Debian alert DLA-4805-1 (mkvtoolnix)

From:
             
 
Thorsten Alteholz <debian@alteholz.de>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4805-1] mkvtoolnix security update
Date:
             
 
Wed, 30 Sep 2026 17:38:30 +0000
Message-ID:
             
 
<6e179bc-e22-1cd7-a845-77bc38ba757c@alteholz.de>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4805-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                    Thorsten Alteholz
September 30, 2026                            https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : mkvtoolnix
Version        : 74.0.0-1+deb12u1
CVE ID         : CVE-2026-90783


An issue has been found in mkvtoolnix, a set of command-line tools to work 
with Matroska files. The issue is related to a heap buffer overflow in 
the bundled avilib.
The only way to avoid this issue is to update the software.


For Debian 12 bookworm, this problem has been fixed in version
74.0.0-1+deb12u1.

We recommend that you upgrade your mkvtoolnix packages.

For the detailed security status of mkvtoolnix please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/mkvtoolnix

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEYgH7/9u94Hgi6ruWlvysDTh7WEcFAmq9SRZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDYy
MDFGQkZGREJCREUwNzgyMkVBQkI5Njk2RkNBQzBEMzg3QjU4NDcACgkQlvysDTh7
WEf6yhAAg0NVnY07LbhsGtSbUUO4BcWz8OkwSm0eXwyoiROEpnQ1xuKiN4xekC9E
PitAmWZTfX7iyfuX1g2lkmixLY05Mcp1wkdi2Z3VWwqquAn7tI4APm2Q9mW1DwkC
N6dWcxTeBFr+tzp03bPwyvV2g/R7Vl4JwYrh14mJ/Uy30B8zhJ3/RdUvWD08LGqW
lyMLqJTZxhnbIiaEQjoLYKxaBwyj9JLjkII8Th3GFHQrnyQawmFZAIO18b1zP97U
/cnh6bO4xyGuFSmw3BCunBOPqDtyxYUjnE35h2ZRBg0kqk5KWx3C7mIOCpGEMcIb
Qs1N9whOdZBVgeW0gqS8EdFArCQgUc0AvS0p4LUXdpL8JyuSueGJyCIACSNaEFm+
z845C72HLsQfD4K24bLh9KuLw+hLyngxXqJ1kiY5k0Ra2iYc9aOUdGvOPSq4t+4E
6UCJcdb4hgGI0lfyt2f2QqsX8NqGGfpVS5wq5NOgHyhbDGKase2y9rnToGXzap1+
l7zwOZeyywFCdlbPAnOU4Db56+uZHnV10tAOIFLp/mQe2Q9kTyYmD5m+QWimx4bx
sGZJVrSRM2zNX217hmTgJt86kYhH43OSyeUiDubHZyEJtgWt3htlg0rulJ3wgmD4
CHKblBz40hnAeDL0veniNu01SCsgbYboMgMxlrYO96DQnAvlZok=
=bcKs
-----END PGP SIGNATURE-----