Control: tags -1 + fixed-upstream patch Hi,
Both CVEs are fixed upstream, and the fixes are backported to the popt-1.19.x branch, which is prepared as 1.19.1 (PR #146, merged 2026-10-19). As of today there is no popt-1.19.1 tag or tarball, so I list the individual commits below. CVE-2026-18739 (off-by-one in poptStuffArgs): master: https://www.google.com/url?q=https://github.com/rpm-software-management/popt/commit/14c42b415b&source=gmail&ust=1793764846560000&sa=E (PR #138) 1.19.x: e2dc871d219b8e688bd181fc595996f86c1785cd CVE-2026-18839 (underflows/overflows in help output), PR #142: master: https://www.google.com/url?q=https://github.com/rpm-software-management/popt/commit/af6f19e596&source=gmail&ust=1793764846560000&sa=E 1.19.x: 31f1b81a1b1155746e5ac7caccc0bcaf9af171b7 "Bring in our own allocating printf() variants" f9771bcd15073c2835cbe06a5d65bcbf612675d8 "Fix a bucketful of buffer overflows in popt --help printing" (f9771bc depends on 31f1b81) There is also a fix for CVE-2026-18743, which the tracker marks unimportant: d99846e83eaa034db540f6f96d5d96508e0b5030. Verification: I cherry-picked e2dc871, 31f1b81 and f9771bc onto the popt-1.19-release tag (the base of 1.19+dfsg) and all three apply cleanly (13 files changed, 274 insertions, 43 deletions). I built the library and tests with -fsanitize=address,undefined. I compiled them directly against a hand-written config.h because autotools isn't installed on this machine, and ran tests/testit.sh with ASAN_OPTIONS=detect_leaks=0. The leaks reported in test1 are in the test programs themselves and are fixed by f25322d and b5351bb on the same branch. - Unpatched 1.19: 65/65 pass. - 1.19 + the three backports: 70/70 pass, no sanitizer reports. This includes the new tstuff and test4-1..4 regression tests. - I also built the new regression tests against the unpatched 1.19 library: tstuff (CVE-2026-18739): UBSan "member access within misaligned address", i.e. the poptContext is corrupted test4-1 --help: AddressSanitizer negative-size-param test4-2 --help: AddressSanitizer requested allocation size too large test4-3 --help: AddressSanitizer global-buffer-overflow All of these are clean with the backports. So either cherry-pick those commits into debian/patches or package 1.19.1 once it is tagged. Thanks!
