On Fri, 30 Oct 2026, Agustin Martin wrote:
Control: tags -1 + pending
El jue, 29 oct 2026 a las 22:47, Kevin Atkinson (<[email protected]>) escribió:
I just wanted to let you know that GNU Aspell 0.60.8.3 is now released. It
looks like I released it just after you manually patched the vulnerabilities.
Sorry about the timing. This release fixed a number of other memory problems
beyond ones that a CVE were issued for. It also included a more correct fix
for CVE-2026-103658.
HI, Kevin,
Thanks for the reminder. I will wait until current package in sid
reaches testing. It contains exactly the differences (vulnerability
fixes) I want to propose for stable-upates, and I want to have that
minimal set of changes tested outside my box before uploading new
aspell version. I expect to have a Debian package with new aspell
version prepared and uploaded around beginning of next week.
I would prefer if you just update stable to 0.60.8.3. The changes between
0.60.8.0, .1, .2, and .3, were kept very minimal (I even used the exact same
verson of autotools). No new features were added, and the bug fixes beyond
security are very minimal and won't break anything.
Also even though the commits that mentioned the CVE did in fact fix them,
please note the following:
0b52f16f997958a7d973cbda15f106114a2b3749 is a followup fix for CVE-2026-103658.
I belive the exact fix might still lead to a crash.
The fix for CVE-2026-75819 left open a similar vulnability,
7f9bda27d68b34c2abfbf82ad7bdbab45c1fb903 fixes that.
Also, the memory issues I mentioned are likely just as serious as the three
CVE with low severity. It is just that no CVE were created.
Thank you,
Kevin
