popt - Debian Package Tracker

general

source: popt (main)
version: 1.19+dfsg-2
maintainer: Håvard F. Aasen (DMD)
arch: any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.18-2
oldstable: 1.19+dfsg-1
stable: 1.19+dfsg-2
testing: 1.19+dfsg-2
unstable: 1.19+dfsg-2

versioned links

1.18-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.19+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.19+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libpopt-dev (4 bugs: 0, 1, 3, 0)
libpopt0 (2 bugs: 0, 2, 0, 0)
libpopt0-udeb

action needed

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-18739: A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
CVE-2026-18839: An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

Created: 2026-08-04 Last update: 2026-09-04 22:01

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-18739: A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
CVE-2026-18839: An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

Created: 2026-08-04 Last update: 2026-09-04 22:01

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2026-18739: A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
CVE-2026-18839: An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

Created: 2026-08-04 Last update: 2026-08-09 22:31

5 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit aecb71173d50a08b0d01b342a41bb090f78f74a0
Author: Håvard F. Aasen <havard.f.aasen@pfft.no>
Date:   Wed Oct 14 17:44:10 2026 +0200

    Add reference to local file for GPL2 license
    
    This fixes a lintian issue with 'wrong fsf address'.

commit 7daaffe3ffd4ec557ba7e6c6b43b7a87f5bf6c51
Author: Håvard F. Aasen <havard.f.aasen@pfft.no>
Date:   Tue Oct 13 17:39:59 2026 +0200

    Bump debhelper to 14
    
    Removes now unnecessary 'depends' fields.

commit 93b9f9fc7f44ec7fd77da5dc24b4496d4f83d9a4
Author: Håvard F. Aasen <havard.f.aasen@pfft.no>
Date:   Tue Oct 13 17:38:33 2026 +0200

    Update Standards-Version to 4.7.4

commit 80e03097617df2102844dd803e045c0b167360db
Author: Håvard F. Aasen <havard.f.aasen@pfft.no>
Date:   Tue Oct 13 17:37:48 2026 +0200

    Remove Priority field, value is now default

commit 3c2f9aa41b20779a9aabd0a560ba0278ec978741
Author: Håvard F. Aasen <havard.f.aasen@pfft.no>
Date:   Tue Oct 13 17:37:23 2026 +0200

    Remove RRR, value is now default

Created: 2026-10-14 Last update: 2026-10-14 19:32

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-01-16 Last update: 2026-01-16 06:00

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2026-18739: (needs triaging) A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data.
CVE-2026-18839: (needs triaging) An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-08-04 Last update: 2026-09-04 22:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-03-31 15:01

news

[rss feed]

[2024-11-01] popt 1.19+dfsg-2 MIGRATED to testing (Debian testing watch)
[2024-10-29] Accepted popt 1.19+dfsg-2 (source) into unstable (Håvard F. Aasen) (signed by: 肖盛文)
[2022-10-24] popt 1.19+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-10-13] Accepted popt 1.19+dfsg-1 (source) into unstable (Håvard F. Aasen) (signed by: bage@debian.org)
[2022-09-20] Accepted popt 1.19+dfsg-1~exp1 (source) into experimental (Håvard F. Aasen) (signed by: bage@debian.org)
[2021-08-27] popt 1.18-3 MIGRATED to testing (Debian testing watch)
[2021-08-24] Accepted popt 1.18-3 (source) into unstable (Michael Jeanson)
[2020-11-07] popt 1.18-2 MIGRATED to testing (Debian testing watch)
[2020-11-03] Accepted popt 1.18-2 (source) into unstable (Michael Jeanson)
[2020-07-02] popt 1.18-1 MIGRATED to testing (Debian testing watch)
[2020-06-26] Accepted popt 1.18-1 (source) into unstable (Michael Jeanson)
[2019-10-27] popt 1.16-14 MIGRATED to testing (Debian testing watch)
[2019-10-21] Accepted popt 1.16-14 (source) into unstable (Michael Jeanson)
[2019-10-16] Accepted popt 1.16-13 (source) into unstable (Michael Jeanson)
[2019-02-06] popt 1.16-12 MIGRATED to testing (Debian testing watch)
[2019-01-11] Accepted popt 1.16-12 (source) into unstable (Michael Jeanson)
[2018-04-02] popt 1.16-11 MIGRATED to testing (Debian testing watch)
[2018-03-27] Accepted popt 1.16-11 (source) into unstable (Michael Jeanson)
[2018-03-08] Accepted popt 1.16-11~experimental1 (source) into experimental (Michael Jeanson)
[2014-09-05] popt 1.16-10 MIGRATED to testing (Britney)
[2014-08-25] Accepted popt 1.16-10 (source amd64) into unstable (Paul Martin)
[2014-08-25] Accepted popt 1.16-9 (source amd64) into unstable (Paul Martin)
[2013-11-14] popt 1.16-8 MIGRATED to testing (Debian testing watch)
[2013-11-03] Accepted popt 1.16-8 (source amd64) (Paul Martin)
[2012-06-10] popt 1.16-7 MIGRATED to testing (Debian testing watch)
[2012-05-30] Accepted popt 1.16-7 (source amd64) (Paul Martin)
[2012-05-29] Accepted popt 1.16-6 (source amd64) (Paul Martin)
[2012-05-14] Accepted popt 1.16-5 (source amd64) (Paul Martin)
[2012-05-13] popt 1.16-4 MIGRATED to testing (Debian testing watch)
[2012-05-02] Accepted popt 1.16-4 (source amd64) (Paul Martin)

bugs [bug history graph]

all: 11
RC: 0
I&N: 7
M&W: 4
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (-, 79)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.19+dfsg-2build1
3 bugs