---------------------------------------------------------------------------- Debian Stable Updates Announcement SUA 282-1 https://www.debian.org/ [email protected] Jonathan Wiltshire July 5th, 2026 ----------------------------------------------------------------------------
Upcoming Debian 12 Update (12.15) An update to Debian 12 is scheduled for Saturday, July 11th, 2026. As of now it will include the following bug fixes. They can be found in "bookworm-proposed-updates", which is carried by all official mirrors. Please note that packages published through security.debian.org are not listed, but will be included if possible. Testing and feedback would be appreciated. Bugs should be filed in the Debian Bug Tracking System, but please make the Release Team aware of them by copying "[email protected]" on your mails. The point release will also include a rebuild of debian-installer. Miscellaneous Bugfixes ---------------------- This oldstable update adds a few important corrections to the following packages: Package Reason ------- ------ 7zip New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] apache2 Fix HTTP/2 request DoS and file handle exhaustion [CVE-2026-49975 CVE-2026-48913]; fix proxy, DAV, LDAP, SSL, XML and header memory/crash issues [CVE-2026-29167 CVE-2026-34355 CVE-2026-34356 CVE-2026-42535 CVE-2026-42536 CVE-2026-43951 CVE-2026-44185]; fix proxy FTP directory listing XSS and backend loop [CVE-2026-29170 CVE-2026-44186]; restrict htaccess expression file access [CVE-2026-44119]; fix regex parsing underflow [CVE-2026-44631]; correct SSI, file-cache, WebDAV DELETE and proxy health-check handling; update documentation and tests appstream Rebuild with updated libxmlb astropy Fix FTBFS (on some architectures) through failing tests base-files Update for the point release beets Fix XSS vulnerability [CVE-2026-42052]; fix FTBFS in tests calibre Fix various potential security issues; read resources only from book contents [CVE-2026-33206]; keep extracted files within container dir [CVE-2026-30853]; prevent reading background images from outside the config dir [CVE-2026-33205] chrony Ensure that if-up/down hook scripts exit successfully cloud-init Fix OpenStack bond initialisation composer Fix support for new GitHub token format [CVE-2026-45793] curl Fix cache poisoning issue [CVE-2025-10148]; fix data leak issues [CVE-2025-14524 CVE-2026-3783]; fix incorrect connection re-use issues [CVE-2025-14819 CVE-2026-3784 CVE-2026-5773 CVE-2026-7168] dar Rebuild with updated libgcrypt20 dcmtk Fix NULL pointer dereference issues [CVE-2022-4981 CVE-2025-14841]; fix memory corruption issues [CVE-2025-2357 CVE-2025-9732 CVE-2025-14607]; fix command injection issue [CVE-2026-5663]; fix buffer overflow issues [CVE-2026-10194 CVE-2026-12805] debian-security-support Prepare support limitations ahead of transition to LTS delve Fix FTBFS on 4th generation EYPC processors dhcpcd5 Fix NULL pointer dereference issue [CVE-2025-70102]; fix out-of-bounds write issue [CVE-2026-56114] firewalld Fix dbus policy checking [CVE-2026-4948] fwupd Rebuild with updated libjcat, libxmlb; add support for updating DBX and KEK stores geoip-database Revert to a DFSG-compatible version ghdl Rebuild with updated gcc-12 giflib Fix memory corruption issues [CVE-2026-23868 CVE-2026-26740] gnome-firmware Rebuild with updated libxmlb; backport patch for libfwupd3 compatibility gnome-software Rebuild with updated libxmlb; backport patch for libfwupd3 compatibility graphite2 Fix out-of-bounds write [CVE-2026-50593] gss Fix FTBFS caused by an expired Kerberos ticket; avoid krb5context self-tests with timebomb horizon Fix escaping of special characters in project ironic Fix file disclosure via image sources [CVE-2025-44021]; fix console command injection [CVE-2026-42510]; fix Swift token disclosure [CVE-2026-42997]; fix unsafe template execution [CVE-2026-44916] keystone Fix behaviour of user_enabled_invert [CVE-2026-40683]; prevent unauthorized EC2 credential creation and deletion [CVE-2026-33551] libapache-session-browseable-perl Improve entropy of generated session IDs libbytes-random-secure-perl Fix incorrect usage of seed in PRNG [CVE-2026-11625] libcaca Prevent undefined behaviour in overflow check [CVE-2026-42046] libcrypt-pbkdf2-perl Change default hash algorithm to HMAC-SHA256 and default iterations to 600,000 [CVE-2026-9641]; generate salts using Crypt::URandom [CVE-2026-9638]; use a constant- time comparison in `validate` to avoid timing attacks [CVE-2017-20240] libhtml-gumbo-perl Fix uninitialized memory access [CVE-2025-15646] libhtml-parser-perl Fix heap-use-after-free in _decode_entities [CVE-2026-8829] libjcat Add support for ed25519 types and SHA512 hashes libnet-cidr-lite-perl Fix IP/CIDR parser validation: reject non-ASCII digits and trailing newlines [CVE-2026-55190]; reject zero-padded CIDR masks [CVE-2026-45191] libreoffice Gracefully handle failure in graphite2 libvncserver Fix buffer overflow and out-of-bounds write [CVE-2026-44988 CVE-2026-50538] libxml-libxml-perl Fix out-of-bounds read [CVE-2026-8177] libxml2 Fix catalogue recursion and duplicate-catalog handling [CVE-2025-8732 CVE-2026-0990 CVE-2026-0992]; limit RelaxNG include recursion [CVE-2026-0989]; fix xmllint shell memory leak [CVE-2026-1757]; correct schematron regression- test outputs [CVE-2025-49794 CVE-2025-49796]; fix XML writer and schematron memory leaks; mitigate RelaxNG validation use-after-free; update catalogue and RelaxNG regression tests libxmlb Add support for zstd decompression; fix XMLb store/truncation validation; correct query binding/index handling; fix XML export and empty text() handling linuxcnc Sanitize module names mariadb New upstream stable release; fix code execution issues [CVE-2025-13699 CVE-2026-44168 CVE-2026-44170 CVE-2026-48163 CVE-2026-48165 CVE-2026-49261]; fix denial of service issues [CVE-2026-21968 CVE-2026-34303]; fix logging bypass issue [CVE-2026-3494]; fix path traversal issue [CVE-2026-44171]; fix SQL injection issue [CVE-2026-44172]; fix incomplete privilege check issue [CVE-2026-44173]; fix "Illegal mix of collations" error; fix "Mroonga hangs on invalid index flag"; fix crash in information_schema.table_constraints mesa Fix WebGPU/SPIR-V allocation handling [CVE-2026-40393] modsecurity Prevent denial of service in hexDecode handling [CVE-2026-30923]; prevent denial of service in SSN/CPF/SVNR verification [CVE-2026-42268] mxml Fix out-of-bounds read [CVE-2026-5037] node-flatted Fix prototype pollution issue [CVE-2026-33228] node-jschardet Fix build link references node-regexpp Add missing link to undici-types ojalgo Reduce frequency of built-time test failures openslide Fix possible code execution issue [CVE-2026-48977] p7zip New upstream stable release; fix buffer overflow issues [CVE-2026-48092 CVE-2026-48095]; fix memory disclosure issue [CVE-2026-48101]; fix out-of-bounds read issues [CVE-2026-48102 CVE-2026-48103 CVE-2026-48111 CVE-2026-48112]; fix uninitialised memory read issue [CVE-2026-48104] php-guzzlehttp-psr7 Fix Host authority validation [CVE-2026-48998]; reject control characters in URI hosts [CVE-2026-49214]; harden ServerRequest globals handling; normalise global header values; encode literal plus signs in query helpers php-twig Security update phpunit Fix unsafe deserialization in PHPT code coverage handling [CVE-2026-24765] plasma-discover Backport patch for libfwupd3 compatibility prometheus Fix date-sensitive build-time test protobuf Fix parser recursion limits [CVE-2024-7254 CVE-2025-4565 CVE-2026-0994 CVE-2026-6409] pydantic Fix denial of service in email verification [CVE-2024-3772] pymatgen Fix denial of service in GaussianInput.from_string [CVE-2022-42964] python-ase Disable unreliable built-time test python-django Update test suite following changes in python3.13 python-filelock Fix symlink vulnerabilies [CVE-2025-68146 CVE-2026-22701] python-markdown Fix parsing of bogus HTML markup [CVE-2025-69534] python-pyramid Fix information disclosure issue [CVE-2023-40587] python-xmltodict Fix XML injection issue [CVE-2025-9375] python3.11 Prevent incorrect tar archive handling [CVE-2025-13462]; ensure bytecode-only imports use normal security checks [CVE-2026-2297]; reject unsafe cookie values [CVE-2026-3644]; prevent XML parser crashes [CVE-2026-4224]; prevent browser command injection [CVE-2026-4519]; prevent bz2/lzma decompressor memory corruption [CVE-2026-6100]; restore XML autopkgtests qemu Rebuild with updated gnutls28 rhino Fix denial of service issue [CVE-2025-66453] rlottie Fix out-of-bounds read issue [CVE-2026-10305]; fix denial of service issues [CVE-2026-47319 CVE-2026-47320] rsync Reject excessively long HTTP proxy response lines [CVE-2026-45232] ruby-css-parser Fix validation of HTTPS certificates for remote CSS [CVE-2026-44312] rust-time Fix denial of service [CVE-2026-25727] science.js Fix build time race condition sentry-python Fix subprocess environment sanitisation [CVE-2024-40647] shim New upstream release; build with default gcc; set SBAT revocation level to 2025021800 shim-helpers-amd64-signed Update to shim 16.1-2~deb12u1 shim-helpers-arm64-signed Update to shim 16.1-2~deb12u1 shim-helpers-i386-signed Update to shim 16.1-2~deb12u1 shim-signed Ensure Secure Boot compatibility with 2023 Microsoft UEFI CA; check for likely boot issues before installation; combine and verify multiple shim signatures; update signed shim binaries sqlite-utils Add dependency on python3-click-default-group sshfs-fuse Add contain_symlinks option to prevent symlink escape attacks [CVE-2026-47187]; reject hostname option injection via bracketed mount source [CVE-2026-48711] sylpheed Fix link checking [CVE-2021-37746] user-mode-linux Rebuild with updated linux vitrage Fix remote code execution vulnerability [CVE-2026-28370] webkit2gtk Reinstate Priority field wireless-regdb New upstream stable release; update regulatory information for several countries xz-utils Fix buffer overflow issue [CVE-2026-34743] A complete list of all accepted and rejected packages together with rationale is on the preparation page for this revision: <https://release.debian.org/proposed-updates/oldstable.html> Removed packages ---------------- The following packages will be removed due to circumstances beyond our control: Package Reason ------- ------ smb4k Difficult to fix security issues If you encounter any issues, please don't hesitate to get in touch with the Debian Release Team at "[email protected]".
signature.asc
Description: PGP signature
