[Pkg-javascript-devel] Bug#1150156: CVE-2026-90648/wabt not yet fixed (was: Re: Bug#1150156 closed by Debian FTP Masters <ftpmaster at ftp-master.debian.org> (reply to Xavier Guimard <yadd at debian.org>) (Bug#1150156: fixed in wabt 1.0.42+dfsg+~cs1.0.39-1))

[Salvatore Bonaccorso]

Control: reopen 1150156
Control: found 1150156 1.0.42+dfsg+~cs1.0.39-1

Hi Xavier,

On Tue, Oct 06, 2026 at 07:35:08PM +0000, Debian Bug Tracking System wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
> 
> Format: 1.8
> Date: Tue, 06 Oct 2026 21:05:12 +0200
> Source: wabt
> Architecture: source
> Version: 1.0.42+dfsg+~cs1.0.39-1
> Distribution: unstable
> Urgency: medium
> Maintainer: Debian Javascript Maintainers <pkg-javascript-devel at lists.alioth.debian.org>
> Changed-By: Xavier Guimard <yadd at debian.org>
> Closes: 1150156
> Changes:
>  wabt (1.0.42+dfsg+~cs1.0.39-1) unstable; urgency=medium
>  .
>    * Team upload
>    * New upstream version (Closes: #1150156, CVE-2026-90648)
>    * Unfuzz patches

Just checked, the commit
https://github.com/WebAssembly/wabt/commit/e197d0b7bd3fe426f5963ae540f4426a1d49e89f
is not included in the upstream release 1.0.42. So this should not yet
be closed.

Regards,
Salvatore