[From nobody Wed Aug 5 15:35:07 2026 Received: (at 1132032-close) by bugs.debian.org; 5 Aug 2026 14:33:48 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,SPF_HELO_PASS,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 93; hammy, 150; neutral, 182; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:46224) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wrcgl-00HMvt-1a for 1132032-close@bugs.debian.org; Wed, 05 Aug 2026 14:33:47 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wrcgk-001adS-0l for 1132032-close@bugs.debian.org; Wed, 05 Aug 2026 14:33:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=AfC/B2r0rishv4JTlZJoWPClTnrWReGg9JnlVji0+uA=; b=TTNASZ5cN8M+imc2pQM4lBl+zN kW6HwI7vG0S8MdtuSMuu8T3LFgjZTrzNk0yS0mwczxwNrX8kzqREBU6evTqbTQs3UCkoGkqSuZeCX LZsmEK0KWmn8D03F+SXryyQnjyP0dK5zI89OYWPVXRwRRam3YKbhAUOwiAf+6XvakBL2BIMH1ld26 s1FmBODZHGQnQRD+/79OveFMl9vTiERDZJtsG5q4z7TCMaEb46elFT9XErG2EDHDJxjRekT9UAx4D XG2Iq0qpmflWbpnfJeonXsWDt2DnMMIbPvjA5z9IgR3rKF85Efqd5qNykBodFk0qvDOdtBfJ4x1O9 Gsx0FIHA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wrcgj-0000000FWWQ-1JgV; Wed, 05 Aug 2026 14:33:45 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Pierre Gruet <pgt@debian.org> To: 1132032-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: libpf4j-java Debian: DAK Debian-Changes: libpf4j-java_3.15.0+dfsg-1_source.changes Debian-Source: libpf4j-java Debian-Version: 3.15.0+dfsg-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1132032: fixed in libpf4j-java 3.15.0+dfsg-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============2332691966550122900==" Message-Id: <E1wrcgj-0000000FWWQ-1JgV@fasolo.debian.org> Date: Wed, 05 Aug 2026 14:33:45 +0000 --===============2332691966550122900== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libpf4j-java Source-Version: 3.15.0+dfsg-1 Done: Pierre Gruet <pgt@debian.org> We believe that the bug you reported is fixed in the latest version of libpf4j-java, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1132032@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Pierre Gruet <pgt@debian.org> (supplier of updated libpf4j-java package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 05 Aug 2026 16:23:00 +0200 Source: libpf4j-java Architecture: source Version: 3.15.0+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1132032 Changes: libpf4j-java (3.15.0+dfsg-1) unstable; urgency=3Dmedium . * New upstream version 3.15.0+dfsg: Fixes CVE-2025-70952: pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation. (Closes: #1132032) * Refreshing patches * Raising Standards version to 4.7.4 (no change) * Build-Depending on debhelper-compat 14, removing misc:Depends substvar * Updating d/copyright years * Using com.google.compile.testing Java classes, which are now packaged in Debian, for testing Checksums-Sha1: 2c2b5043d056ca53b188b99c26070f678e7f8e85 2406 libpf4j-java_3.15.0+dfsg-1.dsc bdc30eb87e096a661e9aee6a6e2d43a0fc365feb 119488 libpf4j-java_3.15.0+dfsg.ori= g.tar.xz 94d6bd8d82870f76638b9e0e65960ed029f8f424 8500 libpf4j-java_3.15.0+dfsg-1.deb= ian.tar.xz a2b032f07ff9a97f5ce100c9cd840f9474eae2fd 18335 libpf4j-java_3.15.0+dfsg-1_so= urce.buildinfo Checksums-Sha256: ffd9f752e91b05e3be702595aa54ed78018e47bf1ae8a0131abbeaeae698f890 2406 libpf4= j-java_3.15.0+dfsg-1.dsc 36f1b069c767b336dfa908e68ac064808b18107dea7bf6e6f05abd3c92857548 119488 libp= f4j-java_3.15.0+dfsg.orig.tar.xz de85924fe0f8eb4794f4e70af618b580cbb2695b34eb85a4df4e998b87ab1ecb 8500 libpf4= j-java_3.15.0+dfsg-1.debian.tar.xz 7c4d5f40e2a4fdf9294fbf04268efd0ab711de3d3cab15e47b59167375470746 18335 libpf= 4j-java_3.15.0+dfsg-1_source.buildinfo Files: 2060819ca1e3c28f994b887544e70273 2406 java optional libpf4j-java_3.15.0+dfsg= -1.dsc e34cc80da2b230dd18f3e1b38165d510 119488 java optional libpf4j-java_3.15.0+df= sg.orig.tar.xz c44a060f3cb68e611c493cba04e8d4b6 8500 java optional libpf4j-java_3.15.0+dfsg= -1.debian.tar.xz 7c3e2a0e02c4fa8ac7ffd526587fb917 18335 java optional libpf4j-java_3.15.0+dfs= g-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmpzR1oACgkQYAMWptwn dHZu3g/+OjxAZcx6UacUGf5q9EzocdYtZgO7Wm5pa3c508OqMd/JX7a345hDwprX ZeZrz7pYoZRKer6DGSXArRtW6QZQQ6hEj6dOnI/XSeWOSr8al72go9aTDYXUw6SY LlPEvYCKmi7B/1P3nlo7OWlUiBKnH9HqbmLMD64vf7Kyd3sewPBvaNDZ+Nk1m7RQ aVlkySCiD8MDe+Qz/dLiinbZuPbkjx8psRkgF1Jj2RLYvfHS1D2c8zPO6bpJWN7n 1qxo/sYU3OdY2d3RqthdQ+woCSUg3U32BOYVH2V2tKyijg3dzHYHfgFnnTCU+bVG 4xji6ydcWe5osU+dcRjuO3Bt029/0NOLb69AIbd4BdZB5jDDGEXY6g56yTbFIET2 2nPTnE1B7n3WsW1ozSIWgCjNfugVP4gVvkEWlRSMlB/MGLErckmhD4eSabtgLjxJ OpwOHj1CtXuCrHMi6XdFpz8aHGhWRUlGat7GX2VytlSKIHWJ/27bj3Ew2udyGCua NQaOHH9c5u1jz8s6zv3lcjSE8+M+Fw2f65gYg2Zg+kFw0cq/9YgnNWqbPfYoDDkW cZVPVCEPNwrA4d2WIFQj6kTHaGYOmHGc1rV3HQJ3knwOPoVToMp7Ff3Jj9UW83bO p32DDK//ybWOdayygn/sdTO2jX5gD9MQdD8mnR7TXsu1OnQvc9c=3D =3D1vb0 -----END PGP SIGNATURE----- --===============2332691966550122900== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCanNJyQAKCRCb9qggYcy5 Ib7sAP92Y8YqcGY0RQA/umHbacbjqLBZuT+rsoGHkN0CfWkzPgEA1piIJCU5oWog es4slq4LW/RwvMVC+QSzqTWEatvXYAA= =W6qp -----END PGP SIGNATURE----- --===============2332691966550122900==-- ]