-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 09 Nov 2026 17:28:55 +0100
Source: libspreadsheet-xlsx-perl
Architecture: source
Version: 0.20-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 1152516
Changes:
 libspreadsheet-xlsx-perl (0.20-0+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
 .
   [ gregor herrmann ]
   * Import upstream version 0.20.
 .
     From 0.19:
     - Security: replace string eval of number-format conditions with strict
       numeric comparisons; invalid conditions use the fallback format section.
       Prevents arbitrary Perl code execution when parsing crafted XLSX files.
     A.k.a CVE-2026-115943 (closes: #1152516)
 .
     From 0.20:
     - Security: limit ZIP entry counts and uncompressed sizes; read members
       incrementally and reject inconsistent size metadata.
     - Security: validate number format IDs and escape regex lookups to prevent
       regex injection from crafted styles.
     - Security: reject out-of-range date values to prevent excessive CPU usage.
     - Security: validate cell references against XLSX worksheet limits before
       indexing cell arrays, preventing excessive allocation from invalid rows.
Checksums-Sha1: 
 c99d3cc7d19aea2f7492bd83a0da510302524c3c 2472 libspreadsheet-xlsx-perl_0.20-0+deb13u1.dsc
 559f7bba6d1ba461dbf6dbbf2b6f76ccf9a02204 89884 libspreadsheet-xlsx-perl_0.20.orig.tar.gz
 c796cd694d5e20c59a82dda43ade6d70b65604a9 3556 libspreadsheet-xlsx-perl_0.20-0+deb13u1.debian.tar.xz
Checksums-Sha256: 
 fe3197239f761ca0c7891339b1f974b656107635cb49114d2c52c557031913e4 2472 libspreadsheet-xlsx-perl_0.20-0+deb13u1.dsc
 5add7b91c4845809b065a1b61e326627b0019aaec91078b1efa54842c9a7ab5d 89884 libspreadsheet-xlsx-perl_0.20.orig.tar.gz
 60bbf3386305ec09738d652abff9078b691716afb94cc0ce5c67c024b09e3153 3556 libspreadsheet-xlsx-perl_0.20-0+deb13u1.debian.tar.xz
Files: 
 b8aa6a838fc7637f47944efe75c0b9f3 2472 perl optional libspreadsheet-xlsx-perl_0.20-0+deb13u1.dsc
 84efc2a287e018ff45ce0c6aeed5bb8a 89884 perl optional libspreadsheet-xlsx-perl_0.20.orig.tar.gz
 94316373daf70638c7b93d00c9bddf2f 3556 perl optional libspreadsheet-xlsx-perl_0.20-0+deb13u1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrx97tfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk
ZWJpYW4ub3JnAAoJEAVMuPMTQ89Ef7QP/1VnAlw8rDB/s8fTz8kRoSdKB4DJQmk7
Ku21FDcCwCA1hNyMKdfoPCM0d19HniaqFeL7xvbt0bI19zPPssq1v8Waztl2pCtS
GBo5O3WpeFlMtcTcKJpJ/8k+3TOAss0L3MZqzBVlc2rfrdT5Z5Y67/EmkOTZh7yr
ZjDH/phTtAp0tRT6jzJkikZ8cXqfyYxLDhJ6MK16kct2ueUFtmiXc6HPC8WUtV70
USHSfTTtn7eYhjugAi46Mm4rsSUKmlAVXnoyZK0Go7RRv5pV611/sevudtH5wPNd
nXY3QfF2ZpwV8AvpFgDBfkneiaXegJhELW0Hrrhd3syq5iBVKrQh6Wl8JCNKTZ4s
f7RX87+0okZSZ/8BuFoHjr6hAT07MjxuTmgz0E2XwRze4/tC4FgvPvDNd+EZ5FbL
FpiaBesTuZTdiz9HQRG9VeyEMcnbLwnlaanoTYOc5JsvVE56zrWt/uFFqOBVXDSs
bNgIcmYh9ZZN7dLctniRDwt9EUgP2X7Nr8iWwY4SZx8L5Zs4i4K8NpT2oDfmRhUu
Ry+4edk06Y57jJ7JjuJJi5GhwaFUG3EH3wKd6C01OoZwj8IgPm1+LgGVZedtK0RT
S5t/icg71TtKjpGUQeX9Mhwm5zyeYuxpADuS3ppCIixr5TsZT7CA5MCfWPgexRlj
LHXuuNSeKDSE
=pyFy
-----END PGP SIGNATURE-----