[From nobody Mon Oct 19 10:57:04 2026
Received: (at 1131493-done) by bugs.debian.org; 19 Oct 2026 09:55:58 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-4.7 required=4.0 tests=BAYES_00,DKIM_INVALID,
 DKIM_SIGNED,FOURLA,MD5_SHA1_SUM,SPF_HELO_NONE,SPF_PASS autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 54; hammy, 148; neutral, 49; spammy,
 2. spammytokens:0.933-+--quality, 0.888-+--news
 hammytokens:0.000-+--H*r:mail.an3as.eu, 0.000-+--H*M:an3as,
 0.000-+--H*RU:mail.an3as.eu, 0.000-+--UD:fam-tille.de,
 0.000-+--fam-tille.de
Return-path: <andreas@an3as.eu>
Received: from mail.an3as.eu ([135.181.254.178]:33582)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <andreas@an3as.eu>) id 1xIk61-006E5X-1Q
 for 1131493-done@bugs.debian.org; Mon, 19 Oct 2026 09:55:58 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=an3as.eu;
 s=202306; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date:
 Content-Transfer-Encoding:Sender:Reply-To:Cc:Content-ID:Content-Description:
 In-Reply-To; bh=U3DeAULiQmjjUKcCfKeiGq598NN9GW2kpITA8oK1qz0=; b=HbsQWe9svwafn
 4SNEtachkl2ygN87mklTJT51rNaRnSbSxqHbw+B6HX+hqRiPpIikKYTT7SPOPRnQYgA6so7/40C5P
 NGLrfAtq0Oa8FbhWbi5WCqVn2A2raxNZMWBDBkGrCzkwrht0Xff4U8gD/YSDYlS5tyNZVlCcjVL1N
 8I7fRvchfHQ/miOZ7CjfzqBzn/MQ4ras+l9Z+KxHH6IhoK0mTxRKMMmYK0x8ce8+4ateQEQDKsaml
 e8xMU4LZUQLf83jJZOfdcRUDkRIixwspwWhDBqCbbB/kDfTJeqwD4sdE6q+/8OeDx+AmiW8wU5dWA
 ibTbMDOATotodaiVRWZkw==;
Received: from andreas by mail.an3as.eu with local (Exim 4.98.2)
 (envelope-from <andreas@an3as.eu>) id 1xIk5y-0000000FPpb-1Lwx;
 Mon, 19 Oct 2026 11:55:54 +0200
Date: Mon, 19 Oct 2026 11:55:54 +0200
From: Andreas Tille <andreas@an3as.eu>
To: 1131493-done@bugs.debian.org, Salvatore Bonaccorso <carnil@debian.org>
Subject: All CVEs closed in latest upstream version
Message-ID: <atXpKnSPf9JeKqxP@an3as.eu>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi Salvatore,

you once pointed out that I should mention the CVEs closed by an upload
inside the changelog.  Unfortunately I missed even closing this bug in
the changelog.

You can find the following in the NEWs file of htslib  1.24-3 which just
migrated to testing:


Noteworthy changes in release 1.23.1 (18th March 2026)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Bug fixes
---------

* Fix a number of bugs in the CRAM decoder which could result in undefined
  behaviour on invalid inputs (PR #1981, PR #1991):

  - Not checking the amount of byte array len data returned matched the amount
    expected. (CVE-2026-31971)
  - Incorrect check for the length of byte array stop data. (CVE-2026-31969)
  - Invalid use of the varint and const codecs. (CVE-2026-31968)
  - Missing check for a valid reference ID. (CVE-2026-31965)
  - Missing check for a valid mate reference ID. (CVE-2026-31967)
  - Incomplete validation of CRAM feature locations.
    (CVE-2026-31965, CVE-2026-31966)
  - Bugs due to improper handling of records where no sequence or quality
    values were stored (CVE-2026-31962, CVE-2026-31964)

* Reject GZI indexes with impossibly-large item counts. (CVE-2026-31970)
  (PR #1978.  Reported by Harrison Green)
...


This list is lacking CVE-2026-31963.  Thus I verified that
  https://github.com/samtools/htslib/commit/8bcc9907be0f945ddc31796d64f078fa05456acd
is applied to the code which is the case.

Thus I'm closing this bug report.  Please feel free to reopen if you want
me to rather do an upload mentioning all this in d/changelog.

Sorry for not dealing with this in a better way.

Kind regards
    Andreas.


-- 
https://fam-tille.de]