Your message dated Sat, 11 Jul 2026 10:32:47 +0000
with message-id <[email protected]>
and subject line Released in 13.6
has caused the Debian Bug report #1138539,
regarding trixie-pu: package libcaca/0.99.beta20-5+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1138539: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138539
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected], Sebastian
Ramacher <[email protected]>, [email protected]
Control: affects -1 + src:libcaca
User: [email protected]
Usertags: pu
Hi
libcaca in trixie is prone to CVE-2026-42046, #1136952 but does not
seem severe enough to warrant a DSA. This update provide the patch
used in unstable already to address the issue.
Regards,
Salvatore
diff -Nru libcaca-0.99.beta20/debian/changelog
libcaca-0.99.beta20/debian/changelog
--- libcaca-0.99.beta20/debian/changelog 2024-08-11 22:08:05.000000000
+0200
+++ libcaca-0.99.beta20/debian/changelog 2026-05-31 15:40:07.000000000
+0200
@@ -1,3 +1,11 @@
+libcaca (0.99.beta20-5+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload.
+ * Prevent undefined behaviour in overflow check (CVE-2026-42046)
+ (Closes: #1136952)
+
+ -- Salvatore Bonaccorso <[email protected]> Sun, 31 May 2026 15:40:07 +0200
+
libcaca (0.99.beta20-5) unstable; urgency=medium
* debian/patches: Disable doxygen timestamps (Closes: #1071672)
diff -Nru
libcaca-0.99.beta20/debian/patches/0004-Prevent-undefined-behaviour-in-overflow-check.patch
libcaca-0.99.beta20/debian/patches/0004-Prevent-undefined-behaviour-in-overflow-check.patch
---
libcaca-0.99.beta20/debian/patches/0004-Prevent-undefined-behaviour-in-overflow-check.patch
1970-01-01 01:00:00.000000000 +0100
+++
libcaca-0.99.beta20/debian/patches/0004-Prevent-undefined-behaviour-in-overflow-check.patch
2026-05-31 15:38:54.000000000 +0200
@@ -0,0 +1,42 @@
+From: Pascal Terjan <[email protected]>
+Date: Sun, 12 Apr 2026 19:06:08 +0000
+Subject: Prevent undefined behaviour in overflow check
+Origin:
https://github.com/cacalabs/libcaca/commit/fb77acff9ba6bb01d53940da34fb10f20b156a23
+Bug-Debian: https://bugs.debian.org/1136952
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-42046
+
+Fixes #86
+---
+ caca/canvas.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/caca/canvas.c b/caca/canvas.c
+index 7beff5b81d47..62b72b72bb5e 100644
+--- a/caca/canvas.c
++++ b/caca/canvas.c
+@@ -26,6 +26,7 @@
+ # if defined(HAVE_UNISTD_H)
+ # include <unistd.h>
+ # endif
++# include <limits.h>
+ #endif
+
+ #include "caca.h"
+@@ -368,12 +369,12 @@ int caca_resize(caca_canvas_t *cv, int width, int height)
+ int x, y, f, old_width, old_height, old_size;
+
+ /* Check for overflow */
+- int new_size = width * height;
+- if (new_size < 0 || (width > 0 && new_size / width != height))
++ if (width != 0 && height > INT_MAX / width)
+ {
+ seterrno(EOVERFLOW);
+ return -1;
+ }
++ int new_size = width * height;
+
+ old_width = cv->width;
+ old_height = cv->height;
+--
+2.53.0
+
diff -Nru libcaca-0.99.beta20/debian/patches/series
libcaca-0.99.beta20/debian/patches/series
--- libcaca-0.99.beta20/debian/patches/series 2024-08-11 22:04:38.000000000
+0200
+++ libcaca-0.99.beta20/debian/patches/series 2026-05-31 15:39:27.000000000
+0200
@@ -1,3 +1,4 @@
0001-caca-config.in-Avoid-mentioning-libdir.patch
0002-Don-t-generate-PDF-with-latex.patch
0003-Disable-doxygen-timestamps.patch
+0004-Prevent-undefined-behaviour-in-overflow-check.patch
--- End Message ---
--- Begin Message ---
Version: 13.6
This update was released as part of 13.6.
--- End Message ---
