Source: raptor2 Version: 2.0.16-7 Severity: important Tags: security upstream
Hi, The following vulnerability was published for raptor2 and is still listed as unfixed for sid in the security tracker, with no Debian bug yet: CVE-2025-71436[0]: Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow. Callers pass the string length rather than the buffer size (length + 1, including the NUL terminator) to raptor_stringbuffer_copy_to_string(), so the terminating NUL is written one byte past the allocation. Upstream issue: https://www.google.com/url?q=https://github.com/dajobe/raptor/issues/83&source=gmail&ust=1793764102338000&sa=E Upstream fix: https://www.google.com/url?q=https://github.com/dajobe/raptor/commit/361a803a72817ae771db2438277229e6541e1575&source=gmail&ust=1793764102338000&sa=E The fix changes the callers in src/raptor_parse.c and src/raptor_grddl.c to pass buffer_len + 1 / len + 1, tightens the bounds check in raptor_stringbuffer_copy_to_string() (src/raptor_stringbuffer.c), and fixes two related issues in src/raptor_ntriples.c (signed char passed to isxdigit(), wrong pointer in an error message). I checked the 2.0.16-7 source on https://www.google.com/url?q=http://sources.debian.org&source=gmail&ust=1793764102338000&sa=E: src/raptor_parse.c line 1644 still calls raptor_stringbuffer_copy_to_string(rdf_parser->sb, buffer, len), and none of the patches in debian/patches touch this code (the existing patches cover GitHub issue #70 / CVE-2024-57822 and CVE-2024-57823, fixed in #1067896). If you fix the bug, please make sure to include the CVE identifier in your changelog entry. [0] https://www.google.com/url?q=https://security-tracker.debian.org/tracker/CVE-2025-71436&source=gmail&ust=1793764102338000&sa=E https://www.google.com/url?q=https://www.cve.org/CVERecord?id%3DCVE-2025-71436&source=gmail&ust=1793764102338000&sa=E Thanks!
