Hi,

aspell-0.60.8.3 includes fixes for some non-dsa CVE as well as other fixes
upstream considers equally important.

#1150460 aspell: CVE-2026-75818 CVE-2026-75819 CVE-2026-75820
#1150801 aspell: CVE-2026-103658

[ Reason ]
Quoting upstream words in #1152490
-- 8<
This release fixed a number of other memory problems
beyond ones that a CVE were issued for.  It also included a more correct fix
for CVE-2026-103658.
...
Also even though the commits that mentioned the CVE did in fact fix them,
please note the following:

0b52f16f997958a7d973cbda15f106114a2b3749 is a followup fix for CVE-2026-103658.
I belive the exact fix might still lead to a crash.

The fix for CVE-2026-75819 left open a similar vulnability,
7f9bda27d68b34c2abfbf82ad7bdbab45c1fb903 fixes that.

Also, the memory issues I mentioned are likely just as serious as the three
CVE with low severity.  It is just that no CVE were created.
-- >8

Upstream proposes just uploading 0.60.8.3 to stable (there is an
intermediate 0.60.8.2 upstream release). I have prepared an upload with the
minimal changes borrowed from 0.60.8.3 (nothing from 0.60.8.2), including
complete fixes for the CVE as well as fixes for other memory problems
added by upstream. Let me know if you prefer me to just adapt 0.60.8.3 to
trixie.

[ Impact ]
Fixed CVE are non-dsa, but is desirable to have them fixed.

[ Tests ]
Built package has been tested manually. Also, autopkg suite added in
0.60.8.2-2 was cherry-picked and adapted in a separate branch, with tests
succeeding. This autopkg suite is not included in this release.

[ Risks ]
Changes look miminal and problems are not expected.

[ Checklist ]
  [*] *all* changes are documented in the d/changelog
  [*] I reviewed all changes and I approve them
  [*] attach debdiff against the package in (old)stable
  [*] the issue is verified as fixed in unstable

[ Changes ]
 * common/string.hpp: fix integer overflow in String::reserve
   (CVE-2026-103658).
 * speller/readonly_ws.cpp: check return status of file reads
   (CVE-2026-103658).
 * prezip: correctly detect bad input (CVE-2026-75818).
 * Limit length of words added to the personal dictionary to 250
   (CVE-2026-75820).
 * speller/readonly_ws.cpp: check that offsets are valid in dictionary
   header (CVE-2026-75819).
 * speller/readonly_ws.cpp: check first_word_offset without integer
   overflow (CVE-2026-75819).
 * common/convert.hpp fix out-of-bounds read in DecodeNormLookup::decode.
 * common/convert.hpp: fix stack overflow in create_norm_table on crafted
   .cmap.
 * speller/phonet.cpp: check target bounds in phonet '^^' rule handling.
 * speller/affix.cpp: fix out-of-bounds read in normalize_cond_str.
 * speller/affix.cpp: fix heap overflow in SfxEntry::add.
 * speller/suggest.cpp: fix off-by-one error in  Working::try_word_c.
 * speller/affix.cpp: reject over-long strip/affix fields in affix
   parse_file.
 * speller/writable.cpp: limit replacement word length to 250.

[ Other info ]
Attached debdiff as well as individual patches for easier inspection. Built
package is available at

https://people.debian.org/~agmartin/debian-store/experimental/

Thanks for looking into this.

Regards,