Source: libgphoto2 Version: 2.5.34-2 Severity: important Tags: security upstream fixed-upstream patch
Hi, The following vulnerabilities were published for libgphoto2, both in the Jeilin JL2005B/C/D camlib (camlibs/jl2005c), which Debian builds and ships (jl2005c.so in libgphoto2-6t64). CVE-2026-120451: jl2005c_init() takes the allocation table entry count from the device without an upper bound and reads/copies the table into the 0x4020 byte stack buffer info[] and into priv->table[0x4000]; a count of 1022 or more overflows both. CVE-2026-120452: jl2005bcd_decompress() takes the thumbnail size from a device header byte and byte-swaps that many samples in place without checking the input length (heap out-of-bounds read and write). Upstream issue: gphoto/libgphoto2 #1326 Upstream fix: pull request #1338, merged as af3b8e9c542c, consisting of 6a3393dd9965 jl2005c: reject an allocation table that does not fit the buffers (CVE-2026-120451) 30bf7ace6d47 jl2005c: bound thumbnail conversion by the real input length (CVE-2026-120452) Neither is in a release yet (the latest upstream release is 2.5.34). I checked the Debian sources: both commits apply with patch -p1 (clean on 2.5.34-2; 6a3393dd9965 with offset -1 on 2.5.31-4, 2.5.30-1 and 2.5.27-1), and a reverse dry-run confirms none of these versions contains the fix. Both bugs need a malicious or spoofed camera on USB. I did not test with a device or a reproducer. If you fix this in unstable, please make sure to reference the CVE ids in the changelog. Regards, Sumit Verma
