Updated Debian 13: 13.7 released

Key points

Debian has released 13.7, the seventh update of its stable distribution Debian 13 "trixie", dated 12 September 2026. It mainly collects security fixes already issued through security.debian.org, plus corrections for serious problems. It is not a new version of Debian 13: existing trixie media remain valid, and an installed system only needs its packages upgraded.

How to upgrade

• Point the package manager at an up-to-date Debian mirror and upgrade as usual; the mirror list is at debian.org/mirror/list.
• Systems that install updates from security.debian.org regularly will have few packages left to update.
• New installation images will appear at the regular locations; the installer was rebuilt with the point-release fixes and its kernel ABI moves to 6.12.107+deb13.

Core libraries and base system

• glibc: buffer overflow and underflow fixes (CVE-2026-5928, CVE-2026-5450) and compatibility with Linux 7.0 headers. Many packages were rebuilt against it, among them bash, busybox, docker.io, gnupg2, snapd and zsh.
• glib2.0: nine CVE fixes covering out-of-bounds access, file content disclosure, denial of service and an out-of-bounds write.
• openssl and samba: new upstream releases.
• perl: thirteen CVE fixes, including archive extraction through symlinks and hardlinks and credential forwarding on redirects.
• python3.13: fixes a use-after-free regression in dict.clear() plus five CVEs.
• gzip, sqlite3, pcre2, alsa-lib and libssh2: security fixes.
• tzdata and libdatetime-timezone-perl: 2026c data; Alberta is permanently at -06 and Morocco permanently at +00.
• base-files: adds AGPL-3.0, Artistic-2.0, BSL-1.0, several CC-BY and CC-BY-SA licences, GFDL-1.1 and OFL-1.1 to common-licenses.

Virtualisation and containers

• qemu: new upstream stable release with over twenty CVE fixes, including a Secure Boot bypass (CVE-2026-16288).
• libvirt: five CVEs, including a privilege escalation (CVE-2026-63622).
• incus: path traversal and access check fixes. lxc: nested containers work with current runc.

Network services

• dnsmasq: buffer overflow and out-of-bounds read. dhcpcd: IPv6 Neighbor Discovery parsing (CVE-2026-14258).
• cyrus-imapd: nine CVEs. proftpd-dfsg: SQL injection and overflows. rsyslog: denial of service and buffer overflows. squid, socat and transmission: one fix each.
• mbedtls and wolfssl: multiple validation and certificate handling fixes.

Other notable fixes

• imagemagick: more than twenty CVEs. libraw, dcmtk, fluidsynth and the SDL image libraries: parser fixes.
• ansible-core: new upstream release fixing code injection (CVE-2026-11332).
• rustc: tar unpacking and cargo credential leak fixes. u-boot: FIT signature verification bypass (CVE-2026-46728).
• cinnamon: downloading and updating applets, desklets, extensions and themes works again.
• audit gains riscv64 support; refpolicy enables the usbguard SELinux policy.
• New packages llvm-toolchain-22, rustc-web and rust-cbindgen-web support browser builds.

Security advisories folded in

• The release incorporates advisories from DSA-6381 to DSA-6486.
• Kernel: six linux advisories (DSA-6381, 6393, 6405, 6415, 6466, 6477).
• Browsers and desktop: chromium, firefox-esr, webkit2gtk, gimp, emacs, flatpak, bubblewrap.
• Servers: postfix, exim4, bind9, pdns, postgresql-17, php8.4, openssl, samba, roundcube, wordpress, xen, docker.io, zfs-linux, openjdk-21 and openjdk-25.
• The full list of changed packages is in the trixie ChangeLog on deb.debian.org.

Summary by DistroNews, based on the original post.