Your message dated Sat, 12 Sep 2026 17:08:59 +0200
with message-id <[email protected]>
and subject line Re: Bug#1144469: transition: libcec
has caused the Debian Bug report #1144469,
regarding transition: libcec
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144469: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144469
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
User: [email protected]
Usertags: transition
Dear Release Team,
I would like to request a transition slot for libcec, which I just
dput.
Upstream 8.1.6 bumps SONAME from libcec.so.7 to libcec.so.8, so shared
library package is renamed libcec7 -> libcec8. No API changes that
affect the reverse dependencies. (The ABI change is just the addition
of three fields at the end of libcec_configuration.)
unstable now: libcec 7.1.1-2 (libcec7)
to be uploaded: libcec 8.1.6+dfsg-1 (libcec8)
Reverse dependencies of libcec7, and what they need:
kodi (kodi-bin)
vdr-plugin-xineliboutput (xineliboutput-fbfe, xineliboutput-sxfe,
xineliboutput-wlfe)
Both need only a binNMU. The development package is libcec-dev,
unversioned.
Notes:
* This has to clear NEW before the transition can start. It introduces
libcec8, and also new binary packages for rust and nodejs bindings.
* Upstream fixed a handful of buffer overflows in 8.0.0, and 7.1.1-2
in the archive still has them. No CVEs have been assigned, there is no
entry for src:libcec in the security tracker, and I am not requesting
that this be handled as a security upload. But still...
The four (4) security issues are:
1. CCECCommandHandler::HandleSetOSDName copies the whole CEC
datapacket into a 17-byte stack buffer with no bound. A datapacket
is up to 64 bytes, so any device on the HDMI bus can overflow it
by about 47 attacker-chosen bytes by sending a long SET_OSD_NAME.
This is reachable in kodi-bin. Fixed in upstream commit f65762b9.
The rest need either a hostile/broken display or a hostile USB adapter:
2. CUSBCECAdapterCommands::RequestSetting memcpy()s a reply length
taken from the adapter into a fixed cec_datapacket. Fixed in
upstream commit 16c1e13d.
3. The EDID readers (nvidia, drm) read an unbounded fgetc loop into a
4096-byte buffer, and the shared parser underflows (size - 4) for
sizes 1..4 and reads out of bounds. EDID comes from the connected
display via sysfs/procfs. Fixed in upstream commit 94e37582.
4. String copy sizes in the cecc-client example, upstream issue #708.
Fixed in upstream commit 01769988.
Ben file:
title = "libcec";
is_affected = .depends ~ "libcec7" | .depends ~ "libcec8";
is_good = .depends ~ "libcec8";
is_bad = .depends ~ "libcec7";
Cheers,
--Barak
--- End Message ---
--- Begin Message ---
On 2026-09-02 12:59:28 +0100, Barak A. Pearlmutter wrote:
> libcec 8.1.6+dfsg2-1 has cleared NEW.
>
> Upstream has also merged the debian patches.
The old binaries got removed from testing. Closing.
Cheers
--
Sebastian Ramacher
--- End Message ---
