[ Reason ]
This fixes CVE-2026-12725 and CVE-2026-12969 for trixie. These flaws
have been discovered and fixed upstream in pre-releases of
dnsmasq/2.93, currently in unstable in testing.
[ Impact ]
CVE-2026-12725: A remote attacker able to supply a crafted DNS response
may crash the dnsmasq process, resulting in denial of service.
CVE-2026-12969: A remote attacker controlling a DNS zone can exploit
this via a crafted NXDOMAIN response to cause a 10-byte heap out-of-
bounds read, potentially accessing stale data from prior transactions.
[ Tests ]
In Debian, no tests specific to the affected code have been executed.
However, the changes are cherry-picked from dnsmasq/2.93 which is
already publicly in use. There have been no reports about regressions.
Autopkgtest run successfully locally and on Debusine:
https://debusine.debian.net/debian/developers/work-request/1211374/
[ Risks ]
I consider the risks low as dnsmasq/2.93 is already publicly in use.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
Sven