Bug#1137210: kitty update for CVE fixes in stable

This is a multi-part message in MIME format.
--------------MYcB0DJkyjEMZVHwXvh11CQt
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit



On 22/05/26 2:25 am, Nilesh Patra wrote:
> Hi Salvatore, all,
> 
> CVE-2026-33633 and CVE-2026-33642 have been reported against kitty (see #1137210), the latter
> with a 9.9/10 CVE score, and hence fixes should make it to stable on priority.
> 
> I've prepared the patches, tested the PoCs in a stable (amd64) VM, and I can see kitty
> no longer crashing, and hence this should likely be good to go.
> 
> My changes are at: https://salsa.debian.org/debian/kitty/-/tree/debian/trixie-security?ref_type=heads
> 
> Can I go ahead and upload to trixie-security suite? Let me know.
> 
> If I get no answers for a week, I'll consider that as a yes and will go ahead and upload it.
> Not trying to be pushy but I feel this should be fixed ASAP.
I've also pushed the built artefacts here incase someone wants to test.

https://people.debian.org/~nilesh/tmp/

Also attaching a debdiff if it makes it easier to review.

Thanks
Nilesh
--------------MYcB0DJkyjEMZVHwXvh11CQt
Content-Type: text/plain; charset=UTF-8;
 name="kitty-trixie-pu-0.41-2+deb13u1.debdiff"
Content-Disposition: attachment;
 filename="kitty-trixie-pu-0.41-2+deb13u1.debdiff"
Content-Transfer-Encoding: base64

ZGlmZiAtTnJ1IGtpdHR5LTAuNDEuMS9kZWJpYW4vY2hhbmdlbG9nIGtpdHR5LTAuNDEuMS9k
ZWJpYW4vY2hhbmdlbG9nCi0tLSBraXR0eS0wLjQxLjEvZGViaWFuL2NoYW5nZWxvZwkyMDI1
LTA2LTA1IDExOjA5OjIxLjAwMDAwMDAwMCAtMDQwMAorKysga2l0dHktMC40MS4xL2RlYmlh
bi9jaGFuZ2Vsb2cJMjAyNi0wNS0yMSAxNjozNDo0OS4wMDAwMDAwMDAgLTA0MDAKQEAgLTEs
MyArMSw5IEBACitraXR0eSAoMC40MS4xLTIrZGViMTN1MSkgdHJpeGllLXNlY3VyaXR5OyB1
cmdlbmN5PW1lZGl1bQorCisgICogQWRkIHBhdGNoZXMgdG8gZml4IENWRS0yMDI2LTMzNjQy
IGFuZCBDVkUtMjAyNi0zMzYzMworCisgLS0gTmlsZXNoIFBhdHJhIDxuaWxlc2hAZGViaWFu
Lm9yZz4gIEZyaSwgMjIgTWF5IDIwMjYgMDI6MDQ6NDkgKzA1MzAKKwoga2l0dHkgKDAuNDEu
MS0yKSB1bnN0YWJsZTsgdXJnZW5jeT1tZWRpdW0KIAogICAqIEJhY2twb3J0IHVwc3RyZWFt
IHBhdGNoIHRvIGZpeHVwIEZUQkZTIG9uIHMzOTB4CmRpZmYgLU5ydSBraXR0eS0wLjQxLjEv
ZGViaWFuL3BhdGNoZXMvMDAxNi1DVkUtMjAyNi0zMzYzMy5wYXRjaCBraXR0eS0wLjQxLjEv
ZGViaWFuL3BhdGNoZXMvMDAxNi1DVkUtMjAyNi0zMzYzMy5wYXRjaAotLS0ga2l0dHktMC40
MS4xL2RlYmlhbi9wYXRjaGVzLzAwMTYtQ1ZFLTIwMjYtMzM2MzMucGF0Y2gJMTk2OS0xMi0z
MSAxOTowMDowMC4wMDAwMDAwMDAgLTA1MDAKKysrIGtpdHR5LTAuNDEuMS9kZWJpYW4vcGF0
Y2hlcy8wMDE2LUNWRS0yMDI2LTMzNjMzLnBhdGNoCTIwMjYtMDUtMjEgMTY6MzQ6NDcuMDAw
MDAwMDAwIC0wNDAwCkBAIC0wLDAgKzEsMTkgQEAKK0Zyb20gNDhhYjYyM2Y1OTRkNjBkYmJm
YjFlNzY3ZDk2ODZkMzgwY2U1NDdmYiBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206
IEtvdmlkIEdveWFsIDxrb3ZpZEBrb3ZpZGdveWFsLm5ldD4KK0RhdGU6IFNhdCwgMjEgTWFy
IDIwMjYgMTc6MjM6MDYgKzA1MzAKK1N1YmplY3Q6IFtQQVRDSF0gR3JhcGhpY3MgcHJvdG9j
b2w6IEZpeCBjcmFzaCB3aGVuIGhhbmRsaW5nIGludmFsaWQgUE5HIGltYWdlCisgd2l0aCBk
aXJlY3QgdHJhbnNtaXNzaW9uCisKK2RpZmYgLS1naXQgYS9raXR0eS9ncmFwaGljcy5jIGIv
a2l0dHkvZ3JhcGhpY3MuYworaW5kZXggM2NmZWM0YmEzOWUuLjk0NGMyMWRhYjU1IDEwMDY0
NAorLS0tIGEva2l0dHkvZ3JhcGhpY3MuYworKysrIGIva2l0dHkvZ3JhcGhpY3MuYworQEAg
LTU1NSw3ICs1NTUsNyBAQCBsb2FkX2ltYWdlX2RhdGEoR3JhcGhpY3NNYW5hZ2VyICpzZWxm
LCBJbWFnZSAqaW1nLCBjb25zdCBHcmFwaGljc0NvbW1hbmQgKmcsIGNvbgorICAgICAgICAg
Y2FzZSAnZCc6ICAvLyBkaXJlY3QKKyAgICAgICAgICAgICBpZiAobG9hZF9kYXRhLT5idWZf
Y2FwYWNpdHkgLSBsb2FkX2RhdGEtPmJ1Zl91c2VkIDwgZy0+cGF5bG9hZF9zeikgeworICAg
ICAgICAgICAgICAgICBpZiAobG9hZF9kYXRhLT5idWZfdXNlZCArIGctPnBheWxvYWRfc3og
PiBNQVhfREFUQV9TWiB8fCBkYXRhX2ZtdCAhPSBQTkcpIEFCUlQoIkVGQklHIiwgIlRvbyBt
dWNoIGRhdGEiKTsKKy0gICAgICAgICAgICAgICAgbG9hZF9kYXRhLT5idWZfY2FwYWNpdHkg
PSBNSU4oMiAqIGxvYWRfZGF0YS0+YnVmX2NhcGFjaXR5LCBNQVhfREFUQV9TWik7CisrICAg
ICAgICAgICAgICAgIGxvYWRfZGF0YS0+YnVmX2NhcGFjaXR5ID0gTUFYKE1JTigyICogbG9h
ZF9kYXRhLT5idWZfY2FwYWNpdHksIE1BWF9EQVRBX1NaKSwgbG9hZF9kYXRhLT5idWZfdXNl
ZCArIGctPnBheWxvYWRfc3opOworICAgICAgICAgICAgICAgICBsb2FkX2RhdGEtPmJ1ZiA9
IHJlYWxsb2MobG9hZF9kYXRhLT5idWYsIGxvYWRfZGF0YS0+YnVmX2NhcGFjaXR5KTsKKyAg
ICAgICAgICAgICAgICAgaWYgKGxvYWRfZGF0YS0+YnVmID09IE5VTEwpIHsKKyAgICAgICAg
ICAgICAgICAgICAgIGxvYWRfZGF0YS0+YnVmX2NhcGFjaXR5ID0gMDsgbG9hZF9kYXRhLT5i
dWZfdXNlZCA9IDA7CmRpZmYgLU5ydSBraXR0eS0wLjQxLjEvZGViaWFuL3BhdGNoZXMvMDAx
Ny1DVkUtMjAyNi0zMzY0Mi5wYXRjaCBraXR0eS0wLjQxLjEvZGViaWFuL3BhdGNoZXMvMDAx
Ny1DVkUtMjAyNi0zMzY0Mi5wYXRjaAotLS0ga2l0dHktMC40MS4xL2RlYmlhbi9wYXRjaGVz
LzAwMTctQ1ZFLTIwMjYtMzM2NDIucGF0Y2gJMTk2OS0xMi0zMSAxOTowMDowMC4wMDAwMDAw
MDAgLTA1MDAKKysrIGtpdHR5LTAuNDEuMS9kZWJpYW4vcGF0Y2hlcy8wMDE3LUNWRS0yMDI2
LTMzNjQyLnBhdGNoCTIwMjYtMDUtMjEgMTY6MzQ6NDcuMDAwMDAwMDAwIC0wNDAwCkBAIC0w
LDAgKzEsMjcgQEAKK0Zyb20gZTk2NjFmMGYzYWZiNGU0ZGJmZmE1MDlhZGZiM2RmM2M5Nzgw
YWQzNCBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IEtvdmlkIEdveWFsIDxrb3Zp
ZEBrb3ZpZGdveWFsLm5ldD4KK0RhdGU6IFN1biwgMjIgTWFyIDIwMjYgMjE6NDk6MTIgKzA1
MzAKK1N1YmplY3Q6IFtQQVRDSF0gR3JhcGhpY3MgcHJvdG9jb2w6IEZpeCBjcmFzaCB3aGVu
IGhhbmRsaW5nIGludmFsaWQgb2Zmc2V0CisgdmFsdWVzIGluIGdyYXBoaWNzIGNvbXBvc2Ug
Y29tbWFuZHMKKworLS0tCisgZG9jcy9jaGFuZ2Vsb2cucnN0IHwgMiArKworIGtpdHR5L2dy
YXBoaWNzLmMgICB8IDcgKysrKy0tLQorIDIgZmlsZXMgY2hhbmdlZCwgNiBpbnNlcnRpb25z
KCspLCAzIGRlbGV0aW9ucygtKQorCistLS0gYS9raXR0eS9ncmFwaGljcy5jCisrKysgYi9r
aXR0eS9ncmFwaGljcy5jCitAQCAtMTgyNSw5ICsxODI1LDEwIEBACisgICAgICAgICBzZXRf
Y29tbWFuZF9mYWlsZWRfcmVzcG9uc2UoIkVOT0VOVCIsICJObyBkZXN0aW5hdGlvbiBmcmFt
ZSBudW1iZXIgJXUgZXhpc3RzIGluIGltYWdlIGlkOiAldVxuIiwgZy0+b3RoZXJfZnJhbWVf
bnVtYmVyLCBpbWctPmNsaWVudF9pZCk7CisgICAgICAgICByZXR1cm47CisgICAgIH0KKy0g
ICAgY29uc3QgdW5zaWduZWQgaW50IHdpZHRoID0gZy0+d2lkdGggPyBnLT53aWR0aCA6IGlt
Zy0+d2lkdGg7CistICAgIGNvbnN0IHVuc2lnbmVkIGludCBoZWlnaHQgPSBnLT5oZWlnaHQg
PyBnLT5oZWlnaHQgOiBpbWctPmhlaWdodDsKKy0gICAgY29uc3QgdW5zaWduZWQgaW50IGRl
c3RfeCA9IGctPnhfb2Zmc2V0LCBkZXN0X3kgPSBnLT55X29mZnNldCwgc3JjX3ggPSBnLT5j
ZWxsX3hfb2Zmc2V0LCBzcmNfeSA9IGctPmNlbGxfeV9vZmZzZXQ7CisrICAgIC8vIFVzZSB1
aW50NjRfdCB0byBhdm9pZCBvdmVyZmxvdyB3aGVuIHRlc3RpbmcgZm9yIHZhbGlkaXR5LiBB
bGwgZGltZW5zaW9ucyBhcmUgMzJiaXQgbnVtYmVycy4KKysgICAgY29uc3QgdWludDY0X3Qg
d2lkdGggPSBnLT53aWR0aCA/IGctPndpZHRoIDogaW1nLT53aWR0aDsKKysgICAgY29uc3Qg
dWludDY0X3QgaGVpZ2h0ID0gZy0+aGVpZ2h0ID8gZy0+aGVpZ2h0IDogaW1nLT5oZWlnaHQ7
CisrICAgIGNvbnN0IHVpbnQ2NF90IGRlc3RfeCA9IGctPnhfb2Zmc2V0LCBkZXN0X3kgPSBn
LT55X29mZnNldCwgc3JjX3ggPSBnLT5jZWxsX3hfb2Zmc2V0LCBzcmNfeSA9IGctPmNlbGxf
eV9vZmZzZXQ7CisgICAgIGlmIChkZXN0X3ggKyB3aWR0aCA+IGltZy0+d2lkdGggfHwgZGVz
dF95ICsgaGVpZ2h0ID4gaW1nLT5oZWlnaHQpIHsKKyAgICAgICAgIHNldF9jb21tYW5kX2Zh
aWxlZF9yZXNwb25zZSgiRUlOVkFMIiwgIlRoZSBkZXN0aW5hdGlvbiByZWN0YW5nbGUgaXMg
b3V0IG9mIGJvdW5kcyIpOworICAgICAgICAgcmV0dXJuOwpkaWZmIC1OcnUga2l0dHktMC40
MS4xL2RlYmlhbi9wYXRjaGVzL3NlcmllcyBraXR0eS0wLjQxLjEvZGViaWFuL3BhdGNoZXMv
c2VyaWVzCi0tLSBraXR0eS0wLjQxLjEvZGViaWFuL3BhdGNoZXMvc2VyaWVzCTIwMjUtMDYt
MDUgMTE6MDg6MzUuMDAwMDAwMDAwIC0wNDAwCisrKyBraXR0eS0wLjQxLjEvZGViaWFuL3Bh
dGNoZXMvc2VyaWVzCTIwMjYtMDUtMjEgMTY6MzQ6NDcuMDAwMDAwMDAwIC0wNDAwCkBAIC0x
MiwzICsxMiw1IEBACiAwMDEzLWF2b2lkLWZhaWxpbmctZm9udC10ZXN0cy1vbi1jaS5wYXRj
aAogMDAxNC11c2UtZGlzaW50ZWdyYXRpb24taW1hZ2luZy5wYXRjaAogMDAxNS1iYWNrcG9y
dC1zMzkweC1mdGJmcy1maXgucGF0Y2gKKzAwMTYtQ1ZFLTIwMjYtMzM2MzMucGF0Y2gKKzAw
MTctQ1ZFLTIwMjYtMzM2NDIucGF0Y2gK

--------------MYcB0DJkyjEMZVHwXvh11CQt--