Version in base suite: 1.9.3-1 Base version: goaccess_1.9.3-1 Target version: goaccess_1.9.3-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/goaccess/goaccess_1.9.3-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/goaccess/goaccess_1.9.3-1+deb13u1.dsc changelog | 14 +++ patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch | 37 ++++++++ patches/0002-Tighten-websocket-payload-length-handling.patch | 46 ++++++++++ patches/0003-Tighten-iOS-user-agent-parsing.patch | 23 +++++ patches/series | 3 salsa-ci.yml | 3 6 files changed, 126 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmplxrwu3te/goaccess_1.9.3-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmplxrwu3te/goaccess_1.9.3-1+deb13u1.dsc: no acceptable signature found diff -Nru goaccess-1.9.3/debian/changelog goaccess-1.9.3/debian/changelog --- goaccess-1.9.3/debian/changelog 2024-09-24 00:54:02.000000000 +0000 +++ goaccess-1.9.3/debian/changelog 2026-08-17 21:49:23.000000000 +0000 @@ -1,3 +1,17 @@ +goaccess (1:1.9.3-1+deb13u1) trixie; urgency=high + + * Apply security updates (Closes: #1143181) + Includes fixes for the following vulnerabilities: + - CVE-2026-54715: Heap Out-of-Bounds Write in GoAccess `parse_browser()` + - CVE-2026-55768: GoAccess WebSocket server: signed 32 bit truncation of + the 64 bit frame length causes a remote pre authentication denial of + service + - CVE-2026-55777: Out-of-bounds heap read in parse_ios() via crafted + User-Agent (opesys.c:323) lead to remote crash/DoS + * debian/salsa-ci.yml: disable uscan test for this branch + + -- Antonio Terceiro Mon, 17 Aug 2026 18:49:23 -0300 + goaccess (1:1.9.3-1) unstable; urgency=medium * New upstream version 1.9.3 diff -Nru goaccess-1.9.3/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch goaccess-1.9.3/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch --- goaccess-1.9.3/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch 1970-01-01 00:00:00.000000000 +0000 +++ goaccess-1.9.3/debian/patches/0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch 2026-08-17 21:49:23.000000000 +0000 @@ -0,0 +1,37 @@ +From: Gerardo O +Date: Sun, 7 Jun 2026 23:13:31 -0500 +Subject: Fix heap buffer overflow in parse_browser() Opera handling + +Anchor the offset to the actual 'Opera' position and require the slash to be at +or after the byte following it (op + 5 <= slh) so the destination can never run +past the buffer's NUL terminator. + +(cherry picked from commit 81f90d9dafd6956c188dea9f944d24946d3d3351) +--- + src/browsers.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/src/browsers.c b/src/browsers.c +index de0b56b..20f6fa7 100644 +--- a/src/browsers.c ++++ b/src/browsers.c +@@ -525,7 +525,7 @@ check_http_crawler (const char *str) { + * Otherwise the parsed browser is returned. */ + static char * + parse_browser (char *match, char *type, int i, char ***hash) { +- char *b = NULL, *ptr = NULL, *slh = NULL; ++ char *b = NULL, *ptr = NULL, *slh = NULL, *op = NULL; + size_t cnt = 0, space = 0; + + match = char_replace (match, '+', '-'); +@@ -547,8 +547,8 @@ parse_browser (char *match, char *type, int i, char ***hash) { + return parse_opera (slh); + } + /* Opera has the version number at the end */ +- if (strstr (match, "Opera") && (slh = strrchr (match, '/')) && match < slh) { +- memmove (match + 5, slh, strlen (slh) + 1); ++ if ((op = strstr (match, "Opera")) && (slh = strrchr (match, '/')) && op + 5 <= slh) { ++ memmove (op + 5, slh, strlen (slh) + 1); + } + /* IE Old */ + if (strstr (match, "MSIE") != NULL) { diff -Nru goaccess-1.9.3/debian/patches/0002-Tighten-websocket-payload-length-handling.patch goaccess-1.9.3/debian/patches/0002-Tighten-websocket-payload-length-handling.patch --- goaccess-1.9.3/debian/patches/0002-Tighten-websocket-payload-length-handling.patch 1970-01-01 00:00:00.000000000 +0000 +++ goaccess-1.9.3/debian/patches/0002-Tighten-websocket-payload-length-handling.patch 2026-08-17 21:49:23.000000000 +0000 @@ -0,0 +1,46 @@ +From: Gerardo O +Date: Mon, 15 Jun 2026 16:56:06 -0500 +Subject: Tighten websocket payload length handling. + +(cherry picked from commit ea74b87254d0adc675c087ff49bddd2d60dc01d5) +--- + src/websocket.c | 5 ++++- + src/websocket.h | 2 +- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/src/websocket.c b/src/websocket.c +index 8088921..8da1da9 100644 +--- a/src/websocket.c ++++ b/src/websocket.c +@@ -2027,7 +2027,7 @@ ws_get_frm_header (WSClient *client) { + ws_set_payloadlen ((*frm), (*frm)->buf); + ws_set_masking_key ((*frm), (*frm)->buf); + +- if ((*frm)->payloadlen > wsconfig.max_frm_size) { ++ if ((*frm)->payloadlen > (uint64_t) wsconfig.max_frm_size) { + ws_error (client, WS_CLOSE_TOO_LARGE, "Frame is too big"); + return ws_set_status (client, WS_ERR | WS_CLOSE, bytes); + } +@@ -2049,6 +2049,9 @@ ws_realloc_frm_payload (WSFrame *frm, WSMessage *msg) { + uint64_t newlen = 0; + + newlen = msg->payloadsz + frm->payloadlen; ++ if (newlen > (uint64_t) wsconfig.max_frm_size) ++ return 1; ++ + tmp = realloc (msg->payload, newlen); + if (tmp == NULL && newlen > 0) { + free (msg->payload); +diff --git a/src/websocket.h b/src/websocket.h +index 2846d6b..bd575a0 100644 +--- a/src/websocket.h ++++ b/src/websocket.h +@@ -195,7 +195,7 @@ typedef struct WSFrame_ { + unsigned char mask[4]; /* mask key */ + uint8_t res; /* extensions */ + int payload_offset; /* end of header/start of payload */ +- int payloadlen; /* payload length (for each frame) */ ++ uint64_t payloadlen; /* payload length (for each frame) */ + + /* status flags */ + int reading; /* still reading frame's header part? */ diff -Nru goaccess-1.9.3/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch goaccess-1.9.3/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch --- goaccess-1.9.3/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch 1970-01-01 00:00:00.000000000 +0000 +++ goaccess-1.9.3/debian/patches/0003-Tighten-iOS-user-agent-parsing.patch 2026-08-17 21:49:23.000000000 +0000 @@ -0,0 +1,23 @@ +From: Gerardo O +Date: Mon, 15 Jun 2026 19:49:17 -0500 +Subject: Tighten iOS user agent parsing + +(cherry picked from commit ba813ed97d998dbdcb8d87e178799a4bb2da9e81) +--- + src/opesys.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/opesys.c b/src/opesys.c +index f83d0c3..ca05690 100644 +--- a/src/opesys.c ++++ b/src/opesys.c +@@ -303,7 +303,8 @@ parse_ios (char *agent, int tlen) { + goto out; + + *q = 0; +- memmove (agent + tlen, agent + offset, offset); ++ /* Move the version suffix to sit immediately after the matched keyword. */ ++ memmove (agent + tlen, p, (size_t) (q - p) + 1); + return char_replace (agent, '_', '.'); + + out: diff -Nru goaccess-1.9.3/debian/patches/series goaccess-1.9.3/debian/patches/series --- goaccess-1.9.3/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ goaccess-1.9.3/debian/patches/series 2026-08-17 21:49:23.000000000 +0000 @@ -0,0 +1,3 @@ +0001-Fix-heap-buffer-overflow-in-parse_browser-Opera-hand.patch +0002-Tighten-websocket-payload-length-handling.patch +0003-Tighten-iOS-user-agent-parsing.patch diff -Nru goaccess-1.9.3/debian/salsa-ci.yml goaccess-1.9.3/debian/salsa-ci.yml --- goaccess-1.9.3/debian/salsa-ci.yml 2024-09-24 00:54:02.000000000 +0000 +++ goaccess-1.9.3/debian/salsa-ci.yml 2026-08-17 21:49:23.000000000 +0000 @@ -2,3 +2,6 @@ include: - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml + +variables: + SALSA_CI_DISABLE_USCAN: 1