libgsf - Debian Package Tracker

general

source: libgsf (main)
version: 1.14.53-1
maintainer: Dmitry Smirnov (DMD)
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.14.45-1
oldstable: 1.14.47-1
old-sec: 1.14.47-1+deb11u1
stable: 1.14.50-1+deb12u1
stable-sec: 1.14.50-1+deb12u1
testing: 1.14.53-1
unstable: 1.14.53-1

versioned links

1.14.45-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.47-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.47-1+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.50-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.53-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gir1.2-gsf-1
libgsf-1-114
libgsf-1-common
libgsf-1-dev (1 bugs: 0, 1, 0, 0)
libgsf-bin

action needed

4 security issues in trixie high

There are 4 open security issues in trixie.

4 important issues:

CVE-2025-2721: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been classified as critical. This affects the function gsf_base64_encode_simple. The manipulation of the argument size_t leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2722: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been declared as critical. This vulnerability affects the function gsf_prop_settings_collect_va. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Local access is required to approach this attack. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2723: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been rated as critical. This issue affects the function gsf_property_settings_collec. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2724: A vulnerability classified as problematic has been found in GNOME libgsf up to 1.14.53. Affected is the function sorting_key_copy. The manipulation of the argument Name leads to out-of-bounds read. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2025-03-25 Last update: 2025-03-27 11:30

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2025-2721: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been classified as critical. This affects the function gsf_base64_encode_simple. The manipulation of the argument size_t leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2722: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been declared as critical. This vulnerability affects the function gsf_prop_settings_collect_va. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Local access is required to approach this attack. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2723: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been rated as critical. This issue affects the function gsf_property_settings_collec. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2724: A vulnerability classified as problematic has been found in GNOME libgsf up to 1.14.53. Affected is the function sorting_key_copy. The manipulation of the argument Name leads to out-of-bounds read. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2025-03-25 Last update: 2025-03-27 11:30

4 security issues in bullseye high

There are 4 open security issues in bullseye.

4 important issues:

CVE-2025-2721: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been classified as critical. This affects the function gsf_base64_encode_simple. The manipulation of the argument size_t leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2722: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been declared as critical. This vulnerability affects the function gsf_prop_settings_collect_va. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Local access is required to approach this attack. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2723: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been rated as critical. This issue affects the function gsf_property_settings_collec. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2724: A vulnerability classified as problematic has been found in GNOME libgsf up to 1.14.53. Affected is the function sorting_key_copy. The manipulation of the argument Name leads to out-of-bounds read. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2025-03-25 Last update: 2025-03-27 11:30

4 security issues in bookworm high

There are 4 open security issues in bookworm.

4 important issues:

CVE-2025-2721: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been classified as critical. This affects the function gsf_base64_encode_simple. The manipulation of the argument size_t leads to heap-based buffer overflow. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2722: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been declared as critical. This vulnerability affects the function gsf_prop_settings_collect_va. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Local access is required to approach this attack. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2723: A vulnerability was found in GNOME libgsf up to 1.14.53. It has been rated as critical. This issue affects the function gsf_property_settings_collec. The manipulation of the argument n_alloced_params leads to heap-based buffer overflow. Attacking locally is a requirement. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-2724: A vulnerability classified as problematic has been found in GNOME libgsf up to 1.14.53. Affected is the function sorting_key_copy. The manipulation of the argument Name leads to out-of-bounds read. It is possible to launch the attack on the local host. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2025-03-25 Last update: 2025-03-27 11:30

lintian reports 1 error and 2 warnings high

Lintian reports 1 error and 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-01-29 Last update: 2025-01-29 18:01

8 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 3bf902d485f1a166c708f256667a65b5d6ef85a1
Merge: 85706d8 32eb0c1
Author: onlyjob <onlyjob@debian.org>
Date:   Thu Jan 30 23:49:37 2025 +0000

    Merge branch 'wip/smcv/cross' into 'master'
    
    Improve multiarch and ability to cross-compile
    
    See merge request debian/libgsf!5

commit 32eb0c16cc1b758ce0db1bffb2e112663ae5a091
Author: Simon McVittie <smcv@debian.org>
Date:   Wed Jan 29 10:49:29 2025 +0000

    d/control, d/rules: Enable GIR dh sequence declaratively
    
    This makes it easier to disable under specific build configurations.
    In fact we only need this sequence when building architecture-dependent
    packages, so move it to Build-Depends-Arch.

commit f42ef7f0534f834e38e9bdd108f4db8817ba0da1
Author: Simon McVittie <smcv@debian.org>
Date:   Wed Jan 29 10:17:56 2025 +0000

    d/rules: Don't build or install HTML docs with nodoc build option
    
    In addition to removing a source of non-reproducibility which can break
    multi-arch co-installation (#814502), when combined with previous changes
    this is enough to make it possible to cross-compile libgsf for a foreign
    architecture, as long as DEB_BUILD_OPTIONS includes nodoc and a version
    of qemu-user that emulates the host architecture is available.
    
    Mitigates: #814502

commit 7ad70c41d2f192dfe78686c144d758b53ef810bc
Author: Simon McVittie <smcv@debian.org>
Date:   Wed Jan 29 10:25:47 2025 +0000

    d/control: Add gir1.2-*-dev Build-Depends as suggested by dh_girepository
    
    These systematic virtual package names correspond exactly to the
    Gsf_1_gir_INCLUDES in the upstream build system. Explicitly
    build-depending on these means we no longer need to build-depend on
    libgirepository1.0-dev, which for historical reasons cannot be
    multiarch-friendly.

commit 16f1a8fc998b25d34534a69b945d1bb23eff3684
Author: Simon McVittie <smcv@debian.org>
Date:   Wed Jan 29 10:11:46 2025 +0000

    d/control: Add ${gir:Depends}, ${gir:Provides} to -dev package
    
    As suggested by dh_girepository warning messages during the build.
    
    ${gir:Depends} ensures that loading GIR XML files in this package will
    not fail because GIR XML that they depend on is missing.
    
    ${gir:Provides} allows other packages to depend on Gsf-1.gir by its
    systematic name gir1.2-gsf-1-dev.
    
    Fixes Lintian tag: gir-package-name-does-not-match

commit 9cb33653870eddb97683a8531a584eafbcf8883f
Author: Simon McVittie <smcv@debian.org>
Date:   Wed Jan 29 10:03:39 2025 +0000

    Add patch from Helmut Grohne to use host architecture pkg-config
    
    Fixes Lintian tag: autotools-pkg-config-macro-not-cross-compilation-safe
    Closes: #1061247

commit f3679d9c39063ad5d243e4f7ca88ef882f958f84
Author: Simon McVittie <smcv@debian.org>
Date:   Wed Jan 29 09:58:42 2025 +0000

    Revert "Build-Depends: gobject-introspection --> gobject-introspection-bin"
    
    As shown in its Description, gobject-introspection-bin is an
    implementation detail and is not intended to be depended on directly.
    
    This reverts commit 16ce503c0d86e0bc40b155d6b62b3159cf6f77ed.
    
    Fixes Lintian tag: missing-build-dependency-for-dh-addon gir
    Closes: #1094604

commit 85706d8971395f487168983ed8d1f295e238ee15
Author: onlyjob <onlyjob@member.fsf.org>
Date:   Wed Jan 29 16:14:08 2025 +1100

    CI: modernised config.

https://salsa.debian.org/api/v4/projects/debian%2Flibgsf/pipelines?scope=finished&per_page=1 API request failed: 403 Forbidden at /srv/qa.debian.org/data/vcswatch/vcswatch line 431.

Created: 2024-10-07 Last update: 2025-04-03 14:03

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.7.0).

Created: 2025-02-21 Last update: 2025-02-27 13:25

testing migrations

This package will soon be part of the auto-libxml2 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-02-04] libgsf 1.14.53-1 MIGRATED to testing (Debian testing watch)
[2025-01-29] Accepted libgsf 1.14.53-1 (source) into unstable (Dmitry Smirnov)
[2024-10-12] libgsf 1.14.52-1.1 MIGRATED to testing (Debian testing watch)
[2024-10-07] Accepted libgsf 1.14.52-1.1 (source) into unstable (Salvatore Bonaccorso)
[2024-10-06] Accepted libgsf 1.14.47-1+deb11u1 (source) into oldstable-security (Adrian Bunk)
[2024-10-06] Accepted libgsf 1.14.50-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-10-05] Accepted libgsf 1.14.50-1+deb12u1 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2024-05-07] libgsf 1.14.52-1 MIGRATED to testing (Debian testing watch)
[2024-05-02] Accepted libgsf 1.14.52-1 (source) into unstable (Dmitry Smirnov)
[2023-11-30] libgsf 1.14.51-2 MIGRATED to testing (Debian testing watch)
[2023-11-25] Accepted libgsf 1.14.51-2 (source) into unstable (Dmitry Smirnov)
[2023-11-24] Accepted libgsf 1.14.51-1 (source) into unstable (Dmitry Smirnov)
[2022-08-11] libgsf 1.14.50-1 MIGRATED to testing (Debian testing watch)
[2022-08-06] Accepted libgsf 1.14.50-1 (source) into unstable (Dmitry Smirnov)
[2022-04-04] libgsf 1.14.49-1 MIGRATED to testing (Debian testing watch)
[2022-03-30] Accepted libgsf 1.14.49-1 (source) into unstable (Dmitry Smirnov)
[2020-04-25] Accepted libgsf 1.14.30-2+deb8u1 (source amd64 all) into oldoldstable (Thorsten Alteholz)
[2020-04-10] libgsf 1.14.47-1 MIGRATED to testing (Debian testing watch)
[2020-04-05] Accepted libgsf 1.14.47-1 (source) into unstable (Dmitry Smirnov)
[2019-08-21] libgsf 1.14.46-1 MIGRATED to testing (Debian testing watch)
[2019-08-16] Accepted libgsf 1.14.46-1 (source) into unstable (Dmitry Smirnov)
[2019-01-30] libgsf 1.14.45-1 MIGRATED to testing (Debian testing watch)
[2019-01-25] Accepted libgsf 1.14.45-1 (source amd64 all) into unstable (Dmitry Smirnov)
[2018-09-22] libgsf 1.14.44-1 MIGRATED to testing (Debian testing watch)
[2018-09-17] Accepted libgsf 1.14.44-1 (source amd64 all) into unstable (Dmitry Smirnov)
[2018-05-04] libgsf 1.14.43-1 MIGRATED to testing (Debian testing watch)
[2018-04-29] Accepted libgsf 1.14.43-1 (source amd64 all) into unstable (Dmitry Smirnov)
[2017-10-13] libgsf 1.14.41-2 MIGRATED to testing (Debian testing watch)
[2017-10-08] Accepted libgsf 1.14.41-2 (source amd64 all) into unstable (Dmitry Smirnov)
[2016-12-17] libgsf 1.14.41-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 3
RC: 0
I&N: 1
M&W: 0
F&P: 2
patch: 0

links

homepage
lintian (1, 2)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
l10n (-, 89)

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.14.53-1
5 bugs