The Debian project has announced the fifth update to its stable distribution, Debian 13 (codename trixie). This point release, version 13.5, is primarily a collection of security corrections and fixes for serious problems.
Unlike a full version upgrade, this point release does not constitute a new version of Debian 13. It only updates some of the packages included. Users do not need to discard old trixie media; after installation, packages can be upgraded to current versions using an up-to-date Debian mirror.
Upgrading to 13.5
To upgrade an existing installation to this revision, users should point their package management system at one of Debian's many HTTP mirrors. A comprehensive list of mirrors is available on the Debian website.
Security and Bug Fixes
This stable update addresses a wide range of vulnerabilities. The release notes highlight updates to several critical packages:
- apache2: Updated to a new upstream stable release and fixed multiple issues including privilege escalation, authentication bypass, and HTTP response splitting.
- openssh: Fixed command execution issues, incomplete application of key algorithms, and improper handling of the authorized_keys principals option.
- curl: Fixed a server certificate verification issue.
- systemd: Updated to a new upstream stable release and fixed code execution issues and an nspawn escape-to-host issue.
- glibc: Fixed incorrect handling of DNS responses and invalid DNS hostnames.
The update also includes fixes in packages such as black (arbitrary file write), docker.io (rebuild with updated glibc), python3.13 (header injection issues), and many others.
Security advisories for these updates have been published separately under Debian Security Advisories (DSA) numbers. The release notes reference over 70 DSAs covering packages like chromium, firefox-esr, thunderbird, openssl, and more.
Removed Packages
One package, dav4tbsync, was removed due to being superseded by Thunderbird 140.
Debian 13 (trixie) continues to be maintained with regular point releases to ensure stability and security for users.