CVE-2026-91094:
A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.
CVE-2026-91094:
A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could contain the quilt database directory (.pc) with attacker controlled symlinks, where that in combination with patches that would fail to apply, could be used to make the code used to restore the backup files to either modify or remove the files pointed to by the attacker controlled symlinks.
26 bugs with a patch to review in the bug tracker
normal
vcswatch reports that
this package seems to have a new changelog entry (version
1.23.13, distribution
UNRELEASED) and new commits
in its VCS. You should consider whether it's time to make
an upload.
Here are the relevant commit messages:
commit a4a5979089c352f238439fd93b566a369710fea8
Author: Guillem Jover <guillem@debian.org>
Date: Fri Nov 13 08:05:03 2026 +0100
Bump version to 1.23.13
![[bug history graph]](https://qa.debian.org/data/bts/graphs/d/dpkg.png){kind=link}