The Debian LTS Team, funded by [Freexian’s Debian LTS offering] (https://www.freexian.com/lts/debian/), is pleased to report its activities for July.
Activity summary
During the month of July, 23 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).
The team released 52 DLAs fixing 2159 CVEs.
In July, the Debian Stable Release Managers published the last point release of Debian 12 (“bookworm”), after which the Debian LTS team took full responsibility of Debian 12. This completes the handover from the Security Team, that took place in June. This also marks the second month in a row where the Debian LTS has been focusing on two simultaneous Debian releases.
Other than Debian 12, the team is maintaining Debian 11 (“bullseye”), which will reach the end of its Long Term Support on 31 August 2026. After that date, Freexian will continue the security support under the Extended LTS offer.
The team published several notable updates:
- jq (DLA 4662-1 and DLA 4661-1) prepared by Andreas Henriksson in collaboration with Jochen Sprickerhof, addressing multiple vulnerabilities.
- Several updates for the different linux supported versions prepared by Ben Hutchings, in collaboration with Emilio Pozuelo Monfort. Other than the regular security advisories: DLA 4664-1, DLA 4665-1, DLA 4671-1, DLA 4688-1, and DLA 4700-1, Ben started preparing packages of 6.12 via bookworm-backports.
- nginx (DLA 4667-1), updated for bookworm by Carlos Henrique Lima Melara, as a follow up of the bullseye update (DLA 4660-1), that was prepared in June.
- grub2/bullseye (DLA 4685-1), prepared by Emilio. Other than addressing several security issues, this DLA was needed for being able to update the shim boot loader.
- samba (DLA 4692-1), uploaded by Markus Koschany, to fix several security flaws in bullseye, including issues that could yield to remote code execution.
- imagemagick (DLA 4680-1 and DLA 4696-1), prepared by Bastien Roucariès, addressing several issues that could lead to denial of service, information disclosure or potentially arbitrary code execution in some scenarios.
- poppler (DLA 4709-1), by Guilhem Moulin, fixing several vulnerabilities.
- nss (DLA-4694-1), by Jochen, fixing flaws that may result in or denial of service or potentially the execution of arbitrary code.
Contributions from outside the LTS Team:
- Guillem Jover prepared the dpkg update, released as DLA-4673-1 by Arnaud.
- Nicholas Guriev released a rlottie security update (DLA 4675-1)
- Bernhard Schmidt prepared the openvpn updates for both bookworm and trixie, released as DLA 4666-1.
The LTS Team has also contributed with updates to the latest Debian releases:
- Bastien also proposed two updates for imagemagick. The first one released as DSA 6383-1, and the second as a trixie point update proposal (#1142554).
- python-httplib2 by Emmanuel Arias, and released by the security team as DSA 6441-1 in August.
- hplip (DSA 6402-1), prepared by Thorsten Alteholz, to address privilege escalation and arbitrary code execution related flaws.
- libnfs trixie update (#1142351), by Thorsten
- patool update for trixie #1141607, by Abhijith PA
Other contributions:
Besides the work on security updates, different documentation and tooling changes were needed, especially in the context of the Debian 12 handover. This work was mainly done by Sylvain Beucler.
Individual Debian LTS contributor reports
- Abhijith PA
- Andreas Henriksson
- Andrej Shadura
- Arnaud Rebillout
- Bastien Roucariès
- Ben Hutchings
- Carlos Henrique Lima Melara
- Chris Lamb
- Daniel Leidert
- Emmanuel Arias
- Emilio Pozuelo Monfort
- Guilhem Moulin
- Jochen Sprickerhof
- Lee Garrett
- Lucas Kanashiro
- Lukas Märdian
- Markus Koschany
- Paride Legovini
- Santiago Ruano Rincón
- Sylvain Beucler
- Thorsten Alteholz
- Tobias Frost
Thanks to our sponsors
Sponsors that joined recently are in bold.
- Platinum sponsors:
- Toshiba Corporation (for 130 months)
- Civil Infrastructure Platform (CIP) (for 98 months)
- VyOS Inc (for 63 months)
- Gold sponsors:
- F. Hoffmann-La Roche AG (for 141 months)
- CONET Deutschland GmbH (for 124 months)
- University of Oxford (for 81 months)
- EDF SA (for 52 months)
- Dataport AöR (for 27 months)
- CERN (for 25 months)
- Silver sponsors:
- Domeneshop AS (for 145 months)
- Nantes Métropole (for 139 months)
- Akamai - Linode (for 135 months)
- Univention GmbH (for 131 months)
- Université Jean Monnet de St Etienne (for 131 months)
- Ribbon Communications, Inc. (for 125 months)
- Exonet B.V. (for 115 months)
- Leibniz Rechenzentrum (for 109 months)
- Ministère de l’Europe et des Affaires Étrangères (for 93 months)
- Dinahosting SL (for 80 months)
- Upsun Formerly Platform.sh (for 75 months)
- Moxa Inc. (for 69 months)
- sipgate GmbH (for 66 months)
- OVH US LLC (for 64 months)
- Tilburg University (for 64 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 56 months)
- THINline s.r.o. (for 28 months)
- Copenhagen Airports A/S (for 22 months)
- Conseil Départemental de l’Isère (for 8 months)
- CEOS GmbH
- Bronze sponsors:
- Seznam.cz, a.s. (for 146 months)
- Evolix (for 145 months)
- Linuxhotel GmbH (for 143 months)
- Intevation GmbH (for 142 months)
- WAAYS (for 141 months)
- Megaspace Internet Services GmbH (for 140 months)
- Greenbone AG (for 139 months)
- NUMLOG (for 139 months)
- WinGo AG (for 138 months)
- Entr’ouvert (for 130 months)
- Adfinis AG (for 127 months)
- Plat’Home (for 124 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 122 months)
- Tesorion (for 122 months)
- Bearstech (for 114 months)
- LiHAS (for 114 months)
- Catalyst IT Ltd (for 108 months)
- Demarcq SAS (for 102 months)
- Université Grenoble Alpes (for 88 months)
- TouchWeb SAS (for 80 months)
- SPiN AG (for 77 months)
- CoreFiling (for 73 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 65 months)
- Tem Innovations GmbH (for 59 months)
- WordFinder.pro (for 59 months)
- CNRS DT INSU Résif (for 58 months)
- Soliton Systems K.K. (for 53 months)
- Alter Way (for 51 months)
- SOBIS Software GmbH (for 25 months)
- Tuxera Inc. (for 17 months)
- OPM-OP AS (for 8 months)
- LU-CIX Management G.I.E.