-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 17 Jul 2026 14:57:10 +0200 Source: libyaml-syck-perl Architecture: source Version: 1.47-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1142267 Changes: libyaml-syck-perl (1.47-1) unstable; urgency=medium . * Import upstream version 1.47. - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags: CVE-2026-57077 CVE-2026-57076 CVE-2026-57075 CVE-2026-13713 (Closes: #1142267) * Drop gcc15-fix.patch, fixed in 1.37 release. * Drop fix-address-all-4-C-layer-audit-findings-from-issue-.patch. Taken from upstream Git, fixed in 1.37. * Drop fix-prevent-buffer-underflow-in-base60-sexagesimal-p.patch. Taken from upstream Git, fixed in 1.45. * Declare compliance with Debian Policy 4.7.4. * Add debian/tests/pkg-perl/smoke-tests. Only run t/*.t during autopkgtests, as during build. Checksums-Sha1: a0552c550ac2ddfd0f8c9766b0c29b961c2c3aa8 2414 libyaml-syck-perl_1.47-1.dsc 7c421304c7b213127862c667a3f438c06fd712a8 270328 libyaml-syck-perl_1.47.orig.tar.gz db399c620a6936b260fd21395bd73f0c8f5619bd 7376 libyaml-syck-perl_1.47-1.debian.tar.xz Checksums-Sha256: cbf09b3fe6f9ab20436677ccb255231695ef38bea81be04187f426368cef0c53 2414 libyaml-syck-perl_1.47-1.dsc 672196ca1c021e3c68f4b5f7b4aec305ad471bbbf448c53c7e40034d6ebb7e1d 270328 libyaml-syck-perl_1.47.orig.tar.gz dd47e6d2895009db7dad157154801602db32cb5814e07825ec9eb3b50f9c46f4 7376 libyaml-syck-perl_1.47-1.debian.tar.xz Files: 02b160cb2c4a239e686d1329e1272884 2414 perl optional libyaml-syck-perl_1.47-1.dsc c9202ef678821a1e723defed86353faf 270328 perl optional libyaml-syck-perl_1.47.orig.tar.gz edb3524a9b347cd683e0c7ac51a8328c 7376 perl optional libyaml-syck-perl_1.47-1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmpaJ39fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ qgbIUhAArjCtyT/GXQXx7jh1DrN7In/Oje1CagSS5KfcFt8ks9guSMIO9EhxKXg0 B38PNC5Xu3tiqe9hu3+2KynhehcwiWM+R5iKc6J5W4i5HmOEd7BoxDPO6vgv5Eof oWzpSft498C0sKZ0lWYQGFgfmxCaiTvv/ddNbiNOGhzSg9d8cUMIILyVHry4dcb+ oqkvRjufAUWLBpYPm9XZzV8yi7JHywUoUCl+c7APbEnwCuJcTncHGTWKzoEOauC8 UeTcV0kymTL6y/hqjHxJNY9nWdizuxn9mnz4A7AnsP8bkN7izizCTiwWp152410k 1ExxlSoHJIiiG/ibD3AwSiUB2SPVV01mXEpAh7hJQP7UEUTQmm/+i1034HMShk7B WfpMufJ5IqeozmD2cOBFuhdc/rO8iCqQaQ9cVaphZYiRstGwl6A4iUZX1otVfqD7 NWB59MaHwQeihO/7g4aOylhmYDMMmFETru9iUtEMT2EQU5Wu5WlldmhDvezsQX+a Plwjj2ZM+gMd8Kra52eFn2uQX2PFTAdpcVDHDeBiVYCh9bvXziF/+R3rbYSM8+hc 4agoud+4oUush52qTgLGcTMGT+tjXFJwyd1FauKxuCVbOnapJbu4Q7tYOPo6omDf i3bGJ4ZG2WEeAmX5/Fcd3P5DbQy6p165jIweXZkadPnjYX/HC3I= =YhBM -----END PGP SIGNATURE-----
