Control: tags -1 + patch Hi,
Attached is a debdiff for a 2.15+dfsg-2.2 NMU fixing all three CVEs. I have not uploaded anything; please use as much or as little of it as you like. Patches (upstream cpio commits, checked by full commit id): CVE-2026-66484 e2b9cbdd sanitize tar hard link targets with --no-absolute-filenames b19a03e4 follow-up: do not rewrite symbolic link targets (otherwise the CVE-2023-7207 regression comes back) CVE-2026-66485 3cd51403 replace the unbounded alloca() in make_path CVE-2026-66486 2ff9600c quote file names in listings and messages; adds --quoting-style and --quote-chars, which I documented in cpio(1) (separate small patch) tar-memory-safety e8931bed, b5c7d6e2, e5bb73f0: upstream tar-format memory safety fixes without CVE ids debian/rules also regenerates tests/testsuite instead of touching the prebuilt one; without that the patched and new tests are not actually run. Testing (sid chroot, amd64): - test suite: all 18 tests successful. - reproducer (crafted archives, run against the installed binaries): CVE-2026-66484, tar hard link with an absolute target and --no-absolute-filenames: 2.15+dfsg-2.1: creates a hard link to a file outside the extraction directory 2.15+dfsg-2.2: the leading "/" is stripped and the link is refused symlink with an absolute target: kept unchanged in both versions CVE-2026-66485, 10 MB nested path, ulimit -s 8192: 2.15+dfsg-2.1: SIGSEGV 2.15+dfsg-2.2: clean error, exit status 2 CVE-2026-66486, member name with OSC/CSI escape sequences, output on a pty: 2.15+dfsg-2.1: raw ESC bytes reach the terminal with -t, -tv and in the "not created" error message 2.15+dfsg-2.2: shown escaped (x\033]0;...) in all three cases Note the user-visible change from CVE-2026-66486: names containing control characters are now printed escaped in -t output and in messages, as upstream does. Regards, automationcanadian
cpio_2.15+dfsg-2.2.debdiff.gz
Description: application/gzip
