Source: keepassxc Version: 2.7.10+dfsg1-1 Severity: important Tags: security upstream fixed-upstream X-Debbugs-CC: [email protected]
Dear Maintainer and Security Team, I am reporting the public upstream advisory GHSA-4642-49vv-4p43 for assessment in Debian: https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4642-49vv-4p43 Upstream reports a heap use-after-free when importing a crafted KeePass 1 (.kdb) database. Deleted entries remain referenced in the importer's UUID map and can later be dereferenced. The advisory describes a confirmed crash and an attacker-controlled write; I have not tested exploitability on Debian. The advisory identifies the tested version as 2.7.12 and the patched version as 2.8.0. The release announcement says that the 2.7.x series and earlier versions are affected. Please verify applicability to Debian's 2.7.10 package. Upstream states that the legacy reader is not conditional on an optional build flag. The release notes identify this issue as CVE-2026-69150 and associate its fix with upstream PR #13500. The fix is included in KeePassXC 2.8.0-beta1, announced on 23 September 2026: https://keepassxc.org/blog/2026-09-23-2.8.0-beta1-released/ I use Debian 13 (trixie) with keepassxc-full 2.7.10+dfsg1-1. I have not independently reproduced this issue or verified whether Debian-specific patches address it. On 10 October 2026, I could not find a corresponding entry on the package's Security Tracker page or a matching report in the current source-package bug list. Could you assess whether Debian is affected and consider backporting the applicable fix to trixie? Please adjust the severity as appropriate. Thank you, Jonatan Nyberg
