Bug#1105885: Helping to fix CVE-2025-4817{4,5} on bookworm
Hi Multimedia Maintainers and Boyuan,
On Mon, May 26, 2025 at 10:17:53PM -0300, Carlos Henrique Lima Melara wrote:
> Hi,
>
> On Sun, May 25, 2025 at 08:42:30PM +0200, Salvatore Bonaccorso wrote:
> > Attached are the patches we aim to use for bookworm.
> >
> > The first one, is very similar to your backported one, but it uses
> > abort() instead of exit(1), as upstream suggested to be consistent
> > with avifAlloc(). I put an explanation in the patch.
> >
> > The second was handled after all in public as you asked there as well,
> > so it is identical to what Wan-Teh Chang posted on the issue.
> >
> > Hope this helps.
>
> It does help quite a lot, thanks Salvatore! I've tested things in
> bullseye and all is fine [1] (though it had only one rdep in there and
> no rdep autopkgtest, it was quite a new package at the time).
I've uploaded the fix to LTS and sent the DLA. I've also opened a merge
request in libavif's repo to update debian/bullseye branch with the
latest version [1], could you merge please?
A small note, the tag for 0.8.4-2+deb11u2 is available in my fork, could
you grab there and push to multimedia-team/libavif or give me permission
so I can do it myself? The tag for 0.8.4-2+deb11u1 is missing in the
repo too.
Cheers,
Charles
[1] https://salsa.debian.org/multimedia-team/libavif/-/merge_requests/4
[2] https://salsa.debian.org/charles/libavif
Reply to: