Version in base suite: 3.5.2+dfsg-1+deb13u1 Base version: cimg_3.5.2+dfsg-1+deb13u1 Target version: cimg_3.5.2+dfsg-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/c/cimg/cimg_3.5.2+dfsg-1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/c/cimg/cimg_3.5.2+dfsg-1+deb13u2.dsc changelog | 11 +++++++++++ patches/CVE-2026-47667.patch | 36 ++++++++++++++++++++++++++++++++++++ patches/openexr-iex.patch | 22 ++++++++++++++++++++++ patches/series | 2 ++ 4 files changed, 71 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpv8z7ii71/cimg_3.5.2+dfsg-1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpv8z7ii71/cimg_3.5.2+dfsg-1+deb13u2.dsc: no acceptable signature found diff -Nru cimg-3.5.2+dfsg/debian/changelog cimg-3.5.2+dfsg/debian/changelog --- cimg-3.5.2+dfsg/debian/changelog 2026-05-08 11:47:35.000000000 +0000 +++ cimg-3.5.2+dfsg/debian/changelog 2026-11-10 11:54:15.000000000 +0000 @@ -1,3 +1,14 @@ +cimg (3.5.2+dfsg-1+deb13u2) trixie; urgency=medium + + * Non-maintainer upload. + * Fix FTBFS with the OpenEXR 3.2.12 security update by linking Iex + explicitly when building the OpenEXR-enabled examples. This also + fixes the installed examples used by autopkgtest. + * CVE-2026-47667: Bound Analyze/NIfTI header allocations and release + the header buffer on read errors. (Closes: #1142677) + + -- Aron Xu Tue, 10 Nov 2026 19:54:15 +0800 + cimg (3.5.2+dfsg-1+deb13u1) trixie; urgency=medium * Non-maintainer upload. diff -Nru cimg-3.5.2+dfsg/debian/patches/CVE-2026-47667.patch cimg-3.5.2+dfsg/debian/patches/CVE-2026-47667.patch --- cimg-3.5.2+dfsg/debian/patches/CVE-2026-47667.patch 1970-01-01 00:00:00.000000000 +0000 +++ cimg-3.5.2+dfsg/debian/patches/CVE-2026-47667.patch 2026-11-10 11:54:15.000000000 +0000 @@ -0,0 +1,36 @@ +Description: Bound Analyze/NIfTI header allocations and own the buffer on errors + Backport the CVE-2026-47667 header-size bound and header-buffer RAII fix. +Origin: upstream, https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee +Bug: https://github.com/GreycLab/CImg/issues/480 +Bug-Debian: https://bugs.debian.org/1142677 +Forwarded: not-needed +Last-Update: 2026-11-12 + +--- a/CImg.h ++++ b/CImg.h +@@ -57176,13 +57176,15 @@ + unsigned int header_size; + cimg::fread(&header_size,1,nfile_header); + if (header_size>=4096) { endian = true; cimg::invert_endianness(header_size); } +- if (header_size<128) ++ const ulongT fsiz = file?(ulongT)cimg_max_buf_size:(ulongT)cimg::fsize(nfile_header); ++ if (header_size<128 || (ulongT)header_size>fsiz) + throw CImgIOException(_cimg_instance + "load_analyze(): Invalid header size (%u) specified in file '%s'.", + cimg_instance, + header_size,filename?filename:"(FILE*)"); + +- unsigned char *const header = new unsigned char[header_size]; ++ CImg _header(header_size); ++ unsigned char *const header = _header._data; + const size_t header_size_read = cimg::fread(header + 4,header_size - 4,nfile_header); + if (header_size_read!=header_size - 4) + throw CImgIOException(_cimg_instance +@@ -57228,7 +57230,6 @@ + const float *vsize = (float*)(header + 76); + voxel_size[0] = vsize[1]; voxel_size[1] = vsize[2]; voxel_size[2] = vsize[3]; + } +- delete[] header; + + // Read pixel data. + assign(dimx,dimy,dimz,dimv); diff -Nru cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch --- cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch 1970-01-01 00:00:00.000000000 +0000 +++ cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch 2026-11-10 11:54:15.000000000 +0000 @@ -0,0 +1,22 @@ +Description: Link Iex when building OpenEXR-enabled examples + OpenEXR 3.2.12 validates dimensions in the inline Array/Array2D templates. + Instantiating these templates can introduce direct Iex::ArgExc references, + so the examples must link Iex explicitly rather than relying on OpenEXR + to load it as a runtime dependency. +Author: Aron Xu +Forwarded: not-needed +Last-Update: 2026-11-10 + +Index: cimg-3.5.2+dfsg/examples/Makefile +=================================================================== +--- cimg-3.5.2+dfsg.orig/examples/Makefile ++++ cimg-3.5.2+dfsg/examples/Makefile +@@ -249,7 +249,7 @@ HEIF_LIBS = -lheif + OPENEXR_DEFINE = -Dcimg_use_openexr + OPENEXR_INCDIR = -I/usr/include/OpenEXR -I/usr/include/Imath + OPENEXR_CFLAGS = $(OPENEXR_DEFINE) $(OPENEXR_INCDIR) +-OPENEXR_LIBS = -lOpenEXR -lImath ++OPENEXR_LIBS = -lOpenEXR -lImath -lIex + + # Flags to enable native support for various video files, using the FFMPEG library. + # ( http://www.ffmpeg.org/ ) diff -Nru cimg-3.5.2+dfsg/debian/patches/series cimg-3.5.2+dfsg/debian/patches/series --- cimg-3.5.2+dfsg/debian/patches/series 2026-05-08 11:47:35.000000000 +0000 +++ cimg-3.5.2+dfsg/debian/patches/series 2026-11-10 11:54:15.000000000 +0000 @@ -5,3 +5,5 @@ Imath.patch fix-cve-2026-42144.patch fix-cve-2026-42146.patch +openexr-iex.patch +CVE-2026-47667.patch