biosig - Debian Package Tracker

general

source: biosig (main)
version: 3.9.5-1
maintainer: Debian Med Packaging Team (archive) (DMD) (LowNMU)
uploaders: Yaroslav Halchenko (DMD) – Michael Hanke (DMD) – Alois Schlögl (DMD)
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.1.2-4
oldstable: 2.5.0-1
stable: 3.9.0-1
testing: 3.9.5-1
unstable: 3.9.5-1

versioned links

2.1.2-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.5.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.9.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.9.5-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

biosig-tools
libbiosig-dev
libbiosig3
octave-biosig (1 bugs: 0, 1, 0, 0)
python3-biosig

action needed

A new upstream version is available: 4.0.0 high

A new upstream version 4.0.0 is available, you should consider packaging it.

Created: 2026-09-05 Last update: 2026-11-15 12:00

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-05-01 Last update: 2026-11-15 17:03

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.0.0-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 88a26421ce6e572f984be2c381adfc8c604adee3
Author: Andreas Tille <tille@debian.org>
Date:   Tue Nov 10 19:49:33 2026 +0100

    TODO: Clarify copyright see https://dfsg-new-queue.debian.org/reviews/biosig?response_token=hsOcd7DigLb_sZ51y0ZgPZEWnTEJqmsL#maintainer-response

commit 6feb0d0f9aab3960de4b43bb647820381d57ee9b
Author: Andreas Tille <tille@debian.org>
Date:   Tue Nov 10 17:00:40 2026 +0100

    Upload to unstable

commit a3453ee06e71aa28ba89fd681c2c8dfc749a6a21
Author: Andreas Tille <tille@debian.org>
Date:   Tue Nov 10 16:55:28 2026 +0100

    lrc clean d/copyright

commit fb7db161107e3344d7f78b62f5e7400475dfdda6
Author: Andreas Tille <tille@debian.org>
Date:   Mon Nov 9 16:53:49 2026 +0100

    Major review of d/copyright, add d/lrc.config

commit 25dd0769590bfd88e756f4f81f55e81e7db97cca
Author: Andreas Tille <tille@debian.org>
Date:   Mon Nov 9 10:25:14 2026 +0100

    Upload to unstable

commit 4dc5ecc86dbfaa27cd63967f4d08a43d81f2f7e4
Author: Andreas Tille <tille@debian.org>
Date:   Mon Nov 9 10:20:37 2026 +0100

    SONAME was bumped from 3 to 4 in upstream 3.9.8

commit 973792d58658aaf14e0578ef646207746f50db2e
Author: Andreas Tille <tille@debian.org>
Date:   Sun Nov 8 07:26:57 2026 +0100

    d/watch: Point to https://git.ista.ac.at/alois.schloegl/biosig

commit dbeb83b07b483625230d13fe093e7cf897853306
Author: Andreas Tille <tille@debian.org>
Date:   Thu Nov 5 10:46:31 2026 +0100

    Drop 'Rules-Requires-Root: no' from d/control (routine-update)

commit de9e032f01dd7736f5b625a9367d0ff9ea8a01c1
Author: Andreas Tille <tille@debian.org>
Date:   Thu Nov 5 10:46:29 2026 +0100

    Changes made by cme

commit bcbf1d23877e2ff111bcead94f5e1e69d71016f3
Author: Andreas Tille <tille@debian.org>
Date:   Thu Nov 5 10:45:00 2026 +0100

    New upstream version

commit f17d8937f113de021127c54c5bd57dac0b07f61c
Merge: e95771b c3e5ddf
Author: Andreas Tille <tille@debian.org>
Date:   Thu Nov 5 10:44:24 2026 +0100

    Update upstream source from tag 'upstream/4.0.0'
    
    Update to upstream version '4.0.0'
    with Debian dir fb3dbf6d36be0932c75237de5c4f89e764e7995b

commit c3e5ddfc06157a7a8a7fc612beeab8a88704a43f
Author: Andreas Tille <tille@debian.org>
Date:   Thu Nov 5 10:44:21 2026 +0100

    New upstream version 4.0.0

Created: 2026-11-05 Last update: 2026-11-10 20:33

33 low-priority security issues in trixie low

There are 33 open security issues in trixie.

33 issues left for the package maintainer to handle:

CVE-2025-46411: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-48005: (needs triaging) A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted RHS2000 file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-52461: (needs triaging) An out-of-bounds read vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted .nex file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-52581: (needs triaging) An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted GDF file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-53511: (needs triaging) A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-53518: (needs triaging) An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ABF file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-53557: (needs triaging) A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-53853: (needs triaging) A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted ISHNE ECG annotations file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-54462: (needs triaging) A heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted .nex file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-54480: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8719 of biosig.c on the current master branch (35a819fa), when the Tag is 0: if (tag==0) { if (len!=1) fprintf(stderr,"Warning MFER tag0 incorrect length %i!=1\n",len); curPos += ifread(buf,1,len,hdr); }
CVE-2025-54481: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8744 of biosig.c on the current master branch (35a819fa), when the Tag is 3: else if (tag==3) { // character code char v[17]; // [1] if (len>16) fprintf(stderr,"Warning MFER tag2 incorrect length %i>16\n",len); curPos += ifread(&v,1,len,hdr); v[len] = 0; In this case, the overflowed buffer is the newly-declared `v` \[1\] instead of `buf`. Since `v` is only 17 bytes large, much smaller values of `len` (even those encoded using a single octet) can trigger an overflow in this code path.
CVE-2025-54482: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8751 of biosig.c on the current master branch (35a819fa), when the Tag is 4: else if (tag==4) { // SPR if (len>4) fprintf(stderr,"Warning MFER tag4 incorrect length %i>4\n",len); curPos += ifread(buf,1,len,hdr);
CVE-2025-54483: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8759 of biosig.c on the current master branch (35a819fa), when the Tag is 5: else if (tag==5) //0x05: number of channels { uint16_t oldNS=hdr->NS; if (len>4) fprintf(stderr,"Warning MFER tag5 incorrect length %i>4\n",len); curPos += ifread(buf,1,len,hdr);
CVE-2025-54484: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8779 of biosig.c on the current master branch (35a819fa), when the Tag is 6: else if (tag==6) // 0x06 "number of sequences" { // NRec if (len>4) fprintf(stderr,"Warning MFER tag6 incorrect length %i>4\n",len); curPos += ifread(buf,1,len,hdr);
CVE-2025-54485: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8785 of biosig.c on the current master branch (35a819fa), when the Tag is 8: else if (tag==8) { if (len>2) fprintf(stderr,"Warning MFER tag8 incorrect length %i>2\n",len); curPos += ifread(buf,1,len,hdr);
CVE-2025-54486: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8824 of biosig.c on the current master branch (35a819fa), when the Tag is 11: else if (tag==11) //0x0B { // Fs if (len>6) fprintf(stderr,"Warning MFER tag11 incorrect length %i>6\n",len); double fval; curPos += ifread(buf,1,len,hdr);
CVE-2025-54487: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8842 of biosig.c on the current master branch (35a819fa), when the Tag is 12: else if (tag==12) //0x0C { // sampling resolution if (len>6) fprintf(stderr,"Warning MFER tag12 incorrect length %i>6\n",len); val32 = 0; int8_t v8; curPos += ifread(&UnitCode,1,1,hdr); curPos += ifread(&v8,1,1,hdr); curPos += ifread(buf,1,len-2,hdr); In addition to values of `len` greater than 130 triggering a buffer overflow, a value of `len` smaller than 2 will also trigger a buffer overflow due to an integer underflow when computing `len-2` in this code path.
CVE-2025-54488: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8850 of biosig.c on the current master branch (35a819fa), when the Tag is 13: else if (tag==13) { if (len>8) fprintf(stderr,"Warning MFER tag13 incorrect length %i>8\n",len); curPos += ifread(&buf,1,len,hdr);
CVE-2025-54489: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 8970 of biosig.c on the current master branch (35a819fa), when the Tag is 63: else if (tag==63) { uint8_t tag2=255, len2=255; count = 0; while ((count<len) && !(FlagInfiniteLength && len2==0 && tag2==0)){ curPos += ifread(&tag2,1,1,hdr); curPos += ifread(&len2,1,1,hdr); if (VERBOSE_LEVEL==9) fprintf(stdout,"MFER: tag=%3i chan=%2i len=%-4i tag2=%3i len2=%3i curPos=%i %li count=%4i\n",tag,chan,len,tag2,len2,curPos,iftell(hdr),(int)count); if (FlagInfiniteLength && len2==0 && tag2==0) break; count += (2+len2); curPos += ifread(&buf,1,len2,hdr); Here, the number of bytes read is not the Data Length decoded from the current frame in the file (`len`) but rather is a new length contained in a single octet read from the same input file (`len2`). Despite this, a stack-based buffer overflow condition can still occur, as the destination buffer is still `buf`, which has a size of only 128 bytes, while `len2` can be as large as 255.
CVE-2025-54490: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9090 of biosig.c on the current master branch (35a819fa), when the Tag is 64: else if (tag==64) //0x40 { // preamble char tmp[256]; // [1] curPos += ifread(tmp,1,len,hdr); In this case, the overflowed buffer is the newly-declared `tmp` \[1\] instead of `buf`. While `tmp` is larger than `buf`, having a size of 256 bytes, a stack overflow can still occur in cases where `len` is encoded using multiple octets and is greater than 256.
CVE-2025-54491: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9191 of biosig.c on the current master branch (35a819fa), when the Tag is 65: else if (tag==65) //0x41: patient event { // event table curPos += ifread(buf,1,len,hdr);
CVE-2025-54492: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9141 of biosig.c on the current master branch (35a819fa), when the Tag is 67: else if (tag==67) //0x43: Sample skew { int skew=0; // [1] curPos += ifread(&skew, 1, len,hdr); In this case, the address of the newly-defined integer `skew` \[1\] is overflowed instead of `buf`. This means a stack overflow can occur using much smaller values of `len` in this code path.
CVE-2025-54493: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9184 of biosig.c on the current master branch (35a819fa), when the Tag is 131: else if (tag==131) //0x83 { // Patient Age if (len!=7) fprintf(stderr,"Warning MFER tag131 incorrect length %i!=7\n",len); curPos += ifread(buf,1,len,hdr);
CVE-2025-54494: (needs triaging) A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa). A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability manifests on line 9205 of biosig.c on the current master branch (35a819fa), when the Tag is 133: else if (tag==133) //0x85 { curPos += ifread(buf,1,len,hdr);
CVE-2025-64736: (needs triaging) An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afb0). A specially crafted .abf file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2025-66043: (needs triaging) Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 3
CVE-2025-66044: (needs triaging) Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 64
CVE-2025-66045: (needs triaging) Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 65
CVE-2025-66046: (needs triaging) Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 67
CVE-2025-66047: (needs triaging) Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 131
CVE-2025-66048: (needs triaging) Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. A specially crafted MFER file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger these vulnerabilities.When Tag is 133
CVE-2026-20777: (needs triaging) A heap-based buffer overflow vulnerability exists in the Nicolet WFT parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted .wft file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2026-22891: (needs triaging) A heap-based buffer overflow vulnerability exists in the Intan CLP parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (db9a9a63). A specially crafted Intan CLP file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-08-25 Last update: 2026-09-01 22:00

news

[rss feed]

[2026-05-01] biosig 3.9.5-1 MIGRATED to testing (Debian testing watch)
[2026-04-26] Accepted biosig 3.9.5-1 (source) into unstable (Andreas Tille)
[2026-01-14] biosig REMOVED from testing (Debian testing watch)
[2025-04-08] biosig 3.9.0-1 MIGRATED to testing (Debian testing watch)
[2025-04-02] Accepted biosig 3.9.0-1 (source) into unstable (Étienne Mollier)
[2024-08-10] biosig 2.6.1-1 MIGRATED to testing (Debian testing watch)
[2024-08-05] Accepted biosig 2.6.1-1 (source) into unstable (Étienne Mollier)
[2024-02-24] biosig 2.6.0-1 MIGRATED to testing (Debian testing watch)
[2024-02-24] biosig 2.6.0-1 MIGRATED to testing (Debian testing watch)
[2024-02-19] Accepted biosig 2.6.0-1 (source) into unstable (Andreas Tille)
[2024-02-11] biosig 2.5.2-2 MIGRATED to testing (Debian testing watch)
[2024-02-06] Accepted biosig 2.5.2-2 (source) into unstable (Andreas Tille)
[2023-10-24] biosig 2.5.2-1 MIGRATED to testing (Debian testing watch)
[2023-10-19] Accepted biosig 2.5.2-1 (source) into unstable (Andreas Tille)
[2023-01-17] biosig 2.5.0-1 MIGRATED to testing (Debian testing watch)
[2023-01-12] Accepted biosig 2.5.0-1 (source) into unstable (Andreas Tille)
[2022-06-12] biosig 2.4.0-2 MIGRATED to testing (Debian testing watch)
[2022-06-06] Accepted biosig 2.4.0-2 (source) into unstable (Étienne Mollier)
[2022-05-12] Accepted biosig 2.4.0-1 (source) into unstable (Andreas Tille)
[2022-01-05] biosig 2.3.3-1 MIGRATED to testing (Debian testing watch)
[2021-12-30] Accepted biosig 2.3.3-1 (source) into unstable (Alois Schlögl) (signed by: Andreas Tille)
[2021-04-26] biosig 2.1.2-4 MIGRATED to testing (Debian testing watch)
[2021-04-15] Accepted biosig 2.1.2-4 (source) into unstable (Alois Schlögl) (signed by: Andreas Tille)
[2021-02-04] biosig 2.1.2-3 MIGRATED to testing (Debian testing watch)
[2021-02-04] biosig 2.1.2-3 MIGRATED to testing (Debian testing watch)
[2021-01-30] Accepted biosig 2.1.2-3 (source) into unstable (Alois Schlögl) (signed by: Andreas Tille)
[2021-01-22] biosig 2.1.2-2 MIGRATED to testing (Debian testing watch)
[2021-01-16] Accepted biosig 2.1.2-2 (source) into unstable (Juhani Numminen) (signed by: Andreas Tille)
[2021-01-14] Accepted biosig 2.1.2-1 (source) into unstable (Juhani Numminen) (signed by: Andreas Tille)
[2020-12-06] biosig 2.1.0-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.9.5-1build1
2 bugs (1 patch)