Version in base suite: 0.41.1-2+deb13u1 Base version: kitty_0.41.1-2+deb13u1 Target version: kitty_0.41.1-2+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/k/kitty/kitty_0.41.1-2+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/k/kitty/kitty_0.41.1-2+deb13u2.dsc changelog | 11 +++++++++++ patches/0016-CVE-2026-33633.patch | 4 +--- patches/0018-CVE-2026-42850.patch | 27 +++++++++++++++++++++++++++ patches/0019-CVE-2026-42851.patch | 23 +++++++++++++++++++++++ patches/0020-CVE-2026-54055.patch | 17 +++++++++++++++++ patches/0021-CVE-2026-54057.patch | 21 +++++++++++++++++++++ patches/series | 4 ++++ 7 files changed, 104 insertions(+), 3 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp6h8apnzq/kitty_0.41.1-2+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp6h8apnzq/kitty_0.41.1-2+deb13u2.dsc: no acceptable signature found diff -Nru kitty-0.41.1/debian/changelog kitty-0.41.1/debian/changelog --- kitty-0.41.1/debian/changelog 2026-05-22 19:24:52.000000000 +0000 +++ kitty-0.41.1/debian/changelog 2026-06-13 17:20:48.000000000 +0000 @@ -1,3 +1,14 @@ +kitty (0.41.1-2+deb13u2) trixie-security; urgency=medium + + * Re-diff 0016-CVE-2026-33633 patch + * Fixing following CVEs: (Closes: #1139898) + - CVE-2026-42850 + - CVE-2026-42851 + - CVE-2026-54055 + - CVE-2026-54057 + + -- Nilesh Patra Sat, 13 Jun 2026 22:50:48 +0530 + kitty (0.41.1-2+deb13u1) trixie-security; urgency=medium * Add patches to fix CVE-2026-33642 and CVE-2026-33633 diff -Nru kitty-0.41.1/debian/patches/0016-CVE-2026-33633.patch kitty-0.41.1/debian/patches/0016-CVE-2026-33633.patch --- kitty-0.41.1/debian/patches/0016-CVE-2026-33633.patch 2026-05-22 19:24:19.000000000 +0000 +++ kitty-0.41.1/debian/patches/0016-CVE-2026-33633.patch 2026-06-13 17:20:48.000000000 +0000 @@ -4,11 +4,9 @@ Subject: [PATCH] Graphics protocol: Fix crash when handling invalid PNG image with direct transmission -diff --git a/kitty/graphics.c b/kitty/graphics.c -index 3cfec4ba39e..944c21dab55 100644 --- a/kitty/graphics.c +++ b/kitty/graphics.c -@@ -555,7 +555,7 @@ load_image_data(GraphicsManager *self, Image *img, const GraphicsCommand *g, con +@@ -548,7 +548,7 @@ case 'd': // direct if (load_data->buf_capacity - load_data->buf_used < g->payload_sz) { if (load_data->buf_used + g->payload_sz > MAX_DATA_SZ || data_fmt != PNG) ABRT("EFBIG", "Too much data"); diff -Nru kitty-0.41.1/debian/patches/0018-CVE-2026-42850.patch kitty-0.41.1/debian/patches/0018-CVE-2026-42850.patch --- kitty-0.41.1/debian/patches/0018-CVE-2026-42850.patch 1970-01-01 00:00:00.000000000 +0000 +++ kitty-0.41.1/debian/patches/0018-CVE-2026-42850.patch 2026-06-13 17:20:48.000000000 +0000 @@ -0,0 +1,27 @@ +From e4144832645aa437e9cfb4914ca0a358ae74724d Mon Sep 17 00:00:00 2001 +From: Kovid Goyal +Date: Fri, 24 Apr 2026 17:25:00 +0530 +Subject: [PATCH] Sanitize ssh kitten shm open error message when sending over + tty + +This prevents sending attacker controlled data over the tty where it +might end up getting evaled by the shell if the user is doing something +like cat of unsanitized data into the terminal (something that should +never be done). +--- + kittens/ssh/utils.py | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kittens/ssh/utils.py ++++ b/kittens/ssh/utils.py +@@ -136,7 +136,9 @@ + raise ValueError(f'Incorrect request id: {rq_id!r} expecting the KITTY_PID-KITTY_WINDOW_ID for the current kitty window') + except Exception as e: + traceback.print_exc() +- yield f'{e}\n'.encode() ++ import re ++ msg = re.sub(r'[^a-zA-Z0-9 ]+', '_', str(e)) ++ yield f'{msg}\n'.encode() + else: + yield b'OK\n' + encoded_data = memoryview(env_data['tarfile'].encode('ascii')) diff -Nru kitty-0.41.1/debian/patches/0019-CVE-2026-42851.patch kitty-0.41.1/debian/patches/0019-CVE-2026-42851.patch --- kitty-0.41.1/debian/patches/0019-CVE-2026-42851.patch 1970-01-01 00:00:00.000000000 +0000 +++ kitty-0.41.1/debian/patches/0019-CVE-2026-42851.patch 2026-06-13 17:20:48.000000000 +0000 @@ -0,0 +1,23 @@ +From 8bf1bd479b0e75c9010800d135c8d90690d94645 Mon Sep 17 00:00:00 2001 +From: Kovid Goyal +Date: Sat, 4 Apr 2026 08:42:06 +0530 +Subject: [PATCH] edit-in-kitty: Ignore environment variables as some editors + execute code present in env vars + +--- a/kitty/launch.py ++++ b/kitty/launch.py +@@ -994,6 +994,14 @@ + return + cmdline = get_editor(path_to_edit=c.file_localpath, line_number=c.line_number) + c.opts.source_window = c.opts.next_to = f'id:{window.id}' ++ # We ignore env vars as some editors execute code present in env vars such as VIMINIT ++ c.opts.env = () ++ c.opts.copy_env = False ++ # We ignore color specs because color values containing '=' are re-parsed ++ # as inline kitty config (kitty/colors.py:parse_colors) and the config ++ # language honours `geninclude`, which executes attacker-controlled .py ++ # via runpy.run_path. The edit DCS path is unauthenticated. ++ c.opts.color = () + w = launch(get_boss(), c.opts, cmdline) + if w is not None: + c.source_window_id = window.id diff -Nru kitty-0.41.1/debian/patches/0020-CVE-2026-54055.patch kitty-0.41.1/debian/patches/0020-CVE-2026-54055.patch --- kitty-0.41.1/debian/patches/0020-CVE-2026-54055.patch 1970-01-01 00:00:00.000000000 +0000 +++ kitty-0.41.1/debian/patches/0020-CVE-2026-54055.patch 2026-06-13 17:20:48.000000000 +0000 @@ -0,0 +1,17 @@ +From 4aa4a5c0567a92553a8c20a88a4352da637fca5d Mon Sep 17 00:00:00 2001 +From: Kovid Goyal +Date: Wed, 3 Jun 2026 06:18:31 +0530 +Subject: [PATCH] File transfer protocol: use O_NOFOLLOW when opening regular + files + +--- a/kitty/file_transmission.py ++++ b/kitty/file_transmission.py +@@ -546,7 +546,7 @@ + if self.actual_file is None: + self.make_parent_dirs() + self.unlink_existing_if_needed() +- flags = os.O_RDWR | os.O_CREAT | os.O_TRUNC | getattr(os, 'O_CLOEXEC', 0) | getattr(os, 'O_BINARY', 0) ++ flags = os.O_RDWR | os.O_CREAT | os.O_TRUNC | getattr(os, 'O_CLOEXEC', 0) | getattr(os, 'O_BINARY', 0) | getattr(os, 'O_NOFOLLOW', 0) + self.actual_file = open(os.open(self.name, flags, self.permissions), mode='r+b', closefd=True) + af = self.actual_file + if decompressed or is_last: diff -Nru kitty-0.41.1/debian/patches/0021-CVE-2026-54057.patch kitty-0.41.1/debian/patches/0021-CVE-2026-54057.patch --- kitty-0.41.1/debian/patches/0021-CVE-2026-54057.patch 1970-01-01 00:00:00.000000000 +0000 +++ kitty-0.41.1/debian/patches/0021-CVE-2026-54057.patch 2026-06-13 17:20:48.000000000 +0000 @@ -0,0 +1,21 @@ +From 424fe9991b5ad61422ca5d1b0ff9b8e01465e6f5 Mon Sep 17 00:00:00 2001 +From: Kovid Goyal +Date: Tue, 9 Jun 2026 06:21:15 +0530 +Subject: [PATCH] Sanitise color control responses for shells that still dont + use the kitty keyboard protocol + +--- + kitty/window.py | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kitty/window.py ++++ b/kitty/window.py +@@ -486,6 +486,8 @@ + if isinstance(value, (bytes, memoryview)): + value = str(value, 'utf-8', 'replace') + responses: dict[str, str] = {} ++ # Only printable ASCII payload allowed as it is echoed back ++ value = re.sub(r'[^ -~]', '', value) + for rec in value.split(';'): + key, sep, val = rec.partition('=') + if key.startswith('transparent_background_color'): diff -Nru kitty-0.41.1/debian/patches/series kitty-0.41.1/debian/patches/series --- kitty-0.41.1/debian/patches/series 2026-05-22 19:24:19.000000000 +0000 +++ kitty-0.41.1/debian/patches/series 2026-06-13 17:20:48.000000000 +0000 @@ -14,3 +14,7 @@ 0015-backport-s390x-ftbfs-fix.patch 0016-CVE-2026-33633.patch 0017-CVE-2026-33642.patch +0018-CVE-2026-42850.patch +0019-CVE-2026-42851.patch +0020-CVE-2026-54055.patch +0021-CVE-2026-54057.patch