The Debian LTS Team, funded by [Freexian s Debian LTS offering]
(
https://www.freexian.com/lts/debian/), is pleased to report its activities for
February.
Activity summary
During the month of February, 20 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 35 DLAs fixing 527 CVEs.
We also welcomed Arnaud Rebillout to the team and had to say farewell to Roberto, who left the team after more than nine years as part of it.
The team continued preparing security updates in its usual rhythm. Beyond the
updates targeting Debian 11 ( bullseye ), which is the current release under LTS,
the team also proposed updates for more recent releases (Debian 12 ( bookworm )
and Debian 13 ( trixie )), including Debian unstable.
Notable security updates:
- Guilhem Moulin prepared DLA 4492-1
for gnutls28 to fix vulnerabilities which may lead to Denial of Service.
- Utkarsh Gupta prepared DLA 4464-1
for xrdp, to fix a a vulnerability that could allow remote attackers to execute arbitrary code on the target system.
- Emilio Pozuelo Monfort prepared DLA-4465-1
to replace ClamAV 1.0 with ClamAV 1.4. This latter is the current LTS version supported by upstream.
- Markus Koschany prepared DLA 4468-1
for tomcat9, to fix a vulnerability that can be used to bypass security constraints.
- Santiago Ruano Rinc n prepared DLA 4471-1
to update package debian-security-support, the Debian security coverage checker.
- Bastien Roucari s prepared DLA 4473-1
for zabbix, to fix a potential remote code execution vulnerability.
- Paride Legovini prepared DLA 4478-1
for tcpflow, to fix a vulnerability that might result in DoS and potentially code execution.
- Thorsten Alteholz prepared DLA 4477-1
for munge, to fix a vulnerability which may allow local users to leak the MUNGE cryptographic key and forge arbitrary credentials.
- Ben Hutchings prepared DLA 4475-1 and DLA 4476-1
for Linux kernel updates.
- Chris Lamb prepared DLA 4482-1
for ceph, to fix SSL certificate checking in the Python bindings.
- Andreas Henriksson prepared DLA 4491-1
to fix vulnerabilities in glib2.0, which could result in denial of service, memory corruption or potentially arbitrary code execution.
Contributions from outside the LTS Team:
- The update of nova was prepared by the maintainer, Thomas Goirand.
The corresponding DLA 4486-1 was published by Carlos Henrique Lima Melara.
- The updates of thunderbird were prepared by the maintainer Christoph Goehre.
The corresponding DLA 4466-1 and DLA 4495-1 was published by Emilio Pozuelo Monfort.
The LTS Team has also contributed with updates to the latest Debian releases:
- Jochen prepared a point update of wireshark for bookworm (#1127945).
- Jochen prepared point updates of erlang for trixie (#1127606) and bookworm (#1127607).
- Bastien helped preparing DSA 6160-1 for netty and uploaded a fixed package to unstable.
- Bastien prepared a point update of zabbix for trixie (#1127437).
- Tobias prepared a point update of modsecurity-crs for bookworm (#1128655).
- Tobias prepared a point update of busybox for bookworm (#1129503).
- Tobias helped preparing DSA 6138-1 for libpng1.6.
- Daniel prepared point updates of python-authlib for trixie (#1129477) and bookworm (#1129246).
- Ben uploaded several Linux kernel packages to trixie-backports and bookworm-backports.
- Ben prepared point updates of wireless-regdb for trixie and bookworm.
Other than the work related to updates, Sylvain made several improvements to
the documentation and tooling used by the team.
Some milestones in the lifecycle of two Debian releases are just around the corner.
The support of Debian 12 will be handed over to the LTS team on June 11th 2026.
After August 31st, support for Debian 11 will move from Debian LTS to ELTS managed by Freexian.
