-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 30 Oct 2026 17:50:26 +0100 Source: libspreadsheet-xlsx-perl Architecture: source Version: 0.20-1 Distribution: unstable Urgency: medium Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org> Changed-By: gregor herrmann <gregoa@debian.org> Closes: 1152516 Changes: libspreadsheet-xlsx-perl (0.20-1) unstable; urgency=medium . * Import upstream version 0.20. . From 0.19: - Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files. A.k.a CVE-2026-115943 (closes: #1152516) . From 0.20: - Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata. - Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles. - Security: reject out-of-range date values to prevent excessive CPU usage. - Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows. . * Update years of packaging copyright. * Declare compliance with Debian Policy 4.7.4. * Remove «Rules-Requires-Root: no», which is the current default. * Remove «Priority: optional», which is the current default. * Set upstream metadata fields: Bug-Database, Bug-Submit. Checksums-Sha1: 1b33fcc60fce97478badeab7fda2eb3c81f10aef 2569 libspreadsheet-xlsx-perl_0.20-1.dsc 559f7bba6d1ba461dbf6dbbf2b6f76ccf9a02204 89884 libspreadsheet-xlsx-perl_0.20.orig.tar.gz 10f264b4c45f53833a45255a7f14091990a1a642 3584 libspreadsheet-xlsx-perl_0.20-1.debian.tar.xz f59015384cffe7ef7f9aad2de2714418bd11dfce 135392 libspreadsheet-xlsx-perl_0.20-1.git.tar.xz 905a98ebef77d494f84992fa3eb0e3c3801315d7 17801 libspreadsheet-xlsx-perl_0.20-1_source.buildinfo Checksums-Sha256: e5212023f0aa3c186b0ad1c7fed8b0f4b807dfe46a0197cf144d55661bbd2783 2569 libspreadsheet-xlsx-perl_0.20-1.dsc 5add7b91c4845809b065a1b61e326627b0019aaec91078b1efa54842c9a7ab5d 89884 libspreadsheet-xlsx-perl_0.20.orig.tar.gz adb18a86dfb37e1116fe4b1e0144a421a3ed7408cf325af7e6b43140e1d40a4c 3584 libspreadsheet-xlsx-perl_0.20-1.debian.tar.xz 2fce0babb5d416f2d5b6c423e1424d3a7463235c685c1f52bc00e1b5123b1fc2 135392 libspreadsheet-xlsx-perl_0.20-1.git.tar.xz 1d262efcba0c5278424c451fa32ed2210d4ebb891cd58fa896179fe791b2f237 17801 libspreadsheet-xlsx-perl_0.20-1_source.buildinfo Files: 6e3a871b4379b649b6be6ee32c52d162 2569 perl optional libspreadsheet-xlsx-perl_0.20-1.dsc 84efc2a287e018ff45ce0c6aeed5bb8a 89884 perl optional libspreadsheet-xlsx-perl_0.20.orig.tar.gz f25a66ced90f4ec7a8acfc73edff2852 3584 perl optional libspreadsheet-xlsx-perl_0.20-1.debian.tar.xz de2c9805834db62978f8eeaeeb1d8b9d 135392 perl None libspreadsheet-xlsx-perl_0.20-1.git.tar.xz d4c1bb56340da5efd052653264a724ae 17801 perl optional libspreadsheet-xlsx-perl_0.20-1_source.buildinfo Git-Tag-Info: tag=08e1ca1819f3c7e0dabc6cc5f1123b15eaa251a7 fp=d1e1316e93a760a8104d85fabb3a68018649aa06 Git-Tag-Tagger: gregor herrmann <gregoa@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrky6oACgkQYG0ITkaD wHlbWw//WOfxsCgiyQ4P6BBwl1dxwtWCa+rceeFQZtohy9lYP6//AL6HrBDsUjQB gaHafOGumuGtACRqZDsTSzmLy3+7JVg4Tk20olJF+AKk+r7j3XpiLGOOuGUjL98n aNCmJ889VOVKuP3EWw4myzDpbDQH4KOCyAP5G++wiRykoo7fUff/D3aDIW4HilX5 2RQ19mYLVju86fEgqAHWzxYlCFy3rUVqeNw/XPsfGBlJW/dh+DnuiXLJy53+5up5 jHI2WM6B1wC+YW4Ug/GTx5dM/Jj2bdsa0bgCdms2JrIFnnP4B8eomuxq64vx/N7O hiJyMQgbqeUk+n2NbA3OTd6ExSYxMbhO3AdslSsGvI4UjVY62PYuGUoq0Zd8EDqC yhLVJo+H3hGJS/UYnfG6h4p0lfIF6uRYJnzzeqSQeBTVuAlWWjwEGIoI+97ENg1J TD58Qs4UtFmx9tQHNU3fZ7rAaLjCPcmomF82NMdJNQ5orABCKI15OvBWu257TS6u pYcyQtK2IJzrekTySIC3Ibu5OznCo1AlYAUe1WYrmxOjnUdPuWPk7FTf+o6hO0zV kMh+kBL5GeqjynUhWBufFbU9AOdZes9CHrGaVFL0A6Qyr5V1p8WeH7zyOpdgxWWU /3Sf6yvQi5l30hBSTg4AOf/vr0MnmfLCy613F2j6UeivV9HSKv8= =ez0O -----END PGP SIGNATURE-----
