1. Forum
  2. Usenet
  3. LINUX.DEBIAN.BUGS.DIST

  • Bug#1106536: bookworm-pu: package libraw/0.20.2-2.1+deb12u1

    From Moritz Muehlenhoff@21:1/5 to All on Sun May 25 20:10:05 2025
    XPost: linux.debian.devel.release

    UGFja2FnZTogcmVsZWFzZS5kZWJpYW4ub3JnClNldmVyaXR5OiBub3JtYWwKVGFnczogYm9va3dv cm0KWC1EZWJidWdzLUNjOiBsaWJyYXdAcGFja2FnZXMuZGViaWFuLm9yZwpDb250cm9sOiBhZmZl Y3RzIC0xICsgc3JjOmxpYnJhdwpVc2VyOiByZWxlYXNlLmRlYmlhbi5vcmdAcGFja2FnZXMuZGVi aWFuLm9yZwpVc2VydGFnczogcHUKCk11bHRpcGxlIGxvdyBzZXZlcml0eSBpc3N1ZXMsIG5vdCB3 YXJyYW50aW5nIGEgRFNBLApkZWJkaWZmIGJlbG93LgoKQ2hlZXJzLAogICAgICAgIE1vcml0egoK ZGlmZiAtTnJ1IGxpYnJhdy0wLjIwLjIvZGViaWFuL2NoYW5nZWxvZyBsaWJyYXctMC4yMC4yL2Rl Ymlhbi9jaGFuZ2Vsb2cKLS0tIGxpYnJhdy0wLjIwLjIvZGViaWFuL2NoYW5nZWxvZwkyMDIzLTA1 LTIwIDIxOjQ0OjQyLjAwMDAwMDAwMCArMDIwMAorKysgbGlicmF3LTAuMjAuMi9kZWJpYW4vY2hh bmdlbG9nCTIwMjUtMDUtMTggMjE6MTA6MjIuMDAwMDAwMDAwICswMjAwCkBAIC0xLDMgKzEsMTEg QEAKK2xpYnJhdyAoMC4yMC4yLTIuMStkZWIxMnUxKSBib29rd29ybTsgdXJnZW5jeT1tZWRpdW0K KworICAqIENWRS0yMDI1LTQzOTYxIC8gQ1ZFLTIwMjUtNDM5NjIgKENsb3NlczogIzExMDM3ODEp CisgICogQ1ZFLTIwMjUtNDM5NjMgKENsb3NlczogIzExMDM3ODIpCisgICogQ1ZFLTIwMjUtNDM5 NjQgKENsb3NlczogIzExMDM3ODMpCisKKyAtLSBNb3JpdHogTcO8aGxlbmhvZmYgPGptbUBkZWJp YW4ub3JnPiAgU3VuLCAxOCBNYXkgMjAyNSAyMToxMDoyMiArMDIwMAorCiBsaWJyYXcgKDAuMjAu Mi0yLjEpIHVuc3RhYmxlOyB1cmdlbmN5PW1lZGl1bQogCiAgICogTm9uLW1haW50YWluZXIgdXBs b2FkLgpkaWZmIC1OcnUgbGlicmF3LTAuMjAuMi9kZWJpYW4vcGF0Y2hlcy9DVkUtMjAyNS00Mzk2 MV80Mzk2Ml80Mzk2M180Mzk2NC5wYXRjaCBsaWJyYXctMC4yMC4yL2RlYmlhbi9wYXRjaGVzL0NW RS0yMDI1LTQzOTYxXzQzOTYyXzQzOTYzXzQzOTY0LnBhdGNoCi0tLSBsaWJyYXctMC4yMC4yL2Rl Ymlhbi9wYXRjaGVzL0NWRS0yMDI1LTQzOTYxXzQzOTYyXzQzOTYzXzQzOTY0LnBhdGNoCTE5NzAt MDEtMDEgMDE6MDA6MDAuMDAwMDAwMDAwICswMTAwCisrKyBsaWJyYXctMC4yMC4yL2RlYmlhbi9w YXRjaGVzL0NWRS0yMDI1LTQzOTYxXzQzOTYyXzQzOTYzXzQzOTY0LnBhdGNoCTIwMjUtMDUtMTgg MjE6MTA6MDYuMDAwMDAwMDAwICswMjAwCkBAIC0wLDAgKzEsMTEzIEBACitDb21iaW5lZCBwYXRj aCBvZiB0aGUgZm9sbG93aW5nIHVwc3RyZWFtIGNvbW1pdHM6CisKK0Zyb20gNjZmZTY2M2UwMmE0 ZGQ2MTBiNGU4MzJmNWQ5YWYzMjY3MDkzMzZjMiBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zy b206IEFsZXggVHV0dWJhbGluIDxsZXhhQGxleGEucnU+CitEYXRlOiBTYXQsIDEgRmViIDIwMjUg MTU6MzI6MzkgKzAzMDAKK1N1YmplY3Q6IFtQQVRDSF0gUHJldmVudCBvdXQtb2YtYm91bmRzIHJl YWQgaW4gZnVqaSAweGYwMGMgdGFnIHBhcnNlcgorCitGcm9tIGJlMjZlNzYzOWVjZjhiZWI1NWYx MjRjZTc4MGU5OTg0MmRlMmU5NjQgTW9uIFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBBbGV4 IFR1dHViYWxpbiA8bGV4YUBsZXhhLnJ1PgorRGF0ZTogVGh1LCA2IEZlYiAyMDI1IDIxOjAxOjU4 ICswMzAwCitTdWJqZWN0OiBbUEFUQ0hdIGNoZWNrIHNwbGl0X2NvbC9zcGxpdF9yb3cgdmFsdWVz IGluIHBoYXNlX29uZV9jb3JyZWN0CisKK0Zyb20gYTUwZGMzZjExMjdkMmUzN2E5YjM5ZjU3YWQ5 YmIyZWJiNjBmMThjMCBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IEFsZXggVHV0dWJh bGluIDxsZXhhQGxleGEucnU+CitEYXRlOiBTdW4sIDIgTWFyIDIwMjUgMTE6MzU6NDMgKzAzMDAK K1N1YmplY3Q6IFtQQVRDSF0gYWRkaXRpb25hbCBjaGVja3MgaW4gUGhhc2VPbmUgY29ycmVjdGlv biB0YWcgMHg0MTIgcHJvY2Vzc2luZworCisKKy0tLSBsaWJyYXctMC4yMC4yLm9yaWcvc3JjL2Rl Y29kZXJzL2xvYWRfbWZiYWNrcy5jcHAKKysrKyBsaWJyYXctMC4yMC4yL3NyYy9kZWNvZGVycy9s b2FkX21mYmFja3MuY3BwCitAQCAtMjExLDcgKzIxMSw4IEBAIGludCBMaWJSYXc6OnBoYXNlX29u ZV9jb3JyZWN0KCkKKyAgICAgICAgICAgb2ZmXzQxMiA9IGZ0ZWxsKGlmcCkgLSAzODsKKyAgICAg ICAgIH0KKyAgICAgICB9CistICAgICAgZWxzZSBpZiAodGFnID09IDB4MDQxZiAmJiAhcWxpbl9h cHBsaWVkKQorKyAgICAgIGVsc2UgaWYgKHRhZyA9PSAweDA0MWYgJiYgIXFsaW5fYXBwbGllZCAm JiBwaDEuc3BsaXRfY29sID4gMCAmJiBwaDEuc3BsaXRfY29sIDwgcmF3X3dpZHRoCisrCQkmJiBw aDEuc3BsaXRfcm93ID4gMCAmJiBwaDEuc3BsaXRfcm93IDwgcmF3X2hlaWdodCkKKyAgICAgICB7 IC8qIFF1YWRyYW50IGxpbmVhcml6YXRpb24gKi8KKyAgICAgICAgIHVzaG9ydCBsY1syXVsyXVsx Nl0sIHJlZlsxNl07CisgICAgICAgICBpbnQgcXIsIHFjOworQEAgLTI4OCw3ICsyODksOCBAQCBp bnQgTGliUmF3OjpwaGFzZV9vbmVfY29ycmVjdCgpCisgICAgICAgICB9CisgICAgICAgICBxbXVs dF9hcHBsaWVkID0gMTsKKyAgICAgICB9CistICAgICAgZWxzZSBpZiAodGFnID09IDB4MDQzMSAm JiAhcW11bHRfYXBwbGllZCkKKysgICAgICBlbHNlIGlmICh0YWcgPT0gMHgwNDMxICYmICFxbXVs dF9hcHBsaWVkICYmIHBoMS5zcGxpdF9jb2wgPiAwICYmIHBoMS5zcGxpdF9jb2wgPCByYXdfd2lk dGgKKysgICAgICAgICYmIHBoMS5zcGxpdF9yb3cgPiAwICYmIHBoMS5zcGxpdF9yb3cgPCByYXdf aGVpZ2h0KQorICAgICAgIHsgLyogUXVhZHJhbnQgY29tYmluZWQgKi8KKyAgICAgICAgIHVzaG9y dCBsY1syXVsyXVs3XSwgcmVmWzddOworICAgICAgICAgaW50IHFyLCBxYzsKK0BAIC0zMzEsNiAr MzMzLDExIEBAIGludCBMaWJSYXc6OnBoYXNlX29uZV9jb3JyZWN0KCkKKyAgICAgICBmc2Vlayhp ZnAsIG9mZl80MTIsIFNFRUtfU0VUKTsKKyAgICAgICBmb3IgKGkgPSAwOyBpIDwgOTsgaSsrKQor ICAgICAgICAgaGVhZFtpXSA9IGdldDQoKSAmIDB4N2ZmZjsKKysgICAgICB1bnNpZ25lZCB3MCA9 IGhlYWRbMV0gKiBoZWFkWzNdLCB3MSA9IGhlYWRbMl0gKiBoZWFkWzRdOworKyAgICAgIGlmICh3 MCA+IDEwMjQwMDAwIHx8IHcxID4gMTAyNDAwMDApCisrICAgICAgICB0aHJvdyBMSUJSQVdfRVhD RVBUSU9OX0FMTE9DOworKyAgICAgIGlmICh3MCA8IDEgfHwgdzEgPCAxKQorKyAgICAgICAgdGhy b3cgTElCUkFXX0VYQ0VQVElPTl9JT19DT1JSVVBUOworICAgICAgIHl2YWxbMF0gPSAoZmxvYXQg KiljYWxsb2MoaGVhZFsxXSAqIGhlYWRbM10gKyBoZWFkWzJdICogaGVhZFs0XSwgNik7CisgICAg ICAgbWVycm9yKHl2YWxbMF0sICJwaGFzZV9vbmVfY29ycmVjdCgpIik7CisgICAgICAgeXZhbFsx XSA9IChmbG9hdCAqKSh5dmFsWzBdICsgaGVhZFsxXSAqIGhlYWRbM10pOworQEAgLTM1NiwxMCAr MzYzLDE3IEBAIGludCBMaWJSYXc6OnBoYXNlX29uZV9jb3JyZWN0KCkKKyAgICAgICAgICAgICBm b3IgKGsgPSBqID0gMDsgaiA8IGhlYWRbMV07IGorKykKKyAgICAgICAgICAgICAgIGlmIChudW0g PCB4dmFsWzBdW2sgPSBoZWFkWzFdICogaSArIGpdKQorICAgICAgICAgICAgICAgICBicmVhazsK Ky0gICAgICAgICAgICBmcmFjID0gKGogPT0gMCB8fCBqID09IGhlYWRbMV0pCistICAgICAgICAg ICAgICAgICAgICAgICA/IDAKKy0gICAgICAgICAgICAgICAgICAgICAgIDogKHh2YWxbMF1ba10g LSBudW0pIC8gKHh2YWxbMF1ba10gLSB4dmFsWzBdW2sgLSAxXSk7CistICAgICAgICAgICAgbXVs dFtpIC0gY2lwXSA9IHl2YWxbMF1bayAtIDFdICogZnJhYyArIHl2YWxbMF1ba10gKiAoMSAtIGZy YWMpOworKwkJCWlmIChqID09IDAgfHwgaiA9PSBoZWFkWzFdIHx8IGsgPCAxIHx8IGsgPj0gdzAr dzEpCisrCQkJCWZyYWMgPSAwOworKwkJCWVsc2UKKysJCQl7CisrCQkJCWludCB4ZGl2ID0gKHh2 YWxbMF1ba10gLSB4dmFsWzBdW2sgLSAxXSk7CisrCQkJCWZyYWMgPSB4ZGl2ID8gKHh2YWxbMF1b a10gLSBudW0pIC8gKHh2YWxbMF1ba10gLSB4dmFsWzBdW2sgLSAxXSkgOiAwOworKwkJCX0KKysJ CQlpZiAoayA8IHcwICsgdzEpCisrCQkJCW11bHRbaSAtIGNpcF0gPSB5dmFsWzBdW2sgPiAwID8g ayAtIDEgOiAwXSAqIGZyYWMgKyB5dmFsWzBdW2tdICogKDEgLSBmcmFjKTsKKysJCQllbHNlCisr CQkJCW11bHRbaSAtIGNpcF0gPSAwOworICAgICAgICAgICB9CisgICAgICAgICAgIGkgPSAoKG11 bHRbMF0gKiAoMSAtIGNmcmFjKSArIG11bHRbMV0gKiBjZnJhYykgKiByb3cgKyBudW0pICogMjsK KyAgICAgICAgICAgUkFXKHJvdywgY29sKSA9IExJTShpLCAwLCA2NTUzNSk7CistLS0gbGlicmF3 LTAuMjAuMi5vcmlnL3NyYy9tZXRhZGF0YS90aWZmLmNwcAorKysrIGxpYnJhdy0wLjIwLjIvc3Jj L21ldGFkYXRhL3RpZmYuY3BwCitAQCAtOTgwLDE3ICs5ODAsMjAgQEAgaW50IExpYlJhdzo6cGFy c2VfdGlmZl9pZmQoaW50IGJhc2UpCisgICAgICAgICAgICAgICBpZiAoKGZ3YlswXSA9PSByYWZk YXRhW2ZpXSkgJiYgKGZ3YlsxXSA9PSByYWZkYXRhW2ZpICsgMV0pICYmCisgICAgICAgICAgICAg ICAgICAgKGZ3YlsyXSA9PSByYWZkYXRhW2ZpICsgMl0pKQorICAgICAgICAgICAgICAgeworLSAg ICAgICAgICAgICAgICBpZiAocmFmZGF0YVtmaSAtIDE1XSAhPQorKyAgICAgICAgICAgICAgICBp ZiAoZmkgPiAxNCAmJiByYWZkYXRhW2ZpIC0gMTVdICE9CisgICAgICAgICAgICAgICAgICAgICBm d2JbMF0pIC8vIDE1IGlzIG9mZnNldCBvZiBUdW5nc3RlbiBXQiBmcm9tIHRoZSBmaXJzdAorICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAvLyBwcmVzZXQsIEZpbmUgV2VhdGhlciBXQgorICAg ICAgICAgICAgICAgICAgIGNvbnRpbnVlOworLSAgICAgICAgICAgICAgICBmb3IgKGludCB3Yl9p bmQgPSAwLCBvZnN0ID0gZmkgLSAxNTsgd2JfaW5kIDwgRnVqaV93Yl9saXN0MS5zaXplKCk7Cist ICAgICAgICAgICAgICAgICAgICAgd2JfaW5kKyssIG9mc3QgKz0gMykKKysgICAgICAgICAgICAg ICAgaWYgKGZpID49IDE1KQorICAgICAgICAgICAgICAgICB7CistICAgICAgICAgICAgICAgICAg aWNXQkNbRnVqaV93Yl9saXN0MVt3Yl9pbmRdXVsxXSA9CistICAgICAgICAgICAgICAgICAgICAg IGljV0JDW0Z1amlfd2JfbGlzdDFbd2JfaW5kXV1bM10gPSByYWZkYXRhW29mc3RdOworLSAgICAg ICAgICAgICAgICAgIGljV0JDW0Z1amlfd2JfbGlzdDFbd2JfaW5kXV1bMF0gPSByYWZkYXRhW29m c3QgKyAxXTsKKy0gICAgICAgICAgICAgICAgICBpY1dCQ1tGdWppX3diX2xpc3QxW3diX2luZF1d WzJdID0gcmFmZGF0YVtvZnN0ICsgMl07CisrICAgICAgICAgICAgICAgICAgICBmb3IgKGludCB3 Yl9pbmQgPSAwLCBvZnN0ID0gZmkgLSAxNTsgd2JfaW5kIDwgKGludClGdWppX3diX2xpc3QxLnNp emUoKTsKKysgICAgICAgICAgICAgICAgICAgICAgICB3Yl9pbmQrKywgb2ZzdCArPSAzKQorKyAg ICAgICAgICAgICAgICAgICAgeworKyAgICAgICAgICAgICAgICAgICAgICAgIGljV0JDW0Z1amlf d2JfbGlzdDFbd2JfaW5kXV1bMV0gPQorKyAgICAgICAgICAgICAgICAgICAgICAgICAgICBpY1dC Q1tGdWppX3diX2xpc3QxW3diX2luZF1dWzNdID0gcmFmZGF0YVtvZnN0XTsKKysgICAgICAgICAg ICAgICAgICAgICAgICBpY1dCQ1tGdWppX3diX2xpc3QxW3diX2luZF1dWzBdID0gcmFmZGF0YVtv ZnN0ICsgMV07CisrICAgICAgICAgICAgICAgICAgICAgICAgaWNXQkNbRnVqaV93Yl9saXN0MVt3 Yl9pbmRdXVsyXSA9IHJhZmRhdGFbb2ZzdCArIDJdOworKyAgICAgICAgICAgICAgICAgICAgfQor ICAgICAgICAgICAgICAgICB9CisgCisgICAgICAgICAgICAgICAgIGlmICgoaW1GdWppLlJBRkRh dGFWZXJzaW9uID09IDB4MDI2MCkgfHwgLy8gWC1Qcm8zCitAQCAtMTAwMCw2ICsxMDAzLDggQEAg aW50IExpYlJhdzo6cGFyc2VfdGlmZl9pZmQoaW50IGJhc2UpCisgICAgICAgICAgICAgICAgIGZp ICs9IDk2OworICAgICAgICAgICAgICAgICBmb3IgKGZqID0gZmk7IGZqIDwgKGZpICsgMTUpOyBm aiArPSAzKQorICAgICAgICAgICAgICAgICB7CisrICAgICAgICAgICAgICAgICAgaWYgKGZqID4g bGlicmF3X2ludGVybmFsX2RhdGEudW5wYWNrZXJfZGF0YS5sZW5SQUZEYXRhIC0gMykKKysgICAg ICAgICAgICAgICAgICAgIGJyZWFrOworICAgICAgICAgICAgICAgICAgIGlmIChyYWZkYXRhW2Zq XSAhPSByYWZkYXRhW2ZpXSkKKyAgICAgICAgICAgICAgICAgICB7CisgICAgICAgICAgICAgICAg ICAgICBmaiAtPSA5MzsKZGlmZiAtTnJ1IGxpYnJhdy0wLjIwLjIvZGViaWFuL3BhdGNoZXMvc2Vy aWVzIGxpYnJhdy0wLjIwLjIvZGViaWFuL3BhdGNoZXMvc2VyaWVzCi0tLSBsaWJyYXctMC4yMC4y L2RlYmlhbi9wYXRjaGVzL3NlcmllcwkyMDIzLTA1LTIwIDIxOjQ0OjQyLjAwMDAwMDAwMCArMDIw MAorKysgbGlicmF3LTAuMjAuMi9kZWJpYW4vcGF0Y2hlcy9zZXJpZXMJMjAyNS0wNS0xOCAyMTow OTowNS4wMDAwMDAwMDAgKzAyMDAKQEAgLTEsMiArMSwzIEBACiBjaGVjay1mb3ItaW5wdXQtYnVm ZmVyLXNpemUtb24tZGF0YXN0cmVhbS1nZXRzLnBhdGNoCiBkby1ub3Qtc2V0LXNocmluay1mbGFn LWZvci0zLTQtY29tcG9uZW50LWltYWdlcy5wYXRjaAorQ1ZFLTIwMjUtNDM5NjFfNDM5NjJfNDM5 NjNfNDM5NjQucGF0Y2gK

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Adam D Barratt@21:1/5 to All on Sat May 31 23:30:03 2025
    XPost: linux.debian.devel.release

    package release.debian.org
    tags 1106536 = bookworm pending
    thanks

    Hi,

    The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

    Thanks for your contribution!

    Upload details
    ==============

    Package: libraw
    Version: 0.20.2-2.1+deb12u1

    Explanation: fix out-of-bounds read issues [CVE-2025-43961 CVE-2025-43962 CVE-2025-43963]; enforce minimum w0 and w1 values [CVE-2025-43964]

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)