Hi,

The following vulnerabilities were published for libextutils-typemaps-default-perl.

CVE-2026-107373[0]:
| ExtUtils::Typemaps::STL::String versions before 1.06 for Perl
| T_STD_STRING typemap may read the SV length before stringifying the
| argument.  The typemap uses      $var = std::string(
| SvPV_nolen($arg), SvCUR($arg) )  However, evaluation order for C++
| arguments is not specified, and some compilers may produce code that
| evalutes SvCUR($arg) first.  When $arg is not a string (for example,
| an interger, number or a reference) then SvCUR will return an
| invalid value, and the program may abort or segfault.


CVE-2026-107794[1]:
| ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate
| a 32 GiB array on an empty list.  The OUTPUT typemaps call
| av_extend( av, len-1 ). On an empty list, this undeflows, and
| av_extend will allocate an array with 2^32 slots, leading to memory
| exhaustion.  Note that a similar issue was fixed in
| ExtUtils::Typemaps::STL::Vector version 1.05.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-107373
https://www.cve.org/CVERecord?id=CVE-2026-107373
https://lists.security.metacpan.org/cve-announce/msg/44245994/
[1] https://security-tracker.debian.org/tracker/CVE-2026-107794
https://www.cve.org/CVERecord?id=CVE-2026-107794
https://lists.security.metacpan.org/cve-announce/msg/44246012/

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libextutils-typemaps-default-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150541@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libextutils-typemaps-default-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 10 Oct 2026 18:05:25 +0200
Source: libextutils-typemaps-default-perl
Architecture: source
Version: 1.07-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1150541
Changes:
 libextutils-typemaps-default-perl (1.07-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 1.07.
     1.06 - Address CVE-2026-107373.
     1.07 - Address CVE-2026-107794.
     Closes: #1150541
   * Update years of upstream copyright and upstream email address.
   * Update alternative dependencies.
   * Declare compliance with Debian Policy 4.7.4.
   * Remove «Priority: optional», which is the current default.
   * Convert debian/watch to version 5.
   * Apply multi-arch hints.
     + libextutils-typemaps-default-perl: Add Multi-Arch: foreign.
Checksums-Sha1:
 b2b9c35c47f3748c20f6fb90e0ecc5e603e421ce 2639 libextutils-typemaps-default-perl_1.07-1.dsc
 114e141a254acb84b9f1afb43d80c0508bbafc68 10759 libextutils-typemaps-default-perl_1.07.orig.tar.gz
 94b8a6d36286370c23f66011fcbd3f5caac3bf86 2600 libextutils-typemaps-default-perl_1.07-1.debian.tar.xz
 e1aaa62f8214315f0cd197ae096975c7679e1370 45160 libextutils-typemaps-default-perl_1.07-1.git.tar.xz
 04484efbe32ad56a10167adbc81cd7e84dfd0ab0 17824 libextutils-typemaps-default-perl_1.07-1_source.buildinfo
Checksums-Sha256:
 1b1b29dc17c5604b0ff0019b7cce8ddd6b025bfc972ec8447ecdb04130d570b0 2639 libextutils-typemaps-default-perl_1.07-1.dsc
 268aeab9bdf0997c436115198e4adbdb0a82cc5faec35c629e4ad6db48ed8d78 10759 libextutils-typemaps-default-perl_1.07.orig.tar.gz
 6ab5d209adbfdbdc20d8a49b3d8d675695f6456e28041bce1c14504c79b126a0 2600 libextutils-typemaps-default-perl_1.07-1.debian.tar.xz
 67d2a98b0037ff2849780d0a858d13dcbf222606c342ef4e792e83d7b7b34b7a 45160 libextutils-typemaps-default-perl_1.07-1.git.tar.xz
 7d2cdd950be77c9ba7c93b97410e6af77a07af85256f7893a30255fe58d12242 17824 libextutils-typemaps-default-perl_1.07-1_source.buildinfo
Files:
 64c9fb5101d16009b2839d0a5555e989 2639 perl optional libextutils-typemaps-default-perl_1.07-1.dsc
 8b45bdc123bc929ddf93819a47214c1b 10759 perl optional libextutils-typemaps-default-perl_1.07.orig.tar.gz
 fb3d21f24f0462eefc95af91598dc804 2600 perl optional libextutils-typemaps-default-perl_1.07-1.debian.tar.xz
 80c9930b6ab697da62e5f6c95d2b2d01 45160 perl None libextutils-typemaps-default-perl_1.07-1.git.tar.xz
 3e9d4d68e8e19d60c7deeb7d44f492fd 17824 perl optional libextutils-typemaps-default-perl_1.07-1_source.buildinfo
Git-Tag-Info: tag=1bc63a785ea959b0f6d8b0f8166c0b0637ac5d51 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrKYyQACgkQYG0ITkaD
wHmFzxAAv3UbEGHwOyMV9VwsmPTW9kmUUKJJ62CKr3N4q+3fRltbUXbB8TobxySb
wQL2ARXglas6MZpaVxKFTrHBlHIfv5rLNojXozlvbSQI7tAuCXKT+ipjIafTOiiu
QE0VCRrKbF95F6hUnzDabMPeoPqS2CloQJQT7Uv7VXqVjsvnkXE5n++YL04CagtV
NY0KIjSApt7in5dAyCPiQINhH0KFMWkGVeKykhSyOknx6zRQLGcxA5Dxj0/SLs1s
8CcFTG1oV6bGpD6VP8qg8cfBwpGEv+afpr5lyKYMbskhscpRmStFlglZ1KnaSELJ
kpXCR3EnAra/QzbNi8s2qpLSDicYXqcD5RRFyG9b4sh92CidyiirimHeyDTZ3DFL
Xg24isHGxFItZX0zDpDWK7embFb9YrNig54u7CZs/IHdEtw3CdnPm7jko/mLOAsK
shycyRXKv2Gktxo4i88p7uAB3W5i8NavgMVhzTmRKApwrMITReGtvPANmzvEKeYo
0AvJlBqa4WD3ObVyUhXXZUl/FZ3kdUnw0bxJAPUfoUBpNATQL5qDJvkWAeGPxNnA
ph+7UFVAUNpjOw46j3cfZbfWNXwqZ8szd11oEpHgoO7nIK1SVTzsLehpdNYvHXlA
mP5+D95mINnfcs+7Txx4GGXP6m+mASh1Oud704lV5Gppp4dJxzw=
=5syg
-----END PGP SIGNATURE-----