Your message dated Sat, 05 Sep 2026 18:50:42 +0000
with message-id <[email protected]>
and subject line Bug#558199: fixed in erlang 1:29.0.6+dfsg-1
has caused the Debian Bug report #558199,
regarding erlang-mode, erlang-manpages: non erlang related manpages in the
"Erlang" menu at the menubar
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
558199: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=558199
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: erlang-mode
Version: 1:13.b.2.1-dfsg-1
Severity: normal
erlang-mode builds the manpage menus by searching for manpages in the directory
specified
using the erlang-root-dir variable setted to "/usr/lib/erlang" in
/etc/emacs/site-start.d/50erlang-mode.el, and the erlang-man-dirs variable
setted on
erlang-mode.el. Then uses a regex defined in erlang-mode.el as:
(defun erlang-man-get-files (dir)
"Return files in directory DIR."
(directory-files dir t ".*\\.\\([124-9]\\|3erl\\)?\\(\\.gz\\)?\\'"))
The erlang-manpages package installs the manpages on /usr/share/man/* where non
erlang
related manpages also reside, and creates a /usr/lib/erlang/man ->
/usr/share/man symlink.
So, by traversing that symlink erlang-mode erroneously founds all manpages in
the system as
erlang ones.
Two notes about the regex: 1- there are other similar regexes used in
erlang-mode.el 2- the "3erl" string must be optional because there are manpages
like
/usr/share/man/man6/kernel.6.gz that not contain it.
I think the proper solution is to modify erlang-manpages to create an
/usr/lib/erlang/man directory instead of a symlink, and then man{3,4,6}
directories
containing one symlink for each manpage to his corresponding file in
/usr/share/man
(or viceversa).
Btw, this seems to be the continuation of the #436044 bug :) Creating the
/usr/lib/erlang/man
was a bad solution, erlang manpages become undifferentiated, but the empty
/usr/lib/erlang/man
was also bad.
-l System Information:
Debian Release: squeeze/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.30-2-686 (SMP w/2 CPU cores)
Locale: LANG=en_US, LC_CTYPE=en_US (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash
Versions of packages erlang-mode depends on:
ii emacsen-common 1.4.19 Common facilities for all emacsen
erlang-mode recommends no packages.
Versions of packages erlang-mode suggests:
ii erlang 1:13.b.2.1-dfsg-1 Concurrent, real-time, distributed
ii erlang-doc-html 1:13.b.2.1-dfsg-2 Erlang/OTP HTML documentation
ii erlang-manpages 1:13.b.2.1-1 Erlang/OTP manual pages
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: erlang
Source-Version: 1:29.0.6+dfsg-1
Done: Sergei Golovan <[email protected]>
We believe that the bug you reported is fixed in the latest version of
erlang, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sergei Golovan <[email protected]> (supplier of updated erlang package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 21 Aug 2026 17:34:23 +0300
Source: erlang
Architecture: source
Version: 1:29.0.6+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Erlang Packagers <[email protected]>
Changed-By: Sergei Golovan <[email protected]>
Closes: 558199 999682 1146603
Changes:
erlang (1:29.0.6+dfsg-1) unstable; urgency=medium
.
* New upstream release.
- Fix CVE-2026-55951: The Erlang/OTP httpc HTTP client does not enforce
a limit on the total size of response headers received from a server.
- Fix CVE-2026-59696: Improper Validation of Specified Quantity in Input
vulnerability in Erlang/OTP stdlib allows a remote attacker to degrade
availability by supplying a URI whose port component is a very long run
of digits.
- Fix CVE-2026-66835: Path Equivalence vulnerability in Erlang/OTP inets
httpd allows a remote unauthenticated attacker to read files inside
a mod_auth protected directory by prefixing the request path with
an extra slash.
- Fix CVE-2026-69664: Missing Release of Resource after Effective Lifetime
vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
attacker to cause denial of service by sending a request with a chunked
body whose chunk-size line is not a hexadecimal number.
- Fix CVE-2026-70399: Allocation of Resources Without Limits or Throttling
vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
attacker to cause denial of service by opening and holding open a large
number of connections.
- Fix CVE-2026-70405: Improper Validation of Specified Quantity in Input
vulnerability in Erlang/OTP snmp allows a remote attacker to degrade
availability by sending an SNMP message containing a BER INTEGER whose
length field is arbitrarily large.
- Fix CVE-2026-70409: Improper Validation of Specified Quantity in Input
vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP
server to degrade availability by returning a referral URL whose port
component is a very long run of digits.
- Fix CVE-2026-71380: Missing Release of Resource after Effective Lifetime
vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote
attacker to cause denial of service by sending valid request headers
with a large Content-Length and then stalling before the body
is complete.
- Fix CVE-2026-73270: Improper Handling of Case Sensitivity vulnerability
in Erlang/OTP inets httpd allows a remote unauthenticated attacker
to read files inside a mod_auth protected directory by requesting them
with different casing, on deployments whose filesystem
is case-insensitive.
- Fix CVE-2026-73276: Gracefulness code ignored cases that should
be rejected, resulting in possible HTTP Request Smuggling opportunities.
- Fix CVE-2026-73812: httpd function check_header/3 rejects duplicate
Content-Length (per CVE-2026-23941) but never checks for the TE+CL
co-presence that RFC 9112 ยง6.3 identifies as a probable smuggling
attempt.
- Fix CVE-2026-74835: The inets application HTTP server httpd fails
to enforce a configured body-size limit on chunked request.
- Fix CVE-2026-74994: The mod_auth module in OTP's inets httpd server,
when configured with dets or mnesia authentication backends and multiple
directory configuration blocks, collapses all directory blocks into
a single shared user/group namespace.
- Fix CVE-2026-75538: An attacker that connects to an open Erlang TCP
port that uses the inet driver with {packet,4} mode can use a signed
overflow in an incorrect packet length calculation to overflow
the receive buffer into the VM allocator area and beyond
up to about 2 GB.
Closes: #1146603.
* Replace dependency of erlang-jinterface on java2-runtime(-headless)
by dependency on java-runtime(-headless).
* Add conflict of erlang-doc with erlang-mode version less than 27.0
because the /usr/lib/erlang/man symlink was moved from the former package
to the latter.
* Erlang related manpages are now shipped in erlang-doc under the
/usr/share/erlang-doc/man hierarchy, which avoids showing non-Erlang
manpages in Emacs menu (closes: #558199, #999682).
* Add gbp.conf with pristine-tar directive, which is needed to produce
the original tarball with empty directories.
Checksums-Sha1:
2e0b658dd1567fae70cdcb25fbc8234d510e3b00 5002 erlang_29.0.6+dfsg-1.dsc
777f84b4e984655c5542f874f178d14b60050b7e 49301784
erlang_29.0.6+dfsg.orig.tar.xz
6a035187b413e8748173c9a3e1d64176f8ac9d28 63716
erlang_29.0.6+dfsg-1.debian.tar.xz
92bbc1e6cfd0562420b46e09de4db95ad4b6407c 32289
erlang_29.0.6+dfsg-1_amd64.buildinfo
Checksums-Sha256:
dfe95edd32300f4127bd01d974625c41da29a3a48113dc5426b6fc56b40dd039 5002
erlang_29.0.6+dfsg-1.dsc
e679fe8262e5ec32701857e7bc8034032090bf6e2ac0565301a7feca4fb0626f 49301784
erlang_29.0.6+dfsg.orig.tar.xz
1cd7a021c8c48a878656b1239afa91c69dd4f1db53d9b97bf4d79f97aa807327 63716
erlang_29.0.6+dfsg-1.debian.tar.xz
fdc2036ddf41b2b560eef31def1a7393e40888e80144ea3fb88b7a6dc421e4a0 32289
erlang_29.0.6+dfsg-1_amd64.buildinfo
Files:
766ccde1098c2a268f989a3dfaffef95 5002 interpreters optional
erlang_29.0.6+dfsg-1.dsc
6d4a3f0c1c4340634ffd7a3daac8f135 49301784 interpreters optional
erlang_29.0.6+dfsg.orig.tar.xz
5fbedfa8e66cb2a89af6ecb8668647a8 63716 interpreters optional
erlang_29.0.6+dfsg-1.debian.tar.xz
76d16823ead2c706c6940be087943454 32289 interpreters optional
erlang_29.0.6+dfsg-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmqcXkYACgkQTyrk60tj
54dizg//fD1Hi3jOwrRzRSASoruqGbqaF4+OrvBoy9oJPV8jXqUR0quEndxenixB
H+G8FrY9SChseWP4q5/Mzkh2i5HWvYLNLBdWcmiY4yLunvRMyJ6yly+mwYR8PQB/
qJ7xXtuemVBvMAa7gCmMjeBm5K2a/8UdwWTViVXlVFvssQib3xKNd6ndNtiu4hWD
lD0cjCagPrAbK4AASLvYFmn2A9FHRPndPv5VK8JHxM0aFJlwSoyye2ds8SyPxF6A
LphdPjOP07t8xGkAmhZVrVEsgcAqYKGYC8XzLX3wdijWkpTVyC8mQqUricRzGs3I
ooO2cqqCecpQcT6h2gWHaess74Psnu7cw4dihiN4AAK4fbSCZxnPZce2BTDpwbOi
P7qpO8fJnHJVCxAzFrYN+JsWLWnW9M9DlgHAPRT3rKmoqspL2kZdyQMtibaW/CDp
u8doP4EufhGVHY3NWc5wv0S7tg0QopuMSfpesFyYCXTeUYJU9fXnG/zJ2ZsHEm/S
lmK0LYKLqa8gRR/U4+W2gffHLqaCT3egNUPR5b9H5Lu55xa/XiVmcFlYizQSD1pd
5hDBOx0BwMrxTiRaa11NyFqlHqFYSA09k39fhCb7wuuBHrQx6kR5HZocLjFso+ri
Mienoi/r0R5FK7qShr0/OJ0qWbfe1NfVPRKDpt1cwJ3q5F1KQbg=
=rEkC
-----END PGP SIGNATURE-----
pgpZ2ziUROgTM.pgp
Description: PGP signature
--- End Message ---
