During the month of August 2026 and on behalf of Freexian, I worked on the following:
poppler ------- Uploaded 0.71.0-5+deb10u5 (buster) and 0.48.0-2+deb9u8 (stretch), and issued ELA-1792-1. https://www.freexian.com/lts/extended/updates/ela-1792-1-poppler/ * CVE-2025-43718: SIGSEGV via crafted PDF containing deeply nested structures within the metadata * CVE-2025-43903: Signatures with non-empty encapsulated content were trivially forgeable * CVE-2025-50420: Infinite recursion in pdfseparate(1) * CVE-2025-52885: Use-after-free * CVE-2025-52886: Integer overflow * CVE-2026-10118: Integer overflow in the Splash backend CVE-2025-43718 and CVE-2025-52885 did not affect the poppler version from Debian stretch. (For LTS suites, the fixes were published at the end of the previous month as DLA-4709-1.) libgd2 ------ Uploaded 2.3.0-2+deb11u2 2.3.3-9+deb12u1 (bookworm) and 2.3.0-2+deb11u2 (bullseye), and issued DLA-4731-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-9672: Processing of malicious GIF files may lead to crash or arbitrary code execution Also, uploaded 2.2.5-5.2+deb10u2 (buster) and 2.2.4-2+deb9u7 (stretch), and issued ELA-1805-1 for this issue. https://www.freexian.com/lts/extended/updates/ela-1805-1-libgd2/ php --- Uploaded php8.2=8.2.33-1~deb12u1 (bookworm) and php7.4=7.4.33-1+deb11u12 (bullseye), and issued DLA-4732-1 and DLA-4733-1. https://lists.debian.org/msgid-search/[email protected] https://lists.debian.org/msgid-search/[email protected] * CVE-2026-7260: Stack overflow in phar with circular symlinks * CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout Also, uploaded php7.3=7.3.31-1~deb10u14 (buster) and php7.0=7.0.33-0+deb9u24 (stretch), and issued ELA-1806-1 and ELA-1807-1 for these issues. https://www.freexian.com/lts/extended/updates/ela-1806-1-php7.3/ https://www.freexian.com/lts/extended/updates/ela-1807-1-php7.0/ roundcube --------- Uploaded 1.6.5+dfsg-1+deb12u11 (bookworm) and 1.4.15+dfsg.1-1+deb11u11 (bullseye), and issued DLA-4760-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin * CVE-2026-74998: Content proxied by the CSS proxy is not validated * CVE-2026-74999: Stored XSS in "Add to address book" action * CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by` attribute * CVE-2026-75002: IMAP command injection via mail search and LITERAL+ byte-count desynchronization * CVE-2026-75003: Remote content blocking bypass via unclosed `url()` in a FuncIRI attribute * CVE-2026-75004: Arbitrary sieve script injection via a filter rule name bypassing `managesieve_disabled_actions` * CVE-2026-75006: SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 subnets, or various forms of nip.io/sslip.io hostnames * CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter` * CVE-2026-75010: The modoboa driver of the passwd plugin leaks an authentication token to a user-controlled host Fortunately the most nasty issues only affect plugins, which while they are part of the upstream core repository, are not enabled by default. libnet-dns-perl --------------- Uploaded 1.36-1+deb12u1 (bookworm) and 1.29-1+deb11u1 (bullseye), and issued DLA-4761-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-64194: Denial of Service via deep DNS compression pointer chains Also, uploaded 1.19-1+deb10u1 (buster) and 1.07-1+deb9u1 (stretch), and issued ELA-1815-1 for this issue. https://www.freexian.com/lts/extended/updates/ela-1815-1-libnet-dns-perl/ libdbi-perl ----------- Uploaded 1.643-4+deb12u2 (bookworm) and 1.643-3+deb11u2 (bullseye), and issued DLA-4764-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-14380: String-eval code injection * CVE-2026-14739: Heap overflow when preparsing SQL statements with an extreme number of placeholders * CVE-2026-14740: Out-of-bounds read in preparse() when an initial SQL line comment is deleted * CVE-2026-15043: File-backed filter bypass in DBI::SQL::Nano due to incorrect predicate evaluation * CVE-2026-15392: Symlink escape in DBD::File * CVE-2026-60081: Denial of Service in DBI::ProfileData due to unbounded path index in profile parser * CVE-2026-60082: Out-of-bounds access in _set_fbav() when a statement handle has zero fields but a non-empty row * CVE-2026-73193: Heap out-of-bounds write on 32-bit perl due to integer wraparound * CVE-2026-73194: Heap out-of-bounds write due to unvalidated numeric placeholder Also, prepared 1.642-1+deb10u4 (buster) and 1.636-1+deb9u4 (stretch), but they have not entered the archive yet. An ELA will be issued once they do. libdbd-csv-perl --------------- Uploaded 0.6000-1+deb12u1 (bookworm) and 0.5800-1+deb11u1 (bullseye), and issued DLA-4764-2. https://lists.debian.org/msgid-search/[email protected] * FTBFS with libdbi-perl=1.636-1+deb9u4 (more precisely, with any DBD::File version containing the fix for CVE-2026-15392; the DBD::CSV module itself remains unchanged by this update Also, prepared 0.5300-1+deb10u2 (buster) and 0.4900-1+deb9u1 (stretch), but they have not entered the archive yet. An ELA will be issued once they do. Thanks to the sponsors for financing the above, and to Freexian for coordinating! -- Guilhem.
signature.asc
Description: PGP signature
