Debian 13.7 folds 92 already-published advisories into the trixie installer

u-boot verifies a FIT image before handing control to a kernel, and FIT is the single signed file that bundles the kernel with its device tree ^[10]. CVE-2026-46728 let that verification pass on an image it should have rejected ^[10]. The same u-boot entry closes a BOOTP/DHCP buffer overread filed as CVE-2024-42040, a number two years old ^[11].

Two more fixes sit in the same chain. qemu's list includes a secure boot bypass, CVE-2026-16288, and a post_load check added to its UEFI device, CVE-2026-61404 ^[12]. sbsigntool, the tool that signs EFI binaries, had its intermediate certificate verification corrected ^[13].

perl and libhttp-tiny-perl both carry CVE-2026-7017, credential forwarding on redirects ^[14]. A client that follows a redirect and takes its authorization header to the new destination hands the credentials to whoever controls that destination ^[14]. Both packages also fix CRLF validation, CVE-2026-7010 ^[15]. perl's entry includes symlink and hardlink extraction issues, CVE-2026-42496 and CVE-2026-42497, which matter to anything unpacking an archive it did not create ^[16].

Seventeen of the 106 corrected packages carry no fix of their own ^[5], leaving 89 that do ^[1]. Four of those account for 77 CVE numbers between them ^[2]: qemu 25, imagemagick 24, wolfssl 15 and perl 13 ^[7]. cyrus-imapd shows nine, eight of them insufficient access checks ^[8]. In a mail server those checks decide which account can open which mailbox ^[8]. mbedtls carries seven, including a client impersonation issue, CVE-2026-34873, and a signature algorithm injection issue, CVE-2026-25834 ^[9].

flask now sets "Vary: Cookie" when a session is accessed, CVE-2026-27205, and without that header a cache in front of the application can store a page built for one user's session and serve it to the next ^[17]. dnsmasq fixes a buffer overflow and an out of bounds read, CVE-2026-12725 and CVE-2026-12969 ^[19]. dhcpcd discards IPv6 router advertisements carrying zero-length Neighbor Discovery options, CVE-2026-14258 ^[18].

python3.13 corrects a use-after-free in dict.clear() with embedded values, a regression from the previous version of that package ^[20]. The rest of that entry is five CVEs, among them a file overwrite, CVE-2026-11940, and incorrect handling of user and group IDs in tar files, CVE-2026-4360 ^[20]. bettercap stops installing its systemd service by default and fixes a remote denial of service in its mysql.server module triggered by a crafted client handshake, CVE-2026-8276 ^[21].

An existing host takes all of it by pointing its package manager at a Debian mirror ^[24].