[From nobody Wed Aug 12 06:19:05 2026 Received: (at 1142267-close) by bugs.debian.org; 12 Aug 2026 05:17:15 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-113.0 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,RCVD_IN_DNSWL_MED, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 73; hammy, 150; neutral, 172; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <envelope@ftp-master.debian.org> Received: from mitropoulos.debian.org ([2001:648:2ffc:deb:216:61ff:fe9d:958d]:59552) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wu1L0-00DATX-2t for 1142267-close@bugs.debian.org; Wed, 12 Aug 2026 05:17:15 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mitropoulos.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1wu1Ky-005O7W-2R for 1142267-close@bugs.debian.org; Wed, 12 Aug 2026 05:17:12 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=7HqZ93metZq/a/ESG9ag/TicVaY93VO2I6lqZ6B9nP0=; b=iLSV45Fn3GyENwLmSquTUUatx/ RsZsY4qwTI5JJIqKvsQWhnQ4HOwuvATFWgoK3AgG0JvvWoakR7H1rSJ7Fs5PjA0NZ93n3Y97FuNo1 7ptO6Ey/ACtj1Qz7Q0kHP0xkDam/AomEA17ddbue4hmpzVrmdR1TzI+P2oV7oKAVq+M03HMwt19Xi ksuGdLBMq7IwzxJdv0l96PE4xGAEJPCOP5GXUNd1CHWxpyvJbylShHX6k78ZSPvrqAvkXrbZoVyOX hkDHsv4i+Oeokd5bWa1rP1+ZvxvwPYsu35eq8hF5eK6+qp32jceIZinmKkQMhQQsm2lEj9SQZZgmK uBWGtoug==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1wu1Kx-00000009FIr-2XFm; Wed, 12 Aug 2026 05:17:11 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: Salvatore Bonaccorso <carnil@debian.org> To: 1142267-close@bugs.debian.org X-DAK: dak process-policy X-Debian: DAK X-Debian-Package: libyaml-syck-perl Debian: DAK Debian-Changes: libyaml-syck-perl_1.34-2+deb13u3_sourceonly.changes Debian-Source: libyaml-syck-perl Debian-Version: 1.34-2+deb13u3 Debian-Architecture: source Debian-Suite: proposed-updates Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1142267: fixed in libyaml-syck-perl 1.34-2+deb13u3 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============8973902072667052923==" Message-Id: <E1wu1Kx-00000009FIr-2XFm@fasolo.debian.org> Date: Wed, 12 Aug 2026 05:17:11 +0000 --===============8973902072667052923== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libyaml-syck-perl Source-Version: 1.34-2+deb13u3 Done: Salvatore Bonaccorso <carnil@debian.org> We believe that the bug you reported is fixed in the latest version of libyaml-syck-perl, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1142267@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Salvatore Bonaccorso <carnil@debian.org> (supplier of updated libyaml-syck-pe= rl package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 08 Aug 2026 11:20:57 +0200 Source: libyaml-syck-perl Architecture: source Version: 1.34-2+deb13u3 Distribution: trixie-security Urgency: high Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1142267 Changes: libyaml-syck-perl (1.34-2+deb13u3) trixie-security; urgency=3Dhigh . * Non-maintainer upload by the Security Team. * fix: prevent buffer underflow in base60 (sexagesimal) parsing (CVE-2026-5089) * rebase: apply review feedback * fix: prevent memory leaks when Load/LoadJSON croak on parse errors * Fix four libsyck memory-safety CVEs reachable from YAML::Syck::Load() (CVE-2026-57075, CVE-2026-57076, CVE-2026-57077, CVE-2026-13713) (Closes: #1142267) Checksums-Sha1:=20 e5d2a528afbc86133836b622c372c2371693b7d7 2352 libyaml-syck-perl_1.34-2+deb13= u3.dsc e3064e78a7d530ff6bc14dbeaa01fd68de843657 18808 libyaml-syck-perl_1.34-2+deb1= 3u3.debian.tar.xz Checksums-Sha256:=20 1cbbc5a030d507c2ae809a334e10a872f5cafd1bcd961ab8eb420534678c8ad2 2352 libyam= l-syck-perl_1.34-2+deb13u3.dsc 7d665301076b26ab406b560a4bb88d27be3141454a130512297b18417c0c1aa1 18808 libya= ml-syck-perl_1.34-2+deb13u3.debian.tar.xz Files:=20 fdef0b5b3e5b15702ecb4c72ba762a31 2352 perl optional libyaml-syck-perl_1.34-2= +deb13u3.dsc b0ff053c8aa9d0b7c9301a190ba594b5 18808 perl optional libyaml-syck-perl_1.34-= 2+deb13u3.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmp3Ti5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E48AP/3QuIeJR46KJqpoej17DXe+pCj1XrHJ3 bZAMsGeqtaqnrO1xLr/lxJtdm4Q6d8vaViQOZRTjlKGx1uvpEUTNF/ifLVj1hbX5 XCD4SMtKUEAd3F5QMHltk+4KK9nsv4LJNxy6/WxsIZgHF2SZ3iBhGdmRMJLnYnDu JyEWEhV9TLyvqfwNseilfSDLNdZERD1pff9BMK83CaPADm5DWtTXvWPr7KNXP4Hx zuALWJNiV6dWJFVUotW4zCwqiGAZN29PzLAmPX4hS979UxjjWVgUbrI0ENCc1IQT zbQlM2dhKQTrTS3WqNGCNNQMTphbUyVE7QBtpPwmRkifMSFGf8ltNPrdQgWwoJEv fwjnB7EflbVCOWXgYNKbl+4/w4brIm8CgWgPi/zh5cgwpJaBFNd6qQOvrtKiBkA3 Nk/3IyiombnjMmfqcZ8Lsz6jrPKoZwo07co8+Wfic2IZ7jkiAwXkJ50BqVFAISsC 7mlx8qtQbUgZBiWlJx4JzCDveD8TIayPHJN1LdcKHNF332wSwB+ziEfHahM8+5cH In6bD9frDcG3Evys64gi0U0i8C5++uKZ2IBeagewkylW8UC31ox9IGOJxgKpST66 CJOVUXWp38HtjBylHOKZzPWK4qNzCN8el41FJOHCaUy2jdY7e+Cz59sLDDKPfp++ fHcKkD5ihPSZ =3DnOzS -----END PGP SIGNATURE----- --===============8973902072667052923== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCanwB1wAKCRCb9qggYcy5 IS97AQDvQOZafdQlNuYoBip2k5opLbkjHt7PU+hQz5GtjjtB1wEA+8DMphDsQ6KX g+3AcdThZWNyP5QMNk2JJcez12rn5AM= =hcZV -----END PGP SIGNATURE----- --===============8973902072667052923==-- ]