-2022-47069] p7zip-rar Rebase onto newer 7zip version; fix denial of service issue [CVE-2025-53816] php-dompdf Fix denial of service issue [CVE-2023-50262] php-league-commonmark Fix cross site scripting issue [CVE-2025-46734]; fix validation bypass issues [CVE-2026-30838 CVE-2026-33347] php-phpseclib Fix denial of service issue [CVE-2024-27355]; fix variable time comparison issue [CVE-2026-40194] php-phpseclib3 Fix denial of service issue [CVE-2024-27355]; fix variable time comparison issue [CVE-2026-40194] phpseclib Fix denial of service issue [CVE-2024-27355]; fix variable time comparison issue [CVE-2026-40194] plastimatch Remove non-free files postgresql-15 New upstream stable release; fix buffer overrun issue [CVE-2026-2006] proftpd-dfsg Fix denial of service issue [CVE-2024-57392]; fix SQL injection issue [CVE-2026-42167]; fix "mod_radius: Message-Authenticator check always fails" pymupdf Rebuild with updated mupdf python-authlib Fix algorithm confusion issue [CVE-2024-37568]; fix cross-site request forgery issue [CVE-2025-68158]; fix denial of service issues [CVE-2025-62706 CVE-2025-61920]; fix policy bypass issue [CVE-2025-59420] python-django Fix regular expression-based denial of service issue [CVE-2023-36053], denial of service issues [CVE-2024-38875 CVE-2024-39614 CVE-2024-41990 CVE-2024-41991], user enumeration issue [CVE-2024-39329], directory traversal issue [CVE-2024-39330], excessive memory consumption issue [CVE-2024-41989], SQL injection issue [CVE-2024-42005] python-ldap Fix insufficient escaping issue [CVE-2025-61911]; fix denial of service issue [CVE-2025-61912] python3.11 Fix header injection issues [CVE-2025-11468 CVE-2025-15282 CVE-2026-0672 CVE-2026-0865 CVE-2026-1299]; fix denial of service issues [CVE-2025-12084 CVE-2025-13836 CVE-2025-13837 CVE-2025-6069 CVE-2025-6075 CVE-2025-8194]; fix insufficient validation in zipFile [CVE-2025-8291]; fix use-after-free issue [CVE-2025-4516] qemu Rebuild with updated gnutls28, glibc, glib2.0 request-tracker5 Fix builds of CKEditor when firefox is >= 148 sash Rebuild with updated glibc sed Fix time of check / time of use issue [CVE-2026-5958] sioyek Rebuild with updated mupdf skeema Rebuild with updated containerd snapd Rebuild with updated libcap2 sudo Fix exec_mailer permissions checks [CVE-2026-35535] supermin Rebuild with updated glibc swupdate Fix denial of service issue [CVE-2026-28525] systemd Fix assert and freeze [CVE-2026-29111]; fix code execution issues [CVE-2026-40225 CVE-2026-4105]; fix nspawn escape-to-host issue [CVE-2026-40226] taglib Fix segmentation violation issue [CVE-2023-47466] tpm2-pkcs11 Fix NULL pointer dereference during database migration tripwire Rebuild with updated glibc tzdata New upstream release; update data for British Columbia user-mode-linux Rebuild with updated linux vips Fix buffer overflow issues [CVE-2026-2913 CVE-2026-3147 CVE-2026-3281]; fix memory corruption issue [CVE-2026-3145]; fix null pointer dereference issue [CVE-2026-3146]; fix out of bound read issues [CVE-2026-3282 CVE-2026-3283]; fix integer overflow issue [CVE-2026-3284] wireless-regdb New upstream stable release; update regulatory information for several countries wireshark Fix denial of service issues [CVE-2024-11596 CVE-2024-9781 CVE-2025-11626 CVE-2025-13499 CVE-2025-13945 CVE-2025-13946 CVE-2025-1492 CVE-2025-5601 CVE-2025-9817 CVE-2026-0960] xorg-server Fix buffer re-use issue [CVE-2026-33999]; fix / improve bounds checking [CVE-2026-34000 CVE-2026-34003]; fix use after free issue [CVE-2026-34001]; fix out-of-bounds read issue [CVE-2026-34002] zsh Rebuild with updated libcap2, glibc zvbi Fix uninitialised pointer issue [CVE-2025-2173]; fix integer overflow issues [CVE-2025-2174 CVE-2025-2175 CVE-2025-2176 CVE-2025-2177] A complete list of all accepted and rejected packages together with rationale is on the preparation page for this revision: <https://release.debian.org/proposed-updates/oldstable.html> Removed packages ---------------- The following packages will be removed due to circumstances beyond our control: Package Reason ------- ------ suricata Unsupportable; possible security issues; maintained via backports zulucrypt Security issues; unmaintained If you encounter any issues, please don't hesitate to get in touch with the Debian Release Team at "[email protected]".
signature.asc
Description: PGP signature
