Your message dated Mon, 14 Sep 2026 07:33:53 +0000
with message-id <[email protected]>
and subject line Bug#1147522: fixed in ocaml-cstruct 6.3.0-1
has caused the Debian Bug report #1147522,
regarding ocaml-cstruct: CVE-2026-89087
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147522: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147522
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: ocaml-cstruct
Version: 6.2.0-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for ocaml-cstruct.
CVE-2026-89087[0]:
| The cstruct package before 6.3.0 for OCaml mishandles indexes.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-89087
https://www.cve.org/CVERecord?id=CVE-2026-89087
[1] https://osv.dev/vulnerability/OSEC-2026-20
[2] https://github.com/mirage/ocaml-cstruct/pull/324
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: ocaml-cstruct
Source-Version: 6.3.0-1
Done: Stéphane Glondu <[email protected]>
We believe that the bug you reported is fixed in the latest version of
ocaml-cstruct, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Stéphane Glondu <[email protected]> (supplier of updated ocaml-cstruct package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 14 Sep 2026 08:39:40 +0200
Source: ocaml-cstruct
Architecture: source
Version: 6.3.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian OCaml Maintainers <[email protected]>
Changed-By: Stéphane Glondu <[email protected]>
Closes: 1147522
Changes:
ocaml-cstruct (6.3.0-1) unstable; urgency=medium
.
* New upstream release (Closes: #1147522, CVE-2026-89087)
* Switch debian/watch to version 5
* Bump Standards-Version to 4.7.4
* Bump debhelper compat level to 14
* Remove Priority and Rules-Requires-Root from debian/control
Checksums-Sha1:
6381f5416bb7a78dae4cb8bda1d66dcbca63b88c 2119 ocaml-cstruct_6.3.0-1.dsc
3024a2a263367b6fc261084a3e3dd15a66352008 244860 ocaml-cstruct_6.3.0.orig.tar.gz
c397f9d4ae22a1bdf51860307c115e40465434f1 3556
ocaml-cstruct_6.3.0-1.debian.tar.xz
Checksums-Sha256:
d5191eabf30eedcdda2c7e1d195e327ff9ca1c28c8dda26d474a38cd72ce0ac8 2119
ocaml-cstruct_6.3.0-1.dsc
c0ffb7be74ec7e960beb1a0aa1614179e6041602deb2f3a6531db97f35c797a9 244860
ocaml-cstruct_6.3.0.orig.tar.gz
dbb670b6fd4e62991cdfdca40da0142d926ba683267d2830772bfd8c0e702a7e 3556
ocaml-cstruct_6.3.0-1.debian.tar.xz
Files:
65162b8bdb3482fc9d91c88b7d2fc490 2119 ocaml optional ocaml-cstruct_6.3.0-1.dsc
5ffbff4b1f38396d7bfae58b1b664367 244860 ocaml optional
ocaml-cstruct_6.3.0.orig.tar.gz
0465ce22b60958688ebef8646d095cc1 3556 ocaml optional
ocaml-cstruct_6.3.0-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQFGBAEBCgAwFiEEbeJOl+yohsxW5iUOIbju8bGJMIEFAmqnnhsSHGdsb25kdUBk
ZWJpYW4ub3JnAAoJECG47vGxiTCBdbQH/2QevnFsOkcXQnT23fbasgs7Eoqdch6x
sfLrOQEYIA653DzLFqGGFcqIkmm23gU2rXlIVrk2yy3BejG5szl/clHCRVTNljCf
dnmswTjsISpVL7ZJCACVUQe+UlxB8UfmtP5rqu0IAkBrGd9w8b6RlM8hX9Wc35Xa
oKGGEadKs86yqShn0Y1ZFwmz2zEV5UQjRtBcUAm0DelBY8JJVn4vbwUL2mZaxmmj
FdejoDb8uZ292f3ecNlsl7F07lwBwvpUb/YQfKRaFlStn1r2F4LDcu6ubKlBX5Gg
t2t+3RlwUMc8TLff8KcqoaFbmjLWQAvmai9gqSW8GQN6NZIpGzzx/UI=
=lYQz
-----END PGP SIGNATURE-----
pgpW07J9nXbQz.pgp
Description: PGP signature
--- End Message ---
