Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected], [email protected], [email protected], [email protected] Control: affects -1 + src:libxml-bare-perl User: [email protected] Usertags: pu
Hi I consider this might be late for the upcoming point release but please consider it to be accepted for 13.8 later on. The upload fixes two minor security issues which were adressed in unstable already and marked no-dsa, CVE-2026-13401 and CVE-2026-57074, tracked as well in #1142227. Passes as well the QA testing on debusine: https://debusine.debian.net/debian/developers/work-request/1230875/ Regards, Salvatore
diff -Nru libxml-bare-perl-0.53/debian/changelog libxml-bare-perl-0.53/debian/changelog --- libxml-bare-perl-0.53/debian/changelog 2024-05-15 19:56:55.000000000 +0000 +++ libxml-bare-perl-0.53/debian/changelog 2026-09-05 12:05:52.000000000 +0000 @@ -1,3 +1,12 @@ +libxml-bare-perl (0.53-4+deb13u1) trixie; urgency=medium + + * Team upload. + + [ gregor herrmann ] + * Add patches to fix CVE-2026-13401 and CVE-2026-57074 (Closes: #1142227) + + -- Salvatore Bonaccorso <[email protected]> Sat, 05 Sep 2026 14:05:52 +0200 + libxml-bare-perl (0.53-4) unstable; urgency=medium [ Helmut Grohne ] diff -Nru libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch --- libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch 1970-01-01 00:00:00.000000000 +0000 +++ libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch 2026-09-05 12:05:52.000000000 +0000 @@ -0,0 +1,32 @@ +From: CPANSec Security Scanner Bot <[email protected]> +Subject: [PATCH] XML::Bare: advance stuck attribute-name state (infinite loop) + +Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached +by the default XML::Bare->new(text=>$xml)->parse on untrusted XML. + +The `att_nameqsdone` state — reached after a single-quoted attribute +*name* — loops back to itself without advancing `cpos` on any character +other than `=` or NUL, spinning forever in C on malformed input. The +parser holds the interpreter for the duration of the call, so no +Perl-level signal (`alarm`, etc.) can interrupt it: a single request +pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`, +`<x y=''''''z'>`. + +Fix: advance the cursor before looping, so the scan terminates at the +next `=` or at the NUL sentinel (already handled by the `case 0` branch). + +Origin: https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch +Bug: https://github.com/nanoscopic/perl-XML-Bare/pull/2 +Bug-Debian: https://bugs.debian.org/1142227 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-13401 + +--- a/parser.c ++++ b/parser.c +@@ -482,6 +482,7 @@ + cpos++; + goto att_eq1; + } ++ cpos++; // advance the cursor so malformed input (no '=' after a quoted attr name) cannot spin forever + goto att_nameqsdone; + + att_eq1: diff -Nru libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch --- libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch 1970-01-01 00:00:00.000000000 +0000 +++ libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch 2026-09-05 12:05:52.000000000 +0000 @@ -0,0 +1,71 @@ +From: CPANSec Security Scanner Bot <[email protected]> +Subject: [PATCH] XML::Bare: bounds truncated fixed-advance lookahead (heap OOB read) + +Heap-buffer-overflow READ (CWE-125) in the hand-rolled C parser +(parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on +untrusted XML. + +Several transitions advance `cpos` by a fixed amount past a recognised +token without checking the buffer end, then dereference the new position: + + - the `<
