Re: Bug#1120262: curl 8.14.1-2+deb13u1 flagged for acceptance

Hi,

On 11/7/25 20:36, Adam D Barratt wrote:
> Package: curl
> Version: 8.14.1-2+deb13u1
> 
> Explanation: fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-10148]; allow --output to be overridden by --curl-options; fix manpage example for "continue-at"


https://release.debian.org/proposed-updates/stable.html shows a 
regression (4 tries, the test doesn't seem to have a flaky history) in 
mpd on s390x. Now I'm not really worried that people use mpd on s390x, 
but it might indicate a subtle issue with curl on s390x. Care to have a 
look? I've CC'd the mpd maintainers as they might be able to tell what 
failure they are observing in their test. I also CC'd the s390x porters 
as they might care about curl behavior on s390x.

Paul

PS: the other "regressions" will go away when the page is refreshed as 
they all passed on retry or are flaky tests.

-----BEGIN PGP SIGNATURE-----

wsC7BAABCABvBYJpEHNTCRCcXJnrBb11CkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmdg0eD7tNm0BT7Xrl7JsuDaWGjm+5wgs8R1ZD7UFEz+
YhYhBFi2bUhza+k7BS3mcpxcmesFvXUKAABdGwgAuysqG7tz7YeaIhl8/DkM58Tz
9bqKCRgPT6RMDabhCDPEanxj/0Tql/HNaHRsfAxeEQFpfQSKgYXEASOhBNYYvqTI
3l2RPA7ObN1MheJ/ZNot3eLYjVCdbe0m7/VCCcZMLQU9Y/AUJVq6kNnMhD5Y1DvD
LlnTeUMEjs3X+/LryB8J6j8abVLrp0Pyi6wYaK+tpRchLqhhXc7cI2PWEMF2H2cs
ujjsGX8kv6GdTZvd6Yn9wv/VQXvzol109+zwQTZ7uZ4pCltCyOJZOJUinzBvysyo
f27qrDw82uqlD4FrfaJkJL1yEUHftvYA8xKhKl+uIMGlFMeNXL9F5GO9/mTfOg==
=4ksh
-----END PGP SIGNATURE-----