Bug#1146131: trixie-pu: package binwalk/2.4.3+dfsg1-2+deb13u1

Sven Geuer <[email protected]> Sun, 30 Aug 2026 10:46:58 +0200

Newsgroups	gmane.linux.debian.devel.release
Message-ID	<8b14c24010a84a46d64887acca4b36899c4aefee.camel__16278.2574234129$1788079773$gmane$org@debian.org>

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:binwalk
User: [email protected]
Usertags: pu

Dear Release Managers,

I would like to close this bug regarding trixie through p-u:
https://bugs.debian.org/1136010

[ Reason ]
This fixes CVE-2026-7179 for trixie.

[ Impact ]
A path traversal vulnerability exists in binwalk up to 2.4.3 which can
be escalated to remote code execution. The attack can only be performed
from a local environment.
In Debian we are currently stuck to upstream version 2.4.3 for upstream
switched from Python to Rust with version 3.x.x requiring whole new
packaging at Debian's end.

[ Tests ]
I tested the code from the patch manually in a python console to verify
it does what it is supposed to.
I ran the autopkgtests locally with success.

[ Risks ]
I consider the risks nil as the patch is the same applied in unstable,
plus unstable and stable base on the same upstream version.

[ Checklist ]
  [*] *all* changes are documented in the d/changelog
  [*] I reviewed all changes and I approve them
  [*] attach debdiff against the package in (old)stable
  [*] the issue is verified as fixed in unstable

-- 
GPG Fingerprint
3DF5 E8AA 43FC 9FDF D086 F195 ADF5 0EDA F8AD D585

binwalk_2.4.3+dfsg1-2_to_2.4.3+dfsg1-2+deb13u1.debdiff (text/x-patch, 3.6 KB)

diff -Nru binwalk-2.4.3+dfsg1/debian/changelog binwalk-2.4.3+dfsg1/debian/changelog
--- binwalk-2.4.3+dfsg1/debian/changelog	2025-03-14 21:25:15.000000000 +0100
+++ binwalk-2.4.3+dfsg1/debian/changelog	2026-08-26 19:06:33.000000000 +0200
@@ -1,3 +1,11 @@
+binwalk (2.4.3+dfsg1-2+deb13u1) trixie; urgency=medium
+
+  * Team upload.
+  * d/p/*: Add prevent-path-traversal-in-wince.patch fixing CVE-2026-7179;
+    thanks to Fukui Daichi for providing the patch (Closes: #1136010).
+
+ -- Sven Geuer <[email protected]>  Wed, 26 Aug 2026 19:06:33 +0200
+
 binwalk (2.4.3+dfsg1-2) unstable; urgency=medium
 
   * Team upload.
diff -Nru binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch
--- binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch	1970-01-01 01:00:00.000000000 +0100
+++ binwalk-2.4.3+dfsg1/debian/patches/prevent-path-traversal-in-wince.patch	2026-08-26 19:06:33.000000000 +0200
@@ -0,0 +1,57 @@
+Description: Prevent path traversal in WinCE extraction plugin
+ The WinCE extraction plugin trusted filenames supplied by the input
+ image and used them directly to construct output paths. A crafted
+ WinCE image could therefore cause files to be written outside the
+ extraction directory.
+ .
+ Resolve the extraction paths and ensure they remain below the
+ extraction directory before writing files.
+ .
+ CVE-2026-7179
+Bug-Debian: https://bugs.debian.org/1136010
+Forwarded: not-needed
+Author: Fukui Daichi <[email protected]>
+Reviewed-by: Sven Geuer <[email protected]>
+Last-Update: 2026-08-26
+--- a/src/binwalk/plugins/winceextract.py
++++ b/src/binwalk/plugins/winceextract.py
+@@ -1,4 +1,5 @@
+ import binwalk.core.plugin
++from binwalk.core.common import warning
+ import re
+ import os
+ 
+@@ -41,6 +42,16 @@
+             if match is not None:
+                 self.image_start = result.offset
+ 
++    def _safe_output_path(self, indir, filename):
++        indir = os.path.realpath(indir)
++        output_path = os.path.realpath(os.path.join(indir, filename))
++
++        if os.path.commonpath([indir, output_path]) != indir:
++            warning("Path traversal blocked: %s" % filename)
++            return None
++
++        return output_path
++
+     def extractor(self, fname):
+         """
+         Called when a file matches the extraction criteria set by the init method.
+@@ -58,8 +69,14 @@
+         with open(infile, 'r+b') as f:
+             with WinCEExtractor(f, 0) as extractor:
+                 for module in extractor.modules:
+-                    with open(os.path.join(indir, module.file_name), 'w+b') as module_file:
++                    output_path = self._safe_output_path(indir, module.file_name)
++                    if output_path is None:
++                        continue
++                    with open(output_path, 'w+b') as module_file:
+                         module.write_to(module_file)
+                 for file_e in extractor.files:
+-                    with open(os.path.join(indir, file_e.file_name), 'w+b') as file_file:
++                    output_path = self._safe_output_path(indir, file_e.file_name)
++                    if output_path is None:
++                        continue
++                    with open(output_path, 'w+b') as file_file:
+                         file_e.write_to(file_file)
diff -Nru binwalk-2.4.3+dfsg1/debian/patches/series binwalk-2.4.3+dfsg1/debian/patches/series
--- binwalk-2.4.3+dfsg1/debian/patches/series	1970-01-01 01:00:00.000000000 +0100
+++ binwalk-2.4.3+dfsg1/debian/patches/series	2026-08-26 19:06:33.000000000 +0200
@@ -0,0 +1 @@
+prevent-path-traversal-in-wince.patch

signature.asc (application/pgp-signature, 854 B)