[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1112671: marked as done (trixie-pu: package libcommons-lang-java/2.6-10+deb13u1)

Your message dated Sat, 15 Nov 2025 11:21:45 +0000
with message-id <736c7150dc08501cc89945035c406eaf9688e144.camel@adam-barratt.org.uk>
and subject line Closing requests for updates included in 13.2
has caused the Debian Bug report #1112671,
regarding trixie-pu: package libcommons-lang-java/2.6-10+deb13u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1112671: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1112671
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libcommons-lang-java@packages.debian.org
Control: affects -1 + src:libcommons-lang-java
User: release.debian.org@packages.debian.org
Usertags: pu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

[ Reason ]

This upload attempts to fix CVE-2025-48924, an uncontrolled recursion
vulnerability that can lead to a StackOverflowError, for users of Debian
Trixie.

[ Impact ]

If the update is not approved, users might be affected by CVE-2025-48924.

[ Tests ]

The patch adds a new test to check if the fix is successful. I also did some
successful manual testing.

[ Risks ]

There is the risk of regression. But the patch is rather small and tested.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]

The patch uses (a backported) rewrite that avoids the recursion.

[ Other info ]

The issue has been fixed in LTS/ELTS as well.

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvu1N7VVEpMA+KD3HS80FZ8KW0F0FAmi0kXsACgkQS80FZ8KW
0F1DaQ/9FVYxFL9ywrgGjZhAMCCbpPYUMTCDfzz5M5TjexZ7Cu5HJUL/whWjASmt
/Bnf74++Ztz2X485ADmKm1rqqIhmn5aOTocARTR9zblC4jLEgpqrR6iS3ryGWlex
kKMP3clpdOskwJ42OHmt16He2/EQ6Xv7xO6XD0Qf7M4ezpm2/EeIKjzhxQGjpVdb
YG94nBlLTOfzPNbz3MEjglLXjLHE8IEvm6vfjadnP2XL+WxrbnFbvw1EsLi/uZE2
nYaOVD9wwlFTP6eIBrtVvr+ydAQ12EbwULBaopQ6Pb9iAsUkQY54rYvVfQzG14Ev
exBNbZIOWbjnMwuDb3MkknyDf9h3SEwNLGPyvPSLC/W+eK53JzSbShmLBSeDU4Yw
+XlPNGeWYOA+iLI1wprXAgrpCSNkZEOMWcBz3fEXsox5ptkKNWd/7JJ+3z1myzyz
AK5jxovlzOxHZBV7TO7WjRgCuckRxV/DjbWWNYQXB5xTTg/LJR9dXx1KpjY5Njir
VkNbTZlGA+nCgf20onwviJYZW29QKRPGIgDXAUtKMQI7gSWpYHZHI7uhl7fpgq7P
D3vXkIisFsfZ2CV7UXluE8ws+DKc6uq/If9mPjiHdP+2vCSpVsTXwpUsKuTG0caQ
7pEG7pmlX/wtMksP88K29254s/W0eA7S52DIAPTU2MLQj80f0fk=
=TIID
-----END PGP SIGNATURE-----

--- End Message ---
--- Begin Message --- 
Package: release.debian.org
Version: 13.2

Hi,

The updates referenced in each of these bugs were included in today's
13.2 trixie point release.

Regards,

Adam

--- End Message ---
Reply to: