Debian GNU/Linux has issued important security updates, specifically targeting MuPDF and QEMU. These updates are crucial for users of Debian 11 (Bullseye) and Debian 12 (Bookworm), as well as the upcoming Debian 13 (Trixie).
In addition to these updates, users should regularly monitor their systems for security patches and consider enabling automatic updates where feasible, to ensure they remain protected against emerging threats
MuPDF Security Update
On August 22, 2025, Debian released a security update for MuPDF, a lightweight PDF viewer, under Advisory DLA-4278-1. This update addresses a vulnerability (CVE-2020-21896) that could permit remote attackers to execute a denial of service attack through specially crafted PDF files. The issue was resolved in version 1.17.0+ds1-2+deb11u1 for Debian 11 (Bullseye). Users are advised to upgrade their MuPDF packages to ensure system security. More details can be found on the [MuPDF security tracker page](https://security-tracker.debian.org/tracker/mupdf).QEMU Security Update
Simultaneously, Debian provided a security update for QEMU (Advisory DSA-5983-1), affecting both Debian 12 (Bookworm) and Debian 13 (Trixie). This update addresses two vulnerabilities (CVE-2025-54566, CVE-2025-54567) and modifies the usage of the C (Credential) flag in the binfmt_misc registration of the qemu-user package, which previously allowed privilege escalation when executing suid/sgid binaries. As a result, suid/sgid foreign-architecture binaries will no longer run with elevated privileges under qemu-user, requiring users to adjust their setups if they relied on this capability. The affected packages for Bookworm are `qemu-user-static` and `qemu-user-binfmt`. The fixes for Bookworm have been applied in version 1:7.2+dfsg-7+deb12u15, while Trixie users will find the update in version 1:10.0.2+ds-2+deb13u1. Users should upgrade their QEMU packages accordingly, and more information is available on the [QEMU security tracker page](https://security-tracker.debian.org/tracker/qemu).Conclusion
The security updates for MuPDF and QEMU underscore Debian's commitment to maintaining system security and integrity. Users are strongly encouraged to install these updates promptly to mitigate potential vulnerabilities. For ongoing updates and security advisories, users can visit the [Debian security page](https://www.debian.org/security/).In addition to these updates, users should regularly monitor their systems for security patches and consider enabling automatic updates where feasible, to ensure they remain protected against emerging threats
MuPDF and QEMU updates for Debian
Debian GNU/Linux has been updated with two security updates: a MuPDF security update for Debian 11 (Bullseye) LTS and a QEMU security update for both Debian 12 (Bookworm) and 13 (Trixie).
[DLA 4278-1] mupdf security update
[DSA 5983-1] qemu security update
