Hi Boyuan, On Fri, Jan 23, 2026 at 02:34:04PM -0500, Boyuan Yang wrote: > Control: fixed -1 1.1.9+ds1-4 > > 在 2026/1/23 11:51, Salvatore Bonaccorso 写道: > > Source: opencc > > Version: 1.1.9+ds1-1 > > Severity: important > > Tags: security upstream > > Forwarded: https://github.com/BYVoid/OpenCC/issues/997 > > X-Debbugs-Cc: [email protected], Debian Security Team > > <[email protected]> > > > > Hi, > > > > The following vulnerability was published for opencc. > > > > CVE-2025-15536[0]: > > | A weakness has been identified in BYVoid OpenCC up to 1.1.9. This > > | vulnerability affects the function opencc::MaxMatchSegmentation of > > | the file src/MaxMatchSegmentation.cpp. This manipulation causes > > | heap-based buffer overflow. The attack is restricted to local > > | execution. The exploit has been made available to the public and > > | could be used for attacks. Patch name: > > | 345c9a50ab07018f1b4439776bad78a0d40778ec. To fix this issue, it is > > | recommended to deploy a patch. > > > > > > If you fix the vulnerability please also make sure to include the > > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > > > For further information see: > > > > [0] https://security-tracker.debian.org/tracker/CVE-2025-15536 > > https://www.cve.org/CVERecord?id=CVE-2025-15536 > > [1] https://github.com/BYVoid/OpenCC/issues/997 > > [2] https://github.com/BYVoid/OpenCC/pull/1005 > > [3] > > https://github.com/BYVoid/OpenCC/commit/345c9a50ab07018f1b4439776bad78a0d40778ec > > The targeted fix was accidentally cherry-picked in the 1.1.9+ds1-4 upload. > Updating the affecting version accordingly.
Thanks, I have updated the security-tracker metadata accordingly. > The fix in stable/oldstable may need to be handled separately later. Perfect. As it won't warrant a DSA, can you please schedule fixes via the upcoming point releases once you had time to look in backporting fixes accordingly? Regards, Salvatore
