Debian alert DLA-4648-1 (libtext-csv-xs-perl)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4648-1] libtext-csv-xs-perl security update
Date:
             
 
Thu, 25 Jun 2026 20:27:52 +0200
Message-ID:
             
 
<aj1zKMQgAS3_K8xl@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4648-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
June 25, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : libtext-csv-xs-perl
Version        : 1.45-1+deb11u1 1.49-1+deb12u1
CVE ID         : CVE-2026-7111
Debian Bug     : 1135232

A use-after-free issue was found in libtext-csv-xs-perl, a Perl C/XS
module to process Comma-Separated Value files, which may yield type
confusion or memory corruption when registered callbacks extend the Perl
argument stack.

For Debian 11 bullseye, this problem has been fixed in version
1.45-1+deb11u1.

For Debian 12 bookworm, this problem has been fixed in version
1.49-1+deb12u1.

We recommend that you upgrade your libtext-csv-xs-perl packages.

For the detailed security status of libtext-csv-xs-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libtext-csv-x...

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmo9cygACgkQ05pJnDwh
pVJtaA//RuCOKDMe4I/lrbIS6s4+T28Hz/SWvdTWFS+Ey+RQp5R7jo2bCovis6Zk
TIDvwl2zhYwWSH54ScZsypRCJ7WDE44qjyPDVs+uxLXA83t2gpGyOJim69Y+XY32
eLNQORlTPaEXoTXk9KrkxvmARmCiZinfh2ZqxdZE2cbpHIWzhEd0sSgkNTGuuALO
jCIHQT5sEYJTfK6IPzhXTZEzhdrevy6nh0ODudTwAaVi2BNNf3MZGjl63LDZeGVO
6X2Skqg3sAbDtQhp/meORDRt468pD654TFiPXo5U7J9tzbR2E0AvcXQipbmxjwq9
Axx09VBezYgitYgNxRVB7qbPQJCQLyVtyyJUEudacvwfPtuU7ShmyvxxJRJEg48t
sFLftlZuYfqXm+II/ChpSQqvf4f52cpZ9z1XMrxTsV0HdEUbHQmjugKy0Vl7N5mG
IwoAftezD/wl9wfhw1QzaywUalWfyJqOZ5d+9PsmKjS3BNM+PO7AMdZtVn/ROjeB
phBTGA9yoD+83RU1zcx+UhIC83uwQvLDCWgnGsXQGR+M74Dv3UTLSoymCPGgXCjx
x6R2ztmKwkhchle3dy/5jk41OSlzuyZsU5kmB5pclKMggMRQKWo1J8hzwcuYFT7r
nC9AXUlWk5e61JKIkCq+1w97jf1jPwvH/P89Wri5t0dm7z/C8Ts=
=QGXm
-----END PGP SIGNATURE-----