Your message dated Mon, 27 Oct 2025 08:34:38 +0000
with message-id <[email protected]>
and subject line Bug#1118757: fixed in lz4 1.10.0-5
has caused the Debian Bug report #1118757,
regarding lz4: CVE-2025-62813
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1118757: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1118757
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: lz4
Version: 1.10.0-4
Severity: important
Tags: security upstream
Forwarded: https://github.com/lz4/lz4/pull/1593
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for lz4.
CVE-2025-62813[0]:
| LZ4 through 1.10.0 allows attackers to cause a denial of service
| (application crash) or possibly have unspecified other impact when
| the application processes untrusted LZ4 frames. For example,
| LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-62813
https://www.cve.org/CVERecord?id=CVE-2025-62813
[1] https://github.com/lz4/lz4/pull/1593
[2] https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: lz4
Source-Version: 1.10.0-5
Done: Nobuhiro Iwamatsu <[email protected]>
We believe that the bug you reported is fixed in the latest version of
lz4, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Nobuhiro Iwamatsu <[email protected]> (supplier of updated lz4 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 27 Oct 2025 15:25:17 +0900
Source: lz4
Architecture: source
Version: 1.10.0-5
Distribution: unstable
Urgency: medium
Maintainer: Nobuhiro Iwamatsu <[email protected]>
Changed-By: Nobuhiro Iwamatsu <[email protected]>
Closes: 1118757
Changes:
lz4 (1.10.0-5) unstable; urgency=medium
.
* Add d/patches/Add-license-information-to-pkgconfig.patch.
* Fix CVE-2025-62813. (Closes: #1118757)
- Fix (null) : improve error handlings when passing a null pointer to some
functions from lz4frame.
- Add d/patches/CVE-2025-62813.patch
Checksums-Sha1:
d4c85468e37f700a46491a79caf3c2266498dde2 1941 lz4_1.10.0-5.dsc
c88f66cf6cf181399296d71c204b98c625ad409c 9180 lz4_1.10.0-5.debian.tar.xz
38e850b5b5ee308d605927919b3df6191c3ee986 8169 lz4_1.10.0-5_amd64.buildinfo
Checksums-Sha256:
5bace0c0ce275996fc49d0f83debef5ac3a68654b69fac347eb1f50f24bdc6b9 1941
lz4_1.10.0-5.dsc
346e4325536676a6fdf22f49e16d2a8e96322b3cfe11e2475941cd784f565407 9180
lz4_1.10.0-5.debian.tar.xz
7b197a27ff7160165c4b1135f7e85af8cccfe47e072ca20ed8e1d39cf747710d 8169
lz4_1.10.0-5_amd64.buildinfo
Files:
6ae7251ced4d92afb46837a1da8287c2 1941 utils optional lz4_1.10.0-5.dsc
cd183a797ac20971ffc0d28b1eeb27d6 9180 utils optional lz4_1.10.0-5.debian.tar.xz
3f760603e8407d13bbb4783bfbefba40 8169 utils optional
lz4_1.10.0-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEXmKe5SMhlzV7hM9DMiR/u0CtH6YFAmj/I1UACgkQMiR/u0Ct
H6Zbvg/+M8DrI3PTjmrw2tkWiHb6p5/zPP8ph8RBuHHdRHodLo3KtGh+tUIdjTLG
zqvWWMo1E+DDaSPpGLU80kHeURV4XeeGNDHTNUX8GUZfrQfBgtQZuNi7F1OdvapO
QWkIFjcCwIp7SNMtZV4FsW3wZu0tdON5TqZU+TsYLVLlVJ0AwbYHiV1nyuh5Ac6B
HiDsFcjQHj5zTFuWOgLmn/d7+XpgRW5bf2vT7txmRNtnFZlHJ+mrVJ29182rjH21
UGr7fq7SWMGiDg5befsdrhfNf3pbocKUugHr+506VEPgu2MgdY6CQ+j8jeJ61fio
SQz+LofJ9cHAjmmY88E7+7mSAuikf1fxUT7tQWgj99llGRChWJO88QW/CB5FVXVe
jKFZKA8TPFu6WKo2Asxd27ryrBkaO9n9aRh8ygeoKY5q1kKdz6TXHWoj965mWWCk
NN/y8erL2WXwund3S+TXV2gnQ13+5gbGTvEt/ccHIgZnyc2qhVsF2zn+UGZip/E2
US+Z8DmgeeJYanWPzwlrs5QNMV+ERLyPkBm1Mc1Ujg54VcLioYHjkB2WdUU7t95J
tcRaQjDHX09quFNE63SaXdRUlMAO8dOefBWB/qI4ENrowOmGok27FxdMnBJ7u6w6
rIrj8sbVCjBc6zSAG6EkFDDY0u9W6e5EPJuvWacDmqiCJNT2VkY=
=wr3j
-----END PGP SIGNATURE-----
pgpmyUbf4b5vu.pgp
Description: PGP signature
--- End Message ---
