Debian LTS/ELTS report - August 2026

[Arnaud Rebillout <arnaudr@debian.org>]

During the month of August 2026 and on behalf of Freexian, I worked on the
following:

### ca-certificates / LTS / ELTS

Reviewed and tested the updates for bookworm and buster (with Bastien
Roucaries).

Uploaded `20250419~deb12u1~deb11u1~deb10u1~deb9u1` (stretch), issued
ELA-1810-1.

This is a backport update in order to get fairly up-to-date CA certificates
in Debian stretch. More precisely, it corresponds to Mozilla certificate
authority bundle version 2.74.

### ca-certificates-java / ELTS

Uploaded `20230710~deb12u1~deb11u1~deb10u2` (buster) and
`20230710~deb12u1~deb11u1~deb10u2~deb9u1` (stretch), issued ELA-1809-1.

This is a bugfix update to resolve a circular dependency between Java
packages and ca-certificates, and thus clear the way to backport
`ca-certificates` to Debian 9 stretch.

### xorg-server / LTS

Uploaded `2:21.1.7-3+deb12u13` (bookworm), issued DLA 4737-1, fixing:

  * CVE-2022-49737
  * CVE-2026-50256
  * CVE-2026-50257
  * CVE-2026-50258
  * CVE-2026-50259
  * CVE-2026-50260
  * CVE-2026-50261
  * CVE-2026-50262
  * CVE-2026-50263
  * CVE-2026-50264

Uploaded `2:1.20.11-1+deb11u18` (bullseye), issued DLA 4738-1, fixing all
the CVEs listed above, plus those 5:

  * CVE-2026-33999
  * CVE-2026-34000
  * CVE-2026-34001
  * CVE-2026-34002
  * CVE-2026-34003

### Thanks

Thanks to our sponsors for making this possible, and to Freexian for
handling the offering: <https://www.freexian.com/lts/debian/#sponsors>.

--
Arnaud