Your message dated Sat, 12 Sep 2026 08:05:41 +0000
with message-id <[email protected]>
and subject line Released in 13.7
has caused the Debian Bug report #1145180,
regarding trixie-pu: package libsdl3-image/3.2.4+ds-1+deb13u1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1145180: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1145180
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:libsdl3-image
User: [email protected]
Usertags: pu
[ Reason ]
Fix CVE-2026-35444 and various other out-of-bounds accesses when parsing
malformed/crafted image files
[ Impact ]
If not fixed, games/applications that load untrusted images using
SDL3_image could be subject to denial-of-service (crash) or possibly
exploitable.
[ Tests ]
autopkgtest (automated smoke-tests loading images in various formats)
passes, and the showimage sample program from libsdl3-image-tests can
load various images on a trixie GNOME desktop. I didn't attempt to
obtain malformed/crafted images designed to exploit the robustness
issues.
[ Risks ]
Low risk, hardly anything in trixie uses libsdl3-image: I believe it's
only freerdp-sdl, a developer-oriented RDP client with low popcon, which
uses it to load images into dialogs.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
All changes are robustness fixes from upstream. Most are fixed in 3.4.2
or 3.4.4 upstream. One is not in an upstream release yet, I backported
it into forky already.
[ Other info ]
Related to https://bugs.debian.org/1134510 for libsdl2-image, an older
branch of the same codebase.
--- End Message ---
--- Begin Message ---
Version: 13.7
This update was released as part of 13.7.
--- End Message ---
