-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 16 Oct 2026 13:54:26 -0500 Source: jq Built-For-Profiles: derivative.ubuntu noudeb Architecture: source Version: 1.6-2.1+deb12u3 Distribution: bookworm-security Urgency: medium Maintainer: ChangZhuo Chen (陳昌倬) <czchen@debian.org> Changed-By: Simon Quigley <tsimonq2@debian.org> Changes: jq (1.6-2.1+deb12u3) bookworm-security; urgency=medium . * Non-maintainer upload by the LTS Team. * CVE-2026-32316: Repeating a string past the length bound still aborted after 1.6-2.1+deb12u2. It now fails with "Repeat string result too long". A count below 1 still returns the old result: null for 0 or less, and the input string for a fraction below 1. Upstream's jv_string_repeat() would add a symbol to libjq1, so the check is done in f_multiply() instead. * GHSA-gf4g-95wj-4q4r: args2obj() double-frees when jq_compile_args() is given an array. The command line always passes an object, so only libjq is affected. No CVE is assigned. * 9163e096: f_multiply() aliased the string it was repeating, so ("a"*200)*30 copied from freed memory. This was not introduced by 1.6-2.1+deb12u2. No CVE is assigned. Checksums-Sha1: 269d9095da939201282e9b99aa973681979e004d 1973 jq_1.6-2.1+deb12u3.dsc c5de4e924dd1e349e5c888a4fdbdee70d3aa9ad7 30100 jq_1.6-2.1+deb12u3.debian.tar.xz 250d4ffda0604efaa01cea039c27a545ff9ef1e4 7351 jq_1.6-2.1+deb12u3_source.buildinfo Checksums-Sha256: 28492fec6ddf9e46841e2286674091a1231a248d8893a9c0204591e00e8e725a 1973 jq_1.6-2.1+deb12u3.dsc a053c4f059be84c02db2fc038af289cd6f614a46a528eaaaf690ac08ea33a36b 30100 jq_1.6-2.1+deb12u3.debian.tar.xz 8f683d4a0836c4fc4285748e9ed7b5a43b21c88d3b0db5936b8a76a2b119e50a 7351 jq_1.6-2.1+deb12u3_source.buildinfo Files: 19d1cfb24c8b80a677a8f0ede3a0ea91 1973 utils optional jq_1.6-2.1+deb12u3.dsc af6bfeb3e902d1b2d81e63422a5137db 30100 utils optional jq_1.6-2.1+deb12u3.debian.tar.xz 031c808d3f23fdeeeb0c6e89e0fb4189 7351 utils optional jq_1.6-2.1+deb12u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmrShIcACgkQ4n8s+EWM L6TrMw/+Nq38HaJSvFBJME+kSDBsA2v3xrN1kVHMZ5S47Eq23UZ0zZffDYRzbysq pSLSrAg211TiK2iE5WdCFmcCH7C7+GB/rPEqdguCww4Ova/bMwV/cbq7eLEDOp6l OfBiCzFlPFxerkvBNvd27fjyCyw5nvs0lZdcq9Y+Qes3WXAUZ2C6oQ3vzbULgWHd vycLGcWRUreZbcXiia837+hRyhmuQY8AaMraKLEW9Tx7TAdV8FzR4SaiYLqi//SU Fn1GZxasB4N1lU5gERISDmlAqPVM3mLLyOEG9dBrt2J+XiOapULdBFqhNb0+soYT 8qf5xXGsQa4GDvExvYttCOw2p80JXyvOVhc+4aHowuPriCzOOtxH0kCR39TpOrz9 Wt0KshyMPeJ0yOZ0DXvnPVWIdTWnLwZNBZiuXhAqi4z++h5aR6SfAZpBKk64fNDS WYvcusVWCTaQIfxjDJPMWVb0NQFfY0slxQX83gVknrsve0dXhCneOFD5zQYHQB4W R+sLV1tXj+/019rsIwTe1rr9zK/4BJzUgIdFigMygswi3hMBhV5cttP2Vtxgxwpl IeORwESOVbgF8EirJLTJC9fpyiWMMr3yDd5i5K0NzeYi1EaQ4LMUuKABGcYXDuFT LrDlGe5cJm0e5No/jaXLY/A6xCHBxoG/kTGMd7BA1DOTKk8cwB0= =G/Ah -----END PGP SIGNATURE-----
