To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: trixie-pu: package libsocket-perl/2.038-1+deb13u1

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libsocket-perl@packages.debian.org, kenhys@xdump.org, pkg-perl-maintainers@lists.alioth.debian.org
Control: affects -1 + src:libsocket-perl
User: release.debian.org@packages.debian.org
Usertags: pu

Please consider accepting libsocket-perl 2.038-1+deb13u1 into trixie.

[ Reason ]

The update fixes CVE-2026-12087, an out-of-bounds heap
read in pack_ip_mreq_source().

already fixed in unstable/forky as version 2.041-1.

The security team marked it <no-dsa> (minor issue) for trixie [1], so
a point release seems the appropriate route.

Although the practical impact is low, NVD rates it CVSS v3 9.1 [2],
which means trixie users running vulnerability scanners see it flagged
as critical and have to carry a local exception for the whole trixie
lifetime. 
Shipping the one-line bounds check removes that burden, and the
backporting risk is minimal.

[1] https://security-tracker.debian.org/tracker/CVE-2026-12087
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-12087

[ Impact ]

CVE-2026-12087: if a vulnerable third-party application passes
attacker-controlled data to pack_ip_mreq_source(), adjacent heap
memory could be disclosed to the caller.

[ Tests ]

- Built successfully in a trixie environment.
- Integrated package test suite (t/cve-2026-12087.t) passes during build.

  make[2]: Entering directory '/build/libsocket-perl-2.038'
  "/usr/bin/perl" -MExtUtils::Command::MM -e 'cp_nonempty' -- Socket.bs blib/arch/auto/Socket/Socket.bs 644
  PERL_DL_NONLAZY=1 "/usr/bin/perl" "-MExtUtils::Command::MM" "-MTest::Harness" "-e" "undef *Test::Harness::Switches; test_harness(1, 'blib/li
  b', 'blib/arch')" t/*.t
  t/cve-2026-12087.t .. 
  1..1
  ok 1 - pack_ip_mreq_source rejects short source
  ok
  t/getaddrinfo.t ..... 

- t/cve-2026-12087.t fails without CVE-2026-12087.patch. 
  you can ensure that with the following steps manually.
  (In production, patch will be applied in debian/series)
  
  $ dget -ux http://deb.debian.org/debian/pool/main/libs/libsocket-perl/libsocket-perl_2.038-1.dsc
  $ cd libsocket-perl-2.038
  $ patch -p1 < ../libsocket-perl_2.038-1+deb13u1.debdiff
  $ perl Makefile.PL
  $ patch -p1 < debian/patches/CVE-2026-12087-test.patch
  $ make test TEST_FILES=t/cve-2026-12087.t
  ...
  Result: FAIL
  Failed 1/1 test programs. 1/1 subtests failed.
  ...
  $ patch -p1 < debian/patches/CVE-2026-12087.patch
  $ make test TEST_FILES=t/cve-2026-12087.t
  ...
  All tests successful.
  Files=1, Tests=1,  0 wallclock secs ( 0.01 usr  0.00 sys +  0.02 cusr  0.00 csys =  0.03 CPU)
  Result: PASS

[ Risks ]

The patches are small and self-contained, and a regression test is included.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

* CVE-2026-12087.patch: add a length check on the source address
  argument in pack_ip_mreq_source() before dereferencing it, so that a
  too-short string croaks instead of reading past the end of the buffer.
  Backport of upstream commit de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.
  No API/ABI change; only malformed input is affected.
* CVE-2026-12087-test.patch: add t/cve-2026-12087.t, a regression test
  written for this backport (upstream has no dedicated test for it).
  Kept as a separate patch so the actual security fix stays reviewable
  in isolation.

[ Other info ]

The proposed fix is a minimal backport of the upstream
security fix to the version currently in trixie (2.038-1).
Unrelated upstream changes perldoc have not been included.

The source debdiff is attached.

Best Regards