Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages
Summary
Debian 13.7 bundles 92 previously issued security advisories and corrections to 106 source packages, including kernel, library, application, and boot-chain fixes. The release updates the installer and kernel ABI to 6.12.107+deb13.
Key points
- The release includes six Linux kernel advisories; systems installed from older trixie media receive the updates during their first update run.
- glibc fixes a buffer overflow and underflow, while qemu, imagemagick, wolfssl, and perl account for many of the listed CVEs.
- Fixes address a U-Boot FIT image verification bypass, a qemu secure-boot bypass, and a correction to sbsigntool certificate verification.
- Perl and libhttp-tiny-perl fix credential forwarding across redirects; other listed issues include archive extraction flaws and session-cache handling in Flask.
- Debian updated the installer and its kernel ABI to 6.12.107+deb13; existing systems can update through a Debian mirror.
Article Details
- Event Type
- Debian 13.7 point release incorporating previously published security fixes and package updates.
- Impact
- The release integrates 92 security advisories and corrections to 106 source packages, including six Linux kernel advisories. Reported issues include vulnerabilities affecting glibc, qemu, imagemagick, wolfssl, perl, cyrus-imapd, and other packages; the article describes outcomes such as secure boot bypass, credential forwarding on redirects, buffer errors, and denial of service.
CVE
CVE-2024-42040Denx · U-bootThe same u-boot entry fixes a BOOTP/DHCP buffer overread filed as CVE-2024-42040.CVE-2026-11940Vendor / Product unavailableThe rest of that entry is five CVEs, among them a file overwrite issue, CVE-2026-11940, and incorrect handling of user and group IDs in tar files, CVE-2026-4360.CVE-2026-12725Redhat · Enterprise linux; Redhat · Openshift container platform; +1 moredhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258, and dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969.CVE-2026-12969Redhat · Enterprise linux; Thekelleys · Dnsmasqdhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258, and dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969.CVE-2026-14258Vendor / Product unavailabledhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258, and dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969.CVE-2026-16288Vendor / Product unavailableqemu’s list includes a secure boot bypass, CVE-2026-16288, and a post_load check added to its UEFI device, CVE-2026-61404.CVE-2026-25834Trustedfirmware · Mbed tlsmbedtls carries seven, including a client impersonation issue, CVE-2026-34873, and a signature algorithm injection issue, CVE-2026-25834.CVE-2026-27205Palletsprojects · Flaskflask now sets “Vary: Cookie” when a session is accessed, CVE-2026-27205.CVE-2026-34873Trustedfirmware · Mbed tlsmbedtls carries seven, including a client impersonation issue, CVE-2026-34873, and a signature algorithm injection issue, CVE-2026-25834.CVE-2026-42496Archive::tar project · Archive::tarperl’s entry runs to 13 CVEs and includes symlink and hardlink extraction issues, CVE-2026-42496 and CVE-2026-42497, which matter to anything that unpacks an archive it did not create.CVE-2026-42497Archive::tar project · Archive::tarperl’s entry runs to 13 CVEs and includes symlink and hardlink extraction issues, CVE-2026-42496 and CVE-2026-42497, which matter to anything that unpacks an archive it did not create.CVE-2026-4360Python · PythonThe rest of that entry is five CVEs, among them a file overwrite issue, CVE-2026-11940, and incorrect handling of user and group IDs in tar files, CVE-2026-4360.CVE-2026-46728Denx · U-bootCVE-2026-46728 let that verification pass on an image it should have rejected.CVE-2026-5450Gnu · Glibcglibc itself picked up fixes for a buffer overflow and a buffer underflow, CVE-2026-5928 and CVE-2026-5450, plus a change to keep it working with Linux 7.0 headers.CVE-2026-54707Vendor / Product unavailableonionshare stops writing files in Receive mode when uploads are disabled, CVE-2026-54707.CVE-2026-5928Gnu · Glibcglibc itself picked up fixes for a buffer overflow and a buffer underflow, CVE-2026-5928 and CVE-2026-5450, plus a change to keep it working with Linux 7.0 headers.CVE-2026-61404Vendor / Product unavailableqemu’s list includes a secure boot bypass, CVE-2026-16288, and a post_load check added to its UEFI device, CVE-2026-61404.CVE-2026-7010Vendor / Product unavailableBoth packages also fix CRLF validation, CVE-2026-7010.CVE-2026-7017Vendor / Product unavailableperl and libhttp-tiny-perl both carry CVE-2026-7017, credential forwarding on redirects.CVE-2026-8276Vendor / Product unavailablebettercap stops installing its systemd service by default and fixes a remote denial of service in its mysql.server module triggered by a crafted client handshake, CVE-2026-8276.
Products
bettercapThe point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13.cyrus-imapdsix Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd.Debian 13.7Debian 13.7 “trixie” bundles 92 previously issued security advisories and fixes 106 source packages, including six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, anddhcpcddhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258, and dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969.dnsmasqThe point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13.FlaskThe point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13.glibcadvisories and fixes 106 source packages, including six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd.ImageMagickfixes 106 source packages, including six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd.libhttp-tiny-perlperl and libhttp-tiny-perl both carry CVE-2026-7017, credential forwarding on redirects.Linux kernel“trixie” bundles 92 previously issued security advisories and fixes 106 source packages, including six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd.Mbed TLSmbedtls carries seven, including a client impersonation issue, CVE-2026-34873, and a signature algorithm injection issue, CVE-2026-25834.onionshareThe point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13.perlincluding six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd.python3.13The point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13.QEMUand fixes 106 source packages, including six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd.sbsigntoolThe point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13.u-bootThe point release also addresses issues in u-boot, sbsigntool, flask, dnsmasq, python3.13, bettercap, and onionshare, while updating the installer and kernel ABI to 6.12.107+deb13.wolfSSLpackages, including six Linux kernel advisories and major updates across glibc, qemu, imagemagick, wolfssl, perl, and cyrus-imapd.