During the month of September 2026 and on behalf of Freexian, I worked on the following:
libdbi-perl ----------- Uploaded 1.643-4+deb12u3 and issued DLA-4798-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-78030: Arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes. * CVE-2026-88815: Numeric values are incorrectly treated as strings in sql_type_cast_svpv() * CVE-2026-88816: Numeric values are incorrectly treated as strings in FetchHashKeyName. Also, uploaded 1.643-3+deb11u3 (bullseye), 1.642-1+deb10u5 (buster) and 1.636-1+deb9u5 (stretch), and issued ELA-1834-1 for the above vulnerabilities. https://www.freexian.com/lts/extended/updates/ela-1834-1-libdbi-perl/ lxml ---- Uploaded 4.9.2-1+deb12u1 and issued DLA-4799-1. https://lists.debian.org/msgid-search/[email protected] * CVE-2026-28348: CSS @import filter bypass via unicode escapes * CVE-2026-28350: <base> tag injection via default `Cleaner` configuration * CVE-2026-41066: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files * CVE-2026-49825: javascript: URL bypass in Cleaner via xlink:href Also, uploaded 4.6.3+dfsg-0.1+deb11u2 (bullseye), 4.3.2-1+deb10u5 (buster), 3.7.1-1+deb9u6 (stretch), and issued ELA-1836-1 for the above vulnerabilities. https://www.freexian.com/lts/extended/updates/ela-1836-1-lxml/ Also, filed trixie-pu bug #1149237 fixing the last 2 vulnerabilities. https://bugs.debian.org/1149237 dovecot ------- I spent the vast majority of my allocated time this month on this package. The 2.3 series is no longer maintained upstream (at least not in the CE version) and several of the upstream fixes for the 24 open CVEs (>100 commits) required significant rework for the 2.3 baseline. The backport is now done for both bookworm and bullseye, but the package hasn't been uploaded to the archive yet as it is still being tested. (While many functions in core have good test coverage, this is not the case for some key authentication backends or lookup backends.) I expect an update to be available shortly; in the mean the preliminary source packages can be downloaded from Debusine at https://debusine.debian.net/debian/developers/work-request/1355007/ and https://debusine.freexian.com/freexian/elts-staging/work-request/313592/ . Backport for buster is ongoing. Thanks to the sponsors for financing the above, and to Freexian for coordinating! -- Guilhem.
signature.asc
Description: PGP signature
