Bug#1146798: trixie-pu: package libxml-bare-perl/0.53-4+deb13u1
Salvatore Bonaccorso
carnil at debian.org
Sat Sep 5 18:12:33 BST 2026
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libxml-bare-perl at packages.debian.org, gregoa at debian.org, team at security.debian.org, debian-perl at lists.debian.org, carnil at debian.org
Control: affects -1 + src:libxml-bare-perl
User: release.debian.org at packages.debian.org
Usertags: pu
Hi
I consider this might be late for the upcoming point release but
please consider it to be accepted for 13.8 later on.
The upload fixes two minor security issues which were adressed in
unstable already and marked no-dsa, CVE-2026-13401 and CVE-2026-57074,
tracked as well in #1142227.
Passes as well the QA testing on debusine:
https://debusine.debian.net/debian/developers/work-request/1230875/
Regards,
Salvatore
-------------- next part --------------
diff -Nru libxml-bare-perl-0.53/debian/changelog libxml-bare-perl-0.53/debian/changelog
--- libxml-bare-perl-0.53/debian/changelog 2024-05-15 19:56:55.000000000 +0000
+++ libxml-bare-perl-0.53/debian/changelog 2026-09-05 12:05:52.000000000 +0000
@@ -1,3 +1,12 @@
+libxml-bare-perl (0.53-4+deb13u1) trixie; urgency=medium
+
+ * Team upload.
+
+ [ gregor herrmann ]
+ * Add patches to fix CVE-2026-13401 and CVE-2026-57074 (Closes: #1142227)
+
+ -- Salvatore Bonaccorso <carnil at debian.org> Sat, 05 Sep 2026 14:05:52 +0200
+
libxml-bare-perl (0.53-4) unstable; urgency=medium
[ Helmut Grohne ]
diff -Nru libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch
--- libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch 1970-01-01 00:00:00.000000000 +0000
+++ libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch 2026-09-05 12:05:52.000000000 +0000
@@ -0,0 +1,32 @@
+From: CPANSec Security Scanner Bot <cpan-security at security.metacpan.org>
+Subject: [PATCH] XML::Bare: advance stuck attribute-name state (infinite loop)
+
+Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached
+by the default XML::Bare->new(text=>$xml)->parse on untrusted XML.
+
+The `att_nameqsdone` state ? reached after a single-quoted attribute
+*name* ? loops back to itself without advancing `cpos` on any character
+other than `=` or NUL, spinning forever in C on malformed input. The
+parser holds the interpreter for the duration of the call, so no
+Perl-level signal (`alarm`, etc.) can interrupt it: a single request
+pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`,
+`<x y=''''''z'>`.
+
+Fix: advance the cursor before looping, so the scan terminates at the
+next `=` or at the NUL sentinel (already handled by the `case 0` branch).
+
+Origin: https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch
+Bug: https://github.com/nanoscopic/perl-XML-Bare/pull/2
+Bug-Debian: https://bugs.debian.org/1142227
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-13401
+
+--- a/parser.c
++++ b/parser.c
+@@ -482,6 +482,7 @@
+ cpos++;
+ goto att_eq1;
+ }
++ cpos++; // advance the cursor so malformed input (no '=' after a quoted attr name) cannot spin forever
+ goto att_nameqsdone;
+
+ att_eq1:
diff -Nru libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch
--- libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch 1970-01-01 00:00:00.000000000 +0000
+++ libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch 2026-09-05 12:05:52.000000000 +0000
@@ -0,0 +1,71 @@
+From: CPANSec Security Scanner Bot <cpan-security at security.metacpan.org>
+Subject: [PATCH] XML::Bare: bounds truncated fixed-advance lookahead (heap OOB read)
+
+Heap-buffer-overflow READ (CWE-125) in the hand-rolled C parser
+(parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on
+untrusted XML.
+
+Several transitions advance `cpos` by a fixed amount past a recognised
+token without checking the buffer end, then dereference the new position:
+
+ - the `<![CDATA` match does `cpos += 9` after confirming only eight
+ bytes (`<![CDATA`), so a truncated tail such as `<![CDATA\0` steps
+ one byte past the NUL terminator;
+ - the three "self-closing tag" branches (name_x, name_gap, att_name)
+ do `cpos += 2` on the assumption that a `>` follows the `/`, so a
+ truncated tail such as `<a/\0` steps past the NUL.
+
+The subsequent `let = *cpos;` in val_1/val_x/cdata then reads out of
+bounds. Trigger: `<!-- c --><a/`.
+
+Fix: require the full `<![CDATA[` (nine bytes) before the `+= 9`, and
+only skip the assumed `>` when `*(cpos+1)` is non-NUL. Both changes are
+behaviour-preserving for well-formed input ? real CDATA always carries
+the `[`, and a non-truncated self-close always has a byte after the `/`;
+they differ only on the truncated-tail case that previously overran the
+allocation.
+
+Origin: https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch
+Bug: https://github.com/nanoscopic/perl-XML-Bare/pull/1
+Bug-Debian: https://bugs.debian.org/1142227
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-57074
+
+--- a/parser.c
++++ b/parser.c
+@@ -191,7 +191,8 @@
+ *(cpos+4) == 'D' &&
+ *(cpos+5) == 'A' &&
+ *(cpos+6) == 'T' &&
+- *(cpos+7) == 'A' ) {
++ *(cpos+7) == 'A' &&
++ *(cpos+8) == '[' ) { // require full "<![CDATA[" so cpos+=9 cannot skip past a truncated tail
+ cpos += 9;
+ curnode->type = 1;
+ goto cdata;
+@@ -342,7 +343,7 @@
+ temp = nodec_addchildr( curnode, tagname, tagname_len );
+ temp->z = cpos +1 - xmlin;
+ tagname_len = 0;
+- cpos+=2;
++ if( *(cpos+1) ) cpos += 2; else cpos++; // skip assumed '>' only if not the NUL terminator
+ goto val_1;
+ }
+
+@@ -366,7 +367,7 @@
+ curnode->z = cpos+1-xmlin;
+ curnode = curnode->parent;
+ if( !curnode ) goto done;
+- cpos+=2; // am assuming next char is >
++ if( *(cpos+1) ) cpos += 2; else cpos++; // was: assume next char is > (skip past NUL on truncated tail)
+ goto val_1;
+ case '=':
+ cpos++;
+@@ -423,7 +424,7 @@
+ curnode->z = cpos+1-xmlin;
+ curnode = curnode->parent;
+ if( !curnode ) goto done;
+- cpos += 2;
++ if( *(cpos+1) ) cpos += 2; else cpos++; // "/> assumed" ? skip '>' only if present, not the NUL
+ goto val_1;
+ case ' ':
+ if( *(cpos+1) == '=' ) {
diff -Nru libxml-bare-perl-0.53/debian/patches/series libxml-bare-perl-0.53/debian/patches/series
--- libxml-bare-perl-0.53/debian/patches/series 2024-05-15 19:56:55.000000000 +0000
+++ libxml-bare-perl-0.53/debian/patches/series 2026-09-05 12:05:52.000000000 +0000
@@ -2,3 +2,5 @@
libm.patch
pointer_from_integer.patch
cross.patch
+CVE-2026-13401-r1.patch
+CVE-2026-57074-r1.patch
More information about the pkg-perl-maintainers
mailing list