The Debian Project has announced Debian 13.7, the seventh maintenance update to the stable “Trixie” series, which includes 107 security-related package updates from Debian Security Advisories, along with corrections and updates affecting 106 packages.
If you’ve been keeping your system updated through security.debian.org, there’s not much to do with this release, because most of the fixes were already included in earlier updates. 13.7 just brings them together in one place.
Among the notable changes, the Debian Installer has been rebuilt for the point release and now uses the Linux kernel 6.12.107. The audit package also gains support for the RISC-V 64-bit architecture.
Desktop users will find a fix for Cinnamon that restores downloading and updating its “spices,” including applets, desklets, extensions, and themes.
At the system level, glibc fixes buffer overflow and underflow vulnerabilities and adds compatibility with Linux kernel 7.0 headers. Plus, several packages have been rebuilt against the updated glibc.
Debian 13.7 also updates OpenSSL and Samba to newer upstream stable releases, while QEMU receives a new stable release with fixes for a long list of security problems, including buffer overflows, use-after-free issues, out-of-bounds access, and a Secure Boot bypass.
ImageMagick also receives an extensive collection of security fixes covering buffer overflows, memory leaks, use-after-free bugs, policy bypasses, denial-of-service problems, and an information disclosure issue.
Other noteworthy fixes cover dnsmasq, which addresses buffer overflow and out-of-bounds read vulnerabilities; libvirt, with fixes for privilege escalation, information disclosure, and other issues; and Incus, which patches path traversal and insufficient access-check vulnerabilities.
Perl receives a large collection of security corrections, while Python 3.13 fixes several vulnerabilities and regressions. Security updates are also included for Firefox ESR, Chromium, Flatpak, GIMP, Wireshark, OpenSSH-related libraries, PostgreSQL 17, Docker, OpenJDK, WebKitGTK, ZFS, and others.
Debian 13.7 also refreshes timezone data through a new tzdata upstream release, including changes for Alberta and Morocco, while several new packages have been introduced to support Chromium and other browser builds.
Finally, the Debian Installer has been updated to include all fixes incorporated into the stable distribution through this point release.
For existing Debian 13 users, upgrading is straightforward:
sudo apt updatesudo apt upgrade
For more in-depth information on all the changes, see the release announcement. A comprehensive list of all packages that have received updates is available here.
If you are planning a fresh install, Debian 13.7 netinst ISO images are available for download here. They offer a base system ideal for servers or users who want to customize the installation to their needs, with support for six architectures: amd64, arm64, armhf, ppc64el, riscv64, and s390x.
For a ready-to-use experience, the new release also provides Live images with pre-installed desktop environments: GNOME, KDE, LXDE, Xfce, Cinnamon, and MATE. These are available only for the AMD64 architecture.
