mxml - Debian Package Tracker

general

source: mxml (main)
version: 4.0.4-3
maintainer: Alastair McKinstry (DMD)
arch: any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.2-1
oldstable: 3.3.1-1
stable: 3.3.1-1
testing: 3.3.1-1
unstable: 4.0.4-3

versioned links

3.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.3.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.0.4-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libmxml-dev
libmxml4

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

Devscripts::Uscan::Templates::Github failed: Missing owner at /srv/udd.debian.org/udd/vendor/devscripts/lib/Devscripts/Uscan/Templates/Github.pm line 10.

Created: 2026-03-15 Last update: 2026-03-31 09:01

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-5037: A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Created: 2026-03-29 Last update: 2026-03-30 22:00

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-5037: A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Created: 2026-03-29 Last update: 2026-03-30 22:00

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-5037: A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

Created: 2026-03-29 Last update: 2026-03-30 22:00

Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high

vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: could not read Username for 'https://salsa.debian.org': No such device or address

Created: 2018-07-09 Last update: 2026-03-29 17:03

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-03-20 Last update: 2026-03-31 13:02

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-03-15 Last update: 2026-03-15 23:30

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-5037: (needs triaging) A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-03-29 Last update: 2026-03-30 22:00

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2026-5037: (needs triaging) A vulnerability was determined in mxml up to 4.0.4. This issue affects the function index_sort of the file mxml-index.c of the component mxmlIndexNew. Executing a manipulation of the argument tempr can lead to stack-based buffer overflow. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. This patch is called 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied to remediate this issue.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-03-29 Last update: 2026-03-30 22:00

debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 4.0.4-3 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-03-15 19:02

testing migrations

This package is part of the ongoing testing transition known as auto-mxml. Please avoid uploads unrelated to this transition, they would likely delay it and require supplementary work from the release managers. On the other hand, if your package has problems preventing it to migrate to testing, please fix them as soon as possible. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for mxml (3.3.1-1 to 4.0.4-3): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Autopkgtest for libomemo/0.8.1-3: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), i386: Regression ♻ (reference ♻), ppc64el: Regression ♻ (reference ♻), riscv64: Regression ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- ∙ ∙ Autopkgtest for purple-lurch/0.7.0-2.2: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), i386: Failed (not a regression) ♻ (reference ♻), ppc64el: Regression ♻ (reference ♻), riscv64: Regression ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/m/mxml.html
- ∙ ∙ Reproduced on amd64
- ∙ ∙ Reproduced on arm64
- ∙ ∙ Reproduced on armhf
- ∙ ∙ Reproduced on i386
- ∙ ∙ Reproduced on ppc64el
- ∙ ∙ 16 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-03-31] Accepted mxml 4.0.4-4 (source) into unstable (Alastair McKinstry)
[2026-03-15] Accepted mxml 4.0.4-3 (source) into unstable (Alastair McKinstry)
[2025-03-10] Accepted mxml 4.0.4-1 (source) into experimental (Alastair McKinstry)
[2024-04-28] Accepted mxml 4.0.3-1 (source arm64) into experimental (Alastair McKinstry)
[2024-04-05] Accepted mxml 4.0.2-1 (source arm64) into experimental (Alastair McKinstry)
[2024-04-01] Accepted mxml 4.0.1-1 (source arm64) into experimental (Debian FTP Masters) (signed by: Alastair McKinstry)
[2022-08-03] mxml 3.3.1-1 MIGRATED to testing (Debian testing watch)
[2022-07-29] Accepted mxml 3.3.1-1 (source) into unstable (Alastair McKinstry)
[2021-11-15] mxml 3.3-1 MIGRATED to testing (Debian testing watch)
[2021-11-10] Accepted mxml 3.3-1 (source) into unstable (Alastair McKinstry)
[2020-10-19] mxml 3.2-1 MIGRATED to testing (Debian testing watch)
[2020-10-13] Accepted mxml 3.2-1 (source) into unstable (Alastair McKinstry)
[2019-09-07] mxml 3.1-1 MIGRATED to testing (Debian testing watch)
[2019-09-01] Accepted mxml 3.1-1 (source) into unstable (Alastair McKinstry)
[2019-08-28] mxml 3.0-1 MIGRATED to testing (Debian testing watch)
[2019-08-22] Accepted mxml 3.0-1 (source) into unstable (Alastair McKinstry)
[2019-01-25] Accepted mxml 2.6-2+deb8u1 (source amd64) into oldstable (Abhijith PA)
[2019-01-07] mxml 2.12-2 MIGRATED to testing (Debian testing watch)
[2019-01-02] Accepted mxml 2.12-2 (source amd64) into unstable (Alastair McKinstry)
[2018-10-11] mxml 2.12-1 MIGRATED to testing (Debian testing watch)
[2018-10-06] Accepted mxml 2.12-1 (source amd64) into unstable (Alastair McKinstry)
[2018-07-14] mxml 2.11-2 MIGRATED to testing (Debian testing watch)
[2018-07-09] Accepted mxml 2.11-2 (source amd64) into unstable (Alastair McKinstry)
[2018-03-08] mxml 2.11-1 MIGRATED to testing (Debian testing watch)
[2018-03-02] Accepted mxml 2.11-1 (source amd64) into unstable (Alastair McKinstry)
[2016-09-21] mxml 2.10-1 MIGRATED to testing (Debian testing watch)
[2016-09-15] Accepted mxml 2.10-1 (source amd64) into unstable (Alastair McKinstry)
[2016-09-06] mxml 2.9-3 MIGRATED to testing (Debian testing watch)
[2016-08-31] Accepted mxml 2.9-3 (source amd64) into unstable, unstable (Alastair McKinstry)
[2016-06-16] mxml 2.9-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.3.1-1build2
2 bugs