-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 05 Aug 2026 16:23:00 +0200 Source: libpf4j-java Architecture: source Version: 3.15.0+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org> Changed-By: Pierre Gruet <pgt@debian.org> Closes: 1132032 Changes: libpf4j-java (3.15.0+dfsg-1) unstable; urgency=medium . * New upstream version 3.15.0+dfsg: Fixes CVE-2025-70952: pf4j before 20c2f80 has a path traversal vulnerability in the extract() function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation. (Closes: #1132032) * Refreshing patches * Raising Standards version to 4.7.4 (no change) * Build-Depending on debhelper-compat 14, removing misc:Depends substvar * Updating d/copyright years * Using com.google.compile.testing Java classes, which are now packaged in Debian, for testing Checksums-Sha1: 2c2b5043d056ca53b188b99c26070f678e7f8e85 2406 libpf4j-java_3.15.0+dfsg-1.dsc bdc30eb87e096a661e9aee6a6e2d43a0fc365feb 119488 libpf4j-java_3.15.0+dfsg.orig.tar.xz 94d6bd8d82870f76638b9e0e65960ed029f8f424 8500 libpf4j-java_3.15.0+dfsg-1.debian.tar.xz a2b032f07ff9a97f5ce100c9cd840f9474eae2fd 18335 libpf4j-java_3.15.0+dfsg-1_source.buildinfo Checksums-Sha256: ffd9f752e91b05e3be702595aa54ed78018e47bf1ae8a0131abbeaeae698f890 2406 libpf4j-java_3.15.0+dfsg-1.dsc 36f1b069c767b336dfa908e68ac064808b18107dea7bf6e6f05abd3c92857548 119488 libpf4j-java_3.15.0+dfsg.orig.tar.xz de85924fe0f8eb4794f4e70af618b580cbb2695b34eb85a4df4e998b87ab1ecb 8500 libpf4j-java_3.15.0+dfsg-1.debian.tar.xz 7c4d5f40e2a4fdf9294fbf04268efd0ab711de3d3cab15e47b59167375470746 18335 libpf4j-java_3.15.0+dfsg-1_source.buildinfo Files: 2060819ca1e3c28f994b887544e70273 2406 java optional libpf4j-java_3.15.0+dfsg-1.dsc e34cc80da2b230dd18f3e1b38165d510 119488 java optional libpf4j-java_3.15.0+dfsg.orig.tar.xz c44a060f3cb68e611c493cba04e8d4b6 8500 java optional libpf4j-java_3.15.0+dfsg-1.debian.tar.xz 7c3e2a0e02c4fa8ac7ffd526587fb917 18335 java optional libpf4j-java_3.15.0+dfsg-1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEM8soQxPpC9J9y0UjYAMWptwndHYFAmpzR1oACgkQYAMWptwn dHZu3g/+OjxAZcx6UacUGf5q9EzocdYtZgO7Wm5pa3c508OqMd/JX7a345hDwprX ZeZrz7pYoZRKer6DGSXArRtW6QZQQ6hEj6dOnI/XSeWOSr8al72go9aTDYXUw6SY LlPEvYCKmi7B/1P3nlo7OWlUiBKnH9HqbmLMD64vf7Kyd3sewPBvaNDZ+Nk1m7RQ aVlkySCiD8MDe+Qz/dLiinbZuPbkjx8psRkgF1Jj2RLYvfHS1D2c8zPO6bpJWN7n 1qxo/sYU3OdY2d3RqthdQ+woCSUg3U32BOYVH2V2tKyijg3dzHYHfgFnnTCU+bVG 4xji6ydcWe5osU+dcRjuO3Bt029/0NOLb69AIbd4BdZB5jDDGEXY6g56yTbFIET2 2nPTnE1B7n3WsW1ozSIWgCjNfugVP4gVvkEWlRSMlB/MGLErckmhD4eSabtgLjxJ OpwOHj1CtXuCrHMi6XdFpz8aHGhWRUlGat7GX2VytlSKIHWJ/27bj3Ew2udyGCua NQaOHH9c5u1jz8s6zv3lcjSE8+M+Fw2f65gYg2Zg+kFw0cq/9YgnNWqbPfYoDDkW cZVPVCEPNwrA4d2WIFQj6kTHaGYOmHGc1rV3HQJ3knwOPoVToMp7Ff3Jj9UW83bO p32DDK//ybWOdayygn/sdTO2jX5gD9MQdD8mnR7TXsu1OnQvc9c= =1vb0 -----END PGP SIGNATURE-----
