Simon McVittie uploaded new packages for flatpak which fixed the
following security problems, the same as in DSA 6207-1:

* CVE-2026-34078, which allowed a Flatpak app to break out of the
    sandbox, resulting in code execution in the host context
* CVE-2026-34079, which allowed a Flatpak app to delete arbitrary
    files on the host system
* GHSA-2fxp-43j9-pwvc, which allowed a local user to read any file
    that is readable by the `_flatpak` system user
* GHSA-89xm-3m96-w3jg, which allowed a local user to interfere with
    another local user's ability to cancel an ongoing download

For the bookworm-backports distribution, the problems have been fixed in
version 1.16.6-1~deb13u1~bpo12+1.

Colin Watson uploaded new packages for openssh which fixed the
following security problems:

CVE-2026-3497 (DSA-6204-1)
  Jeremy Brown discovered a flaw in the GSSAPI Key Exchange patch
  applied in Debian to OpenSSH, an implementation of the SSH
  protocol suite, affecting non-default configurations with the
  GSSAPIKeyExchange setting enabled. A remote attacker can take
  advantage of this flaw to cause a denial of service, or
  potentially the execution of arbitrary code.

  https://security-tracker.debian.org/tracker/CVE-2026-3497

For the trixie-backports distribution, the problem has been fixed in
version 1:10.2p1-6~bpo13+1.

Mathias Gibbens uploaded new packages for incus which fixed the
following security problems:

CVE ID         : CVE-2026-28384 CVE-2026-33542 CVE-2026-33743 CVE-2026-33897

Multiple security issues were discovered in Incus, a system container
and virtual machine manager, which could result in denial of service
or the execution of arbitrary commands.

For the bookworm-backports distribution the problems have been fixed in
version 6.0.4-2+deb13u5~bpo12+1.

Mathias Gibbens uploaded new packages for incus which fixed the following
security problems:

CVE ID         : CVE-2026-23953 CVE-2026-23954

Two security issues were discovered in Incus, a system container and
virtual machine manager, which could result the in execution of
arbitrary commands via malformed images.

For the bookworm-backports distribution the problems have been fixed in
version 6.0.4-2+deb13u4~bpo12+1.

Throw away binaries for uploads to BACKPORTS-NEW

Hi all,

Thanks to the initiative of Jochen Sprickerhof, the ftp-masters have merged a change to the Debian configuration of DAK that will enable a feature to throw away binaries after processing of the BACKPORTS-NEW queue [1]. The benefit is that all binary packages (in main) will get built by the Debian buildds before we distribute them within the archive. Packages in contrib, non-free and non-free-firmware will not benefit this change for technical reasons (see [2] for a more detailed explanation).

Please reach out to me if details are still not clear after reading the wiki.

Enjoy, Micha

[1] https://salsa.debian.org/ftp-team/dak/-/merge_requests/300 [2] https://wiki.debian.org/ThrowAwayNewBinaries

Mathias Gibbens uploaded new packages for incus which fixed the following
security problems:

CVE ID         : CVE-2025-64507

It was discovered that Incus, a system container and virtual machine
manager, is prone to a local privilege escalation vulnerability if
unprivileged users are allowed access to Incus through incus-user.

For the bookworm-backports distribution the problems have been fixed in
version 6.0.4-2+deb13u2~bpo12+1.

Mathias Gibbens uploaded new packages for incus which fixed the following
security problems:

CVE ID         : CVE-2025-54286 CVE-2025-54287 CVE-2025-54288
                 CVE-2025-54289 CVE-2025-54290 CVE-2025-54291
                 CVE-2025-54293

Multiple security issues were discovered in Incus, a system container
and virtual machine manager, which could result in file disclosure,
information disclosure, privilege escalation or cross-site request
forgery.

For the bookworm-backports distribution the problems have been fixed in
version 6.0.4-2+deb13u1~bpo12+1.

trixie-backports and bookworm-backports-sloppy open for uploads

Now after Debian trixie got released, we are pleased to announce that trixie-backports and bookworm-backports-sloppy are now open for uploads. Please ensure to follow the rules of those distributions. In short, uploads to these two distributions need to be available in forky (a.k.a. testing).

Thanks

Thanks have to go out to all people making backports possible, and that includes up front the backporters themselves who prepare the backports and upload the packages, track and update them on a regular basis. Also a big thanks goes to the buildd team making the autobuilding possible and the ftp masters for creating the suites in the first place.

Thanks Alex, Rhonda, Micha - backports ftpmasters

[1] https://backports.debian.org/Contribute/

Colin Watson uploaded new packages for python-django which fixed the
following security problems:

CVE-2025-32873

    Denial-of-service possibility in strip_tags().
    django.utils.html.strip_tags() would be slow to evaluate certain
    inputs containing large sequences of incomplete HTML tags. This
    function is used to implement the striptags template filter,
    which was therefore also vulnerable. strip_tags() now raises a
    SuspiciousOperation exception if it encounters an unusually
    large number of unclosed opening tags.

For the bookworm-backports distribution the problem has been fixed
in version 3:4.2.21-1~bpo12+1.

Colin Watson uploaded new packages for python-django which fixed the
following security problems:

    CVE-2025-26699

        Potential denial-of-service vulnerability in
        django.utils.text.wrap(). The wrap() method and wordwrap
        template filter were subject to a potential denial-of-service
        attack when used with very long strings.

For the bookworm-backports distribution the problem has been fixed
in version 3:4.2.20-1~bpo12+1.