Version in base suite: 47.0-1 Base version: eog_47.0-1 Target version: eog_47.0-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/e/eog/eog_47.0-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/e/eog/eog_47.0-1+deb13u1.dsc changelog | 6 +++ patches/png-security-fixes.patch | 70 +++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 77 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpo91rk09l/eog_47.0-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpo91rk09l/eog_47.0-1+deb13u1.dsc: no acceptable signature found diff -Nru eog-47.0/debian/changelog eog-47.0/debian/changelog --- eog-47.0/debian/changelog 2024-09-16 15:31:54.000000000 +0000 +++ eog-47.0/debian/changelog 2026-10-23 21:46:16.000000000 +0000 @@ -1,3 +1,9 @@ +eog (47.0-1+deb13u1) trixie-security; urgency=medium + + * CVE-2026-107651 (Closes: #1150455) + + -- Moritz Mühlenhoff Fri, 23 Oct 2026 23:46:16 +0200 + eog (47.0-1) unstable; urgency=medium * New upstream release diff -Nru eog-47.0/debian/patches/png-security-fixes.patch eog-47.0/debian/patches/png-security-fixes.patch --- eog-47.0/debian/patches/png-security-fixes.patch 1970-01-01 00:00:00.000000000 +0000 +++ eog-47.0/debian/patches/png-security-fixes.patch 2026-10-23 21:46:16.000000000 +0000 @@ -0,0 +1,70 @@ +From 769e4309ae6976248d8c5debe0ff85ff167ed705 Mon Sep 17 00:00:00 2001 +From: Ege BALCI +Date: Sun, 18 Oct 2026 20:07:46 +0200 +Subject: [PATCH] EogMetadataReaderPng: Resume parser in correct state while + parsing chunks + +From 04e4f313421eacb9fc529781542bb7fb81a3cd1a Mon Sep 17 00:00:00 2001 +From: Felix Riemann +Date: Sun, 18 Oct 2026 21:00:44 +0200 +Subject: [PATCH] EogMetadataReaderPng: Avoid buffer overflow with malformed + iCCP chunks + + +--- eog-47.0.orig/src/eog-metadata-reader-png.c ++++ eog-47.0/src/eog-metadata-reader-png.c +@@ -263,7 +263,7 @@ eog_metadata_reader_png_consume (EogMeta + priv->size > (22 + 54) && priv->xmp_chunk == NULL) { + priv->state = EMR_READ_XMP_ITXT; + } else if (memcmp (priv->chunk_name, "iCCP", 4) == 0 && +- priv->icc_chunk == NULL) { ++ priv->icc_chunk == NULL && priv->size >= 128) { + priv->state = EMR_READ_ICCP; + } else if (memcmp (priv->chunk_name, "sRGB", 4) == 0 && + priv->sRGB_chunk == NULL && priv->size == 1) { +@@ -420,7 +420,7 @@ eog_metadata_reader_png_consume (EogMeta + eog_metadata_reader_png_get_next_block (priv, + priv->cHRM_chunk, + &i, buf, len, +- EMR_READ_ICCP); ++ EMR_READ_CHRM); + break; + case EMR_READ_GAMA: + /* Extract the gAMA chunk containing the +@@ -440,7 +440,7 @@ eog_metadata_reader_png_consume (EogMeta + eog_metadata_reader_png_get_next_block (priv, + priv->gAMA_chunk, + &i, buf, len, +- EMR_READ_ICCP); ++ EMR_READ_GAMA); + break; + default: + g_assert_not_reached (); +@@ -520,7 +520,8 @@ eog_metadata_reader_png_get_icc_profile + + priv = emr->priv; + +- if (priv->icc_chunk) { ++ /* An iCCP chunk needs to be at least 4 bytes long */ ++ if (priv->icc_chunk && priv->icc_len >= 4) { + gpointer outbuf; + gsize offset = 0; + z_stream zstr; +@@ -532,11 +533,15 @@ eog_metadata_reader_png_get_icc_profile + zstr.opaque = Z_NULL; + + /* Skip the name of the ICC profile */ +- while (*((guchar*)priv->icc_chunk+offset) != '\0') ++ while (offset < priv->icc_len ++ && *((guchar*)priv->icc_chunk+offset) != '\0') + offset++; + /* Ensure the compression method (deflate) */ +- if (*((guchar*)priv->icc_chunk+(++offset)) != '\0') ++ if (offset >= (priv->icc_len - 2) ++ || *((guchar*)priv->icc_chunk+(++offset)) != '\0') { ++ eog_debug_message (DEBUG_IMAGE_DATA, "Nonconforming ICC chunk. Ignoring."); + return NULL; ++ } + ++offset; //offset now points to the start of the deflated data + + /* Prepare the zlib data structure for decompression */ diff -Nru eog-47.0/debian/patches/series eog-47.0/debian/patches/series --- eog-47.0/debian/patches/series 2024-09-16 15:31:54.000000000 +0000 +++ eog-47.0/debian/patches/series 2026-10-23 21:46:16.000000000 +0000 @@ -0,0 +1 @@ +png-security-fixes.patch