El 08/11/26 a las 16:00, Simon Quigley escribió: > Hi Santiago, > > Thank you very much for the review! > > On 11/8/26 14:56, Santiago Ruano Rincón wrote: > [snip] > > > diff -Nru srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch > > > srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch > > > --- srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch > > > 1969-12-31 18:00:00.000000000 -0600 > > > +++ srt-1.5.1/debian/patches/CVE-2026-55868-d17cc7b4.patch > > > 2026-11-06 09:52:27.000000000 -0600 > > > @@ -0,0 +1,304 @@ > > > +Origin: > > > https://github.com/Haivision/srt/commit/d17cc7b4dbe4658eb3ac71c7eec3c71780553250 > > > > Very small nitpick (for next update): according to dep-3, the origin > > field should include the "backport" tag: > > Origin: backport, > > https://github.com/Haivision/srt/commit/d17cc7b4dbe4658eb3ac71c7eec3c71780553250 > > > > (and maybe, to make it more clear, list the other commits as well) > > Will do in the future, thank you! > > [snip]>> diff -Nru srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch > srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch > > > --- srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch > > > 1969-12-31 18:00:00.000000000 -0600 > > > +++ srt-1.5.1/debian/patches/CVE-2026-55869-e020c3bb.patch > > > 2026-11-06 09:52:27.000000000 -0600 > > > @@ -0,0 +1,31 @@ > > > +Origin: > > > https://github.com/Haivision/srt/commit/e020c3bb8e04e204b36f9fb56cdcbb6756cd0d28 > > > > AFAICS, these changes were not included into trixie. Do you know why? > > Trixie already includes the check in CVE-2026-55868.patch, not > CVE-2026-55869.patch. My proposed Bookworm update puts that check in a > separate patch, which makes it look like an extra fix. > > Please let me know if you have any further questions; feedback is still > welcome.
Thanks for you quick response. Indeed, trixie included as: >From e020c3bb8e04e204b36f9fb56cdcbb6756cd0d28 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20G=C3=A9rouville?= <[email protected]> Date: Thu, 25 Jun 2026 17:22:30 +0200 Subject: [PATCH 7/8] Fix KMREQ buffer overflow at the right place. but also fixed that check with: >From 78e7e144bb49b70fc1c20b44e9aa1f5705919e3e Mon Sep 17 00:00:00 2001 From: Mikolaj Malecki <[email protected]> Date: Thu, 25 Jun 2026 18:19:49 +0200 Subject: [PATCH 8/8] [core] Fixed response for rogue KMREQ message Could you please double check that? Cheers, -- Santiago
