-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 07 Nov 2025 21:10:39 +0100
Source: lasso
Architecture: source
Version: 2.8.2-9+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Frederic Peters <fpeters@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Changes:
lasso (2.8.2-9+deb13u1) trixie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* tests: test that inserted comment do not change node value and still
validate signature
* xml: prevent assignment of attribute value inside any attribute
(CVE-2025-47151)
* misc: check xmlSecGetNodeNsHref for possible NULL result (CVE-2025-46404)
* xml: do not terminate on an unknown XML node type (CVE-2025-46705)
Checksums-Sha1:
5dfd88399aa49fd8f9287860426229cffa02aa51 2354 lasso_2.8.2-9+deb13u1.dsc
a7744a8e61c3e8c0c197cbaf6ed9d8e239788eeb 4023587 lasso_2.8.2.orig.tar.gz
0d42bd174642c3ed263e4bb50d396425dc3f482d 33192 lasso_2.8.2-9+deb13u1.debian.tar.xz
759dac6d4eff136b1ca35b62eaf295a9023469ab 7074 lasso_2.8.2-9+deb13u1_source.buildinfo
Checksums-Sha256:
507965befd9935102f633bd4d98b888c34ebfa48a7d707d0fd87cd8c8a036d79 2354 lasso_2.8.2-9+deb13u1.dsc
6a1831bfdbf8f424c7508aba47b045d51341ec0fde9122f38b0b86b096ef533e 4023587 lasso_2.8.2.orig.tar.gz
852985305a4ad075d1f5218d2e0f572959ce0560683f4e21c24a71003c3948e0 33192 lasso_2.8.2-9+deb13u1.debian.tar.xz
c930ccbb0f69d4f82afaaddc1961153f03f2c4e1dc95291178c7f46c95214e87 7074 lasso_2.8.2-9+deb13u1_source.buildinfo
Files:
4d6b118505419e638ee4537253055fbd 2354 libs optional lasso_2.8.2-9+deb13u1.dsc
ad2e167973cc1c21cd16329bfbcd3d16 4023587 libs optional lasso_2.8.2.orig.tar.gz
bd936dafe6a67bfe42e52efdf8a6dae2 33192 libs optional lasso_2.8.2-9+deb13u1.debian.tar.xz
df50d4d2f17d88e6b977d85da021ae07 7074 libs optional lasso_2.8.2-9+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmkSRqVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89EUNgP/2bJggxseYN/iYPsZZfew6GU3BFEpu2J
Mv5gai7HJgDB4GerxxXCERjWeA6SO0oifX5aeInGlSt+rRvmDep00zDr24oh5zR6
qerpiHI/G94ksy3U/qor4tKt9qA0Ed5S7oo+467r7mm6fzaWG7xa26qLzVzFyOLI
WqrnwvCVZovcJIV3EfjOChOT0LaNktCzPiJaZMr61ih5zOK39qfrAHxuuDgvf3K6
cEbnLyECI8RNcGxswtcE1hHyLfqtRB/3607TiBG7x92HItPYOE8OPSF/gvGiJncL
KrWF7NcAdytfzeb4BLKtfn5VY9ow3D/VaO0pKpACm3fOLfM44tDGOKiOjdNM1lOD
HeAkdqY6TlJamcmAPRGmd8IjtU/wMbQZEkbQNhfaPljBaA3lGVh2GOwsXhuD+bup
FA4Luim/ZwVsDrDJ6du6nYroR+hs/znT0ovsGg+S/d7lfsGROXWRNHSXQ+34C7GU
DA90xRH9GtSO9gP/ysTjLSr3Bf9QwFx1uNojVbVIkMoXtFrgBE7r3cjsaT9Gm2RS
EjAjBFHfkJKbSUB9YEY9dYF0UO6aJUVq0J1C1asQQeJuABrTUcY/D5Ay4LPhFfNl
2alIoPmeIa9MbC5QvYaiIu2yy6dGNkMtnI8du6Q6HmFKGatgzBneZr/Nrya5Y6zb
r6RUllC98v27
=etKz
-----END PGP SIGNATURE-----
