Hi, The following vulnerability was published for mxml. CVE-2026-5037[0]: | A vulnerability was determined in mxml up to 4.0.4. This issue | affects the function index_sort of the file mxml-index.c of the | component mxmlIndexNew. Executing a manipulation of the argument | tempr can lead to stack-based buffer overflow. The attack is | restricted to local execution. The exploit has been publicly | disclosed and may be utilized. This patch is called | 6e27354466092a1ac65601e01ce6708710bb9fa5. A patch should be applied | to remediate this issue. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-5037 https://www.cve.org/CVERecord?id=CVE-2026-5037 [1] https://github.com/michaelrsweet/mxml/issues/350 [2] https://github.com/michaelrsweet/mxml/commit/6e27354466092a1ac65601e01ce6708710bb9fa5 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
We believe that the bug you reported is fixed in the latest version of mxml, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1132328@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Alastair McKinstry <mckinstry@debian.org> (supplier of updated mxml package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Mon, 30 Mar 2026 19:57:18 +0100 Source: mxml Architecture: source Version: 4.0.4-4 Distribution: unstable Urgency: medium Maintainer: Alastair McKinstry <mckinstry@debian.org> Changed-By: Alastair McKinstry <mckinstry@debian.org> Closes: 1132328 Changes: mxml (4.0.4-4) unstable; urgency=medium . * Backport fix for CVE-2026-5037. Closes: #1132328 Checksums-Sha1: 52e7f3285c6f5a6a38fdfb1ec2ad529ef5c1e87b 1864 mxml_4.0.4-4.dsc daaa79507dccd7abdb5a52ccb48428553a02127e 12248 mxml_4.0.4-4.debian.tar.xz Checksums-Sha256: 2ae1c12e8ecad67e658696345dd7fc229c1c8ec2619a59e6b0c36fc612ff4847 1864 mxml_4.0.4-4.dsc 5adff31f7f0db68572074abf3f45230fafca8f3208d8820f2e2338edc832cfb8 12248 mxml_4.0.4-4.debian.tar.xz Files: 8866c0f3fb0bb6aec3b84e8a854d4e25 1864 libs optional mxml_4.0.4-4.dsc 9d9def1dd7233dcaf1f13b645520f569 12248 libs optional mxml_4.0.4-4.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEgjg86RZbNHx4cIGiy+a7Tl2a06UFAmnLezwACgkQy+a7Tl2a 06VRwA/9Ew0y84UrsttpSBxzGx202wpwGhtBObMyGB62/JgMHHIzmSG3bRZ4bpgr ssqdD6A0+hJPhSwjrxnC8cLg8J2Ifgkl1SOkE4g1LWpUCh6Bnx8dah3T+1HNezyQ TKPef3+fVMfN78UObsMNGI9Tc2DA74Lsfu9eu6/OFTCanZ+qax81q5e0zQE2mdEF HEFpvTh8hzFBU7jfoz21sjggwsWQEX0JpkJcha1g6IA9do0PS99YSUwjAJcfG+s7 u4nke1hIVPnQ5W+/UtOaaD5/IhfeyAXS/wWwTXKF9gfiy+ZtBs//6YpfGrnPIm62 DZTmbyDJtpq9PotDQ6w4aVS/pciaPI/fMfAElDpddUbJyJiNli3u7Ff5p2Ak0esh lNwLtr7wd7yrRPWJZyCpFmRjbYCQ7QGEuQrfLVfpNnSzWe4d2bHpJ6JIKcsN7MU3 CjsRBzuK4nMVYevgJOh8CKizYu7HDkItmnsTANk5lEp6rrWZDeh/Du289ugsKXbu 1T/aqyHEXJsviy2Bd04IKbHsasD8zUXRDUM5WjrYnypthlha5g+gvKwGyCeOTHKK PoQImuoZlwKML4Dpd2rpUGuH4ILdh2zBnXBMq/icTbGs4f/Sn/vBIIMuMnluDZeN QjqPn8FxaZDBmTO5Eb2YSmqxuhQ8kDotu9hkHwxfy/hpdRvxU8s= =B2BV -----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of mxml, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1132328@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Adrian Bunk <bunk@debian.org> (supplier of updated mxml package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Fri, 19 Jun 2026 14:38:27 +0300 Source: mxml Architecture: source Version: 3.3.1-1+deb13u1~deb12u1 Distribution: bookworm Urgency: medium Maintainer: Alastair McKinstry <mckinstry@debian.org> Changed-By: Adrian Bunk <bunk@debian.org> Closes: 1132328 Changes: mxml (3.3.1-1+deb13u1~deb12u1) bookworm; urgency=medium . * Non-maintainer upload. * Rebuild for bookworm. . mxml (3.3.1-1+deb13u1) trixie; urgency=medium . * Non-maintainer upload. * CVE-2026-5037: Out-of-bounds read in index_sort() (Closes: #1132328) Checksums-Sha1: 85e3ba568799dfde6be8cd427a84f5ccc824faca 1940 mxml_3.3.1-1+deb13u1~deb12u1.dsc 35a3b02dc4127363f4cbb897d5e43649e7ad58dc 12736 mxml_3.3.1-1+deb13u1~deb12u1.debian.tar.xz Checksums-Sha256: 97e0a8cc9120cca196c07d069387c596fbfac808915f4315349ab89e73e486ae 1940 mxml_3.3.1-1+deb13u1~deb12u1.dsc 4982f97023d952b784b8f956b75ccb813e0f386fcbf7d3643d91d53e7929350b 12736 mxml_3.3.1-1+deb13u1~deb12u1.debian.tar.xz Files: d43618dda7944bffd500253bb8985ae7 1940 libs optional mxml_3.3.1-1+deb13u1~deb12u1.dsc becab4ab5614a37910c2a85df17fc57a 12736 libs optional mxml_3.3.1-1+deb13u1~deb12u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmo1K1QACgkQiNJCh6LY mLEepA/9GgsyqqcgajjQHgxFL9PoITXvEuSp9rFCL6/KVvZ+r4remPqgmGzVF/j7 rrjXAxETNjZQnOW/B3HV5qLDvqIoqy6i/q4dW2QzsFlYmhyfwpHhuq3geyKG9muv 5EEsB9EV9JaaSW9KsDcewLozr+QfnbBLecJAmshym91zK0Ek55TnVo97f5AUT/1L jQ3mWRd31yo+tSkYIfgDPtDOK3ZENePjMUe+igvSd4WGSOD9jpK3VGFswqVGL6Ad znzJsdiD7M01qigPA1s0F4Nppno23MvEuLRF/Oxh9vylgbtEbHWR36ItG2id+LJ6 Hz98jFj7OyqLJF0INiwCfstKe13YwgHjGcHoVFKAJq7aYqScl8eTCGqCTE5ItB/d N7KVv50JZSaURgKlzAbxW8DTeMBfkOFFPhg2OSceuX6jHzeoSjAHQCbSz4ER27dB mfF1JJ9E2CBEQcPQIoRV1yEvorhRECFFpa0R+KLQPIHS7s2ecctX3jNyj16tMO/U RdjXseXvIMsDIFmMs3C5Uvdx2Keidm1bPqoICaaKUmavVGuwXEsfzaSLmvVfXSiF UKf0FPtzbJ2G2lhBNcLtGi/2z4KIYTg/onuSE3ukgDqBbMT3BRT8GbL/Za135YG4 DGd/ZZ/v3QIrqEfebqiUQXj6QzrHtJIl4KoJnaqf3Jjaf6lw42Q= =6TGZ -----END PGP SIGNATURE-----
We believe that the bug you reported is fixed in the latest version of mxml, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1132328@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Adrian Bunk <bunk@debian.org> (supplier of updated mxml package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) Format: 1.8 Date: Fri, 19 Jun 2026 14:17:53 +0300 Source: mxml Architecture: source Version: 3.3.1-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: Alastair McKinstry <mckinstry@debian.org> Changed-By: Adrian Bunk <bunk@debian.org> Closes: 1132328 Changes: mxml (3.3.1-1+deb13u1) trixie; urgency=medium . * Non-maintainer upload. * CVE-2026-5037: Out-of-bounds read in index_sort() (Closes: #1132328) Checksums-Sha1: aabeb47edafd4b6286673bb81d3bc1b6a977938f 1908 mxml_3.3.1-1+deb13u1.dsc e2acbfa4b4d8a241986907b4de528b0dcc6270fe 826200 mxml_3.3.1.orig.tar.xz 87b072ff9a699190aa407df540451688e38a6d89 12724 mxml_3.3.1-1+deb13u1.debian.tar.xz Checksums-Sha256: 21fb15a198f4b91a082d5b8627b75232eaf11b50162411d6ad6eddb863fcb577 1908 mxml_3.3.1-1+deb13u1.dsc 83413d4dea692c27f94064cc7d5c0d5662e0905de54b8f5506bf4820f71bbcc0 826200 mxml_3.3.1.orig.tar.xz 339939a23cef52acc63b1931f1bb7eb0f61e7ea39860d6b0f5cb340dbcd9bf74 12724 mxml_3.3.1-1+deb13u1.debian.tar.xz Files: c6f392e94376ede15a23343c63a7653a 1908 libs optional mxml_3.3.1-1+deb13u1.dsc c78b160b6365e5fc0e35def3359cde8f 826200 libs optional mxml_3.3.1.orig.tar.xz 131de52d2f38ae3fcf368272200b9b50 12724 libs optional mxml_3.3.1-1+deb13u1.debian.tar.xz -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmo1KdcACgkQiNJCh6LY mLGK0w//bgB5RDmX0VcWjiteBqIzVkRzQQUmzIJ5t+19DOK59GT/dwYv6WYRoGhd k34rbcVZnT2lXvti8uyV/8k+P1yUW7VbaBmUCgkkjuVhGNCq7MUv0GGYS1z/HNo0 90a/a/YIY5ropsaCB1xdtqOUeoUtgIcazEobN5ELmn86dlFejm91qVOUScFKLVV0 gqVCDJ7nrWT/kzKdHSgtQJRjZwKCJy8j7CjMIPhtS43uQ6E/ntxCMVC4DMZfWUGy klUTj0fAaghQul++LP3+JWwr04S52rhTlpnJJ5n6u6dMezIfLksYRrr0FSFk4N5x t0euNIw66BUHz3eugUl62IqNh+XdyWJjP4c41UzTTVhgI769cHFCzg2TMRvNjY1i vfTbUtXHGbtvc19JQ+TW4XyYIGdmBj/LdJtPoEPSouY+RbDC3uZmQD5Fr6NQ02Rq 4oykLqNDntfafJWnrzZ+RZt0dea9dCKU0MQ3jj7QUt7ZXKfkKg0+T2q+34lwZFtM Wgl44dSWpimJaBEnLviIU8rkKEQ8xAI5n2AK2rJusOlBUw+EzfCST8145rwBfKMC AeDxekP2UM+YAGEyElqccjQBFg2v7Trk4JdLk9ixO5/RoCoyVUGoVk69PFsT07a1 M9bvRZrpWvzHox+bDgILBbNOdSp3LTs+mKnfOP8vzQqVjFMM+PA= =+0t+ -----END PGP SIGNATURE-----