With 26.10 in Feature Freeze, wore my Release team hat to:
Review and approve a bunch of Feature Freeze Exceptions, including the Go 1.27 transition, Qt 6.11.2, rust-coreutils 0.12.0, devscripts 2.6.12, kdump-tools moving to dracut, and a few GCE packages.
Point linux-entra-sso to the SRU team, as it didn t need an FFe at all, and milestone a couple of bugs for 26.10.
Continued to push for infrastructure improvements:
Made ubuntu-cdimage more resilient to Launchpad hiccups (MP).
Taught generate-freeze-block in ubuntu-archive-tools a couple of new options (--skip-update and --series) and better error handling (MP).
Bumped the arm64 generic non-cloud image to 4.5G in livecd-rootfs and uploaded it as 26.10.16; also sponsored the follow-up 26.10.17 for Chlo .
Reviewed quite a lot of MPs - britney hints, meta-release, ubuntu-release-tools, ubuntu-archive-tools, ubuntu-cdimage, livecd-rootfs, ubuntu-seeds, and so on.
Did Archive Admin, DMB, and Release team duties as usual.
Debian (E)LTS
This month I have worked 33.5 hours
on Debian Long Term Support (LTS)
and on its sister Extended LTS
project and did the following things:
(A quick note that I did quite a lot of the work during my work as Frontdesk that went on till 4th Oct, so 33.50 hours include the work I did till 4th October 2026.)
Released Security Updates
node-lodash: Prototype pollution in _.unset and _.omit (plus a bypass of the initial fix for it), and code injection via the imports option of _.template.
This is the bookworm follow-up to DLA 4663-1 that I carried over from July. The update had been sitting prepared and tested on debusine, so once the upstream discussion wrapped up, it went straight out. It also carries an extra patch to the lodash-cli dependency map - without it, the regenerated lodash.template module throws assignWith is not defined at runtime, which node-gulp-util s autopkgtest caught.
libpng1.6: Use-after-free of zlib input in png_read_end() after incomplete zTXt, iTXt, or iCCP decompression, which could result in denial of service.
I picked this one up whilst on front desk; the upstream fix that went into trixie via DSA 6537-1 applied to 1.6.39 as-is.
Work in Progress
libpng1.6: The same CVE-2026-46675.
[ELTS]: Claimed in ela-needed; the same upstream fix applies to all three ELTS suites, so this should go out shortly.
Other Activities
[E/LTS] Did my front-desk week from 28-09 to 04-10.
Over the week I did roughly:
Triage of 524 unique CVEs across 192 source packages and all four suites. And 1 automated ELTS end-of-life sweep.
Additional data is now part of the front-desk job too, so 75 commits record it for 179 CVEs across 71 packages.
Newly queued 22 source packages - 13 in dla-needed (apache2, chromium, firefox-esr, libnet-idn-encode-perl, libpng1.6, node-shell-quote, nvidia-graphics-drivers, openssl, pcre2, php-mongodb, php8.2, social-auth-core, and wpa) and 16 in ela-needed (apache2, firefox-esr, gegl, lemonldap-ng, libnet-idn-encode-perl, libpng1.6, libwebsockets, nsd, nvidia-graphics-drivers, pcre2, php7.0, php7.3, php7.4, rar, unrar-nonfree, and wpa), 7 of them in both. Also widened 3 ELTS entries to bullseye - antiword, ocaml, and openvswitch.
Most of the interesting work was again in the <not-affected> verdicts: 217 of 263 (83%, across 57 packages) rest on showing that the vulnerable code or feature isn t in the source we ship. Another 17 cover incomplete upstream fixes that we either never shipped or shipped with the follow-up already in (expat, libxml2, node-tar, and pyjwt). 15 come from bundled components we don t ship - node-ajv again, which uses uri-js and not fast-uri, and nvidia-open, which doesn t ship the NGX updater. And 13 are vendor- or platform-specific - openssh s CVE-2026-55654 lives only in a Red Hat GSSAPI patch, and the netdata and PHP ones only affect Windows.
Did 4 rounds of newly supported bullseye packages (33 packages overall), plus libmail-mboxparser-perl for buster - 34 in all. The existing CVE data mostly held up; the real finds were discovery gaps. One interesting gotcha: sid renamed stunnel4 to stunnel, and two new CVEs were associated only with the new name, so they never showed up for trixie, bookworm, or any ELTS suite. I also sorted the 180 Triage needed entries (57 packages) from elts-eol by where each was already handled, and triaged for ELTS the 100 that trixie or bookworm had already decided; the rest come next. And I imported 79 package-level lines for the older source names ELTS still ships (tomcat8, php7.0/7.3/7.4, netty-3.9, openssl1.0, python2.7/3.5/3.7, and pypy).
Caught some inconsistencies in released advisories: DLA 4801-1 (swift) was missing a CVE, ELA 1831-1 (redis) listed the wrong one, and DLA 4808-1 (network-manager-l2tp) listed CVE-2026-75883 - an ID that was renamed and then reassigned to an unrelated ppp issue. I fixed all three in the tracker s advisory lists.
Made the Security team and the uploaders aware of regressions from our own updates:
libde265: the CVE-2026-49337 fix in DLA 4789-1/ELA 1828-1 (and DSA 6413-1) misses upstream s follow-up commit.
libxml2 CVE-2026-76781 and policykit-1 CVE-2026-85498 were introduced by our own back-ports; the policykit-1 one is harmless.
expat: the CVE-2025-59375 backport in DLA 4807-1 is compiled out, because XML_GE is never defined.
xen: DLA 4818-1 s XSA-491 fix makes XSA-510 reachable.
gegl: the CVE-2026-2049/2050 back-port in ELA 1650-1 rejects valid RLE .hdr files.
log4cxx: DLA 4322-1 broke UTF-8 in JSONLayout output. That one is functional, not security.
Helped correct a set of triages and let the Debian Security team know:
ruby-json CVE-2026-71847: the vulnerable code was never in a released Debian version.
openssh CVE-2026-55654: only affects a Red Hat-specific GSSAPI patch.
three libxml2 issues that don t affect trixie either.
the stunnel4 rename above.
trixie <no-dsa> lines on jsch, node-qs, and ruby-loofah, where trixie s version doesn t have the vulnerable feature at all.
Independently found a security issue in rclone and reported it privately upstream through a GitHub security advisory. Upstream already had a report for the same issue, so they folded mine into the existing advisory and credited me as a co-reporter.
Also found some bugs in the additional-data tooling, e.g. cve-ad --package P --severity tbd wipes the CVE-level severity, and the schema doesn t validate package-level entries at all.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
Here s my monthly but brief update about the activities I ve done in the FOSS world.
Debian
I barely did anything this month as I was mostly on vacation - summer break. Went to Iceland for 2 weeks and then watched the Dutch GP the following weekend - it was fab!
Attended and drove a few sessions in the mid-cycle sprints.
Debian (E)LTS
This month I have worked 0 hours
on Debian Long Term Support (LTS)
and on its sister Extended LTS
project as I was on vacation the whole month.
I ll follow up with the two packages in September.
Until next time. :wq for today.
Activity summary
During the month of July, 23 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 52 DLAs fixing 2159 CVEs.
In July, the Debian Stable Release Managers published the
last point release of Debian 12 ( bookworm ),
after which the Debian LTS team took full responsibility of Debian 12. This
completes the handover from the Security Team, that took place in June. This
also marks the second month in a row where the Debian LTS has been focusing on
two simultaneous Debian releases.
Other than Debian 12, the team is maintaining Debian 11 ( bullseye ), which
will reach the end of its Long Term Support on 31 August 2026. After that
date, Freexian will continue the security support under the
Extended LTS offer.
The team published several notable updates:
jq (DLA 4662-1
and DLA 4661-1)
prepared by Andreas Henriksson in collaboration with Jochen Sprickerhof,
addressing multiple vulnerabilities.
Several updates for the different linux supported versions prepared by Ben
Hutchings, in collaboration with Emilio Pozuelo Monfort. Other than the
regular security advisories:
DLA 4664-1,
DLA 4665-1,
DLA 4671-1,
DLA 4688-1, and
DLA 4700-1, Ben
started preparing packages of 6.12 via bookworm-backports.
nginx (DLA 4667-1),
updated for bookworm by Carlos Henrique Lima Melara, as a follow up of the
bullseye update
(DLA 4660-1),
that was prepared in June.
grub2/bullseye (DLA 4685-1),
prepared by Emilio. Other than addressing several security issues, this DLA
was needed for being able to update the shim boot loader.
samba (DLA 4692-1),
uploaded by Markus Koschany, to fix several security flaws in bullseye,
including issues that could yield to remote code execution.
imagemagick (DLA 4680-1
and DLA 4696-1),
prepared by Bastien Roucari s, addressing several issues that could lead to
denial of service, information disclosure or potentially arbitrary code
execution in some scenarios.
poppler (DLA 4709-1),
by Guilhem Moulin, fixing several vulnerabilities.
nss (DLA-4694-1),
by Jochen, fixing flaws that may result in or denial of service or
potentially the execution of arbitrary code.
Other contributions:
Besides the work on security updates, different documentation and tooling
changes were needed, especially in the context of the Debian 12 handover. This
work was mainly done by
Sylvain Beucler.
The Debian LTS Team, funded by [Freexian s Debian LTS offering]
(https://www.freexian.com/lts/debian/), is pleased to report its activities for
June.
Activity summary
During the month of June, 20 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 48 DLAs fixing 231 CVEs.
Debian 12 ( bookworm ) has been handed over to
the LTS Team on June 11th. During this handover Sylvain helped to update relevant tools and
documentation. If you benefit from Debian, especially during the
full 5-year lifecycle, please consider subscribing as a sponsor of Debian LTS:
https://www.freexian.com/lts/debian/.
Moreover, Debian 11 ( bullseye ) will reach the end of the Debian LTS period on
August 31st. After that, Freexian will continue the security support under the
Extended LTS offer.
The team published several notable updates:
haveged update
(DLA-4616-1),
prepared by Thorsten, to address local privilege escalation.
tomcat9 update
(DLA-4619-1),
prepared by Markus, to address, among others, an authentication bypass.
apache2 update
(DLA-4620-1),
prepared by Bastien, to address a HTTP/2 bomb.
apache2 update
(DLA-4629-1),
prepared by Bastien, to address, among others, remote code execution and privilege escalation.
libinput update
(DLA-4626-1),
prepared by Santiago, to address local privilege escalation and arbitrary code execution.
asterisk update
(DLA-4631-1),
prepared by Thorsten, to address, among others, wrong processing of invalid or untrusted certificates.
nginx update
(DLA-4634-1),
prepared by Charles, to address a remote code execution and denial of service.
firefox-esr update
(DLA-4635-1),
prepared by Emilio, to address dozens of CVEs, among other things, related to arbitrary code execution and privilege escalation.
thunderbird update
(DLA-4636-1),
prepared by Emilio, to address dozens of CVEs, among other things, related to arbitrary code execution.
chromium update
(DLA-4654-1),
prepared by Emilio, to address dozens of CVEs, among other things, related to arbitrary code execution.
Contributions from outside the LTS Team:
We are greatly thankful for the contributions from people outside the LTS Team:
Salvatore Bonaccorso prepared a libhttp-daemon-perl update, that was released by Santiago as
DLA-4639-1.
Salvatore also directly uploaded libgd-perl
DLA-4638-1
and libconfig-inifiles-perl
DLA-4637-1.
Peter Palfrader prepared a tor update, that was released by Santiago as
DLA-4656-1.
Pieter Lenaerts prepared a beets update, that was released by Emmanuel as
DLA-4641-1.
Noah Meyerhans prepared a cloud-init update
DLA-4645-1.
The LTS Team has also contributed with updates to the latest Debian releases:
Besides publishing
DLA-4642-1 for package u-boot
Andreas also prepared an NMU for an upload to sid and prepared a stable-proposed-update (SPU) bug
for trixie, which was already acknowledged by a stable release manager (SRM).
Andreas also prepared an upload of package atril for trixie, which was handled by the security team as
DSA-6349-1.
Besides publishing
DLA-4620-1 for package apache
Bastien also prepared an upload for trixie, which was handled by the security team as
DSA-6323-1.
Thorsten fixed some (not security related but RC) issues in package dahdi-linux. This was in preparation to fix lots of security issues in asterisk.
Unfortunately the maintainer ignored the corresponding debdiff and prefered to upload a new upstream version.
Anyway, the concerns of the security team about security support of asterisk could be overcome and asterisk can migrate to tesing and again be
part of a Debian release.
Here s my monthly but brief update about the activities I ve done in the FOSS world.
Debian
Whilst I didn t get a chance to do much, here are still a few things that I worked on:
Leading the DebConf Bursary team along with PEB.
This took most of my Debian time this month but we ve been able to wrap that work now.
Got back to all the tickets on Zammad, too.
Assisted a few folks in getting their patches submitted via Salsa.
Mentoring for newcomers.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
Continued to push for infrastructure improvements:
[LTS] Emilio pointed out that the gst-plugins-ugly1.0 binaries were still not fully released, so I ran dcut migrate to fully release them. The DLA had gone out earlier.
[ELTS] Did some more work on ruby-rack - a lot of new CVEs have opened up and, whilst I made some progress, Santiago let me know that ruby-rack is no longer supported and so it ll be removed from the ela-needed list.
[E/LTS] Set up the security-tracker and a few other things on the new machine, and debugged the git repository size madness. Sent a summary here.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
The Debian LTS Team, funded by [Freexian s Debian LTS offering]
(https://www.freexian.com/lts/debian/), is pleased to report its activities for
March.
Activity summary
During the month of March, 20 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 24 DLAs fixing 250 CVEs.
We also welcomed two new members: Lukas M rdian and
Emmanuel Arias to the team, who actually started to
contribute to the LTS project several months ago.
The team continued preparing security updates in its usual rhythm. Beyond the
updates targeting Debian 11 ( bullseye ), which is the current release under LTS,
the team also proposed updates for more recent releases (Debian 12 ( bookworm )
and Debian 13 ( trixie )), including Debian unstable. We highlight several notable security updates here below.
ansible (DLA 4502-1),
prepared by Lee Garret in collaboration with Jochen, fixing a vulnerability
that allows attackers to bypass unsafe content protections
asterisk (DLA 4515-1),
prepared by Lukas M rdian, fixing four CVEs that include possible privilege
escalations.
gimp (DLA 4500-1),
prepared by Thorsten, fixing four CVEs related to denial of service or
execution of arbitrary code.
gst-plugins-base1.0 and gst-plugins-ugly1.0
(DLA-4514-1,
DLA-4516-1,
respectively), both prepared by Utkarsh, addressing vulnerabilities that may
yield to arbitrary code execution.
imagemagick, released by Bastien Roucari s
(DLA 4497-1) fixing
multiple vulnerabilities that could lead to information leaks, bypass of
security policies, denial of service or arbitrary code execution.
libpng1.6 (DLA 4521-1),
prepared by Tobias Frost, fixing an arbitrary code execution vulnerability
linux: Ben Hutchings released
DLA 4498-1
and DLA 4499-1
for linux 5.10 and linux 6.1, respectively. Those updates especially address
the CrackArmor flaw.
ruby-rack (DLA 4505-1),
prepared by Utkarsh Gupta, addressing two vulnerabilities
strongswan (DLA 4512-1),
prepared by Thorsten Alteholz, fixing a Denial of Service vulnerability
roundcube (DLA 4517-1)
prepared by Guilhem Moulin, who discovered that one of the fixes provided by upstream was incomplete.
Contributions from outside the LTS Team:
As usual, the thunderbird update, released as DLA 4511-1, was prepared by its maintainer Christoph Goehre. Thanks a lot for his continuous contributions.
The LTS Team has also contributed with updates to the latest Debian releases:
Andreas Henriksson completed the uploads of glib2.0 for both trixie and bookworm
Here s my monthly but brief update about the activities I ve done in the FOSS world.
Debian
Whilst I didn t get a chance to do much, here are still a few things that I worked on:
A quick exchange with Xavier about node-lodash fixes for stable releases.
Uploaded ruby-rack to CVE-2026-25500 & CVE-2026-22860 to sid, trixie, and bookworm.
Started to work on the DebConf Bursary team along with PEB.
Assited a few folks in getting their patches submitted via Salsa.
Mentoring for newcomers.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
node-lodash: Affected by CVE-2025-13465, prototype pollution in the baseUnset function.
[stable]: Xavier from the JS team ACK d the patch. The trixie and bookworm uploads will follow.
[LTS]: The bullseye test and upload will follow in April once the stable uploads are in and ACK d by the SRMs.
vlc: Affected by CVE-2025-51602, an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
[LTS]: 3.0.23 backport is ready but not tested. I ll get this over the line in March.
[ELTS]: 3.0.23 backport is ready but not very clean. Would like to complete LTS and get back to this.
Other Activities
[ELTS] Continued to review ruby-rack for ELTS it has since received about 13 new CVEs, making it even more chaotic. Might consider releasing in batches.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
[E/LTS] Attended the monthly LTS meeting on IRC. Summary here.
[Other] Spent quite some time debugging a bug in debusine. Filed https://salsa.debian.org/freexian-team/debusine/-/issues/1412 for the same. Have worked on a preliminary patch but would like to submit something for Colin to review. Will follow up in April.
The Debian LTS Team, funded by [Freexian s Debian LTS offering]
(https://www.freexian.com/lts/debian/), is pleased to report its activities for
February.
Activity summary
During the month of February, 20 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 35 DLAs fixing 527 CVEs.
We also welcomed Arnaud Rebillout to the team and had to say farewell to Roberto, who left the team after more than nine years as part of it.
The team continued preparing security updates in its usual rhythm. Beyond the
updates targeting Debian 11 ( bullseye ), which is the current release under LTS,
the team also proposed updates for more recent releases (Debian 12 ( bookworm )
and Debian 13 ( trixie )), including Debian unstable.
Notable security updates:
Guilhem Moulin prepared DLA 4492-1
for gnutls28 to fix vulnerabilities which may lead to Denial of Service.
Utkarsh Gupta prepared DLA 4464-1
for xrdp, to fix a a vulnerability that could allow remote attackers to execute arbitrary code on the target system.
Emilio Pozuelo Monfort prepared DLA-4465-1
to replace ClamAV 1.0 with ClamAV 1.4. This latter is the current LTS version supported by upstream.
Markus Koschany prepared DLA 4468-1
for tomcat9, to fix a vulnerability that can be used to bypass security constraints.
Santiago Ruano Rinc n prepared DLA 4471-1
to update package debian-security-support, the Debian security coverage checker.
Bastien Roucari s prepared DLA 4473-1
for zabbix, to fix a potential remote code execution vulnerability.
Paride Legovini prepared DLA 4478-1
for tcpflow, to fix a vulnerability that might result in DoS and potentially code execution.
Thorsten Alteholz prepared DLA 4477-1
for munge, to fix a vulnerability which may allow local users to leak the MUNGE cryptographic key and forge arbitrary credentials.
Chris Lamb prepared DLA 4482-1
for ceph, to fix SSL certificate checking in the Python bindings.
Andreas Henriksson prepared DLA 4491-1
to fix vulnerabilities in glib2.0, which could result in denial of service, memory corruption or potentially arbitrary code execution.
Contributions from outside the LTS Team:
The update of nova was prepared by the maintainer, Thomas Goirand.
The corresponding DLA 4486-1 was published by Carlos Henrique Lima Melara.
The updates of thunderbird were prepared by the maintainer Christoph Goehre.
The corresponding DLA 4466-1 and DLA 4495-1 was published by Emilio Pozuelo Monfort.
The LTS Team has also contributed with updates to the latest Debian releases:
Jochen prepared a point update of wireshark for bookworm (#1127945).
Jochen prepared point updates of erlang for trixie (#1127606) and bookworm (#1127607).
Bastien helped preparing DSA 6160-1 for netty and uploaded a fixed package to unstable.
Bastien prepared a point update of zabbix for trixie (#1127437).
Tobias prepared a point update of modsecurity-crs for bookworm (#1128655).
Tobias prepared a point update of busybox for bookworm (#1129503).
Daniel prepared point updates of python-authlib for trixie (#1129477) and bookworm (#1129246).
Ben uploaded several Linux kernel packages to trixie-backports and bookworm-backports.
Ben prepared point updates of wireless-regdb for trixie and bookworm.
Other than the work related to updates, Sylvain made several improvements to
the documentation and tooling used by the team.
Some milestones in the lifecycle of two Debian releases are just around the corner.
The support of Debian 12 will be handed over to the LTS team on June 11th 2026.
After August 31st, support for Debian 11 will move from Debian LTS to ELTS managed by Freexian.
Here s my monthly but brief update about the activities I ve done in the FOSS world.
Debian
Whilst I didn t get a chance to do much, here are still a few things that I worked on:
Uploaded node-lodash/4.17.21+dfsg+~cs8.31.198.20210220-10 to fix CVE-2025-13465 in unstable. Pinged Xavier and Praveen to see how they feel about the backport for the stable releases.
Assited a few folks in getting their patches submitted via Salsa.
Reviewing pyenv MR for Ujjwal.
Reviewing and assisting Anshul with his Golang stuff.
Mentoring for newcomers.
Started to be a bit involved with DC 26 bits.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
ruby-rack: There were multiple vulnerabilities reported in Rack, leading to DoS (memory exhaustion) and proxy bypass.
[ELTS]: I ve partially reviewed patches by Bastien but whilst doing so, new ones came up for all the releases.
[sid]: Uploaded ruby-rack/3.2.5-1 to unstable to fix the new CVEs, CVE-2026-25500 and CVE-2026-22860.
[stable]: Prepared the upload for stable releases, as requested by the Security Team. Will upload them in March.
[bullseye]: Backport for CVE-2026-22860 hasn t been as trivial as it appears to be. There are test failures, which aren t really ignore-able:
The tests requests /cgi/../test, which File.expand_path resolves to <root>/test - firmly inside @root. With the old code, it hit the return unless path_info.include? ".." guard and fell through to 403. But it would also have returned early via start_with?(@root) being true
anyway, this needs more investigation - I ll continue to do so in March as P1.
node-lodash: Affected by CVE-2025-13465, lrototype pollution in baseUnset function.
[stable]: The patch for trixie and bookworm are ready and have been awaiting the maintainer review.
[LTS]: The bullseye upload will follow once the stable uploads are in and ACK d by the SRMs.
vlc: Affected by CVE-2025-51602, an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.
[LTS]: 3.0.23 backport is ready but not tested. I ll get this over the line in March.
[ELTS]: 3.0.23 backport is ready but not very clean. Would like to complete LTS and get back to this.
Other Activities
[LTS] Coordinated the libvirt sitaution with Ben Hutchings. The upload has already been prepped, will upload in March.
[ELTS] Continued to help Bastien and Markus with the tomcat9 regression for buster.
[ELTS] Partially reviewed ruby-rack CVEs to help Bastien. This took more time than expected with some more develpments hapening at the end of the month - new CVEs that aren t as easy to backport as I expected them to be. Will continue with these in March.
[E/LTS] Front Desk duties: Performed a large batch of CVE triage, marking numerous packages for bullseye, buster, and stretch as either postponed, end-of-life, not-affected, or added them to the Xla-needed.txt files.
Also replied to certain mails and IRC texts around FD related tasks.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
[E/LTS] Attended the monthly LTS meeting on Jitsi. Summary here.
Activity summary
During the month of January, 20 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 33 DLAs
fixing 216 CVEs.
The team continued preparing security updates in its usual rhythm. Beyond the
updates targeting Debian 11 ( bullseye ), which is the current release under LTS,
the team also proposed updates for more recent releases (Debian 12 ( bookworm )
and Debian 13 ( trixie )), including Debian unstable. We highlight several notable
security updates here below.
Notable security updates:
python3.9, prepared by Andrej Shadura
(DLA-4455-1),
fixing multiple vulnerabilities in the Python interpreter.
php, prepared by Guilhem Moulin
(DLA-4447-1),
fixing two vulnerabilities that could yield to request forgery or denial of
service.
apache2, prepared by Bastien Roucari s
DLA-4452-1, fixing
four CVEs.
linux-6.1, prepared by Ben Hutchings
(DLA-4436-1), as a
regular update of the linux 6.1 backport to Debian 11.
python-django, prepared by Chris Lamb
(DLA-4458-1),
resolving multiple vulnerabilities.
firefox-esr prepared by Emilio Pozuelo Monfort
(DLA-4439-1)
gnupg2, prepared by Roberto S nchez
(DLA-4437-1),
fixing multiple issues, including
CVE-2025-68973
that could potentially be exploited to execute arbitrary code.
apache-log4j2, prepared by Markus Koschany
(DLA-4444-1)
inetutils, prepared by Andreas Henriksson
(DLA-4453-1),
fixing an authentication bypass in telnetd.
Moreover, Sylvain Beucler studied the security support status of p7zip, a fork
of 7zip that has become unmaintained upstream. To avoid letting the users
continue using an unsupported package, Sylvain has investigated a path forward
in collaboration with the security team and the 7zip maintainer, looking to
replace p7zip with 7zip. It is to note however that 7zip developers don t
reveal the information about the patches that fix CVEs, making it difficult
to backport single patches to fix vulnerabilities in Debian released versions.
Contributions from outside the LTS Team:
Thunderbird, prepared by maintainer Christoph Goehre. The DLA
(DLA-4442-1) was
published by Emilio.
The LTS Team has also contributed with updates to the latest Debian releases:
Bastien uploaded gpsd to
unstable,
and proposed updates for trixie #1126121
and bookworm #1126168 to fix two CVEs.
Bastien also prepared the imagemagick updates for trixie and bookworm,
released as
DSA-6111-1, along
with the bullseye update
DLA-4448-1.
Chris proposed a trixie point update for python-django
(#112646), and the work for bookworm was
completed in February (#1079454). The
longstanding bookworm update required tracking down a regression in the
django-storages packages.
Markus prepared tomcat10 updates for trixie and bookworm
(DSA-6120-1), and
tomcat11 for trixie
(DSA-6121-1)
Thorsten Alteholz prepared bookworm point updates for zvbi
(#1126167) to
fix five CVEs; taglib
(#1126273) to fix
one CVE; and libuev
(#1126370) to fix
one CVE.
Utkarsh prepared an unstable update of
node-lodash
to fix one CVE.
Other than the work related to updates, Sylvain made several improvements to
the documentation and tooling used by the team.
Here s my monthly but brief update about the activities I ve done in the FOSS world.
Debian
Whilst I didn t get a chance to do much, here are still a few things that I worked on:
A few discussions with the new DFSG team, et al.
Assited a few folks in getting their patches submitted via Salsa.
Reviewing pyenv MR for Ujjwal.
Mentoring for newcomers.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
ruby-rack: There were multiple vulnerabilities reported in Rack, leading to DoS (memory exhaustion) and proxy bypass.
[ELTS]: After completing the work for LTS myself, Bastien picked it up for ELTS and reached out about an upstream regression and we ve been doing some exchanges. Bastien has done most of the work backporting the patches but needs a review and help backporting CVE-2025-61771. Haven t made much progress since last month and will carry it over.
node-lodash: Affected by CVE-2025-13465, lrototype pollution in baseUnset function.
[stable]: The patch for trixie and bookworm are ready but haven t been uploaded yet as I d like for the unstable upload to settle a bit before I proceed with stable uploads.
[LTS]: The bullseye upload will follow once the stable uploads are in and ACK d by the SRMs.
xrdp: Affected by CVE-2025-68670, leading to a stack-based buffer overflow.
[ELTS] Helped Bastien Roucaries debug a tomcat9 regression for buster.
I spent quite a lot of time trying to help Bastien (with Markus and Santiago involved via mail thread) by reproducing the regression that the user(s) reported.
I also helped suggest a path forward by vendoring everything, which I was then requested to also help perform.
Whilst doing that, I noticed circular dependency hellhole and suggested another path forward by backporting bnd and its dependencies as separate NEW packages.
Bastien liked the idea and is going to work on that but preferred to revert the update to remedy the immediate regressions reported. I further helped him in reviewing his update. This conversation happened on #debian-elts IRC channel.
[LTS] Assisted Ben Hutchings with his question about the next possible steps with a plausible libvirt regression caused by the Linux kernel update. This was a thread on debian-lts@ mailing list.
[LTS] Attended the monthly LTS meeting on IRC. Summary here.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
The Debian LTS Team, funded by [Freexian s Debian LTS offering]
(https://www.freexian.com/lts/debian/), is pleased to report its activities for
December.
Activity summary
During the month of December, 18 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 41 DLAs fixing 252 CVEs.
The team currently focuses on preparing security updates for Debian 11
bullseye , but also looks for contributing with updates for Debian 12
bookworm , Debian 13 trixie and even Debian unstable.
Notable security updates:
libsoup2.4 (DLA-4398-1),
prepared by Andreas Henrikson, fixing several vulnerabilities.
glib2.0 (DLA-4412-1),
published by Emilio Pozuelo Monfort, addressing multiple issues.
lasso (DLA-4397-1),
prepared by Sylvain Beucler, addressing multiple issues, including a critical
remote code execution (RCE) vulnerability
(CVE-2025-47151)
roundcube (DLA 4415-1),
prepared by Guilhem Moulin, fixing a cross-site-scripting (XSS)
(CVE-2025-68461)
and an information disclosure
(CVE-2025-68460)
vulnerabilities
mediawiki (DLA 4428-1),
published by Guilhem, fixing multiple vulnerabilities could lead to
information disclosure, denial of service or privilege escalation.
python-apt (DLA 4408-1), prepared by
Utkarsh Gupta, in coordination with the Debian Security Team and Julian
Andres Klode, the apt s maintainer.
libpng1.6 (DLA-4396-1),
published by Tobias Frost, completing the work started the previous month.
Notable non-security updates:
tzdata (DLA-4403-1),
prepared by Emilio, including the latest changes to the leap second list and
its expiry date, which was set for the end of December.
Contributions from outside the LTS Team:
Christoph Berg, co-maintainer of PostgreSQL in Debian, prepared a
postgresql-13 update, released as DLA-4420-1
The LTS Team has also contributed with updates to the latest Debian releases:
Andreas proposed trixie
and bookworm point updates for pgbouncer
Abhijith PA prepared a bookworm
point update for php-dompdf
Thorsten Alteholz prepared an unstable update and a
trixie point update for libcoap3
Thorsten prepared or completed different updates for unstable, trixie and
bookworm for packages related to cups: an
unstable update
of cups to fix several issues related to the latest security update, a
trixie point update for
libcupsfilters, and trixie and
bookworm point updates for cups-filter.
Here s my monthly but brief update about the activities I ve done in the FOSS world.
Debian
Whilst I didn t get a chance to do much, here are still a few things that I worked on:
Prepared security update for wordpress for trixie and bookworm.
A few discussions with the new DFSG team, et al.
Assited a few folks in getting their patches submitted via Salsa.
Mentoring for newcomers.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
ceph: Affected by CVE-2024-47866, using the argument x-amz-copy-source to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack.
[LTS]: Whilst the patch is straightforward, backports are a bit tricky. Also trying to backport the fix for CVE-2022-0670. The update has been prepared as of December 16th and awaiting Thomas Goirand s review.
knot-resolver: Affected by CVE-2023-26249, CVE-2023-46317, and CVE-2022-40188, leading to Denial of Service.
[LTS]: The patches aren t very trivial, with
CVE-2023-46317 reverting much of the patch for CVE-2023-26249. And then it had to be re-adjusted a bit for v5.3.1. The backports are ready as of December 23rd and awaiting Jakub or Santiago s review.
adminer: Affected by CVE-2023-45195 and CVE-2023-45196, leading to SSRF and DoS, respectively.
[ELTS]: I picked it up again and the patches were already ready in Git. I ve reached out to Alexandre for a quick review and smoke test before we can release it for buster.
u-boot: Affected by CVE-2025-24857, where boot code access control flaw in U-Boot allowing arbitrary code execution via physical access.
[ELTS]: As it s only affected the version in stretch, I ve started the work to find the fixing commits and prepare a backport. Not much progress there, I ll roll it over to January.
ruby-rack: There were multiple vulnerabilities reported in Rack, leading to DoS (memory exhaustion) and proxy bypass.
[ELTS]: After completing the work for LTS myself, Bastien picked it up for ELTS and reached out about an upstream regression and we ve been doing some exchanges. Bastien has done most of the work backporting the patches but needs a review and help backporting CVE-2025-61771.
Other Activities
Frontdesk from 01-12-2025 to 07-12-2025.
Auto EOL d a bunch of packages.
Marked CVE-2025-12084/python2.7 as end-of-life for bullseye, buster, and stretch.
Marked CVE-2025-12084/jython as end-of-life for bullseye.
Marked CVE-2025-13992/chromium as end-of-life for bullseye.
Marked apache2 CVEs as postponed for bullseye, buster, and stretch.
Marked CVE-2025-13654/duc as postponed for bullseye and buster.
Marked CVE-2025-32900/kdeconnect as ignored for bullseye.
Marked CVE-2025-12084/pypy3 as postponed for bullseye.
Marked CVE-2025-14104/util-linux as postponed for bullseye, buster, and stretch.
Marked several CVEs for fastdds as postponed for bullseye.
Marked several CVEs for pytorch as postponed for bullseye.
Marked CVE-2025-2486/edk2 as postponed for bullseye.
Marked CVE-2025-6172 7,9 /golang-1.15 as postponed for bullseye.
Marked CVE-2025-65637/golang-logrus as postponed for bullseye.
Marked CVE-2025-12385/qtdeclarative-opensource-src ,gles as postponed for bullseye, buster, and stretch.
Marked TEMP-0000000-D08402/rust-maxminddb as postponed for bullseye.
Added the following packages to d,e la-needed.txt:
liblivemedia, sogo.
During my triage, I had to make the bin/elts-eol script robust to determine the lts_admin repository - did a back and forth with Emilio about this on the list.
I claimed php-horde-css-parser to work on CVE-2020-13756 for buster and did almost all the work only to realize that the patch already existed in buster and the changelog confirmed that it was intentionally fixed.
After speaking with Andreas Henriksson, we figured that the CVE ID was missed when the ELA was generated and so I fixed that via 87afaaf19ce56123bc9508d9c6cd5360b18114ef and 5621431e84818b4e650ffdce4c456daec0ee4d51 in the ELTS security tracker to reflect the situation.
Participated in a thread which I started last month around using Salsa CI for E/LTS packages and if we plan to sunset it in favor of using Debusine. The plan for now is to keep it around as it s still beneficial and Debusine is still in its early phase.
Did a lot of back and forth with Helmut about debusine uploads on #debian-elts.
While debugging a failure in dcut uploads, I ran into an SSH compatibility issue on deb-master.freexian.com that could be fixed on the server-side. I shared all my findings to Freexian s sysadmin team.
A minimal fix on the server side would be one of:
PubkeyAcceptedAlgorithms -ssh-dss
or explicitly restricting to modern algorithms, e.g.:
Jelly on #debian-lts reported that all my DLA mails had broken GMail s DKIM signature. So I set up sending replies from @debian.org and that seems to have fixed that! \o/
[LTS] Attended a rather short monthly LTS meeting on Jitsi. Summary here.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
The Debian LTS Team, funded by [Freexian s Debian LTS offering]
(https://www.freexian.com/lts/debian/), is pleased to report its activities for
November.
Activity summary
During the month of November, 18 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 33 DLAs
fixing 219 CVEs.
The LTS Team kept going with the usual cadence of preparing security updates for Debian
11 bullseye , but also for Debian 12 bookworm , Debian 13 trixie and even
Debian unstable.
As in previous months, we are pleased to say that there have been multiple
contributions of LTS uploads by Debian Fellows outside the regular LTS Team.
Notable security updates:
Guilhem Moulin prepared DLA 4365-1
for unbound, a caching DNS resolver, fixing a cache poisoning vulnerability
that could lead to domain hijacking.
Another update related to DNS software was made by Andreas Henriksson. Andreas
completed the work on bind9, released as
DLA 4364-1 to fix
cache poisoning and Denial of Service (DoS) vulnerabilities.
Chris Lamb released DLA 4374-1
to fix a potential arbitrary code execution vulnerability in pdfminer, a tool
for extracting information from PDF documents.
Ben Hutchings published a regular security update for the linux 6.1 bullseye
backport, as DLA 4379-1.
A couple of other important recurrent updates were prepared by Emilio Pozuelo,
who handled firefox-esr and thunderbird (in collaboration with Christoph
Goehre), published as DLAs
DLA 4370-1 and
DLA 4372-1,
respectively.
Contributions from fellows outside the LTS Team:
Thomas Goirand uploaded a bullseye update for
keystone
and
swift
As mentioned above, Christoph Goehre prepared the
bullseye update for thunderbird.
Mathias Behrle provided feedback about the tryton-server and tryton-sao vulnerabilities that were disclosed last month, and helped to review the bullseye patches for tryton-server.
Other than the regular LTS updates for bullseye, the LTS Team has also
contributed updates to the latest Debian releases:
Bastien Roucari s prepared a bookworm update for
squid,
the web proxy cache server.
Carlos Henrique Lima Melara filed a bookworm point update
request for gdk-pixbuf to fix
CVE-2025-7345, a heap buffer overflow vulnerability that could lead to
arbitrary code execution.
Daniel Leidert prepared bookworm and
trixie updates for r-cran-gh to fix
CVE-2025-54956, an issue that may expose user credentials in HTTP responses.
Along with the bullseye updates for unbound mentioned above, Guilhem helped
to prepare the trixie update
for unbound.
In collaboration with Lukas M rdian, Tobias Frost prepared
trixie and
bookworm
updates for log4cxx, the C++ port of the logging framework for JAVA.
Jochen Sprickerhof prepared a bookworm update for syslog-ng.
Utkarsh completed the bookworm update
for wordpress, addressing multiple security issues in the popular blogging
tool.
Beyond security updates, there has been a significant effort in revamping our
documentation, aiming to make the processes more clear and consistent for all
the members of the team. This work was mainly carried out by Sylvain, Jochen
and Roberto.
We would like to express our gratitude to the sponsors for making the Debian
LTS project possible. Also, special thanks to the fellows outside the LTS
team for their valuable help.
Here s my monthly but brief update about the activities I ve done in the FOSS world.
Debian
Whilst I didn t get a chance to do much, here are still a few things that I worked on:
Did a few sessions with the new DFSG team to help kickstart things, et al.
Assited a few folks in getting their patches submitted via Salsa.
Mentoring for newcomers.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
wordpress: There were multiple vulnerabilities reported in Wordpress, leading to Sent Data & Cross-site Scripting.
[bookworm]: Roberto rightly pointed out that the upload to bookworm hadn t gone through last month, so I re-uploaded wordpress/6.1.9+dfsg1-0+deb12u1 to bookworm-security.
ruby-rack: There were multiple vulnerabilities reported in Rack, leading to DoS (memory exhaustion) and proxy bypass.
[ELTS]: Last month I had backported fixes for CVE-2025-46727 & CVE-2025-32441 to buster and stretch but the other backports were being a bit tricky due to really old versions.
I spent a bit more time but there s a lot to demystify. Gonna take a bit of break from this one and come back to this after doing other updates. Might even consider sending a RFH to the list.
libwebsockets: Multiple issues were reported in LWS causing denial of service and stack-based buffer overflow.
Backporting tests was an interesting exercise as I had to make them compatible with the bullseye version. :)
ceph: Affected by CVE-2024-47866, using the argument x-amz-copy-source to put an object and specifying an empty string as its content leads to the RGW daemon crashing, resulting in a DoS attack.
[LTS]: Whilst the patch is straightforward, backports are a bit tricky. I ve prepared the update but would like to reach out to zigo, the maintainer, to make sure nothing regresses.
[ELTS]: Same as LTS, I d like to get a quick review and upload to LTS first before I start staging uploads for ELTS.
[LTS] Attended the monthly LTS meeting on IRC. Summary here.
It was also followed by a 50-minute post-meeting technical discussion/question session.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates. Thanks, Sylvain, for a great documentation summary.
Activity summary
During the month of October, 21 contributors have been
paid to work on Debian LTS (links to individual
contributor reports are located below).
The team released 37 DLAs fixing 893 CVEs.
The team has continued in its usual rhythm, preparing and uploading security
updates targeting LTS and ELTS, as well as helping with updates to oldstable,
stable, testing, and unstable. Additionally, the team received several
contributions of LTS uploads from Debian Developers outside the standing LTS
Team.
Notable security updates:
https-everywhere, prepared by Markus Koschany, deals with a problem created by ownership of the https-rulesets.org domain passing to a malware operator
openjdk-17 and openjdk-11, prepared by Emilio Pozuelo Monfort, fixes XML external entity and certificate validation vulnerabilities
intel-microcode, prepared by Tobias Frost, fixes a variety of privilege escalation and denial of service vulnerabilities
Notable non-security updates:
distro-info-data, prepared by Stefano Rivera, updates information concerning current and upcoming Debian and Ubuntu releases
Contributions from outside the LTS Team:
Lukas M rdian, a Debian Developer, provided an update of log4cxx
Andrew Ruthven, one of the request-tracker4 maintainers, provided an update of request-tracker4
Christoph Goehre, co-maintainer of thunderbird, provided an update of thunderbird
Beyond the typical LTS updates, the team also helped the Debian community more broadly:
Guilhem Moulin prepared oldstable/stable updates of libxml2, and an unstable update of libxml2.9
Bastien Roucari s prepared oldstable/stable updates of imagemagick
Daniel Leidert prepared an oldstable update of python-authlib, oldstable update of libcommons-lang-java and stable update of libcommons-lang3-java
Utkarsh Gupta prepared oldstable/stable/testing/unstable updates of ruby-rack
The LTS Team is grateful for the opportunity to contribute to making LTS a high quality for sponsors and users. We are also particularly grateful for the collaboration from others outside the time; their contributions are important to the success of the LTS effort.
Here s my monthly but brief update about the activities I ve done in the F/L/OSS world.
Debian
Whilst I didn t get a chance to do much, here s still a few things that I worked on:
Uploaded ruby-rack, 3.1.18-1, to fix a bunch of CVEs.
Asssited a few folks in getting their patches submitted via Salsa.
Mentoring for newcomers.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
[trixie/bookworm]: Uploaded a fix for all 5 CVEs in trixie via 3.1.18-1~deb13u1 and 7 CVEs in bookworm via 2.2.20-0+deb12u1.
[LTS]: Uploaded a fix for all 7 CVEs in bullseye via 2.1.4-3+deb11u4. And released DLA 4357-1.
[ELTS]: Backported fixes for CVE-2025-46727 & CVE-2025-32441 to buster and stretch but the other backports are being a bit tricky due to really old versions. But I ll spend some more time there before coming to a conclusion.
wordpress: There were multiple vulnerabilities reported leading to Sent Data & Cross-site Scripting.
[bookworm]: Prepared a fix for all 4 CVEs in bookwrom via 6.1.9+dfsg1-0+deb12u1. Awaiting review from the Security team.
[LTS]: Uploaded a fix for all 4 CVEs in bullseye via 5.7.14+dfsg1-0+deb11u1. And released DLA 4358-1.
[LTS] Attended the monthly LTS meeting on Jitsi. Summary here.
[E/LTS] Monitored discussions on mailing lists, IRC, and all the documentation updates.
Tobias Frost
did 5.0h (out of 0.0h assigned and 8.0h from previous period), thus carrying over 3.0h to the next month.
Utkarsh Gupta
did 16.5h (out of 14.25h assigned and 6.75h from previous period), thus carrying over 4.5h to the next month.
Evolution of the situation
In September, we released 38 DLAs.
Notable security updates:
modsecurity-apache prepared by Adrian Bunk, fixes a cross-site scripting vulnerability
cups, prepared by Thorsten Alteholz, fixes authentication bypass and denial of service vulnerabilities
jetty9, prepared by Adrian Bunk, fixes the MadeYouReset vulnerability (a recent, well-known denial of service vulnerability)
python-django, prepared by Chris Lamb, fixes a SQL injection vulnerability
firefox-esr and thunderbird, prepared by Emilio Pozuelo Monfort, were updated from the 128.x ESR series to the 140.x ESR series, fixing a number of vulnerabilities as well
Notable non-security updates:
wireless-regdb prepared by Ben Hutchings, updates information reflecting changes to radio regulations in many countries
There was one package update contributed by a Debian Developer outside of the LTS Team: an update of node-tar-fs, prepared by Xavier Guimard (a member of the Node packaging team).
Finally, LTS Team members also contributed updates of the following packages:
libxslt (to stable and oldstable), prepared by Guilhem Moulin, to address a regression introduced in a previous security update
libphp-adodb (to stable and oldstable), prepared by Abhijith PA
cups (to stable and oldstable), prepared by Thorsten Alteholz
u-boot (to oldstable), prepared by Daniel Leidert and Jochen Sprickerhof
libcommongs-lang3-java (to stable and oldstable), prepared by Daniel Leidert
python-internetarchive (to oldstable), prepared by Daniel Leidert
One other notable contribution by a member of the LTS Team is that Sylvain Beucler proposed a fix upstream for CVE-2025-2760 in gimp2. Upstream no longer supports gimp2, but it is still present in Debian LTS, and so proposing this fix upstream is of benefit to other distros which may still be supporting the older gimp2 packages.
Thanks to our sponsors
Sponsors that joined recently are in bold.
Asssited Anshul in his interest to do a Go 1.25 transition.
Mentoring for newcomers.
Moderation of -project mailing list.
Ubuntu
I joined Canonical to work on Ubuntu full-time back in February 2021.
Whilst I can t give a full, detailed list of things I did, here s a quick TL;DR of what I did:
Also circled back on previously opened ticket for supported packages for ELTS.
Partially reviewed and added comment on Emilio s MP.
Re-visited an old thread (in order to fully close it) about issues being fixed in buster & bookworm but not in bullseye. And brought it up in the LTS meeting, too.
[LTS] Partook in some internal discussions about introducing support for handling severity of CVEs, et al.
Santiago had asked for an input from people doing FD so spent some time reflecting on his proposal and getting back with thoughts and suggestions.
[LTS] Helped Lee with testing gitk and git-gui aspects of his git update.
[LTS] Attended the monthly LTS meeting on IRC. Summary here.
It was also followed by a 40-minute discussion of technical questions/reviews/discussions - which in my opinion was pretty helpful. :)
[LTS] Prepared the LTS update for wordpress, bumping the package from 5.7.11 to 5.7.13.
Prepared an update for stable, Craig approved. Was waiting on the Security team s +1 to upload.
Now we ve waited enough that we have new CVEs. Oh well.
[ELTS] Finally setup debusine for ELTS uploads.
Since I use Ubuntu, this required installing debusine* from bookworm-backport but that required Python 3.11.
So I had to upgrade from Jammy (22.04) to Noble (24.04) - which was anyway pending.. :)
Tobias Frost
did 4.0h (out of 0.0h assigned and 12.0h from previous period), thus carrying over 8.0h to the next month.
Utkarsh Gupta
did 16.0h (out of 22.75h assigned), thus carrying over 6.75h to the next month.
Evolution of the situation
In August, we released 27 DLAs.
The month of August marked the release of Debian 13 (codename trixie ). This is worth noting because it brought with it the return of the customary fast development pace of Debian unstable, which included several contributions from LTS Team members. More on that below.
Of the many security updates which were published (and a few non-security updates as well), some notable ones are highlighted here.
Notable security updates:
gnutls28 prepared by Adrian Bunk, fixes several potential denial of service vulnerabilities
apache2, prepared by Bastien Roucari s, fixes several vulnerabilities including a potential denial of service and SSL/TLS-related access control
mbedtls (original update, regression update) prepared by Andrej Shadura, fixes several potential denial of service and information disclosure vulnerabilities
openjdk-17, prepared by Emilio Pozuelo Monfort, fixes several vulnerabilities which could result in denial of service, information disclosure or weakened TLS connections
Notable non-security updates:
distro-info-data, prepared by Stefano Rivera, adds information concerning future Debian and Ubuntu releases
ca-certificates-java, prepared by Bastien Roucari s, fixes some bugs which could disrupt future updates
The LTS Team continues to welcome the collaboration of maintainers from across the Debian community. The contributions of maintainers from outside the LTS Team include: postgresql-13 (Christoph Berg), sope (Jordi Mallach), thunderbird (Carsten Schoenert), and iperf3 (Roberto Lumbreras).
Finally, LTS Team members also contributed updates of the following packages:
redis (to stable), prepared by Chris Lamb
firebird3.0 (to oldstable and stable), prepared by Adrian Bunk
node-tmp (to oldstable, stable, and unstable), prepared by Adrian Bunk
openjpeg2 (to oldstable, stable, and unstable), prepared by Adrian Bunk
apache2 (to oldstable), prepared by Bastien Roucari s
unbound (to oldstable), prepared by Guilhem Moulin
luajit (to oldstable), prepared by Guilhem Moulin
golang-github-gin-contrib-cors (to oldstable and stable), prepared by Thorsten Alteholz
libcoap3 (to stable), prepared by Thorsten Alteholz
libcommons-lang-java and libcommons-lang3-java (both to unstable), prepared by Daniel Leidert
python-flask-cors (to oldstable), prepared by Daniel Leidert
The LTS Team would especially like to thank our many longtime friends and sponsors for their support and collaboration.
Thanks to our sponsors
Sponsors that joined recently are in bold.
The Debian LTS Team, funded by