Your message dated Sat, 12 Sep 2026 08:05:40 +0000
with message-id <[email protected]>
and subject line Released in 13.7
has caused the Debian Bug report #1146131,
regarding trixie-pu: package binwalk/2.4.3+dfsg1-2+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146131: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146131
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:binwalk
User: [email protected]
Usertags: pu
Dear Release Managers,
I would like to close this bug regarding trixie through p-u:
https://bugs.debian.org/1136010
[ Reason ]
This fixes CVE-2026-7179 for trixie.
[ Impact ]
A path traversal vulnerability exists in binwalk up to 2.4.3 which can
be escalated to remote code execution. The attack can only be performed
from a local environment.
In Debian we are currently stuck to upstream version 2.4.3 for upstream
switched from Python to Rust with version 3.x.x requiring whole new
packaging at Debian's end.
[ Tests ]
I tested the code from the patch manually in a python console to verify
it does what it is supposed to.
I ran the autopkgtests locally with success.
[ Risks ]
I consider the risks nil as the patch is the same applied in unstable,
plus unstable and stable base on the same upstream version.
[ Checklist ]
[*] *all* changes are documented in the d/changelog
[*] I reviewed all changes and I approve them
[*] attach debdiff against the package in (old)stable
[*] the issue is verified as fixed in unstable
--
GPG Fingerprint
3DF5 E8AA 43FC 9FDF D086 F195 ADF5 0EDA F8AD D585
diff -Nru binwalk-2.4.3+dfsg1/debian/changelog binwalk-2.4.3+dfsg1/debian/changelog
--- binwalk-2.4.3+dfsg1/debian/changelog 2025-03-14 21:25:15.000000000 +0100
+++ binwalk-2.4.3+dfsg1/debian/changelog 2026-08-26 19:06:33.000000000 +0200
@@ -1,3 +1,11 @@
+binwalk (2.4.3+dfsg1-2+deb13u1) trixie; urgency=medium
+
+ * Team upload.
+ * d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179;
+ thanks to Fukui Daichi for providing the patch (Closes: #1136010).
+
+ -- Sven Geuer <[email protected]> Wed, 26 Aug 2026 19:06:33 +0200
+
binwalk (2.4.3+dfsg1-2) unstable; urgency=medium
* Team upload.
diff -Nru binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch
--- binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch 1970-01-01 01:00:00.000000000 +0100
+++ binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch 2026-08-26 19:06:33.000000000 +0200
@@ -0,0 +1,57 @@
+Description: Prevent path traversal in WinCE extraction plugin
+ The WinCE extraction plugin trusted filenames supplied by the input
+ image and used them directly to construct output paths. A crafted
+ WinCE image could therefore cause files to be written outside the
+ extraction directory.
+ .
+ Resolve the extraction paths and ensure they remain below the
+ extraction directory before writing files.
+ .
+ CVE-2026-7179
+Bug-Debian: https://bugs.debian.org/1136010
+Forwarded: not-needed
+Author: Fukui Daichi <[email protected]>
+Reviewed-by: Sven Geuer <[email protected]>
+Last-Update: 2026-08-26
+--- a/src/binwalk/plugins/winceextract.py
++++ b/src/binwalk/plugins/winceextract.py
+@@ -1,4 +1,5 @@
+ import binwalk.core.plugin
++from binwalk.core.common import warning
+ import re
+ import os
+
+@@ -41,6 +42,16 @@
+ if match is not None:
+ self.image_start = result.offset
+
++ def _safe_output_path(self, indir, filename):
++ indir = os.path.realpath(indir)
++ output_path = os.path.realpath(os.path.join(indir, filename))
++
++ if os.path.commonpath([indir, output_path]) != indir:
++ warning("Path traversal blocked: %s" % filename)
++ return None
++
++ return output_path
++
+ def extractor(self, fname):
+ """
+ Called when a file matches the extraction criteria set by the init method.
+@@ -58,8 +69,14 @@
+ with open(infile, 'r+b') as f:
+ with WinCEExtractor(f, 0) as extractor:
+ for module in extractor.modules:
+- with open(os.path.join(indir, module.file_name), 'w+b') as module_file:
++ output_path = self._safe_output_path(indir, module.file_name)
++ if output_path is None:
++ continue
++ with open(output_path, 'w+b') as module_file:
+ module.write_to(module_file)
+ for file_e in extractor.files:
+- with open(os.path.join(indir, file_e.file_name), 'w+b') as file_file:
++ output_path = self._safe_output_path(indir, file_e.file_name)
++ if output_path is None:
++ continue
++ with open(output_path, 'w+b') as file_file:
+ file_e.write_to(file_file)
diff -Nru binwalk-2.4.3+dfsg1/debian/patches/series binwalk-2.4.3+dfsg1/debian/patches/series
--- binwalk-2.4.3+dfsg1/debian/patches/series 1970-01-01 01:00:00.000000000 +0100
+++ binwalk-2.4.3+dfsg1/debian/patches/series 2026-08-26 19:06:33.000000000 +0200
@@ -0,0 +1 @@
+prevent-path-traversal-in-wince.patch
signature.asc
Description: This is a digitally signed message part
--- End Message ---
--- Begin Message ---
Version: 13.7
This update was released as part of 13.7.
--- End Message ---
