cairo - Debian Package Tracker

general

source: cairo (main)
version: 1.16.0-5
maintainer: Debian GNOME Maintainers (archive) (DMD)
uploaders: Jeremy Bicha [DMD] – Emilio Pozuelo Monfort [DMD] – Laurent Bigonville [DMD]
arch: all any
std-ver: 4.5.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.14.8-1
o-o-sec: 1.14.8-1+deb9u1
oldstable: 1.16.0-4+deb10u1
stable: 1.16.0-5
testing: 1.16.0-5
unstable: 1.16.0-5

versioned links

1.14.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.14.8-1+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.0-4+deb10u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.16.0-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

cairo-perf-utils (1 bugs: 0, 1, 0, 0)
libcairo-gobject2
libcairo-script-interpreter2
libcairo2 (42 bugs: 0, 42, 0, 0)
libcairo2-dev (1 bugs: 0, 1, 0, 0)
libcairo2-doc
libcairo2-udeb

action needed

Marked for autoremoval on 30 June due to nvidia-graphics-drivers-tesla-470: #1011146 high

Version 1.16.0-5 of cairo is marked for autoremoval from testing on Thu 30 Jun 2022. It depends (transitively) on nvidia-graphics-drivers-tesla-470, affected by #1011146. You should try to prevent the removal by fixing these RC bugs.

Created: 2022-05-24 Last update: 2022-05-25 10:14

lintian reports 1 error and 9 warnings high

Lintian reports 1 error and 9 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-01-27 Last update: 2022-01-01 04:31

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2017-7475: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
CVE-2019-6461: An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
CVE-2019-6462: An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.
CVE-2018-18064: cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).

Created: 2021-02-19 Last update: 2021-12-05 06:30

4 security issues in bookworm high

There are 4 open security issues in bookworm.

4 important issues:

CVE-2017-7475: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
CVE-2019-6461: An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
CVE-2019-6462: An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.
CVE-2018-18064: cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).

Created: 2021-08-15 Last update: 2021-12-05 06:30

3 bugs tagged patch in the BTS normal

The BTS contains patches fixing 3 bugs, consider including or untagging them.

Created: 2021-08-14 Last update: 2022-05-25 10:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.16.0-6, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 5955e578b2a4520c09c6358645d42240fcb78202
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Wed Feb 2 20:43:06 2022 +0000

    Remove constraints unnecessary since buster
    
    * Build-Depends: Drop versioned constraint on libpixman-1-dev, libx11-dev, libxcb-render0-dev, libxcb1-dev, libxrender-dev and pkg-config.
    * libcairo2: Drop versioned constraint on weston in Breaks.
    * libcairo2-dev: Drop versioned constraint on libpixman-1-dev, libxcb-render0-dev, libxcb1-dev and libxrender-dev in Depends.
    
    Changes-By: deb-scrub-obsolete

commit abe1fef3cde487f152125e8e5cc4cc2b0967004f
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 20:39:43 2021 +0100

    Update changelog

commit 6290383c7f4ef12fabbf1073d9da7210abd2e281
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 20:33:45 2021 +0100

    d/rules: Disable LTO optimization
    
    The "optimize" feature area is not in Debian yet, but it's present in
    dpkg git and was backported into Ubuntu's dpkg. According to testing in
    Ubuntu, cairo is not ready for this yet.
    
    Thanks: Matthias Klose
    Closes: #986153

commit a429c4d969265340ab66543b6a979723e045b5d9
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 20:31:28 2021 +0100

    d/rules: Don't do feature-reduced udeb build if udebs have been disabled
    
    Thanks: Matthias Klose
    Closes: #986153

commit ddff7370923bb22973a2821e8013f49a0857c881
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 20:14:38 2021 +0100

    Bump debhelper compat level from 12 to 13
    
    No changes to built binaries (verified with diffoscope).
    
    Changes-By: lintian-brush
    Fixes: lintian: package-uses-old-debhelper-compat-version
    See-also: https://lintian.debian.org/tags/package-uses-old-debhelper-compat-version.html

commit 8a16cc9b2ba9bc4eea37c3d984a08a05ce8c3520
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 19:44:30 2021 +0100

    Avoid explicitly specifying -Wl,--as-needed linker flag
    
    This is the default in toolchain versions >= bullseye.
    
    Changes-By: lintian-brush
    Fixes: lintian: debian-rules-uses-as-needed-linker-flag
    See-also: https://lintian.debian.org/tags/debian-rules-uses-as-needed-linker-flag.html

commit 3d483bfce691ba26f29dadf320147549a34e26ca
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 19:44:22 2021 +0100

    Add missing ${misc:Depends} to Depends for libcairo2-udeb
    
    Changes-By: lintian-brush
    Fixes: lintian: debhelper-but-no-misc-depends
    See-also: https://lintian.debian.org/tags/debhelper-but-no-misc-depends.html

commit 0879aa5094d52f9702d4cb777d9b539c42d97972
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 19:44:01 2021 +0100

    Standards-Version: 4.6.0 (no changes required)

commit 40fe3a602de74a6accfaf434e79602a1744d282d
Author: Simon McVittie <smcv@debian.org>
Date:   Tue Sep 28 19:43:11 2021 +0100

    d/control.in: Replace transitional libfontconfig1-dev with libfontconfig-dev

commit 35882fadac42e801dda8f5b00affcc9acd764711
Author: Laurent Bigonville <bigon@debian.org>
Date:   Thu Apr 29 11:22:43 2021 +0200

    debian/control.in: Switch dependencies from libfreetype6-dev to libfreetype-dev

commit d01b4763dd5e9bf188611baedbda8b0b2a67a037
Author: Helmut Grohne <helmut@subdivi.de>
Date:   Mon Jan 25 06:42:14 2021 +0100

    Drop unused Build-Depends: libxsm-dev, xutils-dev, libxt-dev
    
    These appear to have been unused since 2006, when cairo switched to
    preferring pkg-config and xlib.pc as its way to find Xlib.
    
    Closes: #980992

Created: 2021-01-26 Last update: 2022-05-18 14:35

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.1 instead of 4.5.1).

Created: 2021-08-18 Last update: 2022-05-11 23:25

No known security issue in buster wishlist

There are 4 open security issues in buster.

4 ignored issues:

CVE-2017-7475: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
CVE-2019-6461: An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
CVE-2019-6462: An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.
CVE-2018-18064: cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).

Created: 2021-02-19 Last update: 2021-12-05 06:30

No known security issue in bullseye wishlist

There are 4 open security issues in bullseye.

4 ignored issues:

CVE-2017-7475: Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.
CVE-2019-6461: An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.
CVE-2019-6462: An issue was discovered in cairo 1.16.0. There is an infinite loop in the function _arc_error_normalized in the file cairo-arc.c, related to _arc_max_angle_for_tolerance_normalized.
CVE-2018-18064: cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).

Created: 2021-08-14 Last update: 2021-12-05 06:30

news

[rss feed]

[2021-01-30] Accepted cairo 1.16.0-4+deb10u1 (source amd64 all) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Moritz Mühlenhoff)
[2021-01-07] cairo 1.16.0-5 MIGRATED to testing (Debian testing watch)
[2021-01-05] Accepted cairo 1.14.8-1+deb9u1 (source amd64 all) into oldstable (Utkarsh Gupta)
[2021-01-01] Accepted cairo 1.16.0-5 (source) into unstable (Simon McVittie)
[2019-03-20] cairo 1.16.0-4 MIGRATED to testing (Debian testing watch)
[2019-03-15] Accepted cairo 1.16.0-4 (source) into unstable (Simon McVittie)
[2019-03-05] cairo 1.16.0-3 MIGRATED to testing (Debian testing watch)
[2019-02-22] Accepted cairo 1.16.0-3 (source) into unstable (Sebastien Bacher)
[2018-12-26] cairo 1.16.0-2 MIGRATED to testing (Debian testing watch)
[2018-12-23] Accepted cairo 1.16.0-2 (source) into unstable (Jeremy Bicha)
[2018-10-23] cairo 1.16.0-1 MIGRATED to testing (Debian testing watch)
[2018-10-20] Accepted cairo 1.16.0-1 (source) into unstable (Jeremy Bicha)
[2018-08-26] cairo 1.15.12-1 MIGRATED to testing (Debian testing watch)
[2018-08-24] Accepted cairo 1.15.12-1 (source) into unstable (Jeremy Bicha)
[2018-04-24] cairo 1.15.10-3 MIGRATED to testing (Debian testing watch)
[2018-04-18] Accepted cairo 1.15.10-3 (source) into unstable (Emilio Pozuelo Monfort)
[2018-02-25] Accepted cairo 1.15.10-2 (source) into unstable (Jeremy Bicha)
[2018-02-08] cairo 1.15.10-1 MIGRATED to testing (Debian testing watch)
[2018-02-02] Accepted cairo 1.15.10-1 (source) into unstable (Jeremy Bicha)
[2017-12-27] cairo 1.15.8-3 MIGRATED to testing (Debian testing watch)
[2017-12-21] Accepted cairo 1.15.8-3 (source) into unstable (Jeremy Bicha)
[2017-10-30] cairo 1.15.8-2 MIGRATED to testing (Debian testing watch)
[2017-10-25] Accepted cairo 1.15.8-2 (source amd64 all) into unstable (Laurent Bigonville)
[2017-10-17] Accepted cairo 1.15.8-1 (source amd64 all) into experimental (Laurent Bigonville)
[2017-07-07] cairo 1.14.10-1 MIGRATED to testing (Debian testing watch)
[2017-07-02] Accepted cairo 1.14.10-1 (source) into unstable (Andreas Henriksson)
[2017-01-02] Accepted cairo 1.14.0-2.1+deb8u2 (all source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2016-12-24] cairo 1.14.8-1 MIGRATED to testing (Debian testing watch)
[2016-12-13] Accepted cairo 1.14.8-1 (source) into unstable (Emilio Pozuelo Monfort)
[2016-11-14] cairo 1.14.6-1.1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 55 57
RC: 0
I&N: 50 52
M&W: 3
F&P: 2
patch: 3

links

homepage
lintian (1, 9)
buildd: logs, clang, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.16.0-5ubuntu2
26 bugs (2 patches)
patches for 1.16.0-5ubuntu2