Version in base suite: 0.53-4

Base version: libxml-bare-perl_0.53-4
Target version: libxml-bare-perl_0.53-4+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/libx/libxml-bare-perl/libxml-bare-perl_0.53-4.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/libx/libxml-bare-perl/libxml-bare-perl_0.53-4+deb13u1.dsc

 changelog                       |    9 +++++
 patches/CVE-2026-13401-r1.patch |   32 ++++++++++++++++++
 patches/CVE-2026-57074-r1.patch |   71 ++++++++++++++++++++++++++++++++++++++++
 patches/series                  |    2 +
 4 files changed, 114 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsod1pz05/libxml-bare-perl_0.53-4.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpsod1pz05/libxml-bare-perl_0.53-4+deb13u1.dsc: no acceptable signature found
diff -Nru libxml-bare-perl-0.53/debian/changelog libxml-bare-perl-0.53/debian/changelog
--- libxml-bare-perl-0.53/debian/changelog	2024-05-15 19:56:55.000000000 +0000
+++ libxml-bare-perl-0.53/debian/changelog	2026-09-05 12:05:52.000000000 +0000
@@ -1,3 +1,12 @@
+libxml-bare-perl (0.53-4+deb13u1) trixie; urgency=medium
+
+  * Team upload.
+
+  [ gregor herrmann ]
+  * Add patches to fix CVE-2026-13401 and CVE-2026-57074 (Closes: #1142227)
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 05 Sep 2026 14:05:52 +0200
+
 libxml-bare-perl (0.53-4) unstable; urgency=medium
 
   [ Helmut Grohne ]
diff -Nru libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch
--- libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch	1970-01-01 00:00:00.000000000 +0000
+++ libxml-bare-perl-0.53/debian/patches/CVE-2026-13401-r1.patch	2026-09-05 12:05:52.000000000 +0000
@@ -0,0 +1,32 @@
+From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
+Subject: [PATCH] XML::Bare: advance stuck attribute-name state (infinite loop)
+
+Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached
+by the default XML::Bare->new(text=>$xml)->parse on untrusted XML.
+
+The `att_nameqsdone` state — reached after a single-quoted attribute
+*name* — loops back to itself without advancing `cpos` on any character
+other than `=` or NUL, spinning forever in C on malformed input. The
+parser holds the interpreter for the duration of the call, so no
+Perl-level signal (`alarm`, etc.) can interrupt it: a single request
+pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`,
+`<x y=''''''z'>`.
+
+Fix: advance the cursor before looping, so the scan terminates at the
+next `=` or at the NUL sentinel (already handled by the `case 0` branch).
+
+Origin: https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch
+Bug: https://github.com/nanoscopic/perl-XML-Bare/pull/2
+Bug-Debian: https://bugs.debian.org/1142227
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-13401
+
+--- a/parser.c
++++ b/parser.c
+@@ -482,6 +482,7 @@
+           cpos++;
+           goto att_eq1;
+       }
++      cpos++; // advance the cursor so malformed input (no '=' after a quoted attr name) cannot spin forever
+       goto att_nameqsdone;
+       
+     att_eq1:
diff -Nru libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch
--- libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch	1970-01-01 00:00:00.000000000 +0000
+++ libxml-bare-perl-0.53/debian/patches/CVE-2026-57074-r1.patch	2026-09-05 12:05:52.000000000 +0000
@@ -0,0 +1,71 @@
+From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
+Subject: [PATCH] XML::Bare: bounds truncated fixed-advance lookahead (heap OOB read)
+
+Heap-buffer-overflow READ (CWE-125) in the hand-rolled C parser
+(parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on
+untrusted XML.
+
+Several transitions advance `cpos` by a fixed amount past a recognised
+token without checking the buffer end, then dereference the new position:
+
+  - the `<![CDATA` match does `cpos += 9` after confirming only eight
+    bytes (`<![CDATA`), so a truncated tail such as `<![CDATA\0` steps
+    one byte past the NUL terminator;
+  - the three "self-closing tag" branches (name_x, name_gap, att_name)
+    do `cpos += 2` on the assumption that a `>` follows the `/`, so a
+    truncated tail such as `<a/\0` steps past the NUL.
+
+The subsequent `let = *cpos;` in val_1/val_x/cdata then reads out of
+bounds. Trigger: `<!-- c --><a/`.
+
+Fix: require the full `<![CDATA[` (nine bytes) before the `+= 9`, and
+only skip the assumed `>` when `*(cpos+1)` is non-NUL. Both changes are
+behaviour-preserving for well-formed input — real CDATA always carries
+the `[`, and a non-truncated self-close always has a byte after the `/`;
+they differ only on the truncated-tail case that previously overran the
+allocation.
+
+Origin: https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch
+Bug: https://github.com/nanoscopic/perl-XML-Bare/pull/1
+Bug-Debian: https://bugs.debian.org/1142227
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-57074
+
+--- a/parser.c
++++ b/parser.c
+@@ -191,7 +191,8 @@
+                     *(cpos+4) == 'D' &&
+                     *(cpos+5) == 'A' &&
+                     *(cpos+6) == 'T' &&
+-                    *(cpos+7) == 'A'    ) {
++                    *(cpos+7) == 'A' &&
++                    *(cpos+8) == '['    ) { // require full "<![CDATA[" so cpos+=9 cannot skip past a truncated tail
+                   cpos += 9;
+                   curnode->type = 1;
+                   goto cdata;
+@@ -342,7 +343,7 @@
+           temp = nodec_addchildr( curnode, tagname, tagname_len );
+           temp->z = cpos +1 - xmlin;
+           tagname_len            = 0;
+-          cpos+=2;
++          if( *(cpos+1) ) cpos += 2; else cpos++; // skip assumed '>' only if not the NUL terminator
+           goto val_1;
+       }
+       
+@@ -366,7 +367,7 @@
+           curnode->z = cpos+1-xmlin;
+           curnode = curnode->parent;
+           if( !curnode ) goto done;
+-          cpos+=2; // am assuming next char is >
++          if( *(cpos+1) ) cpos += 2; else cpos++; // was: assume next char is > (skip past NUL on truncated tail)
+           goto val_1;
+         case '=':
+           cpos++;
+@@ -423,7 +424,7 @@
+           curnode->z = cpos+1-xmlin;
+           curnode = curnode->parent;
+           if( !curnode ) goto done;
+-          cpos += 2;
++          if( *(cpos+1) ) cpos += 2; else cpos++; // "/> assumed" — skip '>' only if present, not the NUL
+           goto val_1;
+         case ' ':
+           if( *(cpos+1) == '=' ) {
diff -Nru libxml-bare-perl-0.53/debian/patches/series libxml-bare-perl-0.53/debian/patches/series
--- libxml-bare-perl-0.53/debian/patches/series	2024-05-15 19:56:55.000000000 +0000
+++ libxml-bare-perl-0.53/debian/patches/series	2026-09-05 12:05:52.000000000 +0000
@@ -2,3 +2,5 @@
 libm.patch
 pointer_from_integer.patch
 cross.patch
+CVE-2026-13401-r1.patch
+CVE-2026-57074-r1.patch