-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 28 Sep 2026 00:11:24 +0200 Source: lxml Architecture: source Version: 4.9.2-1+deb12u1 Distribution: bookworm-security Urgency: high Maintainer: Matthias Klose <doko@debian.org> Changed-By: Guilhem Moulin <guilhem@debian.org> Changes: lxml (4.9.2-1+deb12u1) bookworm-security; urgency=high . * Non-maintainer upload by the LTS Team. * Fix CVE-2026-28348: CSS @import Filter Bypass via Unicode Escapes. * Fix CVE-2026-28350: <base> tag injection through default Cleaner configuration. * Fix CVE-2026-41066: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files. (LP: LP#1742885, #2146291) This update changes the default to resolve_entities='internal' (hence disallowing local file access by default). * Fix CVE-2026-49825: URL bypass in Cleaner via xlink:href. * Fix upstream test suite. * Re-generate .c files. Checksums-Sha1: 07fc8046ec8a4f4048ba5793ae2bc693891c16b3 1948 lxml_4.9.2-1+deb12u1.dsc b0242ca2de9868fe8ec9c1e8ddbb394d61e760c0 3682202 lxml_4.9.2.orig.tar.gz faeaa922526a6d67b50a92fc3b05192206f1e786 111380 lxml_4.9.2-1+deb12u1.debian.tar.xz 23d7f09a0253b63bf40d97a8ca1a5d4cedb5a5ce 6989 lxml_4.9.2-1+deb12u1_source.buildinfo Checksums-Sha256: 7215d1b99267651e9cfb3ae9856aac74b529e38b3e998b591835e5995919d4ea 1948 lxml_4.9.2-1+deb12u1.dsc 2455cfaeb7ac70338b3257f41e21f0724f4b5b0c0e7702da67ee6c3640835b67 3682202 lxml_4.9.2.orig.tar.gz 82925001bbe781caa0a13524adf3c7d41b8698d313842aa81aae11eccef413a1 111380 lxml_4.9.2-1+deb12u1.debian.tar.xz 29dc7459dc5dd76f2c344b1b223bf2e703889b25e14053fdf605f020c6d3cce8 6989 lxml_4.9.2-1+deb12u1_source.buildinfo Files: 113252e5b53cf4d30082e587dff5c1be 1948 python optional lxml_4.9.2-1+deb12u1.dsc aa84a7ce47581b43cb827145340505c6 3682202 python optional lxml_4.9.2.orig.tar.gz 535f8fd6f2d0f924a57aa92790dbb22e 111380 python optional lxml_4.9.2-1+deb12u1.debian.tar.xz bf9267cdf1c6c8c6462154a2f54fed44 6989 python optional lxml_4.9.2-1+deb12u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmq6uj0ACgkQ05pJnDwh pVLxgRAAnhM8f5Dd0GrD5w4N21L8maqk8tsxF1MHk99O3msu4fOz53fP8cvj9ZIi x5UvedVuFcqyS0dwyva84TJc0suvlkBDY2X5eui+9RjZwAn1o+R9FJld+riGP1f7 aW9gRrot8wSzWsdQuVTSvGJJ4wspFxx6EWlC5gkxJR74wmDyAGT87wZJmwjbn/pa AhJ+o+lgFLu99m9NAdqgZYtlN03ECVqKAWMLNbOIYRG4UosUwEdK9Zb6LFINXC6f 8GhiHvWCt8ZAR4icZdOmD7BBiRfVMb+Fwvv0U8b4owOhR2KAMvrppc8feThpodJG 3+jd4DbfDSYGcmTf3ZmiNWCOAqOacC962twBdO1D3TGuVdBu+pwKgKPyhkiB22QV lc6/6GbHqAVLoT/QB/lwYmTNzkpcy1iY2YpAsWENx9xt75QGkh5WAa31BCepQu7G sXE9fzpSN7VDu2VIN7kJFx0fvPyZTSShyweGt5ajz+cQDVY9OrwzVlSOrUvEm7RO 1IRaZ+qVABuqGrDt4GvYsb8kdQ9ThCOBaIo+uz36s75JVnNh5mDjTodP37KXn8tp sVZ/rwgmcSXjHEkaoiZUjpbUuCTQQa9pseR6qw5Iroa9jX07Ezueml04L0AVrKh6 LDNGrlF0ENufxJIN1Ukbji/reFjuvhpQznQSiF4uhTIJmpFm5sw= =5tbL -----END PGP SIGNATURE-----
