Version in base suite: 2.42.10+dfsg-1+deb12u1 Base version: gdk-pixbuf_2.42.10+dfsg-1+deb12u1 Target version: gdk-pixbuf_2.42.10+dfsg-1+deb12u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gdk-pixbuf/gdk-pixbuf_2.42.10+dfsg-1+deb12u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gdk-pixbuf/gdk-pixbuf_2.42.10+dfsg-1+deb12u2.dsc changelog | 6 ++++++ patches/CVE-2025-6199.patch | 30 ++++++++++++++++++++++++++++++ patches/series | 1 + 3 files changed, 37 insertions(+) diff -Nru gdk-pixbuf-2.42.10+dfsg/debian/changelog gdk-pixbuf-2.42.10+dfsg/debian/changelog --- gdk-pixbuf-2.42.10+dfsg/debian/changelog 2024-06-13 21:04:36.000000000 +0000 +++ gdk-pixbuf-2.42.10+dfsg/debian/changelog 2025-06-19 20:52:54.000000000 +0000 @@ -1,3 +1,9 @@ +gdk-pixbuf (2.42.10+dfsg-1+deb12u2) bookworm-security; urgency=medium + + * CVE-2025-6199 (Closes: #1107994) + + -- Moritz Mühlenhoff Thu, 19 Jun 2025 22:52:54 +0200 + gdk-pixbuf (2.42.10+dfsg-1+deb12u1) bookworm; urgency=medium * ANI: Reject files with multiple anih chunks (CVE-2022-48622) diff -Nru gdk-pixbuf-2.42.10+dfsg/debian/patches/CVE-2025-6199.patch gdk-pixbuf-2.42.10+dfsg/debian/patches/CVE-2025-6199.patch --- gdk-pixbuf-2.42.10+dfsg/debian/patches/CVE-2025-6199.patch 1970-01-01 00:00:00.000000000 +0000 +++ gdk-pixbuf-2.42.10+dfsg/debian/patches/CVE-2025-6199.patch 2025-06-19 20:52:54.000000000 +0000 @@ -0,0 +1,30 @@ +From c4986342b241cdc075259565f3fa7a7597d32a32 Mon Sep 17 00:00:00 2001 +From: lumi +Date: Sat, 7 Jun 2025 22:27:06 +0200 +Subject: [PATCH] lzw: Fix reporting of bytes written in decoder + +When the LZW decoder encounters an invalid code, it stops +processing the image and returns the whole buffer size. +It should return the amount of bytes written, instead. + +Fixes #257 +--- + gdk-pixbuf/lzw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gdk-pixbuf/lzw.c b/gdk-pixbuf/lzw.c +index 15293560b..4f3dd8beb 100644 +--- a/gdk-pixbuf/lzw.c ++++ b/gdk-pixbuf/lzw.c +@@ -208,7 +208,7 @@ lzw_decoder_feed (LZWDecoder *self, + /* Invalid code received - just stop here */ + if (self->code >= self->code_table_size) { + self->last_code = self->eoi_code; +- return output_length; ++ return n_written; + } + + /* Convert codeword into indexes */ +-- +GitLab + diff -Nru gdk-pixbuf-2.42.10+dfsg/debian/patches/series gdk-pixbuf-2.42.10+dfsg/debian/patches/series --- gdk-pixbuf-2.42.10+dfsg/debian/patches/series 2024-06-13 21:04:02.000000000 +0000 +++ gdk-pixbuf-2.42.10+dfsg/debian/patches/series 2025-06-19 20:52:54.000000000 +0000 @@ -5,3 +5,4 @@ ANI-Reject-files-with-multiple-anih-chunks.patch ANI-Reject-files-with-multiple-INAM-or-IART-chunks.patch ANI-Validate-anih-chunk-size.patch +CVE-2025-6199.patch