Groups > linux.debian.announce.security > #4562

[SECURITY] [DSA 6000-1] libcpanel-json-xs-perl security update

Path	csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod
From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.announce.security
Subject	[SECURITY] [DSA 6000-1] libcpanel-json-xs-perl security update
Date	Thu, 11 Sep 2025 21:50:01 +0200
Message-ID	<LtVsR-eAz3-9@gated-at.bofh.it> (permalink)
X-Mailbox-Line	From debian-security-announce-request@lists.debian.org Thu Sep 11 19:42:12 2025
Old-Return-Path	<carnil@seger.debian.org>
X-Amavis-Spam-Status	No, score=-112.091 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, FVGT_m_MULTI_ODD=0.02, LDO_WHITELIST=-5, PGPSIGNATURE=-5, RCVD_IN_DNSWL_NONE=-0.0001, USER_IN_DKIM_WELCOMELIST=-0.01, USER_IN_DKIM_WHITELIST=-100] autolearn=ham autolearn_force=no
Old-Dkim-Signature	v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Date:Message-Id:Subject:To:From:Reply-To:Cc:MIME-Version: Content-Type:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=WBJQ5PPVH9PiJ/9jpBrBf+sHNV2rgf7yTzhctHwkCGs=; b=tx RjkPE7GcPcIsL5TsUD4F0mPZb7hxNijMUfWHQk4P2cukk6KiqpIwA84bjf6iLwdF6/QTaSkcrbbkR RiZXEgwErerCNBbjImed2Aq0C49JTo/amt3BbqPXBtQTWp59LrZVs/apDAjLBX24vVZ51BSoFHYc1 bT36ycphVwqloO2Q91wSLWCzKDdE9SjjDYtqVJtIC1FTrpG//hom6MuTbubaH74+Ou+vios89WfPR SBbZHetWvOb/1HPhJfoL29D/rJ9QQjtdRGU6Mw5GtshDRomkIUMKBzr6pQaN2tFZ/6KRBjslh9ALM kaHOSkjGu8J30FrO4aWDth2i+tPlR4Mw==;
X-Debian	PGP check passed for security officers
Priority	urgent
Reply-To	debian-security-announce-request@lists.debian.org
X-Mailing-List	<debian-security-announce@lists.debian.org> archive/latest/4920
List-ID	<debian-security-announce.lists.debian.org>
List-URL	<http://lists.debian.org/debian-security-announce/>
List-Archive	https://lists.debian.org/msgid-search/E1uwnAz-00GiRm-1O@seger.debian.org
Approved	robomod@news.nic.it
Lines	52
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Date	Thu, 11 Sep 2025 19:41:49 +0000
X-Original-Message-ID	<E1uwnAz-00GiRm-1O@seger.debian.org>
Xref	csiph.com linux.debian.announce.security:4562

Show key headers only | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6000-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
September 11, 2025                    https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libcpanel-json-xs-perl
CVE ID         : CVE-2025-40929

Michael Hudak discovered a flaw in libcpanel-json-xs-perl, a module for
fast and correct serialising to JSON. An integer buffer overflow causing
a segfault when parsing specially crafted JSON, may allow an attacker to
mount a denial-of-service attack or cause other unspecified impact.

For the oldstable distribution (bookworm), this problem has been fixed
in version 4.35-1+deb12u1.

For the stable distribution (trixie), this problem has been fixed in
version 4.39-2~deb13u1.

We recommend that you upgrade your libcpanel-json-xs-perl packages.

For the detailed security status of libcpanel-json-xs-perl please refer
to its security tracker page at:
https://security-tracker.debian.org/tracker/libcpanel-json-xs-perl

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmjDJWZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0QcGBAAhomvzAkpvE/ZVP/0sKTUzWTxCJlllzjtYE7H4yNw4pUwE8Dvyb/sAtt5
aUcqrobxUAvwzZZ31OYGCXeq5INuVlfzBUvoAnQDO370vdMaqqZKP0Vao42hurGb
tc9j+/+e02vn9EuGqjM+eGhhHdyZ4OFTBE7BuP1PniaTyFGTvnX/9nYBpVbmg7QT
BIzabjHMaal4LvUzzJbfqMZ0bMKJ4oEo3f/NRGJklwnx0FB7iDR/6Rul4kAKKCE+
jivrN+DW4Iz0bOAIsNSM+Rxhupd4gK/AOKN4ljH4J2Vr/BJRTgJG+yFfEzp+eKed
CE64gKmJTyuze3zTPxTEq3SjBpYES6cttmekN4hz0bZTfTVp+r5dUC0r8yuToEng
EZC1NxBPsd7XgvXZWLl6eodKoMY3igPzlPE6bJaK9O5AdfXi7aarKMMtsrw1NFUw
euK8WKEkY23+O3maYM7R4TeT3XYaSDlHzJbfhEFFr/vlP/GmI6jQK1oZQpDsEUue
0rb5WtvB8nptZgDc0SpJdkEacBrz6IDU3cZNfosNIRgrPnorkpAYHzoHjk4DWwtb
ZxLj8NvKxgp62pwkNf0hzCQOIFO4bnazSLC6EgBpKHfPBNU63ny9VTVOofn+orfx
l6X1JxrlO4DXxTAM3jvc/rPg1MzH5zkjc2lD94Ptsk6BnJhClPw=
=OXGz
-----END PGP SIGNATURE-----

Back to linux.debian.announce.security | Previous | Next | Find similar | Unroll thread

Thread

[SECURITY] [DSA 6000-1] libcpanel-json-xs-perl security update Salvatore Bonaccorso <carnil@debian.org> - 2025-09-11 21:50 +0200

csiph-web