Vulnerabilitymedium
Debian 13.5 point release lands with security fixes, bug patches
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-23918+3 related CVEs | Double-Free (Possible RCE) in Apache HTTP Server HTTP/2 Protocol Handling | 8.8 group max | 50% | ||
| CVE-2026-29111 | systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data | 5.5 | <1% | ||
CVE-2026-35385+4 related CVEs | In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is… | 8.1 group max | <1% | ||
| CVE-2026-35535 | In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal… | 7.8 | <1% | ||
CVE-2026-40225+1 related CVE | In udev in systemd before 260, local root execution can occur via malicious hardware devices and unsanitized kernel output | 6.4 | <1% | ||
| CVE-2026-4046 | The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399… | 7.5 | <1% | PoC | |
| CVE-2026-4105 | systemd: The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class… | 6.7 | <1% | ||
CVE-2026-4437+1 related CVE | Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version… | 7.5 group max | <1% | PoC |
From the original article
2 min read at helpnetsecurity.com
Debian 13. 5 is the fifth point release for the stable distribution “trixie.” The update folds in roughly 100 Debian Security Advisories and corrections for more than 130 source packages, covering everything from the Linux kernel and Apache HTTP Server to OpenSSH, sudo, systemd, OpenSSL, glibc, and FreeRDP.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.