-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 08 Aug 2026 11:20:57 +0200 Source: libyaml-syck-perl Architecture: source Version: 1.34-2+deb13u3 Distribution: trixie-security Urgency: high Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1142267 Changes: libyaml-syck-perl (1.34-2+deb13u3) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * fix: prevent buffer underflow in base60 (sexagesimal) parsing (CVE-2026-5089) * rebase: apply review feedback * fix: prevent memory leaks when Load/LoadJSON croak on parse errors * Fix four libsyck memory-safety CVEs reachable from YAML::Syck::Load() (CVE-2026-57075, CVE-2026-57076, CVE-2026-57077, CVE-2026-13713) (Closes: #1142267) Checksums-Sha1: e5d2a528afbc86133836b622c372c2371693b7d7 2352 libyaml-syck-perl_1.34-2+deb13u3.dsc e3064e78a7d530ff6bc14dbeaa01fd68de843657 18808 libyaml-syck-perl_1.34-2+deb13u3.debian.tar.xz Checksums-Sha256: 1cbbc5a030d507c2ae809a334e10a872f5cafd1bcd961ab8eb420534678c8ad2 2352 libyaml-syck-perl_1.34-2+deb13u3.dsc 7d665301076b26ab406b560a4bb88d27be3141454a130512297b18417c0c1aa1 18808 libyaml-syck-perl_1.34-2+deb13u3.debian.tar.xz Files: fdef0b5b3e5b15702ecb4c72ba762a31 2352 perl optional libyaml-syck-perl_1.34-2+deb13u3.dsc b0ff053c8aa9d0b7c9301a190ba594b5 18808 perl optional libyaml-syck-perl_1.34-2+deb13u3.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmp3Ti5fFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E48AP/3QuIeJR46KJqpoej17DXe+pCj1XrHJ3 bZAMsGeqtaqnrO1xLr/lxJtdm4Q6d8vaViQOZRTjlKGx1uvpEUTNF/ifLVj1hbX5 XCD4SMtKUEAd3F5QMHltk+4KK9nsv4LJNxy6/WxsIZgHF2SZ3iBhGdmRMJLnYnDu JyEWEhV9TLyvqfwNseilfSDLNdZERD1pff9BMK83CaPADm5DWtTXvWPr7KNXP4Hx zuALWJNiV6dWJFVUotW4zCwqiGAZN29PzLAmPX4hS979UxjjWVgUbrI0ENCc1IQT zbQlM2dhKQTrTS3WqNGCNNQMTphbUyVE7QBtpPwmRkifMSFGf8ltNPrdQgWwoJEv fwjnB7EflbVCOWXgYNKbl+4/w4brIm8CgWgPi/zh5cgwpJaBFNd6qQOvrtKiBkA3 Nk/3IyiombnjMmfqcZ8Lsz6jrPKoZwo07co8+Wfic2IZ7jkiAwXkJ50BqVFAISsC 7mlx8qtQbUgZBiWlJx4JzCDveD8TIayPHJN1LdcKHNF332wSwB+ziEfHahM8+5cH In6bD9frDcG3Evys64gi0U0i8C5++uKZ2IBeagewkylW8UC31ox9IGOJxgKpST66 CJOVUXWp38HtjBylHOKZzPWK4qNzCN8el41FJOHCaUy2jdY7e+Cz59sLDDKPfp++ fHcKkD5ihPSZ =nOzS -----END PGP SIGNATURE-----
