Source: m17n-lib Version: 1.8.6-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for m17n-lib. CVE-2026-107167[0]: | A flaw was found in m17n-lib. A user providing specially crafted | text input can trigger a heap use-after-free condition during input- | method state transitions. Under specific conditions, the library | frees an internal input context object but subsequently attempts to | write to that freed memory. This issue can cause applications | relying on the library to crash, leading to a Denial of Service | (DoS), or potentially allow arbitrary code execution. CVE-2026-107168[1]: | A flaw was found in m17n-lib. By providing crafted input containing | an invalid UTF-8 character sequence, an attacker can cause the text | parsing function to enter an infinite loop. This issue leads to | sustained high CPU utilization, resulting in a Denial of Service | (DoS) for the affected application. CVE-2026-107169[2]: | A flaw was found in m17n-lib. An attacker could provide specially | crafted or truncated UTF-8 input to trigger an unhandled null | pointer dereference during text processing. This issue causes the | application to crash unexpectedly, resulting in a Denial of Service | (DoS). CVE-2026-107170[3]: | A flaw was found in m17n-lib. A partial failure during library | initialization can leave an internal driver pointer uninitialized. | Under specific error conditions, such as system resource exhaustion | or database corruption, an application attempting to open an input | method dereferences this null pointer without proper validation. | This issue causes the application to crash, resulting in a Denial of | Service (DoS). If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-107167 https://www.cve.org/CVERecord?id=CVE-2026-107167 [1] https://security-tracker.debian.org/tracker/CVE-2026-107168 https://www.cve.org/CVERecord?id=CVE-2026-107168 [2] https://security-tracker.debian.org/tracker/CVE-2026-107169 https://www.cve.org/CVERecord?id=CVE-2026-107169 [3] https://security-tracker.debian.org/tracker/CVE-2026-107170 https://www.cve.org/CVERecord?id=CVE-2026-107170 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
