Version in base suite: 0.5.50-1 Base version: libhtp_0.5.50-1 Target version: libhtp_0.5.50-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libh/libhtp/libhtp_0.5.50-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libh/libhtp/libhtp_0.5.50-1+deb13u1.dsc changelog | 7 ++ patches/0001-decompressors-fix-leak-in-lzma-error-case.patch | 27 +++++++++++ patches/series | 1 3 files changed, 35 insertions(+) diff -Nru libhtp-0.5.50/debian/changelog libhtp-0.5.50/debian/changelog --- libhtp-0.5.50/debian/changelog 2025-03-18 08:04:23.000000000 +0000 +++ libhtp-0.5.50/debian/changelog 2025-09-08 12:03:54.000000000 +0000 @@ -1,3 +1,10 @@ +libhtp (1:0.5.50-1+deb13u1) trixie; urgency=medium + + * Non-maintainer upload. + * CVE-2025-53537: memory leak with LZMA (Closes: #1109838) + + -- Adrian Bunk Mon, 08 Sep 2025 15:03:54 +0300 + libhtp (1:0.5.50-1) unstable; urgency=medium * New upstream release. diff -Nru libhtp-0.5.50/debian/patches/0001-decompressors-fix-leak-in-lzma-error-case.patch libhtp-0.5.50/debian/patches/0001-decompressors-fix-leak-in-lzma-error-case.patch --- libhtp-0.5.50/debian/patches/0001-decompressors-fix-leak-in-lzma-error-case.patch 1970-01-01 00:00:00.000000000 +0000 +++ libhtp-0.5.50/debian/patches/0001-decompressors-fix-leak-in-lzma-error-case.patch 2025-09-08 12:03:54.000000000 +0000 @@ -0,0 +1,27 @@ +From e49cc779e0b4333354057b40c25c453af6aef61f Mon Sep 17 00:00:00 2001 +From: Philippe Antoine +Date: Tue, 17 Jun 2025 10:12:47 +0200 +Subject: decompressors: fix leak in lzma error case + +Ticket: 7766 +--- + htp/htp_decompressors.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/htp/htp_decompressors.c b/htp/htp_decompressors.c +index d66b6e8..02afd37 100644 +--- a/htp/htp_decompressors.c ++++ b/htp/htp_decompressors.c +@@ -350,6 +350,9 @@ restart: + // There is data even if there is an error + // So use this data and log a warning + htp_log(d->tx->connp, HTP_LOG_MARK, HTP_LOG_WARNING, 0, "GZip decompressor: inflate failed with %d", rc); ++ if (drec->zlib_initialized == HTP_COMPRESSION_LZMA) { ++ LzmaDec_Free(&drec->state, &lzma_Alloc); ++ } + drec->zlib_initialized = HTP_COMPRESSION_OVER; + return HTP_ERROR; + } +-- +2.30.2 + diff -Nru libhtp-0.5.50/debian/patches/series libhtp-0.5.50/debian/patches/series --- libhtp-0.5.50/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ libhtp-0.5.50/debian/patches/series 2025-09-08 12:03:54.000000000 +0000 @@ -0,0 +1 @@ +0001-decompressors-fix-leak-in-lzma-error-case.patch