Bug#1068514: bullseye-pu: package imlib2/1.7.1-2

[Markus Koschany]

Package: release.debian.org
Severity: normal
Tags: bullseye
User: ***@packages.debian.org
Usertags: pu
X-Debbugs-Cc: ***@packages.debian.org, ***@debian.org
Control: affects -1 + src:imlib2

[ Reason ]

Fixing CVE-2024-25447, CVE-2024-25448 and CVE-2024-25450 in bullseye.

[ Impact ]

CVE remain unfixed in bullseye while they are already fixed in stable
and newer distributions.

[ Tests ]

Code changes are trivial

[ Risks ]

Code changes are trivial and are already present in bookworm. No
regressions have been reported.

[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable

[ Changes ]

A variable in the tgaflip function was multiplied with the height and not
the width which can cause a heap buffer overflow.

[Debian Bug Tracking System]

Post by Markus Koschany
affects -1 + src:imlib2

Bug #1068514 [release.debian.org] bullseye-pu: package imlib2/1.7.1-2
Added indication that 1068514 affects src:imlib2

[Jonathan Wiltshire]

Control: tag -1 confirmed

Post by Markus Koschany
Fixing CVE-2024-25447, CVE-2024-25448 and CVE-2024-25450 in bullseye.

Please go ahead.

Thanks,

[Debian Bug Tracking System]

Post by Jonathan Wiltshire
tag -1 confirmed

Bug #1068514 [release.debian.org] bullseye-pu: package imlib2/1.7.1-2
Added tag(s) confirmed.

[Jonathan Wiltshire]

package release.debian.org
tags 1068514 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==============

Package: imlib2
Version: 1.7.1-2+deb11u1

Explanation:

[Debian Bug Tracking System]

Post by Jonathan Wiltshire
package release.debian.org

Limiting to bugs with field 'package' containing at least one of 'release.debian.org'
Limit currently set to 'package':'release.debian.org'

Post by Jonathan Wiltshire
tags 1068514 = bullseye pending

Bug #1068514 [release.debian.org] bullseye-pu: package imlib2/1.7.1-2
Added tag(s) pending; removed tag(s) confirmed.

Post by Jonathan Wiltshire
thanks

Stopping processing here.

Please contact me if you need assistance.