fop - Debian Package Tracker

general

source: fop (main)
version: 1:2.10+dfsg1-4
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Mathieu Malaterre (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:2.5-3
oldstable: 1:2.8-2
stable: 1:2.10+dfsg-2
testing: 1:2.10+dfsg1-4
unstable: 1:2.10+dfsg1-4

versioned links

1:2.5-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.8-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.10+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.10+dfsg1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

fop (5 bugs: 0, 1, 4, 0)
fop-doc
libfop-java

action needed

A new upstream version is available: 2.12 high

A new upstream version 2.12 is available, you should consider packaging it.

Created: 2025-11-27 Last update: 2026-11-15 18:50

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-71395: unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
CVE-2026-126627: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

Created: 2026-11-12 Last update: 2026-11-13 02:31

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-71395: unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
CVE-2026-126627: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

Created: 2026-11-12 Last update: 2026-11-13 02:31

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-71395: unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
CVE-2026-126627: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

Created: 2026-11-12 Last update: 2026-11-13 02:31

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2026-71395: unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.
CVE-2026-126627: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: through 2.11. Users are recommended to upgrade to version 2.12, which fixes the issue.

1 issue postponed or untriaged:

CVE-2024-28168: (needs triaging) Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.

Created: 2026-11-12 Last update: 2026-11-13 02:31

debian/patches: 1 patch with invalid metadata, 5 patches to forward upstream high

Among the 13 debian patches available in version 1:2.10+dfsg1-4 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
5 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-11-03 10:32

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-28 Last update: 2026-10-28 04:31

news

[rss feed]

[2026-11-08] fop 1:2.10+dfsg1-4 MIGRATED to testing (Debian testing watch)
[2026-11-03] Accepted fop 1:2.10+dfsg1-4 (source) into unstable (Juan Manuel Méndez Rey) (signed by: Simon Quigley)
[2026-11-02] Accepted fop 1:2.10+dfsg1-3 (source) into unstable (Juan Manuel Méndez Rey) (signed by: Simon Quigley)
[2026-11-01] fop 1:2.10+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2026-10-27] Accepted fop 1:2.10+dfsg1-2 (source) into unstable (Emmanuel Bourg)
[2026-09-12] fop 1:2.10+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-09-02] Accepted fop 1:2.10+dfsg1-1 (source) into unstable (Pierre Gruet)
[2025-05-19] fop 1:2.10+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-05-07] Accepted fop 1:2.10+dfsg-2 (source) into unstable (Pierre Gruet)
[2024-11-13] fop 1:2.10+dfsg-1 MIGRATED to testing (Debian testing watch)
[2024-11-07] Accepted fop 1:2.10+dfsg-1 (source) into unstable (Pierre Gruet)
[2024-11-03] Accepted fop 1:2.10+dfsg-1~exp1 (source) into experimental (Pierre Gruet)
[2024-11-02] Accepted fop 1:2.10+dfsg-1~exp0 (source) into experimental (Pierre Gruet)
[2024-02-24] fop 1:2.8-3 MIGRATED to testing (Debian testing watch)
[2024-02-18] Accepted fop 1:2.8-3 (source) into unstable (tony mancill)
[2023-01-10] fop 1:2.8-2 MIGRATED to testing (Debian testing watch)
[2023-01-05] Accepted fop 1:2.8-2 (source) into unstable (Mathieu Malaterre)
[2023-01-04] Accepted fop 1:2.8-1 (source) into unstable (Mathieu Malaterre)
[2022-11-08] fop 1:2.7-1 MIGRATED to testing (Debian testing watch)
[2022-11-03] Accepted fop 1:2.7-1 (source) into unstable (Mathieu Malaterre)
[2022-01-02] fop 1:2.6-2 MIGRATED to testing (Debian testing watch)
[2021-12-27] Accepted fop 1:2.6-2 (source) into unstable (tony mancill)
[2021-12-04] fop 1:2.6-1 MIGRATED to testing (Debian testing watch)
[2021-11-29] Accepted fop 1:2.6-1 (source) into unstable (Mathieu Malaterre)
[2021-01-06] fop 1:2.5-3 MIGRATED to testing (Debian testing watch)
[2020-12-31] Accepted fop 1:2.5-3 (source) into unstable (tony mancill)
[2020-12-29] Accepted fop 1:2.5-2 (source) into unstable (tony mancill)
[2020-07-07] fop 1:2.5-1 MIGRATED to testing (Debian testing watch)
[2020-07-01] Accepted fop 1:2.5-1 (source) into unstable (Mathieu Malaterre)
[2020-03-12] fop 1:2.4-3 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 8
RC: 0
I&N: 1
M&W: 7
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1:2.10+dfsg1-4
6 bugs