[From nobody Sat Oct 10 15:37:09 2026 Received: (at 1150168-close) by bugs.debian.org; 10 Oct 2026 14:34:57 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 82; hammy, 150; neutral, 148; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:40384) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFYA5-006pWf-0O for 1150168-close@bugs.debian.org; Sat, 10 Oct 2026 14:34:56 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xFYA3-001iNH-2c for 1150168-close@bugs.debian.org; Sat, 10 Oct 2026 14:34:55 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=ROhSGdWkzeMa/DDApO5uLtgMMgc8Qm/TGl7JIi0ywCI=; b=clfgLeUtlQSqIt5uAx2CT1iLjD I3rPZ0jlAx0PJZqtF2XLm/4L4sc5bgEDeIxMh8mXr49gWUOQbQ9NKZ7nVBUCfGq8p9NLB7rwG2ZdO +oD/zMve/PaOybexk67Zjg4unRrAuALuN7hn1FDZOfGb0RVbvaz1tKLvYjRWIlL0ApO40vrjbjqwN 81NevuC+5DXKeNWlbO/ttgVgnDHQhUf6FaGq43uywd4cNdGs+Hr2ANggwj70ilWg/oKWaeoicFK9/ ZfjXKAl7W/rkmmtcTjhymyX7wyYev55wIjPohgi58Nh0Aw/VHvdcRJsne+3Din419A/0j5AZa3DPB azGPQGlg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xFYA3-00000003XZT-04MA; Sat, 10 Oct 2026 14:34:55 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Andreas Metzler <ametzler@debian.org> To: 1150168-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: gnupg2 Debian: DAK Debian-Changes: gnupg2_2.4.9-8_multi.changes Debian-Source: gnupg2 Debian-Version: 2.4.9-8 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1150168: fixed in gnupg2 2.4.9-8 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============0860231837133341388==" Message-Id: <E1xFYA3-00000003XZT-04MA@fasolo.debian.org> Date: Sat, 10 Oct 2026 14:34:55 +0000 --===============0860231837133341388== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: gnupg2 Source-Version: 2.4.9-8 Done: Andreas Metzler <ametzler@debian.org> We believe that the bug you reported is fixed in the latest version of gnupg2, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1150168@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Andreas Metzler <ametzler@debian.org> (supplier of updated gnupg2 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 10 Oct 2026 15:36:45 +0200 Source: gnupg2 Architecture: source Version: 2.4.9-8 Distribution: unstable Urgency: medium Maintainer: Debian GnuPG Maintainers <pkg-gnupg-maint@lists.alioth.debian.org> Changed-By: Andreas Metzler <ametzler@debian.org> Closes: 1150168 Changes: gnupg2 (2.4.9-8) unstable; urgency=3Dmedium . * Add upstream patchset for CVE-2026-105712 gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directory (aka -C) into an existing directory containing a pre-existing symlink, gpgtar can follow that symlink and create or overwrite a file outside the selected extraction directory. The write is limited by the extraction user's filesystem permissions. An archive extracted into a fresh empty directory does not have this risk. https://static.dev.gnupg.org/T8159.html (Closes: #1150168) Checksums-Sha1:=20 eca456f7321804f6d7f9d5bd6b69d7528d268111 5459 gnupg2_2.4.9-8.dsc f9b45ee04e1e8ad20c82f4b1f249592440050c3b 110392 gnupg2_2.4.9-8.debian.tar.xz Checksums-Sha256:=20 aa955788f65d6f476642be6ee0c77084a093c0d6533fabb46afdb39c549a7219 5459 gnupg2= _2.4.9-8.dsc 69e954dc52f1a674bf567aa40064e24ca230210394975a6cddf98742e2a6f882 110392 gnup= g2_2.4.9-8.debian.tar.xz Files:=20 4bef3973b08bb8eda8ba615cf64bf067 5459 utils optional gnupg2_2.4.9-8.dsc a233452166751126c7bbe2662b5f698d 110392 utils optional gnupg2_2.4.9-8.debian= .tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmrKQhQACgkQpU8BhUOC FITR6RAAiXb6g8L2Dg7seL/SbJnU/U/tuQKW60g6OOlEpZ4ugZeQvf3QOkUN+Vw1 rYJdIjfH38V0M+YHY03LHC3ouo5Fi86BEUqUjtswImeWNmg7Fjtyv7l7dWUuBdIF QdCqXoPw5MAtwyvjULFNCu5Ohtar7RdCmL1j6wP1w9tJk/o/82vPoFhPSPX1O6OM 9oy1g8KTmlNbPk0VAGziku5nADFk/uAmUNAwnHKiCAuVN4EyKLiH7FBN1iUCFfbH E7SLTGOkZz3YDEe99IVlsq+urmpvFxdT38aAsp6PZBRZ1pGQ72lrEV6EtmJm/dD2 t1WnVKSK5TpOpoop6HwMkAMo9uocqioYFyaFNk0XFruydledohqUbnTiVpVNtf2g 93HTYK5RsiF1mANgOMUu+Ofd+yvzgk83bFkDkUaQdcZk28HNu/6FeNwBZqCUQWF0 YGS4hJZ1SS+3FjkqP86DEBOvATi32NMOMXoYn1X97QjBzryUmp1dAGgdyNKxdOia 9NEZGq3PurhRvB5pNl/msJVeMooh9I+TQllzPxFbb9jywzdxZlx6R4i7LqwT8QeC w5MkEWlPWTfjKLaI95NOtVWZ8k2utGE1SEfLDl1Jcs27YFyh8YQpisl8AfBE8+pB GuDVaLFgI5DV1RiipDXtRMtEgu9T55rAXKvvuoUkBqW0U+jMu6g=3D =3DNcXc -----END PGP SIGNATURE----- --===============0860231837133341388== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCaspNDgAKCRCb9qggYcy5 Ic5rAP9piXtJUOIIVSJ3sOKasLzJHMZ+UqaEAaBrm6GKLilcSQEAlETfc+7U3NS9 3ilhZKyWmGbGwjrvD4IuKaw69eu6jAg= =yMTK -----END PGP SIGNATURE----- --===============0860231837133341388==-- ]