Hi, I'm currently working (for LTS) on sogo, and for that I've just uploaded an fix for CVE-2025-63499 to DELAYED-2 for unstable. After that I'd go for trixie, with additionally fixing CVE-2025-63498. (As the final target is providing fixes for LTS, I'll also tackle the open vulnerabilities for bookworm.) sogo is in dsa-needed.txt, trixies CVEs are all triaged "vulnerable", boowkorm's are mixed "no-dsa" and "vulnerable." As the next point release are near too, I can also do a s-p-u, or prepare a security upload and then hand over to you (like we did for libpng) Please let me know how I should proceed.. -- happy holidays, tobi
Attachment:
signature.asc
Description: PGP signature