Security Updates

Debian DSA-6549-1 fixes an LZMA1 decoder memory write in xz-utils on Debian 13. Check liblzma5, update to 5.8.1-1+deb13u2 and restart affected services.

OpenSSL DSA-6531-1 fixes 13 CVEs on Debian 13. Check libssl3t64 against 3.5.7-1~deb13u3, restart daemons using the old library and verify the fix.

Debian DSA-6527-1 fixes 33 rsync CVEs in Debian 13. Check if rsyncd or rsync over SSH is exposed, patch to 3.5.0, verify and test backup jobs.

DSA-6514-1 fixes 10 PHP 8.4 CVEs on Debian 13. Check for 8.4.26-1~deb13u1, restart PHP-FPM or Apache mod_php, and verify the running binary.

Debian 13 fixes BIND9 and Unbound flaws (DSA-6505-1, DSA-6507-1): how to check versions, patch, restart and verify your recursive DNS resolver.

Web server security baseline for Debian 13: unattended-upgrades, key-only SSH, certbot TLS with HSTS, nftables and Fail2ban, with checks for each step.