Post #2173070

@jschauma > 13 (Trixie), 12 (bookworm), 11 (bullseye) all still vulnerable, but fixed in security releases No, these releases have all been fixed. The red lines on the security tracker pages are indicating that the latest package version available in the install media archives is still vulnerable. In Debian, the latest stable security update packages are made available via a first-party security mirror network, which is separate from the larger third-party mirror network that most packages are distributed from. This mitigates against a malicious third-party mirror operator withholding security updates. When a stable point release update is prepared (e.g. the most recent was Debian 13.4, on March 14, 2026), all the security fixes released via the security archive, as well as other stable package updates, are copied into the base repository and installation media are refreshed. Then the red lines on the security tracker pages will disappear. You could in theory install Debian off old install media and disable the security archive in your apt sources configuration. But that would be insane, that would be like installing Windows 11 off of a DVD and disabling Windows Update, and it would similarly be incorrect to say that Windows 11 is vulnerable to something because a fix is only available via Windows Update and the fix is not present on the latest DVD install image.