Hi,
On 15/10/2026 22:21, Simon Quigley wrote:
On 10/15/26 07:33, Sylvain Beucler wrote:
On Tue, Oct 13, 2026 at 02:41:40PM -0500, Simon Quigley wrote:
You also mention "Upstream still asserts on this input, so the patch
is original." Do you mean we're fixing behavior that is unfixed
upstream and/or unstable? We shouldn't divert that way.
On CVE-2026-47770, right, upstream still asserts in jv_delpaths() on
this input. The fix I'm carrying is the same guard Trixie already
shipped in 1.7.1-6+deb13u3 (DSA-6416-1), so Bookworm is catching up to
Trixie, not going its own way. It also stops the abort that deb12u2
introduced after DLA-4662-1. I'm happy to reword the patch header to say
that, or drop it if you don't think Trixie shipping this before unstable
warrants including it.
trixie diverting isn't a sufficient reason to align all other dists
IMHO, maybe it's an error in trixie, maybe it isn't, let's hear from the
maintainer -- who is fortunately already in Cc:.
@czchen, what do you think? Is this original fix a high regression or
security issue that's worth fixing from unstable down?
Cheers!
Sylvain Beucler
Debian LTS Team
