Bug#1142759: trixie-pu: package qemu/1:10.0.12+ds-0+deb13u1

On 7/26/26 19:20, Salvatore Bonaccorso wrote:
> Hi Michael,
> 
> On Sun, Jul 26, 2026 at 04:42:22PM +0200, Salvatore Bonaccorso wrote:
>> Hi Michael,
>>
>> On Sat, Jul 25, 2026 at 10:06:29AM +0300, Michael Tokarev wrote:
>>> Package: release.debian.org
>>> Severity: normal
>>> Tags: trixie
>>> X-Debbugs-Cc: [email protected]
>>> Control: affects -1 + src:qemu
>>> User: [email protected]
>>> Usertags: pu
>>>
>>> [ Reason ]
>>> New upstream stable/bugfix release.  With more than 120 fixes all
>>> over the places, - fixing bugs, correctness.  Including the following
>>> CVE fixes:
>>>   CVE-2026-8348 CVE-2026-9238 CVE-2026-15578 CVE-2026-15705
>>>   CVE-2026-16043 CVE-2026-48002 CVE-2026-61475 CVE-2026-63319
>>
>> Is this the correct set of CVEs for this round? I'm asking because
>> CVE-2026-48002 was already fixed with 1:10.0.11+ds-0+deb13u1 ?
> 
> Okay that one consist of 3 commits, two of wich were in the earlier
> release and the last one in v10.0.12 upstream.

Here's the source of confusion, and the fact stable releases actually
happened in-between (which is described in the next message):

https://lore.kernel.org/qemu-devel/CAMxuvaxUWc=Qr9pQQ6wW6XnAzp4mf77aYpcFuXvret1KL_W9kA@mail.gmail.com/

so yeah, it's two halves of the same issue.

> I guess you are uploading v11.0.3 for unstable?

And I forgot to add the changelog for the changes in 11.0.3,
with all the CVEs mentioned in there.  I'm sorry for this,
but it's already uploaded.  I'm a bit too tired today for a
good work.

 From the git log v11.0.2..v11.0.3:

CVE-2026-8348
CVE-2026-9238
CVE-2026-15705
CVE-2026-15578
CVE-2026-16043 (the same doubling)
CVE-2026-48002
CVE-2026-63319
CVE-2026-61475

so it's the same set.

Thanks,

/mjt