-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 09 Nov 2026 17:28:55 +0100 Source: libspreadsheet-xlsx-perl Binary: libspreadsheet-xlsx-perl Architecture: all Version: 0.20-0+deb13u1 Distribution: trixie-security Urgency: high Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Salvatore Bonaccorso Description: libspreadsheet-xlsx-perl - Perl extension for reading MS Excel 2007 files Closes: 1152516 Changes: libspreadsheet-xlsx-perl (0.20-0+deb13u1) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. . [ gregor herrmann ] * Import upstream version 0.20. . From 0.19: - Security: replace string eval of number-format conditions with strict numeric comparisons; invalid conditions use the fallback format section. Prevents arbitrary Perl code execution when parsing crafted XLSX files. A.k.a CVE-2026-115943 (closes: #1152516) . From 0.20: - Security: limit ZIP entry counts and uncompressed sizes; read members incrementally and reject inconsistent size metadata. - Security: validate number format IDs and escape regex lookups to prevent regex injection from crafted styles. - Security: reject out-of-range date values to prevent excessive CPU usage. - Security: validate cell references against XLSX worksheet limits before indexing cell arrays, preventing excessive allocation from invalid rows. Checksums-Sha1: bd9ef3da617b0453dc320f2d9dc30d8f2a0d3451 6159 libspreadsheet-xlsx-perl_0.20-0+deb13u1_all-buildd.buildinfo 0103aa4d648fa7baeb6c6e7eb26c6b0a1f556131 23204 libspreadsheet-xlsx-perl_0.20-0+deb13u1_all.deb Checksums-Sha256: 3a13b8c1f7a71c990ab1aa342c3d3596c5471691a2838b8cae9d58a1fdf2e7bd 6159 libspreadsheet-xlsx-perl_0.20-0+deb13u1_all-buildd.buildinfo 4e2fc828eae3691234ab0621f39113595898bb521bb292a7881694cdf58c0b97 23204 libspreadsheet-xlsx-perl_0.20-0+deb13u1_all.deb Files: 7db202db6af612e89b2707568ca75ad0 6159 perl optional libspreadsheet-xlsx-perl_0.20-0+deb13u1_all-buildd.buildinfo 89be89e9e9687f387dff1d755b7a6caf 23204 perl optional libspreadsheet-xlsx-perl_0.20-0+deb13u1_all.deb -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmrx/egACgkQPkCWRKsh 20eiHg/+I9w/mU7Qhx2wkrEfgD5w8y+7MtBVp/BK8jYCrrHCHU2bnBh2HHuKl7qn Fg+3VXKM93TPI9jsTtkZX36qOT0q6r/CkR0AG/i/aQvgI2qCYlXWpih0RE8YIG7I 3ycKH57++FSsLlDkBgIEljMTw48VfScTnL60oaCqju1l1o5+hzSCwcwzYfrMK52w 4rCPlD5Pe1HrdtX/OSrcynWMTtkkVjU1rj++FaztGNqxA/YKhbEcwydmKJUhjIiE kYXdmiyXxtE3HsHh02mjTYlrGwlhW78d86lgJIVQ/Ai4hyiUNZ/D70RH+vNyispZ I7zkNVgxOGWdL2VmsCwhfVBPKP/FYfBELDYHSCaZbC7rDtwvj2ftWy3QLnnVODKU WPgy9Y+t+YiqpBh9qm5OwaZkcYwIoQcIRSZ314Iv/bGjkkIYipgz+DZjhwWPV6Zr CkJzzRRSIWT4n7DUAECO2gweWOq0TPKeTiwUYmDoY8Tbu4+tyMjN2dSFT4qXvFw+ Vh+s5eG/22ZOfbOnL/H7AMIqCS/L/ckI4RclSG35S23tAbtqDrJiFtle3Odao5Zn DDP78oOs01+aZbL0rr6cI1rq4tNzZuwOj4FRwrDgB6j7B0HPXdiiUWGY+3RES08l JtSAaSwWC6fFHpcBV/AZaxWvQGSDHV4ikdBOuTPI8ZjPPeLQVaI= =iQh/ -----END PGP SIGNATURE-----