Register | Log in

libimobiledevice

Choose email to subscribe with

general

source: libimobiledevice (main)
version: 1.4.0+git20251127-2
maintainer: gtkpod Maintainers (archive) (DMD)
uploaders: Yves-Alexis Perez (DMD)
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.3.0-6
oldstable: 1.3.0-6
stable: 1.3.0+git20250228-2
testing: 1.4.0+git20251127-2
unstable: 1.4.0+git20251127-2

versioned links

1.3.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.0+git20250228-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.0+git20251127-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libimobiledevice-1.0-6 (1 bugs: 1, 0, 0, 0)
libimobiledevice-dev
libimobiledevice-doc
libimobiledevice-utils
python3-imobiledevice

action needed

5 security issues in trixie high

There are 5 open security issues in trixie.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-11-15 07:00

5 security issues in sid high

There are 5 open security issues in sid.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-11-15 07:00

5 security issues in forky high

There are 5 open security issues in forky.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-11-15 07:00

5 security issues in bookworm high

There are 5 open security issues in bookworm.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-11-15 07:00

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-10-27 Last update: 2026-11-04 12:01

debian/patches: 3 patches to forward upstream low

Among the 5 debian patches available in version 1.4.0+git20251127-2 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-11-10 11:32

testing migrations

This package will soon be part of the auto-libplist transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[2026-11-15] libimobiledevice 1.4.0+git20251127-2 MIGRATED to testing (Debian testing watch)
[2026-11-10] libimobiledevice 1.4.0+git20251127-1 MIGRATED to testing (Debian testing watch)
[2026-11-09] Accepted libimobiledevice 1.4.0+git20251127-2 (source) into unstable (Boyuan Yang)
[2026-11-03] Accepted libimobiledevice 1.4.0+git20251127-1 (source) into unstable (Boyuan Yang)
[2025-11-01] libimobiledevice 1.4.0-1 MIGRATED to testing (Debian testing watch)
[2025-10-26] Accepted libimobiledevice 1.4.0-1 (source) into unstable (Boyuan Yang)
[2025-10-13] libimobiledevice 1.3.0+git20250907-1 MIGRATED to testing (Debian testing watch)
[2025-10-07] Accepted libimobiledevice 1.3.0+git20250907-1 (source) into unstable (Boyuan Yang)
[2025-04-21] libimobiledevice 1.3.0+git20250228-2 MIGRATED to testing (Debian testing watch)
[2025-04-10] Accepted libimobiledevice 1.3.0+git20250228-2 (source) into unstable (Boyuan Yang)
[2025-04-06] Accepted libimobiledevice 1.3.0+git20250228-1 (source) into unstable (Boyuan Yang)
[2024-11-13] libimobiledevice 1.3.0+git20240701-4 MIGRATED to testing (Debian testing watch)
[2024-11-08] Accepted libimobiledevice 1.3.0+git20240701-4 (source) into unstable (Boyuan Yang)
[2024-11-08] Accepted libimobiledevice 1.3.0+git20240701-3 (source) into unstable (Boyuan Yang)
[2024-07-18] libimobiledevice 1.3.0+git20240701-2 MIGRATED to testing (Debian testing watch)
[2024-07-13] Accepted libimobiledevice 1.3.0+git20240701-2 (source) into unstable (Boyuan Yang)
[2024-07-12] Accepted libimobiledevice 1.3.0+git20240701-1 (source) into unstable (Boyuan Yang)
[2024-07-11] Accepted libimobiledevice 1.3.0+git20240701-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Boyuan Yang)
[2023-12-05] libimobiledevice 1.3.0-7.1 MIGRATED to testing (Debian testing watch)
[2023-11-29] Accepted libimobiledevice 1.3.0-8.1 (source) into experimental (Boyuan Yang)
[2023-11-29] Accepted libimobiledevice 1.3.0-7.1 (source) into unstable (Boyuan Yang)
[2023-08-06] libimobiledevice 1.3.0-7 MIGRATED to testing (Debian testing watch)
[2023-08-01] Accepted libimobiledevice 1.3.0-8 (source) into experimental (Boyuan Yang)
[2023-08-01] Accepted libimobiledevice 1.3.0-7 (source) into unstable (Boyuan Yang)
[2021-01-31] libimobiledevice 1.3.0-6 MIGRATED to testing (Debian testing watch)
[2021-01-26] Accepted libimobiledevice 1.3.0-6 (source) into unstable (Yves-Alexis Perez)
[2020-10-16] Accepted libimobiledevice 1.2.1~git20181030.92c5462-2+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Yves-Alexis Perez)
[2020-09-22] libimobiledevice 1.3.0-5 MIGRATED to testing (Debian testing watch)
[2020-09-17] Accepted libimobiledevice 1.3.0-5 (source) into unstable (Yves-Alexis Perez)
[2020-08-26] libimobiledevice 1.3.0-4 MIGRATED to testing (Debian testing watch)

1
2

bugs [bug history graph]

all: 5
RC: 1
I&N: 2
M&W: 2
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.0-1build2
17 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing