Debian alert DLA-4804-1 (libsmpp34)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4804-1] libsmpp34 security update
Date:
             
 
Wed, 30 Sep 2026 14:33:15 +0000
Message-ID:
             
 
<372ce60-d49-7fe2-b1b8-6c38491f8b8c@alteholz.de>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4804-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
September 30, 2026                            https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libsmpp34
Version        : 1.14.1-3+deb12u1
CVE ID         : CVE-2026-75895


An issue has been found in libsmpp34, a library for Open PDU SMPP 
packaging and unpackaging. The issue is related to an out of bound read 
while processing attacker controlled SMPP PDUs, which could lead to 
memory corruption.
The only way to avoid this issue is to update the software.


For Debian 12 bookworm, this problem has been fixed in version
1.14.1-3+deb12u1.

We recommend that you upgrade your libsmpp34 packages.

For the detailed security status of libsmpp34 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libsmpp34

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmq9HaxfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEf6rQ/+NcorvGwV6VBt4DBrZ7CeSWbJaAVQ4DaMkyrCfQfOJjnfbMuteQtogLHW
EJps1TJ6+N74mUyAYg9N43xn0nv7e2heSLHwCfRUahD6cCUGDybDI1MB2cwyoRVH
Yj7z+uR+8Dg2v6fiXSTI8HbewSR/TSM+WFjLf9x5cYlphHPJuvIoPVx1qDlHtS0q
TIOE35r25+yektkjoppClbuKy9mmAhSKR4sLzX53Jx7ZMlq4D8GYBkx2+E3eoOwr
TCGZmu5jt3njKHpI/sFuc2Ys88OwgruTcs06cD2ulIZYxEUIBbDPfal9F1gA7wAP
4NW4yHs0cqOJvBOxurgaHjRp7iXHxVVsjpHHVEsgVtSt6JJxbEGbBvTm3UmI0H4j
WOrTRgji/tzN6C7aYXswQoTrPmSM64SipuiXWB/jYq/lMpCGRKTnDlwIcSX3Ee1a
2+Q2qdCZo6lcRhfTJ6G9JN+jj0bSIrX7PPSGg7RnsziHigmWd0E9L3/M5D9XxVcX
K+IgUZFU96xqnf9F+yReeMPZD0obJ77L4K5meMk/wdeh9FfGYmkhCTT16jRy1vA1
OS8iHrNSCJ1Aab1lddX+VszmYT7FnOgzKWeW+oO0Stuamhbe7wioiefsR4gvRb/V
pJRZNuc14Hw3heLKFhWzvL0k3YZlesfopJ1mS+kYkMsrpxrhKpk=
=8cUY
-----END PGP SIGNATURE-----