Your message dated Sat, 12 Sep 2026 08:05:40 +0000
with message-id <[email protected]>
and subject line Released in 13.7
has caused the Debian Bug report #1146368,
regarding trixie-pu: package fluidsynth/2.4.4+dfsg-1+deb13u3
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146368: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146368
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:fluidsynth
User: [email protected]
Usertags: pu
Fixes two low severity security issues, all tests were fine
and tests in debusine look good. Debdiff below.
Cheers,
Moritz
diff -Nru fluidsynth-2.4.4+dfsg/debian/changelog
fluidsynth-2.4.4+dfsg/debian/changelog
--- fluidsynth-2.4.4+dfsg/debian/changelog 2026-03-04 20:50:29.000000000
+0100
+++ fluidsynth-2.4.4+dfsg/debian/changelog 2026-08-30 19:13:05.000000000
+0200
@@ -1,3 +1,10 @@
+fluidsynth (2.4.4+dfsg-1+deb13u3) trixie; urgency=medium
+
+ * CVE-2026-58264
+ * CVE-2026-61714
+
+ -- Moritz Mühlenhoff <[email protected]> Sun, 30 Aug 2026 19:13:05 +0200
+
fluidsynth (2.4.4+dfsg-1+deb13u2) trixie; urgency=medium
* CVE-2025-56225
diff -Nru fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch
fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch
--- fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch 1970-01-01
01:00:00.000000000 +0100
+++ fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-58264.patch 2026-08-28
12:11:54.000000000 +0200
@@ -0,0 +1,17 @@
+From 762a3bd39a431cd45abf3bbcce7286c87909d087 Mon Sep 17 00:00:00 2001
+From: derselbst <[email protected]>
+Date: Fri, 19 Jun 2026 20:11:54 +0200
+Subject: [PATCH] Fix a heap-based buffer overrun in pitch_bend_range command
+
+--- fluidsynth-2.4.4+dfsg.orig/src/bindings/fluid_cmd.c
++++ fluidsynth-2.4.4+dfsg/src/bindings/fluid_cmd.c
+@@ -795,8 +795,7 @@ fluid_handle_pitch_bend_range(void *data
+
+ channum = atoi(av[0]);
+ value = atoi(av[1]);
+-
fluid_channel_set_pitch_wheel_sensitivity(handler->synth->channel[channum],
value);
+- return FLUID_OK;
++ return fluid_synth_pitch_wheel_sens(handler->synth, channum, value);
+ }
+
+ int
diff -Nru fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch
fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch
--- fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch 1970-01-01
01:00:00.000000000 +0100
+++ fluidsynth-2.4.4+dfsg/debian/patches/CVE-2026-61714.patch 2026-08-28
12:12:45.000000000 +0200
@@ -0,0 +1,39 @@
+From 772702e00cc6acc7c607efb40283e2269211effc Mon Sep 17 00:00:00 2001
+From: derselbst <[email protected]>
+Date: Sat, 27 Jun 2026 08:51:10 +0200
+Subject: [PATCH] Fix heap buffer overflow in MIDI player GHSA-976m-35rw-h3m6
+
+--- fluidsynth-2.4.4+dfsg.orig/src/midi/fluid_midi.c
++++ fluidsynth-2.4.4+dfsg/src/midi/fluid_midi.c
+@@ -1617,10 +1617,11 @@ fluid_track_send_events(fluid_track_t *t
+ {
+ if(player->playback_callback)
+ {
++ int *chan_is_playing =
&player->channel_isplaying[event->channel % MAX_NUMBER_OF_CHANNELS];
+ player->playback_callback(player->playback_userdata, event);
+- if(event->type == NOTE_ON && event->param2 != 0 &&
!player->channel_isplaying[event->channel])
++ if(event->type == NOTE_ON && event->param2 != 0 &&
!*chan_is_playing)
+ {
+- player->channel_isplaying[event->channel] = TRUE;
++ *chan_is_playing = TRUE;
+ }
+ }
+ }
+@@ -2138,7 +2139,7 @@ fluid_player_callback(void *data, unsign
+ {
+ if(fluid_atomic_int_get(&player->stopping))
+ {
+- for(i = 0; i < synth->midi_channels; i++)
++ for(i = 0; i < MAX_NUMBER_OF_CHANNELS; i++)
+ {
+ if(player->channel_isplaying[i])
+ {
+@@ -2186,7 +2187,7 @@ fluid_player_callback(void *data, unsign
+ seek_ticks = fluid_atomic_int_get(&player->seek_ticks);
+ if(seek_ticks >= 0)
+ {
+- for(i = 0; i < synth->midi_channels; i++)
++ for(i = 0; i < MAX_NUMBER_OF_CHANNELS; i++)
+ {
+ if(player->channel_isplaying[i])
+ {
diff -Nru fluidsynth-2.4.4+dfsg/debian/patches/series
fluidsynth-2.4.4+dfsg/debian/patches/series
--- fluidsynth-2.4.4+dfsg/debian/patches/series 2026-03-04 20:50:16.000000000
+0100
+++ fluidsynth-2.4.4+dfsg/debian/patches/series 2026-08-28 12:12:34.000000000
+0200
@@ -1 +1,3 @@
CVE-2025-56225.patch
+CVE-2026-58264.patch
+CVE-2026-61714.patch
--- End Message ---
--- Begin Message ---
Version: 13.7
This update was released as part of 13.7.
--- End Message ---
