libimobiledevice - Debian Package Tracker

general

source: libimobiledevice (main)
version: 1.4.0-1
maintainer: gtkpod Maintainers (archive) (DMD)
uploaders: Yves-Alexis Perez [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.3.0-6
oldstable: 1.3.0-6
stable: 1.3.0+git20250228-2
testing: 1.4.0-1
unstable: 1.4.0-1

versioned links

1.3.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.3.0+git20250228-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libimobiledevice-1.0-6 (1 bugs: 1, 0, 0, 0)
libimobiledevice-dev
libimobiledevice-doc
libimobiledevice-utils (1 bugs: 0, 1, 0, 0)
python3-imobiledevice

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://github.com/libimobiledevice/libimobiledevice/tags failed: 500 Header line too long (limit is 8192)

Created: 2026-10-24 Last update: 2026-10-27 12:30

5 security issues in trixie high

There are 5 open security issues in trixie.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-10-27 07:33

5 security issues in sid high

There are 5 open security issues in sid.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-10-27 07:33

5 security issues in forky high

There are 5 open security issues in forky.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-10-27 07:33

5 security issues in bookworm high

There are 5 open security issues in bookworm.

5 important issues:

CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.0. This affects an unknown part of the file src/afc.c of the component AFC. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116259: A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the file src/afc.c of the component Device Info Handler. Performing a manipulation of the argument Value results in memory corruption. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116260: A weakness has been identified in libimobiledevice up to 1.4.0. This issue affects the function service_receive of the file src/afc.c of the component AFC Service. Executing a manipulation can lead to double free. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116261: A security vulnerability has been detected in libimobiledevice up to 1.4.0. Impacted is the function afc_file_open of the file src/afc.c of the component AFC File Handler. The manipulation of the argument bytes leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116262: A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the file src/webinspector.c of the component Web Inspector. The manipulation results in heap-based buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Created: 2026-10-27 Last update: 2026-10-27 07:33

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-27 15:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.4.0+git20251127-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 14c6655f6ece3852a65cbef2dbc16b3d7a7001bc
Author: Boyuan Yang <byang@debian.org>
Date:   Tue Dec 9 21:43:56 2025 -0500

    Switch from openssl to gnutls for legacy SSLv3 support. (#1076544)

commit 425426ae2678cd7c9cc815ffca437a083e3f7b59
Author: Boyuan Yang <byang@debian.org>
Date:   Tue Dec 9 21:39:24 2025 -0500

    debian/rules: Fix FTCBFS from python checking. (#1121258)

commit 89e9f7c92e2c54f5c8a35d5784d41f3d15ef7d61
Merge: 4123769 c4f1118
Author: Boyuan Yang <byang@debian.org>
Date:   Tue Dec 9 21:37:33 2025 -0500

    Merge tag 'upstream/1.4.0+git20251127' into debian/master

commit c4f111800d2b08d6c65ec075ad49c4a60e9e4309
Author: Nikias Bassen <nikias@gmx.li>
Date:   Thu Nov 27 15:42:55 2025 +0100

    afcclient: Fix text echoing on Windows

commit 5173265fb42adf32f20e80730d0830008a2c6889
Author: Nikias Bassen <nikias@gmx.li>
Date:   Wed Nov 26 16:17:42 2025 +0100

    afcclient: Add linebreak to finalize progress of put command

commit ca85a1829c275635f7b2854887f6490dcb3c5e40
Author: Nikias Bassen <nikias@gmx.li>
Date:   Tue Nov 25 01:02:31 2025 +0100

    afc: Improve error handling

commit c194db388fb7f1f65ef0a08817f26ed0e8d078b3
Author: Nikias Bassen <nikias@gmx.li>
Date:   Mon Nov 24 01:24:56 2025 +0100

    endianness.h: Default to little endian

commit 8d143c95a0ceb4e0bff3a33863349ec712662117
Author: Sergey Fedorov <barracuda@macos-powerpc.org>
Date:   Sun Nov 2 11:14:38 2025 +0800

    libsrp6a-sha512: fix environ for Apple

commit 1fb6b3d1eb64f29ec6d82662a3ca0f9161878017
Author: Nikias Bassen <nikias@gmx.li>
Date:   Thu Oct 23 04:01:58 2025 +0200

    docs: Fix CSS

Created: 2025-12-10 Last update: 2026-10-26 07:34

lintian reports 5 warnings normal

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-10-27 Last update: 2025-10-27 11:01

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 1.4.0-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-10-27 10:02

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

testing migrations

This package will soon be part of the auto-libplist transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2025-11-01] libimobiledevice 1.4.0-1 MIGRATED to testing (Debian testing watch)
[2025-10-26] Accepted libimobiledevice 1.4.0-1 (source) into unstable (Boyuan Yang)
[2025-10-13] libimobiledevice 1.3.0+git20250907-1 MIGRATED to testing (Debian testing watch)
[2025-10-07] Accepted libimobiledevice 1.3.0+git20250907-1 (source) into unstable (Boyuan Yang)
[2025-04-21] libimobiledevice 1.3.0+git20250228-2 MIGRATED to testing (Debian testing watch)
[2025-04-10] Accepted libimobiledevice 1.3.0+git20250228-2 (source) into unstable (Boyuan Yang)
[2025-04-06] Accepted libimobiledevice 1.3.0+git20250228-1 (source) into unstable (Boyuan Yang)
[2024-11-13] libimobiledevice 1.3.0+git20240701-4 MIGRATED to testing (Debian testing watch)
[2024-11-08] Accepted libimobiledevice 1.3.0+git20240701-4 (source) into unstable (Boyuan Yang)
[2024-11-08] Accepted libimobiledevice 1.3.0+git20240701-3 (source) into unstable (Boyuan Yang)
[2024-07-18] libimobiledevice 1.3.0+git20240701-2 MIGRATED to testing (Debian testing watch)
[2024-07-13] Accepted libimobiledevice 1.3.0+git20240701-2 (source) into unstable (Boyuan Yang)
[2024-07-12] Accepted libimobiledevice 1.3.0+git20240701-1 (source) into unstable (Boyuan Yang)
[2024-07-11] Accepted libimobiledevice 1.3.0+git20240701-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Boyuan Yang)
[2023-12-05] libimobiledevice 1.3.0-7.1 MIGRATED to testing (Debian testing watch)
[2023-11-29] Accepted libimobiledevice 1.3.0-8.1 (source) into experimental (Boyuan Yang)
[2023-11-29] Accepted libimobiledevice 1.3.0-7.1 (source) into unstable (Boyuan Yang)
[2023-08-06] libimobiledevice 1.3.0-7 MIGRATED to testing (Debian testing watch)
[2023-08-01] Accepted libimobiledevice 1.3.0-8 (source) into experimental (Boyuan Yang)
[2023-08-01] Accepted libimobiledevice 1.3.0-7 (source) into unstable (Boyuan Yang)
[2021-01-31] libimobiledevice 1.3.0-6 MIGRATED to testing (Debian testing watch)
[2021-01-26] Accepted libimobiledevice 1.3.0-6 (source) into unstable (Yves-Alexis Perez)
[2020-10-16] Accepted libimobiledevice 1.2.1~git20181030.92c5462-2+deb10u1 (source) into proposed-updates->stable-new, proposed-updates (Debian FTP Masters) (signed by: Yves-Alexis Perez)
[2020-09-22] libimobiledevice 1.3.0-5 MIGRATED to testing (Debian testing watch)
[2020-09-17] Accepted libimobiledevice 1.3.0-5 (source) into unstable (Yves-Alexis Perez)
[2020-08-26] libimobiledevice 1.3.0-4 MIGRATED to testing (Debian testing watch)
[2020-08-19] Accepted libimobiledevice 1.3.0-4 (source) into unstable (Yves-Alexis Perez)
[2020-06-28] libimobiledevice 1.3.0-3 MIGRATED to testing (Debian testing watch)
[2020-06-23] Accepted libimobiledevice 1.3.0-3 (source) into unstable (Yves-Alexis Perez)
[2020-06-17] Accepted libimobiledevice 1.3.0-2 (source) into experimental (Yves-Alexis Perez)

bugs [bug history graph]

all: 8
RC: 1
I&N: 5
M&W: 2
F&P: 0
patch: 1

links

homepage
lintian (0, 5)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.4.0-1build2
17 bugs