[From nobody Sat Sep 5 19:37:05 2026 Received: (at 1146744-close) by bugs.debian.org; 5 Sep 2026 18:34:34 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 73; hammy, 150; neutral, 222; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:38950) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x2vDm-000hF1-0C for 1146744-close@bugs.debian.org; Sat, 05 Sep 2026 18:34:34 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1x2vDk-00096Y-2O for 1146744-close@bugs.debian.org; Sat, 05 Sep 2026 18:34:32 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=otnoqh7/xCEDTg5o3so0xDsMZXBXU/pvhKIfeCyd2ks=; b=DfsMlJlkj0TXQhIltYwolLOWiB lMPBgFxog7/W4K3CG3H7wJ0NjgcYvCilG2ko/lzfYGz2jHglXS/Ybq4DrDBxcH3odIaAliMzbyIyQ O6WvDw99v3LPUU/FW4wwlsmukISwCD456F6CkrZV1qL8f9pD3w+GB6f7cXJOYZUatVdkTmBDNP1Tf MIs/2EmLdDSNFq+GVKmGimDIwQ6q4NyeRJVMlCxH1cI34liIx5nQNv8m2b+it6eMLWLq9wCBKuGf9 a9Ei4QpXoPy4v21iVI3HS8+6jbByvLUAHjwA5s1YlkA124klHaF5OcIdP6lKygv/SEkHA8kV3QsQL d30cyJLw==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1x2vDj-00000009xJp-3Zo4; Sat, 05 Sep 2026 18:34:31 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Aron Xu <aron@debian.org> To: 1146744-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: libxml2 Debian: DAK Debian-Changes: libxml2_2.15.4+dfsg-1_source.changes Debian-Source: libxml2 Debian-Version: 2.15.4+dfsg-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1146744: fixed in libxml2 2.15.4+dfsg-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============7162018179076356458==" Message-Id: <E1x2vDj-00000009xJp-3Zo4@fasolo.debian.org> Date: Sat, 05 Sep 2026 18:34:31 +0000 --===============7162018179076356458== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libxml2 Source-Version: 2.15.4+dfsg-1 Done: Aron Xu <aron@debian.org> We believe that the bug you reported is fixed in the latest version of libxml2, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1146744@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Aron Xu <aron@debian.org> (supplier of updated libxml2 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 06 Sep 2026 01:58:14 +0800 Source: libxml2 Architecture: source Version: 2.15.4+dfsg-1 Distribution: unstable Urgency: high Maintainer: Debian XML/SGML Group <debian-xml-sgml-pkgs@lists.alioth.debian.o= rg> Changed-By: Aron Xu <aron@debian.org> Closes: 1146744 Changes: libxml2 (2.15.4+dfsg-1) unstable; urgency=3Dhigh . * New upstream bug fix release. Closes: #1146744. Security fixes: - CVE-2026-86137: xmlregexp: out-of-bounds read in the NXT macro (xmlFAParsePosCharGroup). - CVE-2026-86138: dict: integer overflow in xmlDictAddQString leading to a heap-based buffer overflow. - CVE-2026-86139: uri: integer overflow in xmlURIEscapeStr. - CVE-2026-86140: valid: stack-based buffer overflow through unchecked strcat in xmlSnprintfElements. - CVE-2026-86141: xmlregexp: NULL pointer dereference in xmlRegNewParserCtxt. - CVE-2026-86142: xpointer: heap-based buffer overflow in xmlXPtrEvalXPtrPart. - CVE-2026-86143: xmlIO: missing integer overflow check before calling the write callback. - CVE-2026-86144: xinclude: parse flags such as XML_PARSE_NONET were not propagated by xmlXIncludeProcess and xmlXIncludeProcessTree. - CVE-2026-11979: xmlcatalog: stack-based buffer overflows in --shell command handling. * d/control: bump Standards-Version to 4.7.4, no changes needed. Checksums-Sha1: 3f75c5cdec4a3777bec31c9af5feb52d725647ec 2738 libxml2_2.15.4+dfsg-1.dsc d5d2954d7e9e7f4501f6d96469a9c6475232e76a 2367580 libxml2_2.15.4+dfsg.orig.ta= r.xz 99106d472c022fc3d0aa6a917900dcca3549ab4a 36420 libxml2_2.15.4+dfsg-1.debian.= tar.xz b006ae929d73e1ee4793e4fc25d1eee03fb8369f 5904 libxml2_2.15.4+dfsg-1_source.b= uildinfo Checksums-Sha256: 430fa25d8bb4a31eaf3f314c40fe12a1d0ea19d15576d90c95490e79fcc1d5d1 2738 libxml= 2_2.15.4+dfsg-1.dsc 5868d20db42ee21e4881bc53050c7fa226286a277cb3d0543f76b81f7571e934 2367580 lib= xml2_2.15.4+dfsg.orig.tar.xz a125823450895c0785596a6fce26931ab0a369c82da4d6cfa6bbdac782ed9010 36420 libxm= l2_2.15.4+dfsg-1.debian.tar.xz 79deddde8b8d83a8d4dfb2e3f2d7bf6ae1a067dcaac88496cc6bde8dc48e1496 5904 libxml= 2_2.15.4+dfsg-1_source.buildinfo Files: cbdf4a3815ac31cd5ec1b1dac11717eb 2738 libs optional libxml2_2.15.4+dfsg-1.dsc 0a853c709c8a11e695f7e34e000aa0c2 2367580 libs optional libxml2_2.15.4+dfsg.o= rig.tar.xz dda75bd7e9a40bdd95173c914662548d 36420 libs optional libxml2_2.15.4+dfsg-1.d= ebian.tar.xz 2e007b227ff9676d03b0eee87f88861e 5904 libs optional libxml2_2.15.4+dfsg-1_so= urce.buildinfo -----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqcXLgACgkQ+GQ1dHE8 m65DCgf/UqWbYJpUcujM0us5rJFOTB+ezXYIF0CJB57bU/WCpX+WxRvdSYWv5A49 jCccGObWixHr4NoHZL/jYIwUXEv3/8l3sWJLpxcDP1K14PdjOzlmP8N6sddCOpzA aKn27J9Xd7JN0UeVRkE6an0O/M6etwz5I7B40P7ibYD4UJAPVYKt38+lGIZGTecy jAEh6et38QIQhpY8C8lZajQb1jJfcedqRMKqC3YHsCq/uAnKca0YXRk7lRw/AOR3 fiqDYyrn7lUoI2uoAYy4UjZvUZnbLiDVSz9pDlnJt3ycKzLBiiIVUAd3h5YdS4Au kqkQ3zoysMh0xMCWWEcWx9Qxuxe8zw=3D=3D =3D64UA -----END PGP SIGNATURE----- --===============7162018179076356458== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCapxgtwAKCRCb9qggYcy5 IXWzAP0YoY+8FvAZy7GYRKT1n8UFfeIjkS97Jr16RaTeY6AspAD+MCQH5R4tRaKH 6xmn+Wlp+BA5nFZDHJzgh25bGJ9whQI= =CYVd -----END PGP SIGNATURE----- --===============7162018179076356458==-- ]