Your message dated Sat, 24 Oct 2026 19:15:49 +0200
with message-id
<CAAajCMbv+0ZP-mRXOVcsx8z_M0wM2WmrdRGpXGvo=_+CFmCV=a...@mail.gmail.com>
and subject line Re: navit: CVE-2022-30045 incorrect memory handling in ezml
support leading to a heap out-of-bounds read
has caused the Debian Bug report #1014390,
regarding navit: CVE-2022-30045 incorrect memory handling in ezml support
leading to a heap out-of-bounds read
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1014390: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1014390
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: navit
Version: 0.5.0+dfsg.1-2
Severity: important
Tags: security
X-Debbugs-Cc: [email protected], Debian Security Team
<[email protected]>
Hi,
The following vulnerability was published for navit.
CVE-2022-30045[0]:
| An issue was discovered in libezxml.a in ezXML 0.8.6. The function
| ezxml_decode() performs incorrect memory handling while parsing
| crafted XML files, leading to a heap out-of-bounds read.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-30045
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30045
Please adjust the affected versions in the BTS as needed.
-- System Information:
Debian Release: bookworm/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 5.17.0-2-amd64 (SMP w/6 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8),
LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
--- End Message ---
--- Begin Message ---
navit doesn't use ezxml even though there is source code for it.
This line is in the build logs at least as far back as
0.5.0~svn4423+dfsg.1-1 in 2011:
Disabled ezxml ( native Glib found )
Thank you,
Jeremy Bícha
--- End Message ---
