• Bug#1109943: bookworm-pu: package djvulibre/3.5.28-2.2~deb12u1

    From Adrian Bunk@21:1/5 to All on Sat Jul 26 22:10:01 2025
    XPost: linux.debian.devel.release

    This is a multi-part MIME message sent by reportbug.


    Package: release.debian.org
    Severity: normal
    Tags: bookworm
    X-Debbugs-Cc: [email protected], [email protected]
    Control: affects -1 + src:djvulibre
    User: [email protected]
    Usertags: pu

    * CVE-2021-46310: Divide by zero in IW44Image::Map::image()
    (Closes: #1052668)
    * CVE-2021-46312: Divide by zero in IWBitmap::Encode::init()
    (Closes: #1052669)

    The debdiff is against the DSA-5960-1 version currently in pu.

    diffstat for djvulibre-3.5.28 djvulibre-3.5.28

    changelog | 18 ++++++++++++++----
    patches/CVE-2021-46310.patch | 20 ++++++++++++++++++++
    patches/CVE-2021-46312.patch | 20 ++++++++++++++++++++
    patches/series | 2 ++
    4 files changed, 56 insertions(+), 4 deletions(-)

    diff -Nru djvulibre-3.5.28/debian/changelog djvulibre-3.5.28/debian/changelog --- djvulibre-3.5.28/debian/changelog 2025-07-04 22:33:39.000000000 +0300
    +++ djvulibre-3.5.28/debian/changelog 2025-07-21 13:42:26.000000000 +0300
    @@ -1,9 +1,19 @@
    -djvulibre (3.5.28-2.1~deb12u1) bookworm-security; urgency=high
    +djvulibre (3.5.28-2.2~deb12u1) bookworm; urgency=medium

    - * Non-maintainer upload by the Security Team.
    - * Rebuild for bookworm-security
    + * Non-maintainer upload.
    + * Rebuild for bookworm.

    - -- Salvatore Bonaccorso <[email protected]> Fri, 04 Jul 2025 21:33:39 +0200 + -- Adrian Bunk <[email protected]> Mon, 21 Jul 2025 13:42:26 +0300
    +
    +djvulibre (3.5.28-2.2) unstable; urgency=medium
    +
    + * Non-maintainer upload.
    + * CVE-2021-46310: Divide by zero in IW44Image::Map::image()
    + (Closes: #1052668)
    + * CVE-2021-46312: Divide by zero in IWBitmap::Encode::init()
    + (Closes: #1052669)
    +
    + -- Adrian Bunk <[email protected]> Fri, 18 Jul 2025 20:57:51 +0300

    djvulibre (3.5.28-2.1) unstable; urgency=high

    diff -Nru djvulibre-3.5.28/debian/patches/CVE-202
  • From Jonathan Wiltshire@21:1/5 to All on Mon Jul 28 10:20:02 2025
    XPost: linux.debian.devel.release

    package release.debian.org
    tags 1109943 = bookworm pending
    thanks

    Hi,

    The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

    Thanks for your contribution!

    Upload details
    ==============

    Package: djvulibre
    Version: 3.5.28-2.2~deb12u1

    Explanation: fix denial of service issues [CVE-2021-46310 CVE-2021-46312]

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)