Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1239669

Bug#1101561: bookworm-pu: package fig2dev/1:3.2.8b-3+deb12u1

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
Tags: bookworm
User: release.debian.org@packages.debian.org
Usertags: pu
X-Debbugs-Cc: fig2dev@packages.debian.org
Control: affects -1 + src:fig2dev

[ Reason ]
This fixes CVE-2025-31162, CVE-2025-31163, CVE-2025-31164
(segmentation faults in the pict2e driver of fig2dev).

[ Impact ]
Segmentation faults with some special cases and a minor security
issue.

[ Tests ]
salsa-ci passed except reprotest (this seems to build the package with
sid instead of bookworm, with uses a newer different ghostscript
version, resulting in a slightly different gray rastering with two
more dots in an example, so one test in the testsuite fails):
https://salsa.debian.org/debian/fig2dev/-/pipelines/840929

The patches for CVE-2025-31163 and CVE-2025-31164 add new test cases
(for these bugs) which run successfully.

[ Risks ]
Hopefully none...

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
- fix for CVE-2025-31162
- fix for CVE-2025-31163
- fix for CVE-2025-31164
- Change in debian/salsa-ci.yml to build with bookworm instead of sid

[ Other info ]
I was asked by Salvatore Bonaccorso <carnil@debian.org> from the
security team to upload this to the next point release instead of
fixing via DSA, because of the low severity of the CVEs.

Greetings
Roland

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1101561: bookworm-pu: package fig2dev/1:3.2.8b-3+deb12u1 Roland Rosenfeld <roland@debian.org> - 2025-03-29 12:40 +0100
  Bug#1101561: bookworm-pu: package fig2dev/1:3.2.8b-3+deb12u1 Jonathan Wiltshire <jmw@debian.org> - 2025-04-14 21:50 +0200
  Bug#1101561: fig2dev 3.2.8b-3+deb12u1 flagged for acceptance Jonathan Wiltshire <jmw@debian.org> - 2025-04-18 13:50 +0200

csiph-web