Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:biber User: [email protected] Usertags: pu
[ Reason ] Fix a security issue described on https://www.openwall.com/lists/oss-security/2026/08/17/1 no CVE assigned. Patches cherry picked from upstream repository. All are triggered by opening/importing/exporting a maliciously crafted LyX document (network-deliverable: a zip, an email attachment, a shared folder). Unless noted, the result is arbitrary command execution with the user's privileges. [ Impact ] If the change is not approved the biber program, the user keeps impacted by the security issue. [ Tests ] Upstream provides a test suite, which is not impacted by the change. [ Checklist ] [X] *all* changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in (old)stable [X] the issue is verified as fixed in unstable [ Changes ] As described on the URL, the fix consists of the four patches. I've kept them separated to point to upstream commits.
biber_2.20-2+deb13u1.debdiff.xz
Description: application/xz
signature.asc
Description: PGP signature
