On Sun, Oct 11, 2026 at 08:23:15PM +0200, Salvatore Bonaccorso wrote: > Hi, > > On Sun, Oct 11, 2026 at 07:00:17PM +0200, Tobias Frost wrote: > > Short Update: > > > > the below poc stop crashing when applying the upstream fix for > > CVE-2026-85091 [1]. Additionally, there are many upstream marked as > > "fixed with df84af2", e.g. some of the issues in the table of > > [2], e.g upstram issues #1256, #1286, #1292, #1302, #1307 [3], > > so this fix caused a lot of issues. > > > > CVE-2026-85091 defined its scope to the non-blocking calls, however > > whether the non-non-blocking issues will have a dedicated CVE will > > depend on upstream view on this issue. > > Correct, we asked both upstream but so far with no answer on it. > > > For LTS/ELTS I will at this time go with CVE-2026-85091 when preparing > > the updates, but the first step will be to fix unstable. Upstream confirmed that CVE-2026-85091 applied also to older releases, back up to 1.2.3.5: https://github.com/madler/zlib/issues/1292#issuecomment-6456517984
> For unstable I already proposed a debdiff here in > https://bugs.debian.org/1146895#27 but after talking to Mark (Cc'ed) I > understand he prefers to upload a new upstream version instread. In > any case my debdiff would be still ready and is tested on > https://debusine.debian.net/debian/developers/work-request/1293184/ . > > If Mark is OTOH fine with it I can upload my NMU fixing the issue. > > Regards, > Salvatore >
