Version in base suite: 2.91-1+deb13u1 Base version: dnsmasq_2.91-1+deb13u1 Target version: dnsmasq_2.91-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/d/dnsmasq/dnsmasq_2.91-1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/d/dnsmasq/dnsmasq_2.91-1+deb13u2.dsc changelog | 8 ++++ patches/CVE-2026-12725.patch | 84 +++++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-12969.patch | 36 ++++++++++++++++++ patches/series | 2 + 4 files changed, 130 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp1kwqa48h/dnsmasq_2.91-1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp1kwqa48h/dnsmasq_2.91-1+deb13u2.dsc: no acceptable signature found diff -Nru dnsmasq-2.91/debian/changelog dnsmasq-2.91/debian/changelog --- dnsmasq-2.91/debian/changelog 2026-05-02 16:50:46.000000000 +0000 +++ dnsmasq-2.91/debian/changelog 2026-09-01 13:47:50.000000000 +0000 @@ -1,3 +1,11 @@ +dnsmasq (2.91-1+deb13u2) trixie; urgency=medium + + * d/p/*: + - CVE-2026-12725.patch: Fix heap-based buffer overflow. + - CVE-2026-12969.patch: Fix out-of-bounds read vulnerability. + + -- Sven Geuer Tue, 01 Sep 2026 15:47:50 +0200 + dnsmasq (2.91-1+deb13u1) trixie-security; urgency=high * d/p/*: diff -Nru dnsmasq-2.91/debian/patches/CVE-2026-12725.patch dnsmasq-2.91/debian/patches/CVE-2026-12725.patch --- dnsmasq-2.91/debian/patches/CVE-2026-12725.patch 1970-01-01 00:00:00.000000000 +0000 +++ dnsmasq-2.91/debian/patches/CVE-2026-12725.patch 2026-09-01 13:47:50.000000000 +0000 @@ -0,0 +1,84 @@ +commit 36d081e37477027fd721fea498f3760f529034ad +Author: Simon Kelley +Date: Tue Apr 21 22:14:41 2026 +0100 + + Fix buffer overlow in log_query() + + The addition of "(not supported)" to logs of DS and DNSKEY replies + overflows the buffer used to construct the string. + + Re-arrange things to avoid this, and add checks to avoid the same problem + if the logging calls change in the future. + + Thanks to Yiwei Hou for finding this. + + The problem exists is DNSSEC is enabled and query logging is also + enabled. The overwrite is of bounded length and the bytes + written are not in control of an attacker, so this is not considered + a likely remote-execution vector. + +--- a/src/cache.c ++++ b/src/cache.c +@@ -2174,7 +2174,7 @@ + return; + + /* build query type string if requested */ +- if (!(flags & (F_SERVER | F_IPSET)) && type > 0) ++ if (!(flags & (F_SERVER | F_IPSET | F_KEYTAG | F_RR)) && type > 0) + arg = querystr(arg, type); + + dest = arg; +@@ -2190,15 +2190,21 @@ + { + dest = daemon->addrbuff; + +- if (flags & F_RR) +- { +- if (flags & F_KEYTAG) +- dest = querystr(NULL, addr->rrblock.rrtype); +- else +- dest = querystr(NULL, addr->rrdata.rrtype); +- } +- else if (flags & F_KEYTAG) +- sprintf(daemon->addrbuff, arg, addr->log.keytag, addr->log.algo, addr->log.digest); ++ if (flags & F_RR) ++ { ++ if (flags & F_KEYTAG) ++ dest = querystr(NULL, addr->rrblock.rrtype); ++ else ++ dest = querystr(NULL, addr->rrdata.rrtype); ++ } ++#ifdef HAVE_DNSSEC ++ else if (flags & F_KEYTAG) ++ { ++ snprintf(daemon->addrbuff, ADDRSTRLEN, arg, addr->log.keytag, addr->log.algo, addr->log.digest); ++ if (type) ++ extra = " (not supported)"; ++ } ++#endif + else if (flags & F_RCODE) + { + unsigned int rcode = addr->log.rcode; +--- a/src/dnssec.c ++++ b/src/dnssec.c +@@ -955,10 +955,7 @@ + + a.log.keytag = keytag; + a.log.algo = algo; +- if (algo_digest_name(algo)) +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu", 0); +- else +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu (not supported)", 0); ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DNSKEY keytag %hu, algo %hu", !algo_digest_name(algo)); + } + } + +@@ -1084,7 +1081,7 @@ + a.log.keytag = keytag; + a.log.algo = algo; + a.log.digest = digest; +- log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS for keytag %hu, algo %hu, digest %hu (not supported)", 0); ++ log_query(F_NOEXTRA | F_KEYTAG | F_UPSTREAM, name, &a, "DS for keytag %hu, algo %hu, digest %hu", 1); + neg_ttl = ttl; + } + else if ((key = blockdata_alloc((char*)p, rdlen - 4))) diff -Nru dnsmasq-2.91/debian/patches/CVE-2026-12969.patch dnsmasq-2.91/debian/patches/CVE-2026-12969.patch --- dnsmasq-2.91/debian/patches/CVE-2026-12969.patch 1970-01-01 00:00:00.000000000 +0000 +++ dnsmasq-2.91/debian/patches/CVE-2026-12969.patch 2026-09-01 13:47:50.000000000 +0000 @@ -0,0 +1,36 @@ +commit 14094e88beca519c53151184cc4553656672b54f +Author: do litli +Date: Sat May 9 22:21:18 2026 +0100 + + Fix buffer OOB read in find_soa() + + In find_soa() extract_name() is called with extrabytes=0 when parsing NS + record names, which means it only validates that the DNS name fits + within the packet but does not check that 10 additional bytes exist for + the type/class/TTL/rdlen fixed fields. Lines 546-549 then + unconditionally read these 10 bytes via GETSHORT/GETLONG macros. An + attacker controlling a DNS zone can craft a NXDOMAIN response where the + NS record name extends to the packet boundary, causing a 10-byte + out-of-bounds read past the valid packet data (CWE-125, CVSS 5.3 + Medium). The read stays within the over-allocated packet buffer in + default configurations, limiting crash risk, but accesses data outside + the logical packet boundary. Under certain conditions, the overread may + access stale heap data from prior transactions. + + The fix is straightforward: change the extrabytes + argument from 0 to 10, consistent with other call sites in + the same file. + + Credit is due to do litli for finding this problem. + +--- a/src/rfc1035.c ++++ b/src/rfc1035.c +@@ -533,7 +533,7 @@ + + for (i = 0; i < ntohs(header->nscount); i++) + { +- if (!extract_name(header, qlen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 0)) ++ if (!extract_name(header, qlen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 10)) + return 0; /* bad packet */ + + GETSHORT(qtype, p); diff -Nru dnsmasq-2.91/debian/patches/series dnsmasq-2.91/debian/patches/series --- dnsmasq-2.91/debian/patches/series 2026-05-02 16:50:46.000000000 +0000 +++ dnsmasq-2.91/debian/patches/series 2026-09-01 13:47:50.000000000 +0000 @@ -6,3 +6,5 @@ CVE-2026-4892.patch CVE-2026-4893.patch CVE-2026-5172.patch +CVE-2026-12725.patch +CVE-2026-12969.patch