Your message dated Sat, 11 Jul 2026 10:42:31 +0000
with message-id <[email protected]>
and subject line Released in 12.15
has caused the Debian Bug report #1140383,
regarding bookworm-pu: package mxml/3.3.1-1+deb13u1~deb12u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1140383: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140383
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:mxml
User: [email protected]
Usertags: pu
* CVE-2026-5037: Out-of-bounds read in index_sort() (Closes: #1132328)
diffstat for mxml-3.3.1 mxml-3.3.1
changelog | 14 +++++
patches/0001-Fix-access-issue-in-mxmlIndexNew-Issue-350.patch | 25 ++++++++++
patches/series | 1
3 files changed, 40 insertions(+)
diff -Nru mxml-3.3.1/debian/changelog mxml-3.3.1/debian/changelog
--- mxml-3.3.1/debian/changelog 2022-07-29 11:04:42.000000000 +0300
+++ mxml-3.3.1/debian/changelog 2026-06-19 14:38:27.000000000 +0300
@@ -1,3 +1,17 @@
+mxml (3.3.1-1+deb13u1~deb12u1) bookworm; urgency=medium
+
+ * Non-maintainer upload.
+ * Rebuild for bookworm.
+
+ -- Adrian Bunk <[email protected]> Fri, 19 Jun 2026 14:38:27 +0300
+
+mxml (3.3.1-1+deb13u1) trixie; urgency=medium
+
+ * Non-maintainer upload.
+ * CVE-2026-5037: Out-of-bounds read in index_sort() (Closes: #1132328)
+
+ -- Adrian Bunk <[email protected]> Fri, 19 Jun 2026 14:17:53 +0300
+
mxml (3.3.1-1) unstable; urgency=medium
* New upstream release
diff -Nru
mxml-3.3.1/debian/patches/0001-Fix-access-issue-in-mxmlIndexNew-Issue-350.patch
mxml-3.3.1/debian/patches/0001-Fix-access-issue-in-mxmlIndexNew-Issue-350.patch
---
mxml-3.3.1/debian/patches/0001-Fix-access-issue-in-mxmlIndexNew-Issue-350.patch
1970-01-01 02:00:00.000000000 +0200
+++
mxml-3.3.1/debian/patches/0001-Fix-access-issue-in-mxmlIndexNew-Issue-350.patch
2026-06-19 14:17:18.000000000 +0300
@@ -0,0 +1,25 @@
+From dc646842629275cda0f77f3dd6a5b269ab007fa2 Mon Sep 17 00:00:00 2001
+From: Michael R Sweet <[email protected]>
+Date: Thu, 12 Mar 2026 20:28:25 -0400
+Subject: Fix access issue in mxmlIndexNew (Issue #350)
+
+---
+ mxml-index.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/mxml-index.c b/mxml-index.c
+index ca1ea7b..72836f9 100644
+--- a/mxml-index.c
++++ b/mxml-index.c
+@@ -644,7 +644,7 @@ index_sort(mxml_index_t *ind, /* I - Index to
sort */
+ * Recursively sort the left partition as needed...
+ */
+
+- if (left < (tempr - 1))
++ if (tempr > 0 && left < (tempr - 1))
+ index_sort(ind, left, tempr - 1);
+ }
+ while (right > (left = tempr + 1));
+--
+2.47.3
+
diff -Nru mxml-3.3.1/debian/patches/series mxml-3.3.1/debian/patches/series
--- mxml-3.3.1/debian/patches/series 2022-07-29 11:04:42.000000000 +0300
+++ mxml-3.3.1/debian/patches/series 2026-06-19 14:17:46.000000000 +0300
@@ -5,3 +5,4 @@
06_autoheader-fixes.patch
07_compile_fixes.patch
08_cross.patch
+0001-Fix-access-issue-in-mxmlIndexNew-Issue-350.patch
--- End Message ---
--- Begin Message ---
Version: 12.15
This update was released as part of 12.15.
--- End Message ---
