Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages
Debian 13.7 'trixie' point release bundles 92 security advisories and 106 package updates, including kernel, glibc, u-boot and qemu fixes.
Debian shipped version 13.7 of 'trixie', folding in 92 previously published security advisories and corrections to 106 source packages, including six Linux kernel advisories (DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466, DSA-6477). glibc fixes a buffer overflow (CVE-2026-5928) and buffer underflow (CVE-2026-5450), with 17 packages rebuilt against the updated library; qemu carries 25 CVEs including a secure boot bypass (CVE-2026-16288), imagemagick 24, wolfssl 15 and perl 13. Boot-chain fixes include a u-boot FIT image verification bypass (CVE-2026-46728), a BOOTP/DHCP buffer overread (CVE-2024-42040), and corrected intermediate certificate verification in sbsigntool. The installer was rebuilt with kernel ABI 6.12.107+deb13, and existing systems receive the fixes through normal package mirror updates.
- 92 security advisories and 106 package corrections rolled into Debian 13.7 point release
- Six Linux kernel advisories included: DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466, DSA-6477
- glibc buffer overflow CVE-2026-5928 and underflow CVE-2026-5450 fixed; seventeen packages rebuilt
- u-boot FIT verification bypass CVE-2026-46728 and qemu secure boot bypass CVE-2026-16288 fixed
- Installer rebuilt with kernel ABI 6.12.107+deb13; existing systems update via standard mirrors
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-42040 | Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from its initial commit in 2002 (3861aa5) up to today on any platform allows an attacker on… | 8.1 | <1% | ||
| CVE-2026-11940 | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than… | 7.8 | <1% | ||
| CVE-2026-12725 | A heap-based buffer overflow was found in dnsmasq | 5.9 | <1% | ||
| CVE-2026-12969 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c | 5.3 | <1% | ||
| CVE-2026-14258 | dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing: A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during… | 6.5 | <1% | ||
| CVE-2026-16288 | — | — | — | ||
CVE-2026-34873+1 related CVE | An issue was discovered in Mbed TLS 3.5.0 through 4.0.0 | 9.1 group max | <1% | ||
| CVE-2026-27205 | Flask: In versions 3.1.2 and below, when the session object is accessed, Flask should set the Vary: Cookie header., resulting in a Use… | 2.3 | <1% | ||
CVE-2026-42496+1 related CVE | Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory | 9.1 group max | <1% | ||
| CVE-2026-4360 | In the Tarfile.extract() function, the filter parameter is not passed properly when extracting hardlinks | 2.0 | <1% | ||
| CVE-2026-46728 | Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted from a hash | 8.8 | <1% | PoC | |
CVE-2026-5450+1 related CVE | Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with… | 9.8 group max | <1% | PoC | |
| CVE-2026-54707 | OnionShare: OnionShare CLI/Desktop does not enforce the Receive mode disable_files setting in cli/onionshare_cli/web/receive_mode.py, where… | 5.4 | <1% | ||
| CVE-2026-61404 | — | — | — | ||
| CVE-2026-7010 | HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values | 6.5 | <1% | ||
| CVE-2026-7017 | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets | 7.1 | <1% | ||
| CVE-2026-8276 | A flaw has been found in bettercap up to 2.41.5 | 2.9 | <1% |
From the original article
3 min read at helpnetsecurity.com
The Debian project shipped Debian 13. 7 codenamed “trixie.” The project folded in 92 security advisories it had already published separately, added corrections to 106 source packages, and rebuilt the installer around both.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.