The Debian project shipped Debian 13.7 codenamed “trixie.” The project folded in 92 security advisories it had already published separately, added corrections to 106 source packages, and rebuilt the installer around both.
Six of the 92 advisories cover the Linux kernel, each listing the linux source package alongside the signed amd64 and arm64 builds: DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466 and DSA-6477. Anyone installing from older trixie media gets package versions that predate this whole set, and the machine catches up on its first update run. Systems that already track security.debian.org will pull few packages from the point release, because most of those security updates are included in it.
What is in the bugfix list
Seventeen of the 106 packages carry no fix of their own. Debian rebuilt them against an updated glibc, the C library that most programs on the system link against at runtime, and the list runs from bash and busybox through docker.io, gnupg2, snapd and zsh. glibc itself picked up fixes for a buffer overflow and a buffer underflow, CVE-2026-5928 and CVE-2026-5450, plus a change to keep it working with Linux 7.0 headers.
Four packages account for most of the CVE numbers. qemu carries 25, imagemagick 24, wolfssl 15 and perl 13. cyrus-imapd shows nine CVEs, eight of them insufficient access checks and one an out of bounds read. Access checks in a mail server decide which account can open which mailbox. mbedtls carries seven, including a client impersonation issue, CVE-2026-34873, and a signature algorithm injection issue, CVE-2026-25834.
The boot chain got two fixes
u-boot, the bootloader on many embedded and ARM boards, verifies a FIT image before handing off to a kernel; FIT bundles the kernel and device tree into one signed file. CVE-2026-46728 let that verification pass on an image it should have rejected. The same u-boot entry fixes a BOOTP/DHCP buffer overread filed as CVE-2024-42040. That number is two years old.
qemu’s list includes a secure boot bypass, CVE-2026-16288, and a post_load check added to its UEFI device, CVE-2026-61404. sbsigntool, the tool that signs EFI binaries for secure boot, had its intermediate certificate verification corrected.
Credentials handed to the wrong host
perl and libhttp-tiny-perl both carry CVE-2026-7017, credential forwarding on redirects. An HTTP client that follows a redirect and takes its authorization header along to the new destination hands credentials to whoever controls that destination. Both packages also fix CRLF validation, CVE-2026-7010. perl’s entry runs to 13 CVEs and includes symlink and hardlink extraction issues, CVE-2026-42496 and CVE-2026-42497, which matter to anything that unpacks an archive it did not create.
flask now sets “Vary: Cookie” when a session is accessed, CVE-2026-27205. Without that header, a cache sitting in front of the application can store a page built for one user’s session and serve it to the next. dhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258, and dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969.
A fix for a fix
python3.13 corrects a use-after-free in dict.clear() with embedded values, a regression from the previous version of the package. The rest of that entry is five CVEs, among them a file overwrite issue, CVE-2026-11940, and incorrect handling of user and group IDs in tar files, CVE-2026-4360. bettercap stops installing its systemd service by default and fixes a remote denial of service in its mysql.server module triggered by a crafted client handshake, CVE-2026-8276. onionshare stops writing files in Receive mode when uploads are disabled, CVE-2026-54707.
Getting the update
Debian updated the installer to carry the point release fixes and bumped the kernel ABI there to 6.12.107+deb13. An existing system takes the update by pointing its package manager at a Debian mirror.