Debian Project · Operating system
Debian is a community-developed operating system and Linux distribution that combines the Linux kernel, GNU system tools and a large repository of packaged applications.
Record scope: all represented editions · all channels · all architectures · Global. View the Debian family.
Canonical record: https://lifecycle.blacktree.nl/catalogue/debian-12-bookworm · Generated 2026-10-30 17:05 UTC.
Debian is a community-developed operating system and Linux distribution that combines the Linux kernel, GNU system tools and a large repository of packaged applications.
Servers, desktops, development systems, appliances and a base for other Linux distributions.
Installed on physical or virtual machines and distributed as cloud and container images.
Description source: Debian project overview · reviewed 22 Sep 2026
| Phase | Start | End | State | Coverage and conditions |
|---|---|---|---|---|
| Full Debian support | 10 June 2023day precision | 11 July 2026day precision | confirmed | Security and release teamsConditions: All release architectures, subject to package limitations |
| Debian Long Term SupportPaid or extended | 12 July 2026day precision | 30 June 2028day precision | confirmed | LTS team security supportConditions: i386, amd64, armhf, arm64 and ppc64el; package exclusions apply |
Release notes describe changes in this version. Their publication dates are not treated as support or retirement boundaries.
Release-note research has not completed for this version.
These records add release notes, security advisories and known-issue context. Their publication dates are not lifecycle boundaries.
The webkit2gtk update released as DSA-6534-1 introduced a regression that prevents Evolution from displaying images embedded in HTML emails. https://security-tracker.debian.org/tracker/DSA-6534-3
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordThe update for cifs-utils announced in DSA 6567-1 introduced a regression when using the sec=krb5 and cruid mount options. Updated packages are now available to correct this issue. https://security-tracker.debian.org/tracker/DSA-6567-2
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordTwo vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6570-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, information disclosure or denial of service. https://security-tracker.debian.org/tracker/DSA-6571-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates. https://security-tracker.debian.org/tracker/DSA-6572-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordThis update blocks compromised intermediate certificates issued by the eMudhra CA. Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for installations which have RemoteSettings disabled or which are unable to connect to the revocation backend service due to network constraints. https://security-tracker.debian.org/tracker/DSA-6573-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6574-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory corruption, denial of service, injection of requests to backend servers, or bypass of client certificate authentication. CVE-2026-15176 Mapping a rewritten request URI to a filesystem path in a location using the alias directive could cause a buffer overflow. CVE-2026-93479 Evaluation of string expressions in the HTTP and stream modules could overwrite reserved buffer space, resulting in a buffer overflow. Affected operations include evaluation of variable document roots and access log paths. The affected code was introduced into the trixie package by an earlier security backport. CVE-2026-95101 Incorrect handling of fragmented unknown HTTP/3 frames could cause their contents to be treated as request body data. When proxying requests, this could allow injection of requests into a backend server or bypass of request body size limits. CVE-2026-97205 A counter tracking pending asynchronous operations could overflow, causing request memory to be freed while still in use. This use-after-free could result in memory corruption or denial of service. CVE-2026-97629 Incomplete synchronisation of TLS session ticket keys between worker processes could leave a worker using uninitialised key material. This could allow forged TLS sessions and bypass of client certificate authentication. https://security-tracker.debian.org/tracker/DSA-6575-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution. https://security-tracker.debian.org/tracker/DSA-6576-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6577-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordTwo vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files. https://security-tracker.debian.org/tracker/DSA-6578-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in IMAP command injection, cross-site scripting, SSRF bypass, email header injection, css property injection, remote content blocking bypass, information disclosure or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6579-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in Erlang/OTP, a programming language and runtime environment. These issues could result in denial of service, HTTP request smuggling, or bypass of authentication and access restrictions, including TLS server impersonation. The affected components include the HTTP client and server, SSH, TLS, ASN.1 decoding, the network driver, and URI, LDAP and SNMP parsing. The update tightens protocol validation and HTTP/SSH resource limits. Applications relying on previously permissive behavior may need adjustment. https://security-tracker.debian.org/tracker/DSA-6580-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver. CVE-2026-35501 (DNSSEC) Bypass of a configured island trust anchor underneath an insecure parent from an attacker-controlled NSEC record. CVE-2026-50106 (DNSSEC) Possible insecure NXDOMAIN for non-existing records under a configured island trust anchor underneath an insecure parent. CVE-2026-96405 Aggregate DNS name chained pointer decompression work leads to degradation of service. CVE-2026-97206 DNS-over-QUIC path-migration can lead to use-after-free on multi-threaded deployments, leading to potential denial of service. CVE-2026-109125 Possible cache poisoning vulnerability via a cache side-channel exposed by 'unwanted-reply-threshold'. https://security-tracker.debian.org/tracker/DSA-6581-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordA vulnerability was discovered in Brotli, a generic-purpose lossless compression suite, which could result in denial of service, or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6582-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in libheif, a library for reading and writing HEIF and AVIF images. Processing specially crafted images could result in denial of service through excessive resource consumption or crashes, or disclosure of process memory. A use-after-free and double-free affecting timestamp handling during image encoding, including transcoding of crafted images, is also addressed. https://security-tracker.debian.org/tracker/DSA-6583-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could result in cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing of HTTP/1.1 absolute-form request targets. If the request URL is passed unchecked to a backend which accepts absolute-form URIs, a remote attacker could potentially poison the cache or bypass authentication. The issue affects requests for root URLs. CVE-2026-93894 Tristan Madani discovered a workspace buffer overflow in the .upper() and .lower() string methods of the Varnish Configuration Language. A remote attacker with knowledge of the active configuration could craft a request which exhausts the remaining workspace during case conversion, causing the worker process to crash and restart, resulting in denial of service. Exploitation depends on the configuration using these methods on attacker-controlled strings and on the applicable request size limits. https://security-tracker.debian.org/tracker/DSA-6584-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code or information disclosure Debian follows the Thunderbird upstream releases. Support for the 140.x series has ended, so starting with this update we're now following the 153.x series. https://security-tracker.debian.org/tracker/DSA-6585-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordThe update for thunderbird in DSA-6585-1 introduced a regression in the supported for PGP-encrypted emails. Updated packages are now available to correct this issue. https://security-tracker.debian.org/tracker/DSA-6585-2
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in Valkey, an in-memory key-value database. These issues could cause denial of service and, in some cases, potentially allow arbitrary code execution. https://security-tracker.debian.org/tracker/DSA-6586-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that incorrect parsing of packets with compression pointers in the PowerDNS DNS server could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6587-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox bypass, incomplete certificate checks or information disclosure. https://security-tracker.debian.org/tracker/DSA-6588-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6589-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, bypass of the same-origin policy, privilege escalation, information disclosure or spoofing. https://security-tracker.debian.org/tracker/DSA-6590-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox breakout, incomplete certificate checks or information disclosure. https://security-tracker.debian.org/tracker/DSA-6591-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6592-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. https://security-tracker.debian.org/tracker/DSA-6593-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in GitPython, a Python library to interact with Git repositories, which could result in information disclosure, directory traversal, execution of arbitrary code or denial of service. https://security-tracker.debian.org/tracker/DSA-6594-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6595-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in wordpress, a web blogging tool, which could result in denial of service, cross-site scripting, SQL injection, information disclosure, privilege escalation or remote code execution. https://security-tracker.debian.org/tracker/DSA-6596-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities have been discovered in the Apache HTTP server, which may result in denial of service, information disclosure, authentication bypass or HTTP request smuggling. https://security-tracker.debian.org/tracker/DSA-6569-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities have been discovered in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed. https://security-tracker.debian.org/tracker/DSA-6566-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordTwo vulnerabilities were discovered in cifs-utils, the Common Internet File System utilities, which could result in privilege escalation. https://security-tracker.debian.org/tracker/DSA-6567-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6568-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordA vulnerability was discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. https://security-tracker.debian.org/tracker/DSA-6565-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that incorrect parsing of Content-Type headers in the Mutt mail user agent could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6563-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that missing input sanitising in the APNG parser in the reference code implementation of the JPEG XL format could result in denial of service or information disclosure if malformed images are processed. https://security-tracker.debian.org/tracker/DSA-6564-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that missing validation of tar sources in the Buildstream software integration tool could allow to write files on the build host. https://security-tracker.debian.org/tracker/DSA-6559-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, information disclosure, mitigation bypass or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6560-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in the SOGo groupware server, which could result in cross-site scripting, shell injection, password reset poisoning or SQL injection. https://security-tracker.debian.org/tracker/DSA-6561-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6562-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that the cURL URL transfer library, is prone to a use-after-free vulnerability when handling a HTTP/2 RST_STREAM received by a server during an upload, which could result in remote code execution. https://security-tracker.debian.org/tracker/DSA-6558-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in NTFS-3G, a read-write NTFS driver for FUSE, which could result in denial of service, information leak or potentially local root privilege escalation. https://security-tracker.debian.org/tracker/DSA-6557-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in the Nagios monitoring system, which could result in cross-site request forgery, cross-site scripting or the execution of arbitrary commands. https://security-tracker.debian.org/tracker/DSA-6556-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that librsvg, a library to render Scalable Vector Graphics, incorrectly parsed files with nested XML includes, which could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6555-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordA vulnerability was discovered in the handling of delegated authentication in Keystone, the OpenStack identity service, which may result in information disclosure of privilege escalation. https://security-tracker.debian.org/tracker/DSA-6554-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6553-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system. https://security-tracker.debian.org/tracker/DSA-6551-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities have been discovered in vips, a fast image processing library. These vulnerabilities could result in denial of service, memory safety issues, or other security impact when processing specially crafted image files or data. https://security-tracker.debian.org/tracker/DSA-6552-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which could result in denial of service and potentially the execution of arbitrary code if malformed document files are processed. https://security-tracker.debian.org/tracker/DSA-6550-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that an invalid memory write in the LZMA1 decoders of xz-utils, the XZ-format compression utilities, could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6549-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordTwo vulnerabilities were discovered in node-shell-quote, a Node.js module to quote and parse shell commands, which could result in denial of service or shell command injection. https://security-tracker.debian.org/tracker/DSA-6548-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that ruby-jwt, a JSON Web Token implementation in Ruby, insufficiently validated the HMAC of some tokens. https://security-tracker.debian.org/tracker/DSA-6547-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discocered in the web UI of the SABnzbd+ binary news reader/grabber, which could result in the execution of arbitrary code or authorisation bypass. https://security-tracker.debian.org/tracker/DSA-6544-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities were discovered in roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in cross-site scripting, SRF bypass, email header injection, css property injection, remote content blocking bypass, information disclosure or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6545-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in the Rails web framework which could result in cross-site scripting, denial of service, path traversal or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6546-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in LibreOffice, which could result in denial of service, information disclosure or the execution of arbitrary code if malformed document files are opened. https://security-tracker.debian.org/tracker/DSA-6543-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that incorrect error handling in ruby-rack-session may result in authentication bypass or privilege escalation in some setups. https://security-tracker.debian.org/tracker/DSA-6542-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordThe webkit2gtk update released as DSA-6534-1 introduced two regressions that cause programs such as evolution or the Eclipse IDE to crash on startup in some cases. https://security-tracker.debian.org/tracker/DSA-6534-2
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities have been discocvered in Wireshark, a network protocol analyzer which could result in denial of service or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6541-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that incomplete validation of MS-PPPE packets in radsecproxy, a Radius protocol proxy, could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6540-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could result in information disclosure, PHP objection injection or denial of service. https://security-tracker.debian.org/tracker/DSA-6539-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities were discovered in Redis, a persistent key-value database, which could result in denial of service or the execution of arbitrary code. This update also includes fixes for several related issues that have not been assigned CVE identifiers: ACL key permission checks for SORT, GEORADIUS, GEORADIUSBYMEMBER, XREAD and XREADGROUP could be bypassed; an out-of-bounds read during ACL key extraction for KEYNUM commands invoked with the wrong arity; missing validation of slot information when loading RDB files; a use-after-free in the blocked client list; an out-of-bounds read in HGETEX; and an integer overflow in the HyperLogLog hash function. Additionally, CVE-2026-66373 addresses an incomplete fix for CVE-2026-25243. Because that interim fix was never released on its own in Debian stable, it is therefore not referenced in the CVE ID list above. This update incorporates the comprehensive fix covering both issues. https://security-tracker.debian.org/tracker/DSA-6538-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6536-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordA use-after-free was discovered in libpng, a library implementing an interface for reading and writing PNG (Portable Network Graphics), which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6537-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities have been discovered in the WebKitGTK web engine, that may lead to heap corruption, local privilege escalation, remote code execution, out-of-bounds memory access, cross-origin data leak and sandbox escape, among other problems. See the WebKitGTK security advisory for details on each vulnerability: https://webkitgtk.org/security/WSA-2026-0006.html https://security-tracker.debian.org/tracker/DSA-6534-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6535-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, information disclosure or privilege escalation. Debian follows the extended support releases (ESR) of Firefox. Starting with this update we're now following the 153.x releases. Between 140.x and 153.x, Firefox has seen a number of feature updates. For more information please refer to https://www.firefox.com/en-US/firefox/153.0esr/releasenotes/ https://security-tracker.debian.org/tracker/DSA-6533-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMichael Allen discovered an out-of-bounds write vulnerability in PCRE2, a library of functions to support Perl compatible regular expressions, which could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6530-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities have been discovered in OpenSSL, a Secure Sockets Layer toolkit, which could result in denial of service, information disclosure or potentially recovery of private keys. Additional details can be found in the upstream advisories: https://openssl-library.org/news/secadv/20260929.txt https://security-tracker.debian.org/tracker/DSA-6531-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6532-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that missing input validation in the hpack path header parser of libwebsockets could result in denial of service or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6529-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in wordpress, a web blogging tool, which could result in cross-site scripting, privilege escalation or remote code execution. https://security-tracker.debian.org/tracker/DSA-6525-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities have been discovered in the Dovecot IMAP server which could result in denial of service, SMTP smuggling, information disclosure, code injection via malformed Sieve scripts or bypass of ACL restrictions. https://security-tracker.debian.org/tracker/DSA-6526-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in rsync, a fast, versatile, remote (and local) file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code. Details can be found at https://download.samba.org/pub/rsync/NEWS#3.5.0 https://security-tracker.debian.org/tracker/DSA-6527-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6528-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Flatpak, an application deployment framework for desktop apps, which could result in denial service via malicious applications or information disclosure. https://security-tracker.debian.org/tracker/DSA-6524-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in libheif, an ISO/IEC 23008-12 HEIF and AVIF image file format decoder and encoder, which may result in denial of service, the disclosure of sensitive memory contents or, potentially, the execution of arbitrary code if a malformed image file is processed. Besides the CVEs listed above, this update also fixes a number of issues tracked upstream as GHSA-x8r2-mggj-j6wr, GHSA-w7mc-p8jc-p853, GHSA-9rj8-5mp5-26c9, GHSA-4jqm-2x34-6f6r, GHSA-vg7w-rp49-4fc2, GHSA-5w8x-856j-7x7c, GHSA-fqpw-fj22-78w4, GHSA-prgh-72vc-3xmc, GHSA-xrp2-63fq-jm8q, GHSA-4rv4-953r-p24q and GHSA-rhgw-q5g8-xjh2, and had no CVE assigned when this advisory was published. https://security-tracker.debian.org/tracker/DSA-6523-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in the Exim mail transport agent, which could result in SMTP smuggling, information disclosure, denial of service or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6522-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Oj, a fast JSON parser and serializer for Ruby, which could result in denial of service or memory disclosure. https://security-tracker.debian.org/tracker/DSA-6521-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in the Lemonldap::NG web SSO system, which could result in a bypass of access controls, authorisation bypass in setups using PKCE or information disclosure. https://security-tracker.debian.org/tracker/DSA-6520-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities were discovered in Node.js, which could result in denial of service, permission model bypass, incorrect certificate validation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6517-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in Incus, a system container and virtual machine manager, which could result in a bypass of security/authorisation restrictions, guest to host privilege escalation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6518-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordA vulnerability was discovered in the Swift tempurl middleware, which could result in information disclosure. https://security-tracker.debian.org/tracker/DSA-6519-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in Ghostscript, the GPL PostScript/PDF interpreter, which could result in denial of service and potentially the execution of arbitrary code if malformed document files are processed. https://security-tracker.debian.org/tracker/DSA-6516-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in denial of service, information disclosure, incorrect validation of TLS certificates or bypass of access control restrictions, https://security-tracker.debian.org/tracker/DSA-6514-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities were discovered in the VLC media player, which could result in the execution of arbitrary code or denial of service if a malformed media file is opened. https://security-tracker.debian.org/tracker/DSA-6515-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordThe update for jq released as DSA-6416-1 introduced a regression in the loading of modules. The fix for CVE-2026-44777 registered each library before its own dependencies, so a module reached only through another module (a transitive import or include) was discarded as unreferenced and jq aborted with an assertion failure at compile time. https://security-tracker.debian.org/tracker/DSA-6416-2
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6513-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in LibreOffice, which could result in denial of service, information disclosure or potentially the execution of arbitrary code if malformed document files are opened. https://security-tracker.debian.org/tracker/DSA-6512-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that an incorrect implementation of message filtering in xdg-dbus-proxy allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could achieve arbitrary code execution outside its sandbox. If other app frameworks rely on xdg-dbus-proxy in the same way that Flatpak does, then they will have an equivalent vulnerability until xdg-dbus-proxy is updated. https://security-tracker.debian.org/tracker/DSA-6510-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordTwo security vulnerabilities were discovered in the ZNC IRC bouncer, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6511-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in GIMP, the GNU Image Manipulation Program, which could result in denial of service or potentially the execution of arbitrary code if malformed PSD, light effects filter, ICO, PIX or PCX files are opened. https://security-tracker.debian.org/tracker/DSA-6509-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6506-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Unbound, a validating, recursive, caching DNS resolver, which could result in denial of service, cache poisoning, DNS cookie bypass or potentially the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6507-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSecurity issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure. https://security-tracker.debian.org/tracker/DSA-6508-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in BIND, a DNS server implementation, which may result in denial of service or cache poisoning. https://security-tracker.debian.org/tracker/DSA-6505-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were discovered in Thunderbird, which could result in the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6503-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordIt was discovered that incorrect state cookie parsing in mod_auth_openidc, an OpenID Certified authentication and authorisation module for the Apache HTTP server that implements the OpenID Connect Relying Party functionality, could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6504-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordA buffer overflow was found in the ODML parser of MKVToolNix, a set of command-line tools (and GUI) to work with Matroska files, which could potentially result in the execution of arbitrary code when processing malformed .mkv files. https://security-tracker.debian.org/tracker/DSA-6502-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6500-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information disclosure or privilege escalation. https://security-tracker.debian.org/tracker/DSA-6501-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordThe update for nginx released as DSA 6496-1 caused a regression in the nginx-dev package: the backported fix for CVE-2026-42533 declared two private header files, which are not shipped in nginx-dev, as dependencies of the module build, so third-party nginx modules could no longer be built against nginx-dev. Updated nginx packages are now available to correct this issue. https://security-tracker.debian.org/tracker/DSA-6496-2
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordTwo vulnerabilities were discovered in cjose, a C library implementing the JOSE standard, which could result in denial of service, execution of arbitrary code or plain text recovery in specific setups. https://security-tracker.debian.org/tracker/DSA-6499-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple vulnerabilities were discovered in nginx, a high-performance web and reverse proxy server, which may result in denial of service, memory disclosure or potentially the execution of arbitrary code. CVE-2026-42533 A heap buffer overflow was discovered in the nginx script engine. It can be triggered when a map directive performs regular expression matching and a string expression references captures modified by the map, or when non-cacheable variables change between the script length pass and the script copy pass. CVE-2026-56434 Duplicate finalization of an HTTP subrequest can result in a use-after-free. The issue is observable in configurations using server-side includes together with proxy_pass and proxy_buffering disabled, when an upstream response causes the same subrequest to be posted twice. CVE-2026-60005 ngx_http_regex_exec() could replace the captures array without clearing r->ncaptures when the new regular expression did not match. A subsequent unnamed capture could then access uninitialised memory, resulting in memory disclosure. https://security-tracker.debian.org/tracker/DSA-6496-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in the Xorg X server, which may result in privilege escalation if the X server is running privileged. https://security-tracker.debian.org/tracker/DSA-6497-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordAndres Berbescu discovered two vulnerabilities in the L2TP connection plugin for Network Manager which allowed a local user with permissions to create/activate personal VPN connections to escalate their privileges to root. https://security-tracker.debian.org/tracker/DSA-6498-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution. https://security-tracker.debian.org/tracker/DSA-6495-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security issues were found in Rack, an interface for developing web applications in Ruby, which could result in denial of service, information disclosure, spoofing or bypass of access restrictions. https://security-tracker.debian.org/tracker/DSA-6492-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in libevent, an asynchronous event notification library. The HTTP implementation (evhttp) handled Transfer-Encoding and Content-Length headers, chunked-encoding line terminators, header line folding and chunked trailers too permissively, which could allow HTTP request smuggling, header injection or access control bypass when a libevent-based server or client is combined with an HTTP proxy. Out-of-bounds memory accesses in the DNS (evdns), tagged RPC (evtag/evrpc) and buffered socket (bufferevent) code, and a use-after-free in evbuffer, could result in denial of service or potentially the execution of arbitrary code when processing untrusted input. https://security-tracker.debian.org/tracker/DSA-6493-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMultiple security vulnerabilities were discovered in the Kamailio SIP server, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6494-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordSeveral vulnerabilities were discovered in the Slurm Workload Manager, a cluster resource management and job scheduling system, which may result in privilege escalation, SQL injection in the accounting database, deletion of files outside the container spool directory, bypass of credential verification for shared objects transferred with sbcast, or denial of service. https://security-tracker.debian.org/tracker/DSA-6491-1
Known issues: Not stated in the verified publisher record.
Recommended action: Review the official publisher document before deployment.
BlackTree update recordMatches use the product-family mapping against the CISA Known Exploited Vulnerabilities catalogue. They show vulnerabilities exploited in the wild, not every published CVE. Confirm the affected edition and release in the linked vendor advisory before acting.
No CISA known-exploited entries currently match this mapped product family.
This is not evidence that the product has no vulnerabilities. Review the vendor security advisories for a complete product and release assessment.
Debian 12 full support ended in July 2026 and LTS continues through 30 June 2028 with reduced architecture and package coverage.
Manually verified against the registered authoritative source.
Open vendor sourceRepresentative private pilot catalogue seed.
