Your message dated Tue, 15 Sep 2026 11:35:39 +0000
with message-id <[email protected]>
and subject line Bug#1145374: fixed in icinga-php-thirdparty 1.0.1-1
has caused the Debian Bug report #1145374,
regarding icinga-php-thirdparty: please update bundled dompdf (CVE-2026-56722,
CVE-2026-55554)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145374: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145374
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: icinga-php-thirdparty
Version: 1.0.0-1
Severity: important
Tags: security
X-Debbugs-Cc: [email protected], [email protected]
icinga-php-thirdparty vendors dompdf 3.1.5 at:
vendor/dompdf/dompdf/
This version is affected by two vulnerabilities fixed in dompdf 3.1.6:
CVE-2026-56722: local file read via SVG images embedded as data-URIs
(path validation bypass)
CVE-2026-55554: chroot validation bypass via path traversal
Please update the bundled dompdf to 3.1.6 or later.
The bundled version was confirmed by reading:
vendor/dompdf/dompdf/version (contains: 3.1.5)
Found by: Attack of the Clones GSoC 2026 pipeline
(salsa.debian.org/rouca/gsoc2026)
Gajendra
--- End Message ---
--- Begin Message ---
Source: icinga-php-thirdparty
Source-Version: 1.0.1-1
Done: Bas Couwenberg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
icinga-php-thirdparty, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Bas Couwenberg <[email protected]> (supplier of updated icinga-php-thirdparty
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 15 Sep 2026 04:12:03 -0700
Source: icinga-php-thirdparty
Architecture: source
Version: 1.0.1-1
Distribution: unstable
Urgency: high
Maintainer: Debian Nagios Maintainer Group
<[email protected]>
Changed-By: Bas Couwenberg <[email protected]>
Closes: 1145374
Changes:
icinga-php-thirdparty (1.0.1-1) unstable; urgency=high
.
* New upstream release.
(closes: #1145374)
* Remove more documentation outside usr/share/doc.
Checksums-Sha1:
e19dcc26cdd08a684d0eae652ef00e0f33e26433 2053 icinga-php-thirdparty_1.0.1-1.dsc
37fee826f07ee3c14ee85c05d06d7215ff67736b 11518900
icinga-php-thirdparty_1.0.1.orig.tar.gz
022fc7890fe7a6dbc23941ee3dcdbcc81086eafa 8912
icinga-php-thirdparty_1.0.1-1.debian.tar.xz
8adc3ef7bc7bc6fc1fe9480b0e9152f0bf2b7a19 7398
icinga-php-thirdparty_1.0.1-1_amd64.buildinfo
Checksums-Sha256:
7989441943b25d4a3c68711e59588e96ba2bd6ca2b3ebab745604211bb0c1415 2053
icinga-php-thirdparty_1.0.1-1.dsc
23a8a04e5d07bf2ebca7b1d7fec7811e332a8f25d2791eeedf267cd902db7121 11518900
icinga-php-thirdparty_1.0.1.orig.tar.gz
a9a51db302093707d12b51705e4e6ccd84dc65192fc9b938cfcd356e2b9a2df4 8912
icinga-php-thirdparty_1.0.1-1.debian.tar.xz
40da48e828913069c178880171d48105c1aff2aee378e05681d28d778b5c0373 7398
icinga-php-thirdparty_1.0.1-1_amd64.buildinfo
Files:
1559e7157fef69921472bbf4e0e2cede 2053 admin optional
icinga-php-thirdparty_1.0.1-1.dsc
80119ea5f540fc173a3d9c7fcb8e929a 11518900 admin optional
icinga-php-thirdparty_1.0.1.orig.tar.gz
e239e85356e706a9ac49400183a8dbfb 8912 admin optional
icinga-php-thirdparty_1.0.1-1.debian.tar.xz
770a625fa08e59d5cab3e7c0dacfa229 7398 admin optional
icinga-php-thirdparty_1.0.1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEgYLeQXBWQI1hRlDRZ1DxCuiNSvEFAmqpKVEACgkQZ1DxCuiN
SvHxxw//QLUHKAONTvyKwCJk9TC+jGuK0k7tOhQ8oUpSqvDo81SDxil2pUYq7aK1
KBmUN2voS8M6vqIxestYYrzPPlU+ijM2eAlCWhWSMUbSo2w4LJsTfiDnf3s+Nmxp
VVNg3KT6PPMBWit7ohAP9JU5lwhVoLXH4W1bjJMKqUGRPyHeb7EH9TrFrCsstjH0
+aflt3WipUM5YyKWbD64R8WOT3iD50ih9Rx4OqnUcXdCRPbRe7041rlZPB+2Hhga
1Uqez0sDkcAIwPAXJeu514bU+6ieljDeMQZU1a3y9O+dCMWzTF6CIR3sEIYyFnKo
DgO+9YhZvG9KW/nCqJQvrlLaDxls87NfJ8GNbOdoBVJH3ZHij1Mdv+egVO4ZJ9Hm
0waodPb10scKOVrMSr3lvGzTncuJ8T8bqxmRW2t1DS00nFVQj/8gwVjUOtiyu/xx
qi2XafqARW+k7zd1lXmDbR+tMZkrua3s1oAgaceVYii3Zs72/g3AbCoMXwV9rSy3
vBIucFPXCCo7uL1OrPcHW98pqFwHmE8QXk4H2qtdHloJ7XRLf61B4rQmRBAMKGCC
7a2h+EiJ8GXdsDxsuw7ZYNAJSFQmnCp0TI87bzVFHSWih1V7YxhNiGcD47sSDB/Q
kvsYr8yCBAAaqEXylzv2gx7JwWANWQtQ0uba4O5ELi5cbWxN1OQ=
=+BAO
-----END PGP SIGNATURE-----
pgpN95mGhwU9x.pgp
Description: PGP signature
--- End Message ---
