Hi,

The following vulnerability was published for osmo-bsc.

CVE-2026-75893[0]:
| In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow
| issue was found in the ipaccess_proxy_read_msg()  function via IPA
| frame lengths.

Fixed by: https://cgit.osmocom.org/osmo-bsc/commit/?id=2852a03c153cd9418c2a86d0b2193ac41169dbb7


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-75893
https://www.cve.org/CVERecord?id=CVE-2026-75893

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
osmo-bsc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148556@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thorsten Alteholz <debian@alteholz.de> (supplier of updated osmo-bsc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 10 Oct 2026 10:26:16 +0200
Source: osmo-bsc
Architecture: source
Version: 1.15.0-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Mobcom Maintainers <Debian-mobcom-maintainers@lists.alioth.debian.org>
Changed-By: Thorsten Alteholz <debian@alteholz.de>
Closes: 1148556
Changes:
 osmo-bsc (1.15.0-1) experimental; urgency=medium
 .
   * New upstream release. (Closes: #1148556)
   * upload to experimental
Checksums-Sha1:
 51b1f94cee3fee1bd74d939c2498a78648752ce0 2689 osmo-bsc_1.15.0-1.dsc
 2bb3261d100d6a09456581b228559a4795433c5e 531904 osmo-bsc_1.15.0.orig.tar.xz
 27f958b73ecbb1fe17c3092f9a743809d76b1d98 10840 osmo-bsc_1.15.0-1.debian.tar.xz
 19202e94c987a1532ba3151a65408da25dfd363a 10362 osmo-bsc_1.15.0-1_amd64.buildinfo
Checksums-Sha256:
 6e97d3cb5101cf0f1f4bcfad838cb6233bed35ece95c0ce7c00b8896ce60dc7a 2689 osmo-bsc_1.15.0-1.dsc
 f859493201cdff49f3df7cad7f73dae69ae8bb3e5001121a20f47dff1b37f066 531904 osmo-bsc_1.15.0.orig.tar.xz
 e267658b4eb3cd6a674a7fa6bd9244c8dc93fca4e747fe0f3428c01ba677f096 10840 osmo-bsc_1.15.0-1.debian.tar.xz
 7fe349b6ca0de8047839b5aa30913ac29b8f52ea47e1e5817e728dde92c0187c 10362 osmo-bsc_1.15.0-1_amd64.buildinfo
Files:
 536c1c1147b51466626ececeec0fdfe1 2689 net optional osmo-bsc_1.15.0-1.dsc
 cd730f7b4fe3581a48ff0781ae933ebd 531904 net optional osmo-bsc_1.15.0.orig.tar.xz
 ba5e30509a473bce39455cf2712ffd00 10840 net optional osmo-bsc_1.15.0-1.debian.tar.xz
 4cbbb9ac62ef64566ff7ab9ea5336418 10362 net optional osmo-bsc_1.15.0-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmrQef5fFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh
bHRlaG9sei5kZQAKCRCW/KwNOHtYR8MZD/95kUi1OGoE6LASoJdIwZqSTkWlyuMA
+Mra/ZS+Q1nMig+1THT89lJ6On1jLyfK9Da6/diN0rpVPq6pq3aLZXPcX2XmU2mO
hQnUXh+3hk68btO1zFb5bjrjI7qIuc+VOKRUNejy9vcqOrIlDNKB+wM2E0e+cjWs
oYAipORaRQfSOty1OxWfrZH4Q/ETGQMkzHtATT91vOvcI6xqJOXen3T3E6gLyj+a
kQRWMkukOZs2MylzHg9Bp9afCNOkGZunul8m9NW8bYZC2GYRRs7bLOIZdRvEEX1i
laWFlGvpQ2W72dX+1bbjAaSyrQy64gTUIAzK2yDUUKCo2WDKbjOWOTj1z46WbKa4
sfkNOq8G5nmhBtKRWGcw4Mk/oVtZgjZsCv+XFmr8LtOKQ9clsY5iNZ5Wa7SN2TDV
qrgB/wYED30tbuzW1beXFyPtLVmKqg7et8KtD5OhZoHqjry35+5BvOE7hGAm1ZZc
ZbcE3lEj/10l+idhpafb+4Y8vRnVA3mNW0h64evDUR0AQto2AdOhEhlBKGfnGrq0
CNLxYe7nhrIM2R/dczEMIhwea2OyNQFwpi3zicyRYqZ0NsvOBi75K9TcxtvubVle
DqP2cbElmXWhDSVMPvCDYjKOaPsW62GkzX7JpHnqrJkHsdnL2Z19mgoM21TZf0uh
8KAGQ9GIslTt0w==
=r0c0
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
osmo-bsc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1148556@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thorsten Alteholz <debian@alteholz.de> (supplier of updated osmo-bsc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 17 Oct 2026 10:26:16 +0200
Source: osmo-bsc
Architecture: source
Version: 1.15.0-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Mobcom Maintainers <Debian-mobcom-maintainers@lists.alioth.debian.org>
Changed-By: Thorsten Alteholz <debian@alteholz.de>
Closes: 1148556
Changes:
 osmo-bsc (1.15.0-2) unstable; urgency=medium
 .
   * upload to unstable (Closes: #1148556)
Checksums-Sha1:
 5a9432cb6256e9c4b54fb1afb3d45b74c08b8088 2689 osmo-bsc_1.15.0-2.dsc
 2bb3261d100d6a09456581b228559a4795433c5e 531904 osmo-bsc_1.15.0.orig.tar.xz
 08793735eb40027861677ff94f4d0b3464837012 10836 osmo-bsc_1.15.0-2.debian.tar.xz
 a1a248c0454abb9be581bcf750bd89c68a74ba9c 10368 osmo-bsc_1.15.0-2_amd64.buildinfo
Checksums-Sha256:
 51c42d71ab7f5f166c096235d09e7abe084c27bd60e9c68541fb698befacb098 2689 osmo-bsc_1.15.0-2.dsc
 f859493201cdff49f3df7cad7f73dae69ae8bb3e5001121a20f47dff1b37f066 531904 osmo-bsc_1.15.0.orig.tar.xz
 9492bb4300d8654bdd243481598cd34782c9f86ec5b464dc01712ad05268a120 10836 osmo-bsc_1.15.0-2.debian.tar.xz
 c77d48456a3da6991b36bc8aa1673ebf4f728b8dee286256e274cb6503f4c878 10368 osmo-bsc_1.15.0-2_amd64.buildinfo
Files:
 1fc9e3506a2d719a9b598e2453fa4076 2689 net optional osmo-bsc_1.15.0-2.dsc
 cd730f7b4fe3581a48ff0781ae933ebd 531904 net optional osmo-bsc_1.15.0.orig.tar.xz
 f0468cd8957660981f07231dacb5498b 10836 net optional osmo-bsc_1.15.0-2.debian.tar.xz
 b40b34f196f21f43fe36170cca3bce24 10368 net optional osmo-bsc_1.15.0-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQKnBAEBCgCRFiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmrTljdfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcTHGRlYmlhbkBh
bHRlaG9sei5kZQAKCRCW/KwNOHtYR/TmD/9cllGL1SuA4Pj6twct5ux5IyquYJLC
nV6oRQqNb0CnfrqUHbfSDQWxZT5nt1d1P2/RC/udLP2xBNMnnU0R3nYj9/jFRtcf
5MgeYo9VCSKLgl1FlqjFZj5ekxcGjZenKkCXSKIoJMHEbXJb0jbEFYqvB9GMQd6D
DdYKzqQNo5cN0jDAYtrPiY7pgDk1nNoHcnezb4t+T8KINMmBFnxQH9RBCMeYkYPx
n2CGhQdbXfjpbMqA5VhpVAJKU89VqpDJCKdH3YKrlJGRI5VCd1wqqLW0OMLdggEj
I0CZmxxFY2mnLsUlFX6aD4DB1hW0+sg6+9rrV+DmNhrbhA0KYVC9CQhkbrQYeZdE
qsZrxNQOqMI88asGKb7t6ajbENYd70EusM7rZvp9UqnoAayXITHEm5+5Sj4+BkVK
PJHV2MXTPM0s/eO2VLqWppnZC2pHcPOIlgFHyFCl16i5vBvelGDyEl4oINQaET7H
s2ou0qQPux55dEyuaOQB+Yjtj1ysJdZ1buc/y3H5T3KVn5soEyFqzj4UIp/dsPJQ
YsuRu2LTPXXg2cpOhlXO6KjpeIDH4vOEM76zaOuJWCg7y283w8dGFR3LVTK5dG14
K2qWuSyKs5BWp850/WOraKxAb/OlqHSN7G2LZKnorVZ7PYVYDl/rsjjzmU7foqFw
OFHO+QmIco+SIA==
=jEn5
-----END PGP SIGNATURE-----