[From nobody Wed Oct 14 12:37:09 2026 Received: (at 1148171-close) by bugs.debian.org; 14 Oct 2026 11:34:52 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 11; hammy, 150; neutral, 310; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:57910) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xGxG0-0071ZK-27 for 1148171-close@bugs.debian.org; Wed, 14 Oct 2026 11:34:52 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xGxG0-005ajX-1j for 1148171-close@bugs.debian.org; Wed, 14 Oct 2026 11:34:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=lZK2opSyeHweDiavnF8miiICjTi+dasOq7mkSWF43qo=; b=F7zqEz11iLq4K2N5bqgqx7Cv8z gPUOCQWV4B5nhJ0FYPNNGT8irxlbuOXUVJpSUDkvYOJ+Y/rhiYotx+5LfL84VMSgvaWjV/Kka0M4I ajkQ9dqV0yS1eehL/V+oUBxVyLzXixyDqgebTdHNQmzUHX9v5N4bI3WLcfQFRPMQJfznmWE4Uogqv ycznJ+cxn9accWprvxxaFBUjg1b65IZNzvoIv4T0i0QJIDSULUPbQiBrTC+keHlo9ztsBJLfu/v2J 6PPe8bW2vMqn+w8+KCZ1ntM67q5J7slh0KOFmhrnKgMSp8ykK2VXCjen6nrHy2E33sLAaqqbaVlVx usaL/Pzg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xGxFz-00000002Vjz-34ug; Wed, 14 Oct 2026 11:34:51 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Emmanuel Bourg <ebourg@apache.org> To: 1148171-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: zstd-jni-java Debian: DAK Debian-Changes: zstd-jni-java_1.5.7-23+ds-1_source.changes Debian-Source: zstd-jni-java Debian-Version: 1.5.7-23+ds-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1148171: fixed in zstd-jni-java 1.5.7-23+ds-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============5263414981614617066==" Message-Id: <E1xGxFz-00000002Vjz-34ug@fasolo.debian.org> Date: Wed, 14 Oct 2026 11:34:51 +0000 X-CrossAssassin-Score: 3 --===============5263414981614617066== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: zstd-jni-java Source-Version: 1.5.7-23+ds-1 Done: Emmanuel Bourg <ebourg@apache.org> We believe that the bug you reported is fixed in the latest version of zstd-jni-java, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1148171@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Emmanuel Bourg <ebourg@apache.org> (supplier of updated zstd-jni-java package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 14 Oct 2026 12:53:20 +0200 Source: zstd-jni-java Architecture: source Version: 1.5.7-23+ds-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian= .org> Changed-By: Emmanuel Bourg <ebourg@apache.org> Closes: 1048255 1147397 1148171 1148453 Changes: zstd-jni-java (1.5.7-23+ds-1) unstable; urgency=3Dmedium . * Team upload * Rewrote debian/watch in the version 5 format, using the GitHub API * New upstream release - Fixes CVE-2026-87795, CVE-2026-87823, CVE-2026-87824, CVE-2026-87825, CVE-2026-87877, CVE-2026-89045 and CVE-2026-89046 (Closes: #1147397) - Fixes CVE-2026-90852, a use after free in ZstdCompressCtx.loadDict (Closes: #1148171) - Fixes CVE-2026-90560, an out of bounds read in the ZstdDictDecompress constructor (Closes: #1148453) - Refreshed the patches - New patch to use the public zstd dictionary builder API - New build dependency on libjetbrains-annotations-java - Updated debian/libzstd-jni1.symbols - New lintian override for symbols-file-contains-debian-revision - Excluded the Gradle wrapper from the upstream tarball - Removed the exclusion of the legacy zstd sources, dropped in 1.5.7-13 * Standards-Version updated to 4.7.4 * Removed the Priority field * Versioned the dependency on libzstd-jni1 * Removed the Rules-Requires-Root field * Use ${maven:Depends} instead of ${maven:CompileDepends} * Clean the CMake build directory (Closes: #1048255) Checksums-Sha1: 08dfeeec463d226db2e3106e7d0d95dcef7285fe 2276 zstd-jni-java_1.5.7-23+ds-1.dsc 55cf826b78d834dc36d3a5620e195aee157152a7 83960 zstd-jni-java_1.5.7-23+ds.ori= g.tar.xz d569cbf574eed7d48e07371197c2794f9c332814 9464 zstd-jni-java_1.5.7-23+ds-1.de= bian.tar.xz 54cbbe76af6933f6e94cecd2309259037867fef3 19396 zstd-jni-java_1.5.7-23+ds-1_s= ource.buildinfo Checksums-Sha256: e7e4325ef11207ad2a754fc73944b909d37077c819d03a215a022c3f01ef11b8 2276 zstd-j= ni-java_1.5.7-23+ds-1.dsc 09f753d456e36fa11b2bff68fb9a68e5a22227a5a2cecd1f8a5e5d05619e79ba 83960 zstd-= jni-java_1.5.7-23+ds.orig.tar.xz 5adde6b87c43c7d39d9fa11975a125a4681cf667cb6a04c53d58491d558cf5c3 9464 zstd-j= ni-java_1.5.7-23+ds-1.debian.tar.xz df0e9e8420ae048473fcb8bf81874b8c0b960c38e46b33c154e63582b9fa9016 19396 zstd-= jni-java_1.5.7-23+ds-1_source.buildinfo Files: a102e28ca9754c11fc3a3788a29a36ca 2276 java optional zstd-jni-java_1.5.7-23+d= s-1.dsc ff32e2c337304acb08468e0f3d0475ba 83960 java optional zstd-jni-java_1.5.7-23+= ds.orig.tar.xz ccd759546d3f38e9303a04e9bd6706c6 9464 java optional zstd-jni-java_1.5.7-23+d= s-1.debian.tar.xz 7c8375149d2a4fdeee03060a68324c04 19396 java optional zstd-jni-java_1.5.7-23+= ds-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrPZEsSHGVib3VyZ0Bh cGFjaGUub3JnAAoJEPUTxBnkudCsyDcP/3IeNqjcroTdSeyJk8uq4hWDMru+tTlc hajN0AAMTUz4Ot/oZ967vqgHt+UX8As0gbY5SkCabZrBRYqNgliTRB2lYQ9turW4 MSaGa2kUmauSPRNBTfmSKOwrG9wfotCXFwdADQjGI29mN7hgE6qmkUCYNncPVqcE zWLSkToG8CTV9SS6bjJMTfb9EweTfz+ALFX4RSaKyIJWzz6MR19L6eFJ+p35CMMU hufMG07pr3+rNaELlMIqaXlhSc4OVoO7rjJcxRG0eIUt5bXTU19gihir8Feksw5P 4r1F46kd5+b0FMjHX1v0hddNEmZ8nUwOpEhqfAWyrCpz3JojBizwmqMwvKwQaFLF awFSXGmxovtO+TRWsBsOSPFJtQX0d1EW18w55wKDbEcPNjez++2OncIanNB10PsJ 0eno14750ZiGnxzrpjd+rd1cOanb94Jdm1ULVeh2iGGSLpk7/VMXsIS4X1buqzCP AqU9GGWDekmlIZQq1dPGG91OgaYB19sXHKYZnkCBOetEmgALkZV6fStPM3EUKkPm k22PE2K5DtTbF1oI3S65Hv62v/gFIN1CZNIq3PHbizOULfbQMref7PB8zOCGihX/ GoIKShBfoJKR1hhPXFA3sv+FybsrfnNeaWSEchqFkyBNjP1Ar25CLkkvqw151KES 6sFhPZv4M1n/ =3DWd2c -----END PGP SIGNATURE----- --===============5263414981614617066== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCas9o2wAKCRCb9qggYcy5 IZRtAP4iB7bMKgUgLMqMd2wjWQseesmCZK7fMDECxvN6lCUN9wEAllhhFBrDlhpI tG8YoE5lNcG2In32aeAnmwJRvZF7GwU= =tkq0 -----END PGP SIGNATURE----- --===============5263414981614617066==-- ]