[From nobody Mon Jun 1 22:21:06 2026 Received: (at 1138215-close) by bugs.debian.org; 1 Jun 2026 21:19:00 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 107; hammy, 150; neutral, 180; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from muffat.debian.org ([2607:f8f0:614:1::1274:33]:51958) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wUA2G-008AFe-28 for 1138215-close@bugs.debian.org; Mon, 01 Jun 2026 21:19:00 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by muffat.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wUA2G-003QxF-1t for 1138215-close@bugs.debian.org; Mon, 01 Jun 2026 21:19:00 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=eo3Pucvz0mgwLdAjAyW/Cpc+oytIRBOPE5XNaJ8L380=; b=PjEtqP80/9xs8b470xAM5HiShD iZGxFhAhIr75GReY820BSo/eBz0URk8X2j7qDGR2yQ/vJIvaQKOjDc64XlirrBCkluzE0gAestMP8 E+B1KLAEmOayWsHCd/V5zDwGG++llrfGHXeG9dt0+9QlB58DOjz9r7B/oIX38ciaOGfCE9i/IzP+0 OJDyS8z/XmVhpnlNSRsp38nQpcaAd03k+1l9sdl2M9rLLnjRNbAsHCdUVTHQUyaMN5w6raWQRwnxA OqYEIK+SCiAcYml0PPSQ9mhcnHqr1n7gNwskuMMj7s8PKbR8w8s51xjC1ixn/2HWebFR8Qwg5Ksxd 0/DxcyBA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wUA2F-000000022TD-3Hvs; Mon, 01 Jun 2026 21:18:59 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Florian Schlichting <fsfs@debian.org> To: 1138215-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: mpd Debian: DAK Debian-Changes: mpd_0.24.12-1_source.changes Debian-Source: mpd Debian-Version: 0.24.12-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1138215: fixed in mpd 0.24.12-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============0534208626790047490==" Message-Id: <E1wUA2F-000000022TD-3Hvs@fasolo.debian.org> Date: Mon, 01 Jun 2026 21:18:59 +0000 --===============0534208626790047490== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: mpd Source-Version: 0.24.12-1 Done: Florian Schlichting <fsfs@debian.org> We believe that the bug you reported is fixed in the latest version of mpd, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1138215@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Florian Schlichting <fsfs@debian.org> (supplier of updated mpd package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 01 Jun 2026 22:42:36 +0200 Source: mpd Architecture: source Version: 0.24.12-1 Distribution: unstable Urgency: medium Maintainer: mpd maintainers <pkg-mpd-maintainers@lists.alioth.debian.org> Changed-By: Florian Schlichting <fsfs@debian.org> Closes: 1138215 Changes: mpd (0.24.12-1) unstable; urgency=3Dmedium . * New upstream version 0.24.12 (closes: #1138215) + fixes a stack buffer overflow vulnerability in the pcm_unpack_24be function in src/pcm/Pack.cxx (CVE-2026-49127) + fixes a path traversal vulnerability in LocalStorage::MapFSOrThrow and LocalStorage::MapUTF8 within the local storage plugin (CVE-2026-49128) + fixes a server-side request forgery vulnerability in CurlInputPlugin (CVE-2026-49129) + fixes a CRLF injection vulnerability in the xspf_char_data function within the XSPF playlist plugin (CVE-2026-49130) * Add new files to d/copyright * d/copyright: fix lintian warning about old FSF postal address * Bump libcurl dependency to 7.85 * Declare compliance with Debian Policy 4.7.4 Checksums-Sha1: a6fc0764d203483922e0a052ef10aff5f7906d97 3398 mpd_0.24.12-1.dsc da342c8ed1ca0cc942aecacb1da5ed9b6bd790a6 1020148 mpd_0.24.12.orig.tar.xz 3b7b6d7f3405b6305e8f8192cf1171d4c6d344f2 833 mpd_0.24.12.orig.tar.xz.asc 306ed667e48e4ef30cd4713ff59f61de08318178 35836 mpd_0.24.12-1.debian.tar.xz 70a1082a3403b0b73e9d8c1fd8feaf28ef0e46ac 22115 mpd_0.24.12-1_amd64.buildinfo Checksums-Sha256: 206c305bb32d801fb8e4087e596cf12b58ebf8ca6a478d02afedff64094648f9 3398 mpd_0.= 24.12-1.dsc 14223ca883c35fbf711994bcf745726cecc9d898e3d3964265cf3a2c7519a360 1020148 mpd= _0.24.12.orig.tar.xz 554fdc41adba2a48406c7dbc449f2191ed851d5a082e80d42beef8860c492463 833 mpd_0.2= 4.12.orig.tar.xz.asc 10f858970c37a11b44fe34ca34b841e4cf584b579fd647878ca5be34c3d7e804 35836 mpd_0= .24.12-1.debian.tar.xz 807555946f6d81f0cd58e721d21bdfbd60d733759e0fc26f2281d2c0f9f47624 22115 mpd_0= .24.12-1_amd64.buildinfo Files: 35d7fcb66978f708bc49bfea475d6d13 3398 sound optional mpd_0.24.12-1.dsc 6c4a848e97661562fce3e20c72e6c678 1020148 sound optional mpd_0.24.12.orig.tar= .xz 4c20414e8534a1d9071b19acf40d24a2 833 sound optional mpd_0.24.12.orig.tar.xz.= asc 184877fd0d4ebff71445f7bbebed1dc7 35836 sound optional mpd_0.24.12-1.debian.t= ar.xz 26207999649769afc77bfdcf3de28a11 22115 sound optional mpd_0.24.12-1_amd64.bu= ildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEMLI8i05qOwnqprZSEpc7bnLcB7UFAmod8hIACgkQEpc7bnLc B7VE8w/7B+ig4rzATZ5vlMRtT5sVsd8w43NlBu+R00naAiKrBUdtqIuahd/0UzkP S7nrpSo09aZhhhp+b3FcacTaHAG/kQrrBjzGrXvbV8NWLWGuJAVaCcoT7obebP/w GMIahxJC8hfehjzmfx8X9Xd5nHCJxkvfBr9Bh9d1xAwMPUloYbttO1JqMuqEK+5c Td7dsOxteVAlxyaEuZPASEVktrnyMPypzmABdp8Zyf75gxmMj88hOkotcGcKO0+2 VV5Oiy/c5L2/lMQG7dlzZuQAHbHvJqPRkSVYwf8CPtYCfob4HBpYb45bO+DOHfG2 IoVz6H+VhuwroWq9wNcXW4wdLfcCzyVKVmtM7+lA/9QE5PHw5EyNj1biWw+QC6q7 n7Jn9xOzmNSKHU0/LqZkQotxdJBVTLOJfXKXluIc4CDGD1KPwI9n4hQMAKZDhZC6 Tdtx4eRzekdr8ZRlBJ7BRIskhCYkESQaC/zpiuhJdrFnqotvNg7g4Veowwdi0Jms 5Z4e8nqB+KeGBmMX3F64IvHWRPEkGoxt/KV+hKLB5pyyOQgaJg9QzTfaJheJL0Zv CeZVUiCiBHGY17oD8yBdhBzt6CIamT190cd1ncNRTM2GE3Q5QTG2KgUuiY65kVGO n/f64M19MJQOYU+ZA9UVPoHEVP/fV0aQ+nDxFlXSDooAJ7jP2Hg=3D =3DGuZd -----END PGP SIGNATURE----- --===============0534208626790047490== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCah33QwAKCRCb9qggYcy5 IQ8sAQCS3/0hi7P6WHPtxzOLkhYWRdSvNRSZG0omvW2jqVr6+AEAx8avcRyVsfb9 Hm8nWPjhstZ9/oCbeQ/YGQbnLylO6Qk= =p7xw -----END PGP SIGNATURE----- --===============0534208626790047490==-- ]