Your message dated Wed, 02 Sep 2026 11:41:01 +0300
with message-id <[email protected]>
and subject line CVE-2026-18772 and CVE-2026-19587 seem to be fixed in Debian
has caused the Debian Bug report #1143931,
regarding rlottie: CVE-2026-18772
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1143931: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143931
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: rlottie
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for rlottie.
CVE-2026-18772[0]:
| Improper input validation vulnerability in Samsung Open Source
| rlottie allows Oversized Serialized Data Payloads.
https://github.com/Samsung/rlottie/pull/596
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-18772
https://www.cve.org/CVERecord?id=CVE-2026-18772
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Version: 0.1+dfsg-4
As far as I can see, those merge requests, in particular, limit the maximal
number of processed layers. However, the commits from there do not apply
cleanly due to refactoring in version 0.2 and due to other patches addressing
similar issues. I dare assume that CVE-2026-18772 and CVE-2026-19587 were fixed
by Debian-specific patches, No-cyclic-layers.patch (first appeared in version
0~git20200305.a717479+dfsg-1) and by No-cyclic-structures.patch (from version
0.1+dfsg-4).
https://salsa.debian.org/debian/rlottie/-/blob/7e33a8adaa4e61c90e1ee8573f2dd665b0083291/debian/patches/No-cyclic-layers.patch
https://salsa.debian.org/debian/rlottie/-/blob/7e33a8adaa4e61c90e1ee8573f2dd665b0083291/debian/patches/No-cyclic-structures.patch
signature.asc
Description: This is a digitally signed message part
--- End Message ---
