The following two security updates has been released for Debian 6 LTS:

[DLA 291-1] libidn security update
[DLA 293-1] subversion security update

[DLA 291-1] libidn security update

Package : libidn
Version : 1.15-2+deb6u2

Adam Sampson found a vulnerability in GNU Libidn, library that
implements the IETF IDN specifications. Libdin incorrectly handled
invalid UTF-8 input, causing it to bad free(). This issue was introduced
by the fix for CVE-2015-2059.

For Debian 6 “Squeeze”, this issue has been fixed in the 1.15-2+deb6u2
version of libidn.

[DLA 293-1] subversion security update

Package : subversion
Version : 1.6.12dfsg-7+deb6u3
CVE ID : CVE-2015-3187

C. Michael Pilato, from CollabNet, reported an issue in the version
control system Subversion.

CVE-2015-3187

Subversion servers revealed some sensible paths hidden by path-based
authorization. Remote authenticated users were allowed to obtain
path information by reading the history of a node that has been
moved from a hidden path. The vulnerability only revealed the path,
though it didn't reveal its content.

For Debian 6 “Squeeze”, this issue has been fixed in subversion
1.6.12dfsg-7+deb6u3. We recommend to upgrade your subversion packages.