Package: sdpb
Version: 1.0-5
Severity: minor
Tags: security
X-Debbugs-Cc: [email protected]
sdpb vendors a copy of tinyxml2 at:
src/tinyxml2/tinyxml2.cpp
This copy predates commit a737ecb (May 2026) which fixes an integer
overflow in GetCharacterRef() that could allow heap corruption via
crafted XML input. The fix adds:
if (digitScaled > MAX_CODE_POINT || ucs > MAX_CODE_POINT - digitScaled)
return 0;
No CVE has been assigned yet. The fix is public at:
https://github.com/leethomason/tinyxml2/commit/a737ecb
Please update the bundled tinyxml2 to the latest upstream version.
Found by: Attack of the Clones GSoC 2026 pipeline
(salsa.debian.org/rouca/gsoc2026)
Gajendra
--
debian-science-maintainers mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-science-maintainers
