HTTP/2 302 x-content-type-options: nosniff x-frame-options: sameorigin referrer-policy: no-referrer x-xss-protection: 1 permissions-policy: interest-cohort=() strict-transport-security: max-age=15552000 location: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121041 content-length: 307 content-type: text/html; charset=iso-8859-1 date: Fri, 26 Dec 2025 16:44:25 GMT server: Apache HTTP/2 200 cache-control: public, max-age=300 x-content-type-options: nosniff x-frame-options: sameorigin referrer-policy: no-referrer x-xss-protection: 1 permissions-policy: interest-cohort=() strict-transport-security: max-age=15552000 etag: 1dedcfa9d40eb25fff35dc0283598b60 vary: Accept-Encoding content-encoding: gzip x-clacks-overhead: GNU Terry Pratchett content-length: 6323 content-type: text/html; charset=utf-8 date: Fri, 26 Dec 2025 16:44:26 GMT server: Apache

Debian Bug report logs - #1121041
bookworm-pu: package gdk-pixbuf/2.42.10+dfsg-1+deb12u3

Reply or subscribe to this bug.

Display info messages

---

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

[Message part 1 (text/plain, inline)]

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: gdk-pixbuf@packages.debian.org
Control: affects -1 + src:gdk-pixbuf
User: release.debian.org@packages.debian.org
Usertags: pu
Hi,
[ Reason ]
The reason for the bookworm-pu bug is CVE-2025-7345 [1][2] which is a
potential buffer overflow. The fix was applied already in sid, trixie,
bullseye and other ELTS releases with no reports of regressions but one
in testing [3] before the release of trixie. After further communication
with the reporter, it was dismissed as probably an inconsistent
environment on their side. The reported regression was unreproducible in
trixie, bullseye and also bookworm (tested in a clean VM with multiple
gnome software).
[ Impact ]
We have a pending CVE and a potential buffer overflow in bookworm.
[ Tests ]
I have manually reproduced the reported ASAN overflow in bookworm and
also verified the patch fixed it. The package's autopkgtest was run and
passes without regressions. I have also uploaded it to debusine.d.n [4]
to check rdep autopkgtests using the fixed version and no new failures
showed up when comparing to the version currently in bookworm [5].
[ Risks ]
The patch is pretty trivial, it makes sure there is enough space
allocated without bindly trusting what the image headers say and bails
out if there isn't enough space. For a correctly defined jpeg image,
there shouldn't be any impact since the headers wouldn't lie.
[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable
[ Changes ]
Cherry pick of the patch fixing the CVE, the explanation for it is in
Risks section. Aside from that, there are some changes to add
salsa-ci and enable the full coverage of it, which includes marking a
second test as flaky when running salsa-ci. Also, switch to
debian/bookworm in gbp.conf.
[ Other info ]
Although the last two changes mentioned in Changes section don't impact
the archive, they do provide more comfort and assurance before uploading
so I think it's worth to keep them. If Stable Release Managers prefer to
not have them, please let me know.
Cheers,
Charles
[1] https://security-tracker.debian.org/tracker/CVE-2025-7345
[2] https://bugs.debian.org/1109262
[3] https://bugs.debian.org/1109199
[4] https://debusine.debian.net/debian/developers/work-request/197302/
[5] https://debusine.debian.net/debian/developers/work-request/197416/

[gdk-pixbuf_2.42.10+dfsg-1+deb12u3.diff (text/x-diff, attachment)]

---

Message #12 received at 1121041@bugs.debian.org (full text, mbox, reply):

Control: tags -1 + confirmed
On Wed, 2025-11-19 at 22:34 -0300, Carlos Henrique Lima Melara wrote:
> [ Reason ]
> 
> The reason for the bookworm-pu bug is CVE-2025-7345 [1][2] which is a
> potential buffer overflow.
Please go ahead.
Regards,
Adam

---

Message #19 received at 1121041@bugs.debian.org (full text, mbox, reply):

Hi Adam,
On Sat, Dec 06, 2025 at 03:48:09PM +0000, Adam D. Barratt wrote:
> 
> On Wed, 2025-11-19 at 22:34 -0300, Carlos Henrique Lima Melara wrote:
> > [ Reason ]
> > 
> > The reason for the bookworm-pu bug is CVE-2025-7345 [1][2] which is a
> > potential buffer overflow.
> 
> Please go ahead.
Thanks and uploaded.
Cheers,
Charles

---

Message #24 received at 1121041@bugs.debian.org (full text, mbox, reply):

package release.debian.org
tags 1121041 = bookworm pending
thanks
Hi,
The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.
Thanks for your contribution!
Upload details
==============
Package: gdk-pixbuf
Version: 2.42.10+dfsg-1+deb12u3
Explanation: fix buffer overflow issue [CVE-2025-7345]

---

Send a report that this bug log contains spam.

---

Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Fri Dec 26 16:44:27 2025; Machine Name: berlioz

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.