The Debian project has released Debian 13.6, the sixth maintenance update for the stable distribution (codename trixie). This point release focuses on security corrections and addressing serious bugs. It does not constitute a new version of the operating system.
Upgrading to 13.6
To update an existing installation, users should point their package manager to a current Debian mirror. The release notes recommend running apt update && apt full-upgrade. New installation images will be available at standard locations soon.
Secure Boot CA Expiry
A significant change involves the handling of the expired 2013 UEFI Secure Boot Certificate Authority (CA). The fwupd package has been updated to version 2.0.20, which supports updating the CA, Key Exchange Key (KEK), and revocation (DBX) databases. The default shim-signed binaries have also been updated to shim 16.1-2~deb13u1. Because the 2013 CA has expired, future updates to shim-signed could render systems unable to boot with Secure Boot enabled. Users are strongly advised to follow OEM guidance to update these databases.
Licensing and GeoIP
Due to licensing restrictions, the geoip-database package has been reverted to a version from December 2019. The newer GeoLite database is incompatible with the Debian Free Software Guidelines (DFSG) and cannot be distributed. Applications relying on this database may now use outdated allocation information.
Security and Bug Fixes
The update includes fixes for numerous vulnerabilities across the ecosystem. Notable packages updated include:
- Apache2: Fixes for use-after-free, cross-site scripting (XSS), buffer overflows, and denial-of-service (DoS) issues.
- Curl: Addresses bearer token redirect leaks, OpenSSL CA cache reuse issues, and SMB use-after-free bugs.
- Python 3.13: Fixes a crash in the SNI callback, path traversal issues, and server-side request forgery (SSRF).
- QEMU: Includes security fixes for the LSI53C895A SCSI Host Bus Adapter emulation that could lead to VM escape.
- Samba: Upgraded to a new upstream stable release.
This release consolidates numerous security advisories (DSAs) released separately by the Debian Security Team.