[From nobody Fri Oct 30 17:37:05 2026 Received: (at 1152516-close) by bugs.debian.org; 30 Oct 2026 17:34:37 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 112; hammy, 150; neutral, 231; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:41234) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xMqUu-0053Sl-2R for 1152516-close@bugs.debian.org; Fri, 30 Oct 2026 17:34:37 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xMqUt-005X4p-1L for 1152516-close@bugs.debian.org; Fri, 30 Oct 2026 17:34:35 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=qCSflXOKmZ5kwwjEN30fvvi5w3puXTLQfK6VB0tpl5A=; b=qR2C3+keJABbUi4MpmmwNtwLeH wnUz2WZLfjs9pXwZ6JmxXwMn0OytueujVUpWM0yw8r8wnfPZBmUrwzEu9FKkUeeFxTWN9PLLhJVsy P4W//8lXbLMVat9CXofaKJsl3zGAiUQkeIAqJEPt+N086Rc0JHwDwz8CuK0ER7297YQSOLJPfPGWZ H+DC5V0EdnQ9qCpPhuwsmMoNbslVWw+l4mv08+nZVEKbH0qiw3OnBozBV8dWFROYqhI+QDklV2THR RXz4zt1CpJWfTbEIbgTfprcIoIApMTS9UpZ3BposlV17eZ1E1GsFvzY1zR7Uv29VQX/89sK+BEVu0 Onl0lFOA==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xMqUs-0000000EqiX-2Xgl; Fri, 30 Oct 2026 17:34:34 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: gregor herrmann <gregoa@debian.org> To: 1152516-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: libspreadsheet-xlsx-perl Debian: DAK Debian-Changes: libspreadsheet-xlsx-perl_0.20-1_source.changes Debian-Source: libspreadsheet-xlsx-perl Debian-Version: 0.20-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1152516: fixed in libspreadsheet-xlsx-perl 0.20-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============0056277661918650595==" Message-Id: <E1xMqUs-0000000EqiX-2Xgl@fasolo.debian.org> Date: Fri, 30 Oct 2026 17:34:34 +0000 --===============0056277661918650595== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: libspreadsheet-xlsx-perl Source-Version: 0.20-1 Done: gregor herrmann <gregoa@debian.org> We believe that the bug you reported is fixed in the latest version of libspreadsheet-xlsx-perl, which is due to be installed in the Debian FTP arch= ive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1152516@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. gregor herrmann <gregoa@debian.org> (supplier of updated libspreadsheet-xlsx-= perl package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 17:50:26 +0100 Source: libspreadsheet-xlsx-perl Architecture: source Version: 0.20-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1152516 Changes: libspreadsheet-xlsx-perl (0.20-1) unstable; urgency=3Dmedium . * Import upstream version 0.20. . From 0.19: - Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format sectio= n. Prevents arbitrary Perl code execution when parsing crafted XLSX files. A.k.a CVE-2026-115943 (closes: #1152516) . From 0.20: - Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata. - Security: validate number format IDs and escape regex lookups to preve= nt regex injection from crafted styles. - Security: reject out-of-range date values to prevent excessive CPU usa= ge. - Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid row= s. . * Update years of packaging copyright. * Declare compliance with Debian Policy 4.7.4. * Remove =C2=ABRules-Requires-Root: no=C2=BB, which is the current default. * Remove =C2=ABPriority: optional=C2=BB, which is the current default. * Set upstream metadata fields: Bug-Database, Bug-Submit. Checksums-Sha1: 1b33fcc60fce97478badeab7fda2eb3c81f10aef 2569 libspreadsheet-xlsx-perl_0.20-= 1.dsc 559f7bba6d1ba461dbf6dbbf2b6f76ccf9a02204 89884 libspreadsheet-xlsx-perl_0.20= .orig.tar.gz 10f264b4c45f53833a45255a7f14091990a1a642 3584 libspreadsheet-xlsx-perl_0.20-= 1.debian.tar.xz f59015384cffe7ef7f9aad2de2714418bd11dfce 135392 libspreadsheet-xlsx-perl_0.2= 0-1.git.tar.xz 905a98ebef77d494f84992fa3eb0e3c3801315d7 17801 libspreadsheet-xlsx-perl_0.20= -1_source.buildinfo Checksums-Sha256: e5212023f0aa3c186b0ad1c7fed8b0f4b807dfe46a0197cf144d55661bbd2783 2569 libspr= eadsheet-xlsx-perl_0.20-1.dsc 5add7b91c4845809b065a1b61e326627b0019aaec91078b1efa54842c9a7ab5d 89884 libsp= readsheet-xlsx-perl_0.20.orig.tar.gz adb18a86dfb37e1116fe4b1e0144a421a3ed7408cf325af7e6b43140e1d40a4c 3584 libspr= eadsheet-xlsx-perl_0.20-1.debian.tar.xz 2fce0babb5d416f2d5b6c423e1424d3a7463235c685c1f52bc00e1b5123b1fc2 135392 libs= preadsheet-xlsx-perl_0.20-1.git.tar.xz 1d262efcba0c5278424c451fa32ed2210d4ebb891cd58fa896179fe791b2f237 17801 libsp= readsheet-xlsx-perl_0.20-1_source.buildinfo Files: 6e3a871b4379b649b6be6ee32c52d162 2569 perl optional libspreadsheet-xlsx-perl= _0.20-1.dsc 84efc2a287e018ff45ce0c6aeed5bb8a 89884 perl optional libspreadsheet-xlsx-per= l_0.20.orig.tar.gz f25a66ced90f4ec7a8acfc73edff2852 3584 perl optional libspreadsheet-xlsx-perl= _0.20-1.debian.tar.xz de2c9805834db62978f8eeaeeb1d8b9d 135392 perl None libspreadsheet-xlsx-perl_0= .20-1.git.tar.xz d4c1bb56340da5efd052653264a724ae 17801 perl optional libspreadsheet-xlsx-per= l_0.20-1_source.buildinfo Git-Tag-Info: tag=3D08e1ca1819f3c7e0dabc6cc5f1123b15eaa251a7 fp=3Dd1e1316e93a= 760a8104d85fabb3a68018649aa06 Git-Tag-Tagger: gregor herrmann <gregoa@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrky6oACgkQYG0ITkaD wHlbWw//WOfxsCgiyQ4P6BBwl1dxwtWCa+rceeFQZtohy9lYP6//AL6HrBDsUjQB gaHafOGumuGtACRqZDsTSzmLy3+7JVg4Tk20olJF+AKk+r7j3XpiLGOOuGUjL98n aNCmJ889VOVKuP3EWw4myzDpbDQH4KOCyAP5G++wiRykoo7fUff/D3aDIW4HilX5 2RQ19mYLVju86fEgqAHWzxYlCFy3rUVqeNw/XPsfGBlJW/dh+DnuiXLJy53+5up5 jHI2WM6B1wC+YW4Ug/GTx5dM/Jj2bdsa0bgCdms2JrIFnnP4B8eomuxq64vx/N7O hiJyMQgbqeUk+n2NbA3OTd6ExSYxMbhO3AdslSsGvI4UjVY62PYuGUoq0Zd8EDqC yhLVJo+H3hGJS/UYnfG6h4p0lfIF6uRYJnzzeqSQeBTVuAlWWjwEGIoI+97ENg1J TD58Qs4UtFmx9tQHNU3fZ7rAaLjCPcmomF82NMdJNQ5orABCKI15OvBWu257TS6u pYcyQtK2IJzrekTySIC3Ibu5OznCo1AlYAUe1WYrmxOjnUdPuWPk7FTf+o6hO0zV kMh+kBL5GeqjynUhWBufFbU9AOdZes9CHrGaVFL0A6Qyr5V1p8WeH7zyOpdgxWWU /3Sf6yvQi5l30hBSTg4AOf/vr0MnmfLCy613F2j6UeivV9HSKv8=3D =3Dez0O -----END PGP SIGNATURE----- --===============0056277661918650595== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCauTVKgAKCRCb9qggYcy5 IbttAP94tuJZLgGcvhw1MQcj/tQwH1pvVvGhGTakoVgShnX2iAD/cuNu9MgSwZwz nRFoaedmTClHhH/Vrd/XE3T0ZURdawM= =Bfg/ -----END PGP SIGNATURE----- --===============0056277661918650595==-- ]