blender - Debian Package Tracker

general

source: blender (main)
version: 4.3.2+dfsg-2
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: Matteo F. Vescovi [DMD]
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.83.5+dfsg-5+deb11u1
o-o-sec: 2.83.5+dfsg-5+deb11u1
oldstable: 3.4.1+dfsg-2
stable: 4.3.2+dfsg-2
unstable: 4.3.2+dfsg-2
exp: 5.0.1+dfsg-2

versioned links

2.83.5+dfsg-5+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.1+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.3.2+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.1+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

blender (20 bugs: 1, 12, 7, 0)
blender-data (3 bugs: 0, 2, 1, 0)

action needed

source package has 2 unsatisfiable build dependencies high

Build dependencies in unstable cannot be satisfied on amd64, s390x, riscv64, loong64, ppc64el, and arm64 because: unsatisfied dependency on libboost-system-dev
Build dependencies in unstable cannot be satisfied on armhf and i386 because: unsatisfied dependency on architecture-is-64-bit

Created: 2026-04-16 Last update: 2026-07-15 06:00

1 binary package has unsatisfiable dependencies high

The dependencies of blender=4.3.2+dfsg-2 cannot be satisfied in unstable on amd64, s390x, riscv64, ppc64el, and arm64 because: unsatisfied dependency on libboost-locale1.83.0 (>= 1.83.0)

Created: 2026-06-19 Last update: 2026-07-15 06:00

A new upstream version is available: 5.1.2 high

A new upstream version 5.1.2 is available, you should consider packaging it.

Created: 2025-11-26 Last update: 2026-07-15 03:32

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-60103: Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

Created: 2026-07-14 Last update: 2026-07-14 05:01

2 security issues in bullseye high

There are 2 open security issues in bullseye.

1 important issue:

CVE-2026-60103: Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

1 issue postponed or untriaged:

CVE-2022-2831: (needs triaging) A flaw was found in Blender 3.3.0. An interger overflow in source/blender/blendthumb/src/blendthumb_extract.cc may lead to program crash or memory corruption.

Created: 2026-07-14 Last update: 2026-07-14 05:01

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-60103: Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

Created: 2026-07-14 Last update: 2026-07-14 05:01

debian/patches: 2 patches with invalid metadata, 3 patches to forward upstream high

Among the 7 debian patches available in version 4.3.2+dfsg-2 of the package, we noticed the following issues:

2 patches with invalid metadata that ought to be fixed.
3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-02-03 12:00

AppStream hints: 1 error and 2 warnings for blender,blender-data high

AppStream found metadata issues for packages:

blender: 1 warning
blender-data: 1 error and 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2020-06-01 Last update: 2024-01-27 03:06

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2026-04-13 Last update: 2026-07-15 05:01

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-06-02 Last update: 2026-07-15 05:00

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

blender-data could have its dependency on python3 annotated with :any

Created: 2016-09-14 Last update: 2026-07-15 00:32

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-07-01 Last update: 2026-07-01 18:00

lintian reports 5 warnings normal

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-02-03 Last update: 2025-04-11 03:30

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-60103: (needs triaging) Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-07-14 Last update: 2026-07-14 05:01

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2023-08-22 Last update: 2023-08-22 10:04

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-03-31 15:01

testing migrations

This package will soon be part of the auto-imath transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-opencolorio transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for blender (- to 4.3.2+dfsg-2): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ blender/amd64 has unsatisfiable dependency
- ∙ ∙ blender/arm64 has unsatisfiable dependency
- ∙ ∙ blender/ppc64el has unsatisfiable dependency
- ∙ ∙ blender/riscv64 has unsatisfiable dependency
- ∙ ∙ blender/s390x has unsatisfiable dependency
- ∙ ∙ Updating blender would introduce bugs in testing: #1115049, #1127173, #1132503
- ∙ ∙ blender unsatisfiable Build-Depends(-Arch) on amd64: libboost-system-dev
- ∙ ∙ blender unsatisfiable Build-Depends(-Arch) on arm64: libboost-system-dev
- ∙ ∙ blender unsatisfiable Build-Depends(-Arch) on ppc64el: libboost-system-dev
- ∙ ∙ blender unsatisfiable Build-Depends(-Arch) on riscv64: libboost-system-dev
- ∙ ∙ blender unsatisfiable Build-Depends(-Arch) on s390x: libboost-system-dev
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/b/blender.html
- ∙ ∙ Autopkgtest skipped on amd64: not installable
- ∙ ∙ Autopkgtest skipped on arm64: not installable
- ∙ ∙ Autopkgtest skipped on ppc64el: not installable
- ∙ ∙ Autopkgtest skipped on riscv64: not installable
- ∙ ∙ Autopkgtest skipped on s390x: not installable
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- ∙ ∙ 527 days old (needed 5 days)
- Not considered

news

[rss feed]

[2026-07-02] Accepted blender 5.0.1+dfsg-2 (source) into experimental (Antoine Lassagne) (signed by: Paride Legovini)
[2026-03-09] Accepted blender 5.0.1+dfsg-1 (source) into experimental (Antoine Lassagne) (signed by: Paride Legovini)
[2026-01-09] blender REMOVED from testing (Debian testing watch)
[2025-02-08] blender 4.3.2+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-02-02] Accepted blender 4.3.2+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2025-01-11] Accepted blender 4.3.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-12-04] Accepted blender 4.3.0+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-10-28] Accepted blender 4.2.3+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2024-10-26] Accepted blender 4.2.3+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2024-10-25] Accepted blender 4.2.3+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-09-28] Accepted blender 4.2.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-09-09] Accepted blender 4.2.1+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-06-26] Accepted blender 4.1.1+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2024-06-16] Accepted blender 4.1.1+dfsg-2 (source) into experimental (Matteo F. Vescovi)
[2024-06-16] Accepted blender 4.1.1+dfsg-1 (source) into experimental (Matteo F. Vescovi)
[2024-03-26] blender REMOVED from testing (Debian testing watch)
[2024-01-20] blender 4.0.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-12-31] Accepted blender 4.0.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2023-09-06] Accepted blender 3.6.2+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2023-08-20] Accepted blender 3.6.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2023-08-01] blender REMOVED from testing (Debian testing watch)
[2023-01-28] blender 3.4.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2023-01-28] blender 3.4.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2023-01-17] Accepted blender 3.4.1+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2023-01-14] Accepted blender 3.4.1+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2022-12-22] blender 3.3.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-10-22] Accepted blender 3.3.1+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2022-09-08] Accepted blender 3.2.2+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2022-09-04] Accepted blender 3.2.2+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2022-08-18] Accepted blender 3.2.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)

bugs [bug history graph]

all: 23 25
RC: 1
I&N: 15
M&W: 7 9
F&P: 0
patch: 1

links

homepage
lintian (0, 5)
buildd: logs, exp, debcheck, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 100)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.0.1+dfsg-1ubuntu3