Hi,
On 24/10/2026 00:43, Emmanuel Arias wrote:
I'm sending new debdiff, with your suggestions. Also I pushed to salsa.
Thanks for your review!
On 2026-10-15 11:42, Sylvain Beucler wrote:
On 15/10/2026 04:25, Emmanuel Arias wrote:
On 2026-10-08 14:30, Sylvain Beucler wrote:
On 06/10/2026 21:43, Emmanuel Arias wrote:
I've worked in tiff for bookworm. Please, could you review the patches?
The patches are here:
https://salsa.debian.org/lts-team/packages/tiff/-/tree/debian/bookworm
Please drop the Bug-Debian-Security and Bug-Freexian-Security which only
repeat default tracker links and aren't informative (in particular the
freexian one while this isn't ELTS).
Ready, I left those that patch name is not CVE-*.patch I backported
those from trixie and I leave as they are.
Less clear/consistent for CVE-2026-12912/pixarlog, but fair enough.
For Salsa-CI, maybe fix debian/watch or add an allow_failure for
'test-uscan', which makes the CI FAIL, which is confusing.
Ready.
The CI is currently not working, related to
https://salsa.debian.org/lts-team/pipeline/-/merge_requests/40
I'd like to see the CI running correctly if possible, as the last ones
seem to have trouble / flakyness:
https://salsa.debian.org/lts-team/packages/tiff/-/pipelines
CVE-2026-36849 is marked <ignored> in trixie, maybe check with the security
team and/or maintainer if it's a good idea to fix it.
Contacted, thanks!
(So, who did you contact and how?)
I sent an email to the maintainer first, to know the opinion but I
didn't receive any reply yet.
It would be worth knowing why secteam marked it as <ignored>.
Incidentally the CVE is still marked "RESERVED".
If you got an answer that would be enlightening, especially with the
following:
I see that the CVE-2026-36849 patch adds a symbol, maybe that's why it was
marked <ignored>, as it's always a delicate change especially after the
bookworm freeze. It also changes a structure. And it's a large patch. Did
you perform specific testing?
Your symbol update seems to be wrong, you mark version 4.5.0 while this is
something you're adding after the bookworm release, in 4.5.0-6+deb12u5 and
not before.
I modify a little bit here to make the function private.
The patch doesn't seem to break the ABI now.
Do you believe we should still backport this DoS fix, including in the 3
ELTS releases?
What kind of testing did you do?
We have some notes from the maintainer at
https://lts-team.pages.debian.net/wiki/TestSuites/tiff.html , did you check
them?
There are many reverse dependencies for this package so thorough testing is
needed.
I uploaded it to debusine [0]. But I trying to reproduce the Test
Suites you mentioned.
[0] https://debusine.debian.net/debian/developers/work-request/1426324/
The tiff package doesn't have autopkgtest and is marked as skipped, so
autopkgtest/debusine won't be enough here.
libgd2, an important package, has all its tests failing here, but I can't
find the reference test results for comparison. Did you investigate what's
happening?
That's pending for me
What's the status?
Try to reproduce individual issues when there's a reproducer, in particular
for CVE-2026-52490 where you hand-picked the patch chunks; test if our
version fails without the patch and doesn't fail anymore with the patch.
I couldn't do that yet, I test it with the bank you mentioned (some of
those images not all)
What's your progress with the reproducers?
Cheers!
Sylvain
