Your message dated Sat, 11 Jul 2026 10:32:48 +0000
with message-id <[email protected]>
and subject line Released in 13.6
has caused the Debian Bug report #1139576,
regarding trixie-pu: package libxpm/1:3.5.17-1+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1139576: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139576
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected], [email protected]
Control: affects -1 + src:libxpm
User: [email protected]
Usertags: pu
This fixes a low severity security issue in libxpm. Tests via debusine
look all good and the fix has been in testing for over five weeks now.
debdiff below.
Cheers,
Moritz
diff -u libxpm-3.5.17/debian/changelog libxpm-3.5.17/debian/changelog
--- libxpm-3.5.17/debian/changelog
+++ libxpm-3.5.17/debian/changelog
@@ -1,3 +1,9 @@
+libxpm (1:3.5.17-1+deb13u1) trixie; urgency=medium
+
+ * CVE-2026-4367 (Closes: #1134690)
+
+ -- Moritz Mühlenhoff <[email protected]> Mon, 08 Jun 2026 22:27:18 +0200
+
libxpm (1:3.5.17-1) unstable; urgency=high
[ Timo Aaltonen ]
only in patch2:
unchanged:
--- libxpm-3.5.17.orig/src/data.c
+++ libxpm-3.5.17/src/data.c
@@ -210,6 +210,9 @@
while ((c = *data->cptr++) && c != data->Bos && c != '\0')
if (data->Bcmt && c == data->Bcmt[0])
ParseComment(data);
+
+ if (c == '\0')
+ return XpmFileInvalid;
} else if (data->Bcmt) { /* XPM2 natural */
while (((c = *data->cptr++) == data->Bcmt[0]) && c != '\0')
ParseComment(data);
only in patch2:
unchanged:
--- libxpm-3.5.17.orig/src/parse.c
+++ libxpm-3.5.17/src/parse.c
@@ -221,7 +221,9 @@
if (!data->format) { /* XPM 2 or 3 */
for (a = 0, color = colorTable; a < ncolors; a++, color++) {
- xpmNextString(data); /* skip the line */
+ ErrorStatus = xpmNextString(data); /* skip the line */
+ if (ErrorStatus != XpmSuccess)
+ goto error;
/*
* read pixel value
@@ -319,7 +321,9 @@
/* get to the beginning of the first string */
data->Bos = '"';
data->Eos = '\0';
- xpmNextString(data);
+ ErrorStatus = xpmNextString(data);
+ if (ErrorStatus != XpmSuccess)
+ goto error;
data->Eos = '"';
for (a = 0, color = colorTable; a < ncolors; a++, color++) {
@@ -359,7 +363,9 @@
/*
* read color values
*/
- xpmNextString(data); /* get to the next string */
+ ErrorStatus = xpmNextString(data); /* get to the next string */
+ if (ErrorStatus != XpmSuccess)
+ goto error;
*curbuf = '\0'; /* init curbuf */
while ((l = xpmNextWord(data, buf, BUFSIZ))) {
if (*curbuf != '\0') {
@@ -383,8 +389,11 @@
memcpy(s, curbuf, len);
color->c_color = s;
*curbuf = '\0'; /* reset curbuf */
- if (a < ncolors - 1) /* can we trust ncolors -> leave data's
bounds */
- xpmNextString(data); /* get to the next string */
+ if (a < ncolors - 1) { /* can we trust ncolors -> leave data's
bounds */
+ ErrorStatus = xpmNextString(data); /* get to the next
string */
+ if (ErrorStatus != XpmSuccess)
+ goto error;
+ }
}
}
*colorTablePtr = colorTable;
--- End Message ---
--- Begin Message ---
Version: 13.6
This update was released as part of 13.6.
--- End Message ---
