Your message dated Fri, 09 Oct 2026 14:53:18 +0000
with message-id <[email protected]>
and subject line Bug#1149701: fixed in c-blosc2 3.3.5-1
has caused the Debian Bug report #1149701,
regarding c-blosc2: CVE-2026-103222
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149701: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149701
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: c-blosc2
Version: 2.23.1+ds-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: upstream security
Hi,
The following vulnerability was published for c-blosc2.
CVE-2026-103222[0]:
| A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This
| impacts the function blosclz_decompress of the file blosc/blosclz.c
| of the component blosclz Decompression. Executing a manipulation can
| lead to integer overflow. The attack may be launched remotely. A
| high complexity level is associated with this attack. The
| exploitability is said to be difficult. Upgrading to version 3.3.3
| will fix this issue. This patch is called
| fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component
| should be upgraded.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-103222
https://www.cve.org/CVERecord?id=CVE-2026-103222
[1]
https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: c-blosc2
Source-Version: 3.3.5-1
Done: Antonio Valentino <[email protected]>
We believe that the bug you reported is fixed in the latest version of
c-blosc2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Antonio Valentino <[email protected]> (supplier of updated c-blosc2
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 09 Oct 2026 06:22:05 +0000
Source: c-blosc2
Architecture: source
Version: 3.3.5-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Maintainers
<[email protected]>
Changed-By: Antonio Valentino <[email protected]>
Closes: 1149701
Changes:
c-blosc2 (3.3.5-1) unstable; urgency=medium
.
* Upload to unstable (Closes: #1149701).
Checksums-Sha1:
20380af6a6ee08ea348927a172c2c49335c35e94 3324 c-blosc2_3.3.5-1.dsc
7a767f90d09d822ca49ceff32e64eaaf038139dd 8796 c-blosc2_3.3.5-1.debian.tar.xz
57f26d40a512bfb4563bc71bbcbe9efd95479e63 9962 c-blosc2_3.3.5-1_source.buildinfo
Checksums-Sha256:
b5700d01938c2f7c7c6909e58e62fe8d99c4bafe3d439de9a61cb23d4e8ff34d 3324
c-blosc2_3.3.5-1.dsc
eb0af6380a26fae1f44850e25e2164f3986ee0a9fea8794fa582caf85228d619 8796
c-blosc2_3.3.5-1.debian.tar.xz
f9630016b954c3ba8807cb029f7aa3cb56db5300fa9c0ebd976676b163e0112a 9962
c-blosc2_3.3.5-1_source.buildinfo
Files:
6e6d97ce186ea54d2fac19066f821cd5 3324 libs optional c-blosc2_3.3.5-1.dsc
31fc0098a770873af8e2e6ce61c7792a 8796 libs optional
c-blosc2_3.3.5-1.debian.tar.xz
0a15a439604ecd21ca755408ff64e06b 9962 libs optional
c-blosc2_3.3.5-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJRBAEBCgA7FiEEO3DyCaX/1okDxHLF6/SKslePmBIFAmrI8cMdHGFudG9uaW8u
dmFsZW50aW5vQHRpc2NhbGkuaXQACgkQ6/SKslePmBJFbRAAlTeRnQtzxuOizGBS
DTlxgmH3j3PVfpR95NSwi7uUJI5Xggp/WxmBgLsbFX8rE7hTfZ2tbPvoWVfIxAUr
qfNueXD7j1KIBKKzHgbmRrf8iaXoVIx2CAkwaFnAhci8+MIhgeGAs+BHUTB5cLy0
SiQzXvKktLQOcjrMo8zsIhKomJaBWAF2Fux9w8xQNI3FJ1O1hQeYZLXjRENdM2oa
aIqZ6V7v+vxTH+tkGBZWRCrKJjZIXhibdCezxNfw5Ds4qqBNith6LeeEIt1+mzik
e+Ceiu9wiS6TNryO+h4nmGKhbPDodPPLa30NsL7KOUgVEEA11t94PE6YjmYhfY59
2O/mNO077fXmjPahKcyYKeU80Tc4WyUQuiX9P86Mkizhq60e/XKD6YNTMdVLS4dq
Bkok1bTYfF70kz22Ux99Q5b4yhINoBrAApkH9Z0uRRSNZo90D0iKTZFgJFvmu9il
DPcQqOzOGvQqOBo+Ut23Kbp2xPJQEqQcQ5zJsCzCNUpL4bNzHIDjG2Pz1J2SCzA2
Ki949hoeaMTj7yLyo0u2JGoFuErrkLB4ACvTwPzmx+lhihkElCYtYnL2i4F+f8qx
Oob5Fd+hM7PJrUyfzCBckNc6qLaclAkX8SFeKDYMDtQCM2rOfNvpmHVPa1/5zfF5
hpz1pNUjb/7DRjAGkSyPX/VApds=
=vd5p
-----END PGP SIGNATURE-----
pgpFV6muKCXoj.pgp
Description: PGP signature
--- End Message ---
