Your message dated Fri, 06 Nov 2026 07:19:46 +0000
with message-id <[email protected]>
and subject line Bug#1149063: fixed in libraw 0.22.3-1exp1
has caused the Debian Bug report #1149063,
regarding libraw: CVE-2026-88387
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149063: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149063
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libraw
Version: 0.22.1-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/LibRaw/LibRaw/issues/844
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for libraw.
CVE-2026-88387[0]:
| LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability
| in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe
| (NewSubfileType). A specially crafted RAW, TIFF, or DNG file can
| supply an attacker-controlled NewSubfileType value outside the range
| of a signed int. The parser converts this value and narrows it to
| int without performing range validation. This out-of-range
| conversion triggers undefined behavior, resulting in process
| termination and denial of service.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-88387
https://www.cve.org/CVERecord?id=CVE-2026-88387
[1] https://github.com/LibRaw/LibRaw/issues/844
[2] https://github.com/LibRaw/LibRaw/pull/853
[3]
https://github.com/LibRaw/LibRaw/commit/b41cbbd61951783e0440590dae55411a16185bdf
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libraw
Source-Version: 0.22.3-1exp1
Done: xiao sheng wen <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libraw, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
xiao sheng wen <[email protected]> (supplier of updated libraw package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 06 Nov 2026 15:07:22 +0800
Source: libraw
Architecture: source
Version: 0.22.3-1exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian PhotoTools Maintainers
<[email protected]>
Changed-By: xiao sheng wen <[email protected]>
Closes: 1128504 1149063
Changes:
libraw (0.22.3-1exp1) experimental; urgency=medium
.
* Team upload.
.
[ Benjamin Drung ]
* Drop comments of removed symbols
* Enable LTO build and drop LTO-optimized symbols (Closes: #1128504)
.
[ xiao sheng wen ]
* Bump debhelper-compat 14
* d/watch: add Pgp-Mode: none
* d/libraw25.lintian-overrides: update dirpath use usr/lib/*/
* New upstream version 0.22.3
- Closes: #1149063 CVE-2026-88387
- CVE-2026-111272 is a false positive and a very bad example of reporting
* d/libraw25.symbols: update used by pkgkde-symbolshelper
Checksums-Sha1:
f5b34ba2eb1372df19d652baf3b1f6920519bc36 2231 libraw_0.22.3-1exp1.dsc
7b0cf437ba3ad0ae02e2468112ae212a66c0c7cb 612784 libraw_0.22.3.orig.tar.gz
72cb75ef2c796e4de34c85e5fc3eff660fda5fa9 26056
libraw_0.22.3-1exp1.debian.tar.xz
51a2485b00f61e0984670b0e55d2b1141cca3fa9 6137
libraw_0.22.3-1exp1_source.buildinfo
Checksums-Sha256:
4d42ba9326350dd1186ae3330f0bd49ad16cfaa1c8b6ed267c29a6a3139c02b9 2231
libraw_0.22.3-1exp1.dsc
fc6b94387df269bdfe4dff4a38740fe703fd8df0c3bae41e294f037cdb3ecd75 612784
libraw_0.22.3.orig.tar.gz
c50042604268a386b64c514c0381c4f57dc4024fe8479b70e4266b100e714898 26056
libraw_0.22.3-1exp1.debian.tar.xz
591ac2641960f8a2d16076a4746b620bcb469c5f6cc7f94e4c0c81efdec7fda0 6137
libraw_0.22.3-1exp1_source.buildinfo
Files:
402e83a98f03662cab342eec81fe1145 2231 libs optional libraw_0.22.3-1exp1.dsc
174fccc0cd27f54ab0ddd6e6cc43ebcc 612784 libs optional libraw_0.22.3.orig.tar.gz
f9d18739d24c9791713ac282a011951d 26056 libs optional
libraw_0.22.3-1exp1.debian.tar.xz
14af50635a4d997e4aae354889f9a9c7 6137 libs optional
libraw_0.22.3-1exp1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEvGv7H5NUQYeSuhtTJ2Egg8PSprAFAmrtfSQACgkQJ2Egg8PS
prDCrg/+KQBDllDe/u/u2agmgeVyYdhEpVgS0PrIHohRwJax5YU/h6iELtJ4KddE
IU82wKlYwUxT98l9VDF4LHjBqI99FkUom5gQWTmQhBXNZXyoE8ApTX50kkbM3wKD
n4YRWPoEcU8splrfDfA1AKwKXKs55AUBssiCh7xyRbGi9BkAswthPmC/Y/yiJQOC
EoO+luRcyO8QyqsCP3Jv/iN3jZOdmdpriE/zlDsRPlrMbbnE4Yl5Dh0Q1JF0ePUN
9szH35004J2fSJobYml0RNXI88ib94HOKhSOiZPqJzK+WyQniFZW/My5XJ8Xb5Fb
De8zQUa3T1M/Fj7takn3C6ZGX4IY2aYhqJOFgrkBgTfY4AFqCV48Jfz3fNZw19Tk
faxzn6szwJ6ZKT5+hJYmUVEq23lHCQBBSVObYpDih0dhAiieMckkWbOr4TWm3PNT
w71Gv7QNIaJrc2s/CtgZFxZBQGfiuwkVMwm7WEUe1s1uu6yHN3vpOHVXIxb/05Xd
634cxATzjlZdNf5B8zZuArVtRlRp7cpO0qqox/n/WWdUGh9RwwDGIWqSQy7jB48P
OcuD7rIfD3TsPricfLMzCBySuD7yhzQ5564vPBqDyGE1UoiYtlXsNIGbXI/SnVGl
sVxoDJ6ZUD4HNNe+BkzLJgOZnyNYpqjUrgITNv2PqeLWyQf/zz8=
=ikZW
-----END PGP SIGNATURE-----
pgpQ1FbR0vJBF.pgp
Description: PGP signature
--- End Message ---
