Hi,

The following vulnerabilities were published for dislocker.

CVE-2026-107634[0]:
| Dislocker through 0.7.3 contains a heap out-of-bounds read
| vulnerability in get_dataset() and get_next_datum() that never
| validate dataset and datum sizes against the metadata allocation.
| Attackers can craft a BitLocker volume image with inflated dataset
| or datum sizes that, when opened or mounted, crashes dislocker or
| discloses adjacent heap memory.


CVE-2026-107635[1]:
| Dislocker through 0.7.3 contains an integer underflow vulnerability
| in get_vmk() and get_fvek() that allows attackers to trigger out-of-
| bounds heap reads via crafted datum sizes. Attackers can supply a
| malicious BitLocker volume image with a datum_size smaller than the
| 36-byte AES-CCM header, causing hexdump() to over-read and crash
| dislocker.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107634
https://www.cve.org/CVERecord?id=CVE-2026-107634
https://github.com/Aorimn/dislocker/commit/9158e9e41dd669b360cbc53cc18ccae729b67b48
[1] https://security-tracker.debian.org/tracker/CVE-2026-107635
https://www.cve.org/CVERecord?id=CVE-2026-107635
https://github.com/Aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
dislocker, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150456@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sven Geuer <sge@debian.org> (supplier of updated dislocker package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 22 Oct 2026 20:12:52 +0200
Source: dislocker
Architecture: source
Version: 0.7.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Sven Geuer <sge@debian.org>
Closes: 840489 1150456
Changes:
 dislocker (0.7.4-1) unstable; urgency=medium
 .
   * d/rules:
     - Drop effectless override_dh_makeshlibs section.
     - Drop override_dh_install-arch section, adding d/libdislocker0.7t64.install
       and d/dislocker.install instead.
   * d/dislocker.dirs + d/libdislocker0.7t64.dirs: Removed for being needless.
   * d/watch: Update to version 5 format.
   * d/libdislocker*.links: Removed for being needless.
   * d/rules:
     - Drop all debhelper options for being needless.
     - Invoke dh_auto_configure with defining LIB_INSTALL_DIR.
   * d/p/*: Drop wrong-libdir.patch. With LIB_INSTALL_DIR defined it became
     redundant.
   * New upstream version 0.7.4 (Closes: #1150456)
     - Fixes CVE-2026-107634.
     - Fixes CVE-2026-107635.
   * d/p/*: Adapt patches to new upstream version.
     - Refresh always-pick-linux-manpages.patch.
     - Drop fix-VERSION_RELEASE.patch.
   * d/p/*: Add local-only test decoding a real bitlocker volume.
   * Fix https://bugs.debian.org/840489. (Closes: #840489)
     Move usr/lib/libdislocker.so to the correct package, i.e libdislocker0-dev,
     and add a symlink of the same name but different path making it available
     to dislocker-find.
   * d/control:
     - Drop 'Priority: optional'.
     - Bump Standards-Version to 4.7.4.
     - Bump debhelper-compat to 14 and consequently drop all ${*:Depends}
       substvars.
     - Sort package dislocker to the top of the binary packages.
     - Add needed Replaces and Breaks tags to libdislocker0-dev.
   * d/libdislocker0.7t64.symbols: Add Build-Depends-Package field.
   * d/copyright: Bump packaging copyright years.
   * d/gbp.conf:
     - Switch debian-branch to debian/unstable.
     - Set upstream-branch explicitly.
Checksums-Sha1:
 3ff934c76216ac0003fd87dbca17858c52d3558a 2493 dislocker_0.7.4-1.dsc
 9f293cb3cd7ab84426a42f933636940e0ac77be8 127783 dislocker_0.7.4.orig.tar.gz
 3c938cf24b044eaef788ddd12fa40c07683040a9 9820 dislocker_0.7.4-1.debian.tar.xz
 2eaddf37ca57ecda1d9e76f34996c3dea0930861 319744 dislocker_0.7.4-1.git.tar.xz
 cedff72482753ad7c56ba9e4480dce7f42838f17 17740 dislocker_0.7.4-1_source.buildinfo
Checksums-Sha256:
 c03e9591a4f8e6dd60fc341fe5e80f837cd53bf211d4b5078c85ef298f9f98ac 2493 dislocker_0.7.4-1.dsc
 6497ec7f69e693076c2396d4aaca1468585b179644de94fd445a4336095703dd 127783 dislocker_0.7.4.orig.tar.gz
 6d1646f7ad3fc740e0604ded8af58070a604e6e3d88404db89f2cb57b6e5d02f 9820 dislocker_0.7.4-1.debian.tar.xz
 3544965b2b00489dd835b8640bd196388b2d20821a9389faa790ba92c25b546b 319744 dislocker_0.7.4-1.git.tar.xz
 266c7d70501b8e75485cd010acffa7f1773187cbbab9f6d7c54bbcfce3fec5c9 17740 dislocker_0.7.4-1_source.buildinfo
Files:
 41a50559be83cdf14e529377fbfe51c6 2493 utils optional dislocker_0.7.4-1.dsc
 35aea21041fe4c06e08709ba36fe4397 127783 utils optional dislocker_0.7.4.orig.tar.gz
 85625e092589c553e3d651d587459c9b 9820 utils optional dislocker_0.7.4-1.debian.tar.xz
 f58de2e65ab60f3051ad5fa9a9aa61f0 319744 utils None dislocker_0.7.4-1.git.tar.xz
 fe73b930e0859d5be46b7ce09331add3 17740 utils optional dislocker_0.7.4-1_source.buildinfo
Git-Tag-Info: tag=42fd8fa5617bdd035021fcc0edeebcdd953e4ff2 fp=3df5e8aa43fc9fdfd086f195adf50edaf8add585
Git-Tag-Tagger: Sven Geuer <sge@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmraV0QACgkQYG0ITkaD
wHmApxAAmlIXPh5ZVHXyfposKQRtqVmcoxtPVztUgy2+5ESpo30psPPmkNotW8gO
LbjmrgddhudE8FXh11cYa8CT4GoH9GnPRVuQSQExVu+H2u5P0wpqfi6s7H2LxzAS
XtvUZqX4avL4yGy/cwPATrhbGIvtHQfQxG0rRiRU44BrZdEeZsTxf/i/cacoHTM0
a0U7Cpk8UNflJXivkJnftQQPwm2ZClGgFv+HJ1s2/Ot0U+HhGpUgCV5jIFbKyDQz
5JhnjIMkOUbrBLY1ehXxhgDNeeJGP/KZPFqQKMMSyhQXpQAiMam7Hjc1sVoT+fIm
a2uIviDgb/ttfH0WkVLJ1SaanjEjulZB7/h5FCeJhNt+mtfidvb2DBiFJAbbsINA
tnFmglY+6BeQ4mY4FQefp3C6Hd6vtW5RH5QppqMKlNCB7jYgYltXj06rTljeECTH
YzIf2TK8pzl6/0IgelA6cCGcy3RQkPyB8FV5Q8dvSWmqr6NgEMz+aiayuWB7RpN8
qjcF9a/UpSmyV2yafKsdsYCCBOB8uEhIRhX1wDgBwK/kIlDguLXsxwi6w7npnxfq
OS7AAZZsCfPmwQkNYeb8bisMwhLquklTAFG/3kd15t/86RbtCfYim1AFDoDd0zJT
l//2YaZZMy50nTPQmnQwm3w4U/l0WWQ8vAy+86DOstPuMGhKIDQ=
=kE0e
-----END PGP SIGNATURE-----