Re: [SECURITY] libapt-pkg: wild pointer dereference and daemon crash via versionless stanza in debDebFileParser::UsePackage

David Kalnischkies <[email protected]> Tue, 18 Aug 2026 14:09:31 +0200

Newsgroups	gmane.linux.debian.apt.devel
Message-ID	<aoREVma55rDdlm1f@crossbow>

(not commenting at this moment on your actual report)

Am Tue, Aug 18, 2026 at 10:19:54AM +0300, schrieb Christos Papakonstantinou:
> We are always committed to responsible disclosure in accordance with your
> security policy.

Note that by mailing [email protected] you have publicly
disclosed your report already as that mail forwards to the
maintainer(s) of that package in Debian, which in this case
(and in many others as well) is a publicly archived mailing list.
Reference: https://lists.debian.org/deity/2026/08/msg00015.html

If you want to make a report against a Debian package its usually best
to contact Debians security team ~ they will know which and how to
contact the maintainers as well as fellow teams in downstream
distributions like Ubuntu and the rest of the large Debian family.
See also: https://www.debian.org/security/faq#contact

Of course, contacting Ubuntus security team only would have worked as
well, given you seem focused on Ubuntu, as they would have looped in
Debian and the rest if needed.


Best regards

David Kalnischkies

signature.asc (application/pgp-signature, 833 B)