I've worked during April 2025 on the below listed packages, for Freexian LTS/ELTS [1] Many thanks to Freexian and sponsors [2] for providing this opportunity! abseil (DLA-4116-1) =================== Started in March, I've finished the work on abseil to address CVE-2025-0838. I've also uploaded a fix for unstable and prepared a s-p-u, but this is pending on release manager's feedback (#1102135) zabbix (DLA-4131-1, ELA-1409-1) =============================== Brought up zabbix for LTS to the last upstream LTS version, as the 5.0.x branch is still in limited supported until end of May. This reduced the risk of introducing regressions a lot and as upstream only targets security and severe issues. However, some issues will still require backporting, as not every issue is adresses upstream. (For bookworm, 2 out of the 5 open CVEs required manual backporting) For ELTS there are no longer upstream supported LTS versions to pick, so CVEs have to be triaged and assessed if the vulnerability applies to those ELTS versions and then they need to be backported. This way, for buster, eventually 12 CVEs have been adressed and for jessie there was one CVE to be fixed. simplesamlphp (WIP) =================== I'm started to fix one CVE in simplesamlphp and currently working on how to properly test the changes. This work will complete in early May. [1] https://www.freexian.com/lts/ [2] https://www.freexian.com/lts/debian/#sponsors Cheers, -- tobi
Attachment:
signature.asc
Description: PGP signature