Security

Two vulnerabilities were discovered in aide, an advanced intrusion detection system, which could allow a local user to bypass the detection of malicious files.

https://security-tracker.debian.org/tracker/DSA-6578-1

Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure.

https://security-tracker.debian.org/tracker/DSA-6577-1

The webkit2gtk update released as DSA-6534-1 introduced a regression that prevents Evolution from displaying images embedded in HTML emails.

https://security-tracker.debian.org/tracker/DSA-6534-3

Several vulnerabilities were discovered in BIND, a DNS server implementation, which could result in denial of service or remote code execution.

https://security-tracker.debian.org/tracker/DSA-6576-1

Several vulnerabilities were discovered in nginx, a high performance web and reverse proxy server. Depending on the configuration, these could result in memory corruption, denial of service, injection of requests to backend servers, or bypass of client certificate authentication.

CVE-2026-15176

Mapping a rewritten request URI to a filesystem path in a location using the alias directive could cause a buffer overflow.

CVE-2026-93479

Evaluation of string expressions in the HTTP and stream modules could overwrite reserved buffer space, resulting in a buffer overflow. Affected operations include evaluation of variable document roots and access log paths.

The affected code was introduced into the trixie package by an earlier security backport.

CVE-2026-95101

Incorrect handling of fragmented unknown HTTP/3 frames could cause their contents to be treated as request body data. When proxying requests, this could allow injection of requests into a backend server or bypass of request body size limits.

CVE-2026-97205

A counter tracking pending asynchronous operations could overflow, causing request memory to be freed while still in use. This use-after-free could result in memory corruption or denial of service.

CVE-2026-97629

Incomplete synchronisation of TLS session ticket keys between worker processes could leave a worker using uninitialised key material. This could allow forged TLS sessions and bypass of client certificate authentication.

https://security-tracker.debian.org/tracker/DSA-6575-1

It was discovered that incorrect memory state tracking in PHP, a widely-used open source general purpose scripting language, could result in the execution of arbitrary code.

https://security-tracker.debian.org/tracker/DSA-6574-1

This update blocks compromised intermediate certificates issued by the eMudhra CA.

Most users will have these certs already blocked by the OneCRL feature provided by Firefox. This update blocks the certificates also for installations which have RemoteSettings disabled or which are unable to connect to the revocation backend service due to network constraints.

https://security-tracker.debian.org/tracker/DSA-6573-1

It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated ca-certificate packages are provided to remove the "emSign ECC Root CA - G3" and "Comodo AAA Services root" certificates.

https://security-tracker.debian.org/tracker/DSA-6572-1

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in privilege escalation, information disclosure or denial of service.

https://security-tracker.debian.org/tracker/DSA-6571-1

Two vulnerabilities were discovered in HAProxy, a fast and reliable load balancing reverse proxy, which could result in denial of service.

https://security-tracker.debian.org/tracker/DSA-6570-1

The update for cifs-utils announced in DSA 6567-1 introduced a regression when using the sec=krb5 and cruid mount options. Updated packages are now available to correct this issue.

https://security-tracker.debian.org/tracker/DSA-6567-2

Multiple vulnerabilities have been discovered in the Apache HTTP server, which may result in denial of service, information disclosure, authentication bypass or HTTP request smuggling.

https://security-tracker.debian.org/tracker/DSA-6569-1

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

https://security-tracker.debian.org/tracker/DSA-6568-1

Two vulnerabilities were discovered in cifs-utils, the Common Internet File System utilities, which could result in privilege escalation.

https://security-tracker.debian.org/tracker/DSA-6567-1

Several vulnerabilities have been discovered in Expat, an XML parsing C library, which could result in denial of service or potentially the execution of arbitrary code, if a malformed XML file is processed.

https://security-tracker.debian.org/tracker/DSA-6566-1

A vulnerability was discovered in SPIP, a website engine for publishing, which could result in unauthenticated remote code execution.

https://security-tracker.debian.org/tracker/DSA-6565-1

It was discovered that missing input sanitising in the APNG parser in the reference code implementation of the JPEG XL format could result in denial of service or information disclosure if malformed images are processed.

https://security-tracker.debian.org/tracker/DSA-6564-1

It was discovered that incorrect parsing of Content-Type headers in the Mutt mail user agent could result in denial of service or potentially the execution of arbitrary code.

https://security-tracker.debian.org/tracker/DSA-6563-1

Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure.

https://security-tracker.debian.org/tracker/DSA-6562-1

Multiple security vulnerabilities were discovered in the SOGo groupware server, which could result in cross-site scripting, shell injection, password reset poisoning or SQL injection.

https://security-tracker.debian.org/tracker/DSA-6561-1