Public bug reported:
A new release of libgphoto2 is available for merging from Debian.
Ubuntu: 2.5.33-1ubuntu2
Debian Unstable: 2.5.34-2
### New Debian Changes ###
libgphoto2 (2.5.34-2) unstable; urgency=medium
* [be329ad] New patch: Drop the leading components from HAVE_CC
(Closes: #1150179)
* [a556711] Drop the now-superfluous Priority: optional declaration
* [13e6dff] Drop the now-superfluous Rules-Requires-Root: no declaration
* [255263b] Reformat Build-Depends
* [20f74c3] Switch to Debhelper compatibility level 14
-- Ferenc Wágner <[email protected]> Thu, 08 Oct 2026 12:23:13 +0200
libgphoto2 (2.5.34-1) unstable; urgency=medium
* [8fb3b5b] New upstream version 2.5.34 (Closes: #1134329)
Contains fixes for CVE-2026-40333, CVE-2026-40334, CVE-2026-40335,
CVE-2026-40336, CVE-2026-40338, CVE-2026-40339, CVE-2026-40340 and
CVE-2026-40341.
* [988af35] Update Standards-Version to 4.7.4 (no changes required)
* [da497dd] Update watch file to version 5
* [1254f9b] Adapt to new Lintian override format
-- Ferenc Wágner <[email protected]> Tue, 06 Oct 2026 14:23:31 +0200
### Old Ubuntu Delta ###
libgphoto2 (2.5.33-1ubuntu2) stonking; urgency=medium
* SECURITY UPDATE: unbounded reads via data pointer but no length parameter
- debian/patches/CVE-2026-40333.patch: Fixed EOS ImageFormat/CustomFuncEx
Parsers Lack Length Parameter in camlibs/ptp2/ptp-pack.c.
- CVE-2026-40333
* SECURITY UPDATE: OOB read via missing null terminator
- debian/patches/CVE-2026-40334.patch: Fixed Canon FolderEntry Missing Null
Termination in camlibs/ptp2/ptp-pack.c.
- CVE-2026-40334
* SECURITY UPDATE: out-of-bounds read
- debian/patches/CVE-2026-40335.patch: Fixed UINT128/INT128 Unchecked
Offset in camlibs/ptp2/ptp-pack.c.
- CVE-2026-40335
* SECURITY UPDATE: memory leak
- debian/patches/CVE-2026-40336.patch: Fixed Sony DPD Secondary Enum List
Memory Leak in camlibs/ptp2/ptp-pack.c.
- CVE-2026-40336
* SECURITY UPDATE: out-of-bounds read in PTP_DPFF_Enumeration
- debian/patches/CVE-2026-40338.patch: Fixed Sony DPD Enum Count OOB Read
in camlibs/ptp2/ptp-pack.c.
- CVE-2026-40338
* SECURITY UPDATE: out-of-bounds read in ptp_unpack_Sony_DPD()
- debian/patches/CVE-2026-40339.patch: Fixed Sony DPD FormFlag OOB Read in
camlibs/ptp2/ptp-pack.c.
- CVE-2026-40339
* SECURITY UPDATE: out-of-bounds read vulnerability in ptp_unpack_OI()
- debian/patches/CVE-2026-40340.patch: Fixed ObjectInfo Parser OOB Read in
camlibs/ptp2/ptp-pack.c.
- CVE-2026-40340
* SECURITY UPDATE: out of bound read in ptp_unpack_EOS_FocusInfoEx
- debian/patches/CVE-2026-40341.patch: Fixed OOB read in
ptp_unpack_EOS_FocusInfoEx in camlibs/ptp2/ptp-pack.c.
- CVE-2026-40341
-- Marc Deslauriers <[email protected]> Wed, 15 Jul 2026
12:34:49 -0400
libgphoto2 (2.5.33-1ubuntu1) resolute; urgency=medium
* Bluetooth device [0489:e111] is falsely considered as a MTP device,
remove this matching rule, to make Bluetooth work. (LP: #2137691)
-- Atlas Yu <[email protected]> Fri, 23 Jan 2026 04:58:45 +0000
** Affects: libgphoto2 (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: libgphoto2 (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: libgphoto2 (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171225
Title:
Merge libgphoto2 2.5.34-2 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libgphoto2/+bug/2171225/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
