Your message dated Tue, 8 Sep 2026 19:32:30 +0300
with message-id <aqA4nmk-eRErDhjc@localhost>
and subject line Re: Bug#1144082: box64: mismerge of CVE-2025-13151
has caused the Debian Bug report #1144082,
regarding box64: mismerge of CVE-2025-13151
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144082: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144082
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: box64
Severity: serious
Tags: security
Justification: security
X-Debbugs-Cc: Gajendra Nath Soren <[email protected]>,
[email protected]
> > CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed in
> > 4.20.0)
> >
> > The fix changes:
> > char name[2 * ASN1_MAX_NAME_SIZE + 1]
> >
> > to:
> > char name[2 * ASN1_MAX_NAME_SIZE + 2]
> >
> > This applies to two functions: asn1_expand_any_defined_by and
> > asn1_expand_octet_string.
> > box64 vendors a private copy of libtasn1 with the same partial-fix pattern:
> > asn1_expand_any_defined_by updated, asn1_expand_octet_string still at + 1.
Please fix and may be avoid vendoring ?
THanks to Gajendra Nath Soren
rouca
signature.asc
Description: This is a digitally signed message part.
--- End Message ---
--- Begin Message ---
On Mon, Aug 10, 2026 at 10:00:30PM +0200, Bastien Roucaries wrote:
> Source: box64
> Severity: serious
> Tags: security
> Justification: security
> X-Debbugs-Cc: Gajendra Nath Soren <[email protected]>,
> [email protected]
>
> > > CVE-2025-13151 (libtasn1 - off-by-one in asn1_expand_octet_string, fixed
> > > in
> > > 4.20.0)
> > >
> > > The fix changes:
> > > char name[2 * ASN1_MAX_NAME_SIZE + 1]
> > >
> > > to:
> > > char name[2 * ASN1_MAX_NAME_SIZE + 2]
> > >
> > > This applies to two functions: asn1_expand_any_defined_by and
> > > asn1_expand_octet_string.
>
> > > box64 vendors a private copy of libtasn1 with the same partial-fix
> > > pattern:
> > > asn1_expand_any_defined_by updated, asn1_expand_octet_string still at + 1.
>
> Please fix and may be avoid vendoring ?
box64 does not vendor libtasn1.
> THanks to Gajendra Nath Soren
>
> rouca
cu
Adrian
--- End Message ---
