Your message dated Tue, 20 Oct 2026 18:36:25 +0000
with message-id <[email protected]>
and subject line Bug#1151083: fixed in libmspack 0.11-2
has caused the Debian Bug report #1151083,
regarding libmspack: CVE-2026-110602
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151083: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151083
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libmspack
X-Debbugs-CC: [email protected]
Severity: important
Tags: security
Hi,
The following vulnerability was published for libmspack.
CVE-2026-110602[0]:
| libmspack through 0.11alpha contains an uninitialized pointer free
| vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed
| filename and extra pointers on header read errors. Attackers can
| supply a truncated, empty, or wrong-signature KWAJ file to crash the
| process or obtain an arbitrary-free memory corruption primitive.
https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-110602
https://www.cve.org/CVERecord?id=CVE-2026-110602
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: libmspack
Source-Version: 0.11-2
Done: Marc Dequènes (Duck) <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libmspack, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Marc Dequènes (Duck) <[email protected]> (supplier of updated libmspack package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 21 Oct 2026 03:16:20 +0900
Source: libmspack
Architecture: source
Version: 0.11-2
Distribution: unstable
Urgency: medium
Maintainer: Marc Dequènes (Duck) <[email protected]>
Changed-By: Marc Dequènes (Duck) <[email protected]>
Closes: 1151083
Changes:
libmspack (0.11-2) unstable; urgency=medium
.
* Apply patch to fix security issue CVE-2026-110602 (Closes:
#1151083).
* Bump Standards-Version to 4.7.4 (no changes).
* Switch watch file to version 5.
* Switch to Debhelper compat 14.
Checksums-Sha1:
9de6e841fb2fa7aba736076d8199a07e11b5f191 2029 libmspack_0.11-2.dsc
a3712a07d2ca80c9f325494cd8a52d7c471d14e6 4864 libmspack_0.11-2.debian.tar.xz
eb12abb6a0d35999b9d1116d7f17de06debaef69 8448 libmspack_0.11-2_amd64.buildinfo
Checksums-Sha256:
d373e94b9b7940b2510a4d84b176c6c7ecef89f65e50038cc9b4bfdf2458b377 2029
libmspack_0.11-2.dsc
e0e952ec9d14c32d3ccca0b2eb941c66ec46cacf43d1822360fd273cd9016fb3 4864
libmspack_0.11-2.debian.tar.xz
417b7699616f7a3fc6c4ec7467c0c58d24d4d605c5298adf03ed8769c81bf93c 8448
libmspack_0.11-2_amd64.buildinfo
Files:
563339e721c78a45dbc09f04f56cc013 2029 libs optional libmspack_0.11-2.dsc
b31fd4e64cc53537dedd73cf4143d78d 4864 libs optional
libmspack_0.11-2.debian.tar.xz
70e2b2f0385ff28b0ef49c9b755068a6 8448 libs optional
libmspack_0.11-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEcpcqg+UmRT3yiF+BVen596wcRD8FAmrXsf0ACgkQVen596wc
RD84hw//cGcoiMedSCh7suC+64c2Gu6gBBopuwSFW2VOv/ko5weTgYEMWnTK1nTw
eFcyJaMf2uar0Wy5C9V+osxMR0/iIdxeH0uWOxByUdL7QY4P4MJvAZwhB0yHkJzs
upHZZauM2NseF+MsVU/2rvdBkcwkO9EfSyqTAMR1bpag6ywchZBZfYnATmtqxR7P
52FZQQkdW8f4jsqKnf9B0EOSP+ZNR//RRovox+zAimhycVtse85Eba2egl5VTqNt
f7HqFLB08/g2kil/QKPsY6LCDTxU359A/xQ6N6Gjykj4/9/Ciz8HP7TNvY0eTonk
kidbkpq15iEzcEDK4zXqHgYbumHK8jpdvVOt5vDWiqK/aSXLzx0N31katLcGkCSf
3scN+9zslH29sSp/T10Eh+4iUpGcXy3TfJCa+AYN6ZgMalt2nuBeL2plJQMoJJVr
X7mxvgVMcJEVFjoM0owsLi0cdtsvwvQN20rjNnWFTwfVdu1A5bJmE+4GedGucKbw
aFNmrfrE9+0Gla4BX0klW8kk0zNGCpRlmjS8DqV//yo7LxeI2iNPKzK35ew7IZPN
yo9hUhnqmc3qwk0m+3F5bqQLJ5eei/sKF7kb8R9kUztDVFVLPqyxzb3Rb6AmViSE
3MlvH3ZNasIg/ww5OwzaqIM/aPyOe4GguytJxyQjCsP3mctM5mc=
=ZSyK
-----END PGP SIGNATURE-----
pgpInLzwQMG3j.pgp
Description: PGP signature
--- End Message ---
