Version in base suite: 2.20-2 Base version: biber_2.20-2 Target version: biber_2.20-2+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/b/biber/biber_2.20-2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/b/biber/biber_2.20-2+deb13u1.dsc changelog | 7 + patches/30c2a10fd16fd15f685786284ff30052741c8fe1.patch | 70 +++++++++++++++++ patches/47ccd83187dbdc9f62284b6347c2f9caec5452e2.patch | 59 ++++++++++++++ patches/584a1e372946b27927b82b0bce5558b57dac8e89.patch | 28 ++++++ patches/74252e608e5f8115375c532eb25416430a9f52eb.patch | 28 ++++++ patches/series | 4 6 files changed, 196 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp6rmka8ba/biber_2.20-2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp6rmka8ba/biber_2.20-2+deb13u1.dsc: no acceptable signature found diff -Nru biber-2.20/debian/changelog biber-2.20/debian/changelog --- biber-2.20/debian/changelog 2024-05-26 14:50:59.000000000 +0000 +++ biber-2.20/debian/changelog 2026-10-24 22:23:43.000000000 +0000 @@ -1,3 +1,10 @@ +biber (2.20-2+deb13u1) trixie; urgency=medium + + * Fix a security issue described on https://www.openwall.com/lists/oss-security/2026/08/17/1 + no CVE assigned. Patches cherry picked from upstream repository. + + -- Hilmar Preuße Sun, 25 Oct 2026 00:23:43 +0200 + biber (2.20-2) unstable; urgency=medium * Upload to unstable. diff -Nru biber-2.20/debian/patches/30c2a10fd16fd15f685786284ff30052741c8fe1.patch biber-2.20/debian/patches/30c2a10fd16fd15f685786284ff30052741c8fe1.patch --- biber-2.20/debian/patches/30c2a10fd16fd15f685786284ff30052741c8fe1.patch 1970-01-01 00:00:00.000000000 +0000 +++ biber-2.20/debian/patches/30c2a10fd16fd15f685786284ff30052741c8fe1.patch 2026-10-24 16:49:13.000000000 +0000 @@ -0,0 +1,70 @@ +From 30c2a10fd16fd15f685786284ff30052741c8fe1 Mon Sep 17 00:00:00 2001 +From: plk +Date: Sun, 28 Jun 2026 12:15:37 +0200 +Subject: [PATCH] Fixing eval requiresafety issue + +--- + lib/Biber.pm | 7 +++++-- + lib/Biber/Constants.pm | 12 ++++++++++++ + 2 files changed, 17 insertions(+), 2 deletions(-) + +--- biber.orig/lib/Biber.pm ++++ biber/lib/Biber.pm +@@ -4601,6 +4601,7 @@ + my $name = $datasource->{name}; + my $encoding = $datasource->{encoding}; + my $datatype = $datasource->{datatype}; ++ + if ($datatype eq 'biblatexml') { + my $outfile; + if (Biber::Config->getoption('tool')) { +@@ -4620,8 +4621,9 @@ + validate_biber_xml($name, 'bltx', 'http://biblatex-biber.sourceforge.net/biblatexml', $outfile); + } + } ++ + my $package = 'Biber::Input::' . $type . '::' . $datatype; +- unless(eval "require $package") { ++ unless($ALLOWEDTYPES{$type} and $ALLOWEDDATATYPES{$datatype} and eval "require $package") { + + my ($vol, $dir, undef) = File::Spec->splitpath( $INC{"Biber.pm"} ); + $dir =~ s/\/$//; # splitpath sometimes leaves a trailing '/' +@@ -4822,8 +4824,9 @@ + my $encoding = $datasource->{encoding}; + my $datatype = $datasource->{datatype}; + my $package = 'Biber::Input::' . $type . '::' . $datatype; +- eval "require $package" or ++ unless ($ALLOWEDTYPES{$type} and $ALLOWEDDATATYPES{$datatype} and eval "require $package") { + biber_error("Error loading data source package '$package': $@"); ++ } + $missing->@* = "${package}::extract_entries"->(locate_data_file($name), $encoding, $missing); + } + } +--- biber.orig/lib/Biber/Constants.pm ++++ biber/lib/Biber/Constants.pm +@@ -13,6 +13,8 @@ + use Unicode::UCD qw(num); + + our @EXPORT = qw{ ++ %ALLOWEDTYPES ++ %ALLOWEDDATATYPES + $CONFIG_DEFAULT_BIBER + $CONFIG_CSV_PARSER + $BIBER_CONF_NAME +@@ -313,6 +315,16 @@ + xsvsep => { content => q/\s*,\s*/ }, + }; + ++# Used to restrict evals on requires ++our %ALLOWEDTYPES = ( ++ file => 1 ++ ); ++ ++our %ALLOWEDDATATYPES = ( ++ bibtex => 1, ++ biblatexml => 1 ++ ); ++ + # Set up some re-usable CSV parsers here for efficiency reasons + our $CONFIG_CSV_PARSER = Text::CSV->new ( { binary => 1, + allow_whitespace => 1, diff -Nru biber-2.20/debian/patches/47ccd83187dbdc9f62284b6347c2f9caec5452e2.patch biber-2.20/debian/patches/47ccd83187dbdc9f62284b6347c2f9caec5452e2.patch --- biber-2.20/debian/patches/47ccd83187dbdc9f62284b6347c2f9caec5452e2.patch 1970-01-01 00:00:00.000000000 +0000 +++ biber-2.20/debian/patches/47ccd83187dbdc9f62284b6347c2f9caec5452e2.patch 2026-10-24 16:49:10.000000000 +0000 @@ -0,0 +1,59 @@ +From 47ccd83187dbdc9f62284b6347c2f9caec5452e2 Mon Sep 17 00:00:00 2001 +From: plk +Date: Sat, 27 Jun 2026 21:37:49 +0200 +Subject: [PATCH] Fixing /ee safety issue + +--- + lib/Biber/Utils.pm | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +--- biber.orig/lib/Biber/Utils.pm ++++ biber/lib/Biber/Utils.pm +@@ -22,6 +22,7 @@ + use Regexp::Common qw( balanced ); + use List::AllUtils qw( first ); + use Log::Log4perl qw(:no_extra_logdie_message); ++use Safe; + use Scalar::Util qw(looks_like_number); + use Text::Balanced qw(extract_bracketed); + use Text::CSV; +@@ -1084,27 +1085,25 @@ + + =head2 ireplace + +- Do an interpolating match/replace using a match RE, replacement RE ++ Do a relatively safe interpolating match/replace using a match RE, replacement RE + and string passed in as variables + + =cut + + sub ireplace { +- my ($value, $val_match, $val_replace, $ci) = @_; +- return $value unless $val_match; +- if ($ci) { +- $val_match = qr/$val_match/i; +- } +- else { +- $val_match = qr/$val_match/; +- } +- # Tricky quoting because of later evals +- $val_replace = '"' . $val_replace . '"'; +- $value =~ s/$val_match/$val_replace/eegxms; +- return $value; ++ my ($value, $val_match, $val_replace, $ci) = @_; ++ return $value unless length $val_match; ++ $val_match = $ci ? qr/$val_match/i : qr/$val_match/; ++ ++ my $cpt = Safe->new; ++ $cpt->permit_only(qw(:default)); ++ $value =~ s{$val_match}{ ++ my $r = $cpt->reval(qq{"$val_replace"}); ++ $@ ? $val_match : $r; ++ }egxms; ++ return $value; + } + +- + =head2 validate_biber_xml + + Validate a biber/biblatex XML metadata file against an RNG XML schema diff -Nru biber-2.20/debian/patches/584a1e372946b27927b82b0bce5558b57dac8e89.patch biber-2.20/debian/patches/584a1e372946b27927b82b0bce5558b57dac8e89.patch --- biber-2.20/debian/patches/584a1e372946b27927b82b0bce5558b57dac8e89.patch 1970-01-01 00:00:00.000000000 +0000 +++ biber-2.20/debian/patches/584a1e372946b27927b82b0bce5558b57dac8e89.patch 2026-10-24 16:36:23.000000000 +0000 @@ -0,0 +1,28 @@ +From 584a1e372946b27927b82b0bce5558b57dac8e89 Mon Sep 17 00:00:00 2001 +From: plk +Date: Mon, 29 Jun 2026 04:17:49 +0200 +Subject: [PATCH] Fixing verbatim sortstring issue + +--- + lib/Biber/Internals.pm | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/lib/Biber/Internals.pm b/lib/Biber/Internals.pm +index b20669aaa..50762d5f6 100644 +--- a/lib/Biber/Internals.pm ++++ b/lib/Biber/Internals.pm +@@ -1480,12 +1480,12 @@ sub _sort_literal { + + # This is a meta-sub which uses the optional arguments to the dispatch code + # It's done to avoid having many repetitions of almost identical sorting code +-# for literal strings which need no normalising/translit. Nosort is still honoured. ++# for literal strings which need no normalising/translit. + sub _sort_verbatim { + my ($self, $citekey, $secnum, $section, $be, $dlist, $sortelementattributes, $args) = @_; + my $literal = $args->[0]; # get actual field + if (my $field = $be->get_field($literal)) { +- my $string = strip_nosort($field, $literal); ++ my $string = normalise_string_sort($field, $literal); + return _process_sort_attributes($field, $sortelementattributes); + } + else { diff -Nru biber-2.20/debian/patches/74252e608e5f8115375c532eb25416430a9f52eb.patch biber-2.20/debian/patches/74252e608e5f8115375c532eb25416430a9f52eb.patch --- biber-2.20/debian/patches/74252e608e5f8115375c532eb25416430a9f52eb.patch 1970-01-01 00:00:00.000000000 +0000 +++ biber-2.20/debian/patches/74252e608e5f8115375c532eb25416430a9f52eb.patch 2026-10-24 16:36:23.000000000 +0000 @@ -0,0 +1,28 @@ +From 74252e608e5f8115375c532eb25416430a9f52eb Mon Sep 17 00:00:00 2001 +From: plk +Date: Mon, 29 Jun 2026 17:23:31 +0200 +Subject: [PATCH] Fixing verbatim sortstring issue again + +--- + lib/Biber/Internals.pm | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/lib/Biber/Internals.pm b/lib/Biber/Internals.pm +index 50762d5f6..8329eb60a 100644 +--- a/lib/Biber/Internals.pm ++++ b/lib/Biber/Internals.pm +@@ -1483,10 +1483,10 @@ sub _sort_literal { + # for literal strings which need no normalising/translit. + sub _sort_verbatim { + my ($self, $citekey, $secnum, $section, $be, $dlist, $sortelementattributes, $args) = @_; +- my $literal = $args->[0]; # get actual field +- if (my $field = $be->get_field($literal)) { +- my $string = normalise_string_sort($field, $literal); +- return _process_sort_attributes($field, $sortelementattributes); ++ my $verb = $args->[0]; # get actual field ++ if (my $field = $be->get_field($verb)) { ++ my $string = normalise_string_sort($field, $verb); ++ return _process_sort_attributes($string, $sortelementattributes); + } + else { + return ''; diff -Nru biber-2.20/debian/patches/series biber-2.20/debian/patches/series --- biber-2.20/debian/patches/series 2024-04-21 10:22:00.000000000 +0000 +++ biber-2.20/debian/patches/series 2026-10-24 17:39:17.000000000 +0000 @@ -2,3 +2,7 @@ #03_whatis.patch fix-xpathcontext 04_fix-perl-shebang.patch +47ccd83187dbdc9f62284b6347c2f9caec5452e2.patch +30c2a10fd16fd15f685786284ff30052741c8fe1.patch +584a1e372946b27927b82b0bce5558b57dac8e89.patch +74252e608e5f8115375c532eb25416430a9f52eb.patch