----------------------------------------------------------------------------
Debian Stable Updates Announcement SUA 282-1 https://www.debian.org/
debian-release@lists.debian.org Jonathan Wiltshire
July 5th, 2026
----------------------------------------------------------------------------
Upcoming Debian 12 Update (12.15)
An update to Debian 12 is scheduled for Saturday, July 11th, 2026. As of now
it will include the following bug fixes. They can be found in
"bookworm-proposed-updates", which is carried by all official mirrors.
Please note that packages published through security.debian.org are not
listed, but will be included if possible.
Testing and feedback would be appreciated. Bugs should be filed in the
Debian Bug Tracking System, but please make the Release Team aware of them
by copying "debian-release@lists.debian.org" on your mails.
The point release will also include a rebuild of debian-installer.
Miscellaneous Bugfixes
----------------------
This oldstable update adds a few important corrections to the following
packages:
Package Reason
------- ------
7zip New upstream stable release; fix buffer
overflow issues [CVE-2026-48092
CVE-2026-48095]; fix memory disclosure issue
[CVE-2026-48101]; fix out-of-bounds read issues
[CVE-2026-48102 CVE-2026-48103 CVE-2026-48111
CVE-2026-48112]; fix uninitialised memory read
issue [CVE-2026-48104]
apache2 Fix HTTP/2 request DoS and file handle
exhaustion [CVE-2026-49975 CVE-2026-48913]; fix
proxy, DAV, LDAP, SSL, XML and header
memory/crash issues [CVE-2026-29167
CVE-2026-34355 CVE-2026-34356 CVE-2026-42535
CVE-2026-42536 CVE-2026-43951 CVE-2026-44185];
fix proxy FTP directory listing XSS and backend
loop [CVE-2026-29170 CVE-2026-44186]; restrict
htaccess expression file access
[CVE-2026-44119]; fix regex parsing underflow
[CVE-2026-44631]; correct SSI, file-cache,
WebDAV DELETE and proxy health-check handling;
update documentation and tests
appstream Rebuild with updated libxmlb
astropy Fix FTBFS (on some architectures) through failing
tests
base-files Update for the point release
beets Fix XSS vulnerability [CVE-2026-42052]; fix
FTBFS in tests
calibre Fix various potential security issues; read
resources only from book contents
[CVE-2026-33206]; keep extracted files within
container dir [CVE-2026-30853]; prevent reading
background images from outside the config dir
[CVE-2026-33205]
chrony Ensure that if-up/down hook scripts exit
successfully
cloud-init Fix OpenStack bond initialisation
composer Fix support for new GitHub token format
[CVE-2026-45793]
curl Fix cache poisoning issue [CVE-2025-10148]; fix
data leak issues [CVE-2025-14524
CVE-2026-3783]; fix incorrect connection re-use
issues [CVE-2025-14819 CVE-2026-3784
CVE-2026-5773 CVE-2026-7168]
dar Rebuild with updated libgcrypt20
dcmtk Fix NULL pointer dereference issues
[CVE-2022-4981 CVE-2025-14841]; fix memory
corruption issues [CVE-2025-2357 CVE-2025-9732
CVE-2025-14607]; fix command injection issue
[CVE-2026-5663]; fix buffer overflow issues
[CVE-2026-10194 CVE-2026-12805]
debian-security-support Prepare support limitations ahead of transition
to LTS
delve Fix FTBFS on 4th generation EYPC processors
dhcpcd5 Fix NULL pointer dereference issue
[CVE-2025-70102]; fix out-of-bounds write issue
[CVE-2026-56114]
firewalld Fix dbus policy checking [CVE-2026-4948]
fwupd Rebuild with updated libjcat, libxmlb; add
support for updating DBX and KEK stores
geoip-database Revert to a DFSG-compatible version
ghdl Rebuild with updated gcc-12
giflib Fix memory corruption issues [CVE-2026-23868
CVE-2026-26740]
gnome-firmware Rebuild with updated libxmlb; backport patch
for libfwupd3 compatibility
gnome-software Rebuild with updated libxmlb; backport patch
for libfwupd3 compatibility
graphite2 Fix out-of-bounds write [CVE-2026-50593]
gss Fix FTBFS caused by an expired Kerberos ticket;
avoid krb5context self-tests with timebomb
horizon Fix escaping of special characters in project
ironic Fix file disclosure via image sources
[CVE-2025-44021]; fix console command injection
[CVE-2026-42510]; fix Swift token disclosure
[CVE-2026-42997]; fix unsafe template execution
[CVE-2026-44916]
keystone Fix behaviour of user_enabled_invert
[CVE-2026-40683]; prevent unauthorized EC2
credential creation and deletion [CVE-2026-33551]
libapache-session-browseable-perl
Improve entropy of generated session IDs
libbytes-random-secure-perl
Fix incorrect usage of seed in PRNG
[CVE-2026-11625]
libcaca Prevent undefined behaviour in overflow check
[CVE-2026-42046]
libcrypt-pbkdf2-perl Change default hash algorithm to HMAC-SHA256
and default iterations to 600,000
[CVE-2026-9641]; generate salts using
Crypt::URandom [CVE-2026-9638]; use a constant-
time comparison in `validate` to avoid timing
attacks [CVE-2017-20240]
libhtml-gumbo-perl Fix uninitialized memory access [CVE-2025-15646]
libhtml-parser-perl Fix heap-use-after-free in _decode_entities
[CVE-2026-8829]
libjcat Add support for ed25519 types and SHA512 hashes
libnet-cidr-lite-perl Fix IP/CIDR parser validation: reject non-ASCII
digits and trailing newlines [CVE-2026-55190];
reject zero-padded CIDR masks [CVE-2026-45191]
libreoffice Gracefully handle failure in graphite2
libvncserver Fix buffer overflow and out-of-bounds write
[CVE-2026-44988 CVE-2026-50538]
libxml-libxml-perl Fix out-of-bounds read [CVE-2026-8177]
libxml2 Fix catalogue recursion and duplicate-catalog
handling [CVE-2025-8732 CVE-2026-0990
CVE-2026-0992]; limit RelaxNG include recursion
[CVE-2026-0989]; fix xmllint shell memory leak
[CVE-2026-1757]; correct schematron regression-
test outputs [CVE-2025-49794 CVE-2025-49796];
fix XML writer and schematron memory leaks;
mitigate RelaxNG validation use-after-free;
update catalogue and RelaxNG regression tests
libxmlb Add support for zstd decompression; fix XMLb
store/truncation validation; correct query
binding/index handling; fix XML export and
empty text() handling
linuxcnc Sanitize module names
mariadb New upstream stable release; fix code execution
issues [CVE-2025-13699 CVE-2026-44168
CVE-2026-44170 CVE-2026-48163 CVE-2026-48165
CVE-2026-49261]; fix denial of service issues
[CVE-2026-21968 CVE-2026-34303]; fix logging
bypass issue [CVE-2026-3494]; fix path
traversal issue [CVE-2026-44171]; fix SQL
injection issue [CVE-2026-44172]; fix
incomplete privilege check issue
[CVE-2026-44173]; fix "Illegal mix of
collations" error; fix "Mroonga hangs on
invalid index flag"; fix crash in
information_schema.table_constraints
mesa Fix WebGPU/SPIR-V allocation handling
[CVE-2026-40393]
modsecurity Prevent denial of service in hexDecode handling
[CVE-2026-30923]; prevent denial of service in
SSN/CPF/SVNR verification [CVE-2026-42268]
mxml Fix out-of-bounds read [CVE-2026-5037]
node-flatted Fix prototype pollution issue [CVE-2026-33228]
node-jschardet Fix build link references
node-regexpp Add missing link to undici-types
ojalgo Reduce frequency of built-time test failures
openslide Fix possible code execution issue [CVE-2026-48977]
p7zip New upstream stable release; fix buffer
overflow issues [CVE-2026-48092
CVE-2026-48095]; fix memory disclosure issue
[CVE-2026-48101]; fix out-of-bounds read issues
[CVE-2026-48102 CVE-2026-48103 CVE-2026-48111
CVE-2026-48112]; fix uninitialised memory read
issue [CVE-2026-48104]
php-guzzlehttp-psr7 Fix Host authority validation [CVE-2026-48998];
reject control characters in URI hosts
[CVE-2026-49214]; harden ServerRequest globals
handling; normalise global header values;
encode literal plus signs in query helpers
php-twig Security update
phpunit Fix unsafe deserialization in PHPT code
coverage handling [CVE-2026-24765]
plasma-discover Backport patch for libfwupd3 compatibility
prometheus Fix date-sensitive build-time test
protobuf Fix parser recursion limits [CVE-2024-7254
CVE-2025-4565 CVE-2026-0994 CVE-2026-6409]
pydantic Fix denial of service in email verification
[CVE-2024-3772]
pymatgen Fix denial of service in
GaussianInput.from_string [CVE-2022-42964]
python-ase Disable unreliable built-time test
python-django Update test suite following changes in python3.13
python-filelock Fix symlink vulnerabilies [CVE-2025-68146
CVE-2026-22701]
python-markdown Fix parsing of bogus HTML markup [CVE-2025-69534]
python-pyramid Fix information disclosure issue [CVE-2023-40587]
python-xmltodict Fix XML injection issue [CVE-2025-9375]
python3.11 Prevent incorrect tar archive handling
[CVE-2025-13462]; ensure bytecode-only imports
use normal security checks [CVE-2026-2297];
reject unsafe cookie values [CVE-2026-3644];
prevent XML parser crashes [CVE-2026-4224];
prevent browser command injection
[CVE-2026-4519]; prevent bz2/lzma decompressor
memory corruption [CVE-2026-6100]; restore XML
autopkgtests
qemu Rebuild with updated gnutls28
rhino Fix denial of service issue [CVE-2025-66453]
rlottie Fix out-of-bounds read issue [CVE-2026-10305];
fix denial of service issues [CVE-2026-47319
CVE-2026-47320]
rsync Reject excessively long HTTP proxy response
lines [CVE-2026-45232]
ruby-css-parser Fix validation of HTTPS certificates for remote
CSS [CVE-2026-44312]
rust-time Fix denial of service [CVE-2026-25727]
science.js Fix build time race condition
sentry-python Fix subprocess environment sanitisation
[CVE-2024-40647]
shim New upstream release; build with default gcc;
set SBAT revocation level to 2025021800
shim-helpers-amd64-signed Update to shim 16.1-2~deb12u1
shim-helpers-arm64-signed Update to shim 16.1-2~deb12u1
shim-helpers-i386-signed Update to shim 16.1-2~deb12u1
shim-signed Ensure Secure Boot compatibility with 2023
Microsoft UEFI CA; check for likely boot issues
before installation; combine and verify
multiple shim signatures; update signed shim
binaries
sqlite-utils Add dependency on python3-click-default-group
sshfs-fuse Add contain_symlinks option to prevent symlink
escape attacks [CVE-2026-47187]; reject
hostname option injection via bracketed mount
source [CVE-2026-48711]
sylpheed Fix link checking [CVE-2021-37746]
user-mode-linux Rebuild with updated linux
vitrage Fix remote code execution vulnerability
[CVE-2026-28370]
webkit2gtk Reinstate Priority field
wireless-regdb New upstream stable release; update regulatory
information for several countries
xz-utils Fix buffer overflow issue [CVE-2026-34743]
A complete list of all accepted and rejected packages together with
rationale is on the preparation page for this revision:
<https://release.debian.org/proposed-updates/oldstable.html>
Removed packages
----------------
The following packages will be removed due to circumstances beyond our
control:
Package Reason
------- ------
smb4k Difficult to fix security issues
If you encounter any issues, please don't hesitate to get in touch with the
Debian Release Team at "debian-release@lists.debian.org".
Attachment:
signature.asc
Description: PGP signature