[Parted-maintainers] Bug#1150577: trixie-pu: package parted/3.6-5+deb13u1

[Carlos Henrique Lima Melara]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: parted at packages.debian.org
Control: affects -1 + src:parted
User: release.debian.org at packages.debian.org
Usertags: pu

[ Reason ]
The update aims to fix 2 CVEs (#1148169) on parted, CVE-2026-89088 [1]
and CVE-2026-89085 [2]. The commit fixing it has been cherry-picked from
upstream [3] and applied cleanly, the code between trixie's version and
upstream fix did not change, plus the patch adds asserts to avoid
overflows instead of changing logic to avoid greater regressions risk as
noted by upstream [4]:

> I opted to fix things by using the existing PED_ASSERT system -- I
> really do not want to change logic, especially in the filesystem code.
> It's better to get these 'fixed' quickly and if someone wants to
> improve logic later that's fine.

[1] https://deb.freexian.com/extended-lts/tracker/CVE-2026-89088
[2] https://deb.freexian.com/extended-lts/tracker/CVE-2026-89085
[3] https://gitweb.git.savannah.gnu.org/gitweb/?p=parted.git;a=commit;h=73301c6915781c2eee66d0b1cc9d41a70bf901d6
[4] https://alioth-lists.debian.net/pipermail/parted-devel/2026-September/006032.html

[ Impact ]
Buffer overflows are possible on 32-bit arches.

[ Tests ]
I have uploaded to debusine to get regression testing of rdeps of
parted, the results showed no regression [5]. Upstream provides a test
case but I did not manage to get it to run properly (with or without the
fix) after spending a few hours on it so I resort to debusine instead.

[5] https://debusine.debian.net/debian/developers/work-request/1425201/#qa

[ Risks ]
The actual code changes are basically adding asserts to make sure
overflows are not possible. It's pretty trivial and there is no logic
change in code that could introduce regressions.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
        NOTE: Debian maintainers use git-dpm to manage the packaging and
        it does change the tool-specific metadata file in debian/ though
        I left it out of changelog.
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Add upstream commit which add PED_ASSERTS to check values that could
cause overflows and also a testcase for it.

[ Other info ]
Since changes are minimal and low risk, I'll proceed with the upload to
trixie-pu as suggested in dev-ref (5.5.1).

Cheers,
Charles
-------------- next part --------------
A non-text attachment was scrubbed...
Name: parted_3.6-5+deb13u1.diff
Type: text/x-diff
Size: 10019 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/parted-maintainers/attachments/20261010/ec09d7b8/attachment.diff>