Your message dated Sat, 11 Jul 2026 10:42:30 +0000
with message-id <[email protected]>
and subject line Released in 12.15
has caused the Debian Bug report #1141145,
regarding bookworm-pu: package libhtml-gumbo-perl/0.18-3+deb12u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141145: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141145
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:libhtml-gumbo-perl
User: [email protected]
Usertags: pu
[ Reason ]
libhtml-gumbo-perl has a security issue in the version in bookworm. We
don't feel that warrants a DSA, but would like to see it updated in
bookworm before the final point release.
Bug report for the security issue:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104789
CVE-2025-15646
[ Impact ]
Users of this package will be exposed to this security issue.
[ Tests ]
The package has built in test cases, these all pass.
The patch has been accepted upstream.
[ Risks ]
There is minimal risk.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
The change adds handling for the template HTML element.
[ Other info ]
I've been discussing this with Salvatore Bonaccorso.
diff -Nru libhtml-gumbo-perl-0.18/debian/changelog
libhtml-gumbo-perl-0.18/debian/changelog
--- libhtml-gumbo-perl-0.18/debian/changelog 2022-08-01 03:45:00.000000000
+1200
+++ libhtml-gumbo-perl-0.18/debian/changelog 2026-06-28 15:19:13.000000000
+1200
@@ -1,3 +1,12 @@
+libhtml-gumbo-perl (0.18-3+deb12u1) bookworm; urgency=medium
+
+ * Team upload.
+ * [CVE-2025-15646] Add patch to fix wrong code path with GUMBO_NODE_TEMPLATE.
+ Thanks to Vincent Lefevre for the bug report and Niko Tyni for the patch.
+ (Closes: #1104789)
+
+ -- Andrew Ruthven <[email protected]> Sun, 28 Jun 2026 15:19:13 +1200
+
libhtml-gumbo-perl (0.18-3) unstable; urgency=medium
[ gregor herrmann ]
diff -Nru
libhtml-gumbo-perl-0.18/debian/patches/0001-Fix-wrong-code-path-with-GUMBO_NODE_TEMPLATE.patch
libhtml-gumbo-perl-0.18/debian/patches/0001-Fix-wrong-code-path-with-GUMBO_NODE_TEMPLATE.patch
---
libhtml-gumbo-perl-0.18/debian/patches/0001-Fix-wrong-code-path-with-GUMBO_NODE_TEMPLATE.patch
1970-01-01 12:00:00.000000000 +1200
+++
libhtml-gumbo-perl-0.18/debian/patches/0001-Fix-wrong-code-path-with-GUMBO_NODE_TEMPLATE.patch
2026-06-28 15:19:05.000000000 +1200
@@ -0,0 +1,47 @@
+From 549609cd80784012c274c11731e6a31787d3555e Mon Sep 17 00:00:00 2001
+From: Niko Tyni <[email protected]>
+Date: Sat, 17 May 2025 09:32:06 +0100
+Subject: [PATCH] Fix wrong code path with GUMBO_NODE_TEMPLATE
+
+GUMBO_NODE_TEMPLATE was introduced in Gumbo 0.10.0 but HTML-Gumbo has
+not been updated to support that.
+
+This makes walk_tree() take the text node branch for templates
+and access uninitialized memory.
+
+The gumbo C library seems to treat GUMBO_NODE_TEMPLATE very
+similarly to GUMBO_NODE_ELEMENT. From
+
+ https://sources.debian.org/src/gumbo-parser/0.13.0%2Bdfsg-2/src/gumbo.h/#L304
+
+ /** Template node. This is separate from GUMBO_NODE_ELEMENT because many
+ * client libraries will want to ignore the contents of template nodes, as
+ * the spec suggests. Recursing on GUMBO_NODE_ELEMENT will do the right
thing
+ * here, while clients that want to include template contents should also
+ * check for GUMBO_NODE_TEMPLATE. v will be a GumboElement. */
+
+So we add it to the list "special" container types in walk_tree()
+that attach a GumboElement value rather than a GumboText.
+
+Bug-Debian: https://bugs.debian.org/1104789
+Bug: https://github.com/ruz/HTML-Gumbo/issues/6
+---
+ lib/HTML/Gumbo.xs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/HTML/Gumbo.xs b/lib/HTML/Gumbo.xs
+index 97dfc43..32427d7 100644
+--- a/lib/HTML/Gumbo.xs
++++ b/lib/HTML/Gumbo.xs
+@@ -38,7 +38,7 @@ typedef enum {
+ STATIC
+ void
+ walk_tree(pTHX_ GumboNode* node, int flags, void (*cb)(pTHX_
PerlHtmlGumboType, GumboNode*, void*), void* ctx ) {
+- if ( node->type == GUMBO_NODE_DOCUMENT || node->type ==
GUMBO_NODE_ELEMENT ) {
++ if ( node->type == GUMBO_NODE_DOCUMENT || node->type ==
GUMBO_NODE_ELEMENT || node->type == GUMBO_NODE_TEMPLATE) {
+ GumboVector* children;
+ int skip = flags&PHG_FLAG_SKIP_ROOT_ELEMENT && node->type ==
GUMBO_NODE_ELEMENT && node->parent && node->parent->type == GUMBO_NODE_DOCUMENT;
+ if ( !skip ) {
+--
+2.49.0
+
diff -Nru libhtml-gumbo-perl-0.18/debian/patches/series
libhtml-gumbo-perl-0.18/debian/patches/series
--- libhtml-gumbo-perl-0.18/debian/patches/series 2022-08-01
03:45:00.000000000 +1200
+++ libhtml-gumbo-perl-0.18/debian/patches/series 2026-06-28
15:19:05.000000000 +1200
@@ -1,2 +1,3 @@
no-alien-libgumbo.patch
tree_to_callback-don-t-check-document-nodes-for-void.patch
+0001-Fix-wrong-code-path-with-GUMBO_NODE_TEMPLATE.patch
--- End Message ---
--- Begin Message ---
Version: 12.15
This update was released as part of 12.15.
--- End Message ---
