Debian alert DLA-4637-1 (libconfig-inifiles-perl)

From:
             
 
Salvatore Bonaccorso <carnil@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4637-1] libconfig-inifiles-perl security update
Date:
             
 
Fri, 19 Jun 2026 19:13:08 +0000
Message-ID:
             
 
<E1waeeK-00000005Dz9-3MWX@seger.debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4637-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                 Salvatore Bonaccorso
June 19, 2026                                 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libconfig-inifiles-perl
Version        : 3.000003-1+deb11u1 3.000003-2+deb12u1
CVE ID         : CVE-2026-11527

A flaw was discovered in libconfig-inifiles-perl, a Perl module to read
.ini-style configuration files, which may result in the execution of
arbitrary shell commands or file overwrite when processing specially
crafted file names.

For Debian 11 bullseye, this problem has been fixed in version
3.000003-1+deb11u1.

For Debian 12 bookworm, this problem has been fixed in version
3.000003-2+deb12u1.

We recommend that you upgrade your libconfig-inifiles-perl packages.

For the detailed security status of libconfig-inifiles-perl please refer
to its security tracker page at:
https://security-tracker.debian.org/tracker/libconfig-ini...

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmo1k4tfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0Qixw//aV6XRclSZWIEyIsSarpTbfcVfU216J+g/13salc5yZdMJ3MUHter/cTs
HOezp9HTVNnpSX6lpG6C/Uk/AOtHCnxAwdLtDig9nKxTW2s7t/fyJzjon2yvZ032
jOqbm8iPJ5psXTQ9ITPkDYCKUPScnJCFqRo72kkg4jPkin0jrrJwoB9jMKhrERFG
W06KuQT7XhTiJgckaVTRbzWt9g1oZZd6qlksBYB7VCkF4uHXPuqaCYrOBftI+Ae6
Q1gINsKRXM47KEBg4k7hltHKVG5Meiyg6XE6Ej3UX55wds4faWinafllhAXZfmd1
F9VLbDhl8MLH0pa2wdCgNcMWOAcROzAdIWMBlB59BQ0U3zrgEj5zL16dnAA3SgdV
h4lpu8H0+j2/yT3A+NgHSTgLBqlUkFf8RI44p+WbSxudLqhRbl+AEnKU77Ib5p08
Q6QRrchppcm2m6W5AO4K7pHi8GhtLmC0oj7QqJsUIXghEfDxhgqyE4okCQRunlDS
rnluLyI5rXT51UvQX+je0XqS8qVEUvzInjLqjRnBrhHKDbRuFo60plz9aAFwSQ4P
jfrPwnku8gaBVJGxIOn4mqwGqc9Kpb/zpe7qmYwordo+Tk4cIe9F8BciqaM/kdss
5cNu5zd8REWziDmvYJR+YBlW5eKu8/lKJGHuvcYXkeJ3Sb6W3Eg=
=pyG9
-----END PGP SIGNATURE-----