Debian Package Tracker - libjpeg-turbo

general

source: libjpeg-turbo (main)
version: 1:2.0.5-1.1
maintainer: Ondřej Surý (DMD) (LowNMU)
uploaders: Mike Gabriel [DMD]
arch: all any
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1:1.3.1-12
o-o-sec: 1:1.3.1-12+deb8u2
oldstable: 1:1.5.1-2
old-sec: 1:1.5.1-2+deb9u1
stable: 1:1.5.2-2
testing: 1:2.0.5-1.1
unstable: 1:2.0.5-1.1

versioned links

1:1.3.1-12: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.3.1-12+deb8u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.5.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.5.1-2+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:1.5.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1:2.0.5-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjpeg-dev (2 bugs: 0, 1, 1, 0)
libjpeg-turbo-progs (2 bugs: 0, 2, 0, 0)
libjpeg62-turbo (1 bugs: 0, 1, 0, 0)
libjpeg62-turbo-dev
libturbojpeg0
libturbojpeg0-dev

action needed

6 bugs tagged patch in the BTS normal

The BTS contains patches fixing 6 bugs, consider including or untagging them.

Created: 2020-06-28 Last update: 2020-08-09 12:01

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-08-07 Last update: 2020-08-09 11:57

9 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 8a2e6c186da24953b625e88431d430783843b793
Author: Adrian Bunk <bunk@debian.org>
Date:   Fri Jul 31 17:57:45 2020 +0300

    Add changelog

commit ac933a1b8f4b0a8d74626e2848d57dff4a5b24f6
Author: Adrian Bunk <bunk@debian.org>
Date:   Fri Jul 31 17:56:21 2020 +0300

    Remove non-working Rules-Requires-Root
    
    install -m755 -o root -g root -d /tmp/libjpeg-turbo/debian/tmp/usr/bin
    install: cannot change owner and permissions of ‘/tmp/libjpeg-turbo/debian/tmp/usr/bin’: Operation not permitted
    make[2]: *** [Makefile:15: install] Error 1

commit 377c8890b29bb6b6e0b69133e95806f454ffa626
Author: Adrian Bunk <bunk@debian.org>
Date:   Fri Jul 31 17:48:00 2020 +0300

    Add the missing epochs to symbols files

commit dc7765fbdde630de02775f0bfe5e8b468f1fd563
Merge: 2056d9b c2c6a7d
Author: Adrian Bunk <bunk@debian.org>
Date:   Fri Jul 31 13:32:00 2020 +0000

    Merge branch 'master' into 'master'
    
    Floating point related fixes
    
    See merge request debian/libjpeg-turbo!2

commit c2c6a7d5c3d80dda700d6f2d8e3fd07617c0f115
Author: Adrian Bunk <bunk@debian.org>
Date:   Tue Jul 28 14:26:13 2020 +0300

    Add -ffloat-store only on m68k
    
    According to #755073 -ffloat-store was added for m68k,
    but it did also cause a performance penalty on i386.

commit 2ad4fb0aaa5b4523ef3a13e1335babee262951cc
Author: Adrian Bunk <bunk@debian.org>
Date:   Tue Jul 28 14:25:36 2020 +0300

    Fix incorrect FLOATTEST guesses causing test failures

commit 2056d9b758df3f4814d597daacb345ec6bb993f1
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Sun Jul 5 00:07:04 2020 +0200

    debian/rules: Drop explicit setting of DEB_LDFLAGS_MAINT_APPEND. Thanks, lintian.

commit 6e1ce8a8494419fd858612e6ebed77630403c475
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Sun Jul 5 00:05:48 2020 +0200

    debian/control: Fix hyphenation of R³ field.

commit 53792f3ff90a0a35260e8c0ddacce9e04f666733
Author: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date:   Sun Jul 5 00:04:48 2020 +0200

    lintian: Renamed tag: shlib-calls-exit -> exit-in-shared-library.

Created: 2020-07-04 Last update: 2020-08-07 10:38

lintian reports 7 warnings normal

Lintian reports 7 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-07-29 Last update: 2020-07-29 12:32

1 ignored security issue in stretch low

There is 1 open security issue in stretch.

1 issue skipped by the security teams:

CVE-2019-2201: In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338

Please fix it.

Created: 2017-10-11 Last update: 2020-08-07 06:08

4 ignored security issues in buster low

There are 4 open security issues in buster.

4 issues skipped by the security teams:

CVE-2018-1152: libjpeg-turbo 1.5.90 is vulnerable to a denial of service vulnerability caused by a divide by zero when processing a crafted BMP image.
CVE-2018-14498: get_8bit_row in rdbmp.c in libjpeg-turbo through 1.5.90 and MozJPEG through 3.3.1 allows attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted 8-bit BMP in which one or more of the color indices is out of range for the number of palette entries.
CVE-2019-2201: In generate_jsimd_ycc_rgb_convert_neon of jsimd_arm64_neon.S, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-120551338
CVE-2020-13790: libjpeg-turbo 2.0.4, and mozjpeg 4.0.0, has a heap-based buffer over-read in get_rgb_row() in rdppm.c via a malformed PPM input file.

Please fix them.

Created: 2017-10-11 Last update: 2020-08-07 06:08

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2017-10-26 Last update: 2020-07-05 04:17

news

[rss feed]

[2020-08-07] libjpeg-turbo 1:2.0.5-1.1 MIGRATED to testing (Debian testing watch)
[2020-08-01] Accepted libjpeg-turbo 1:2.0.5-1.1 (source) into unstable (Adrian Bunk)
[2020-07-31] Accepted libjpeg-turbo 1:1.5.1-2+deb9u1 (source) into oldstable (Adrian Bunk)
[2020-07-04] Accepted libjpeg-turbo 1:2.0.5-1 (source) into unstable (Mike Gabriel)
[2020-01-14] Accepted libjpeg-turbo 1:2.0.4-1~exp1 (source) into experimental (Mike Gabriel)
[2019-12-19] Accepted libjpeg-turbo 1:2.0.3-1~exp1 (source) into experimental (Mike Gabriel)
[2019-08-27] Accepted libjpeg-turbo 1:2.0.2-1~exp4 (source) into experimental (Mike Gabriel)
[2019-08-27] Accepted libjpeg-turbo 1:2.0.2-1~exp3 (source) into experimental (Mike Gabriel)
[2019-08-22] Accepted libjpeg-turbo 1:2.0.2-1~exp2 (source) into experimental (Mike Gabriel)
[2019-08-21] Accepted libjpeg-turbo 1:2.0.2-1~exp1 (source) into experimental (Mike Gabriel)
[2019-03-18] Accepted libjpeg-turbo 1:1.3.1-12+deb8u2 (source all amd64) into oldstable (Chris Lamb)
[2019-01-22] Accepted libjpeg-turbo 1:1.3.1-12+deb8u1 (source all amd64) into oldstable (Mike Gabriel)
[2017-08-30] libjpeg-turbo 1:1.5.2-2 MIGRATED to testing (Debian testing watch)
[2017-08-25] Accepted libjpeg-turbo 1:1.5.2-2 (source all amd64) into unstable (Ondřej Surý)
[2017-08-25] Accepted libjpeg-turbo 1:1.5.2-1 (source) into unstable (Ondřej Surý)
[2016-10-26] libjpeg-turbo 1:1.5.1-2 MIGRATED to testing (Debian testing watch)
[2016-10-26] libjpeg-turbo 1:1.5.1-2 MIGRATED to testing (Debian testing watch)
[2016-10-20] Accepted libjpeg-turbo 1:1.5.1-2 (source) into unstable (Ondřej Surý)
[2016-09-21] Accepted libjpeg-turbo 1:1.5.1-1 (source) into unstable (Ondřej Surý)
[2016-06-14] libjpeg-turbo 1:1.5.0-1 MIGRATED to testing (Debian testing watch)
[2016-06-08] Accepted libjpeg-turbo 1:1.5.0-1 (source) into unstable (Ondřej Surý)
[2016-02-07] libjpeg-turbo 1:1.4.2-2 MIGRATED to testing (Debian testing watch)
[2016-02-01] Accepted libjpeg-turbo 1:1.4.2-2 (source all) into unstable (Ondřej Surý)
[2016-02-01] Accepted libjpeg-turbo 1:1.4.2-1 (source all) into unstable (Ondřej Surý)
[2015-09-01] libjpeg-turbo 1:1.4.1-2 MIGRATED to testing (Britney)
[2015-08-26] Accepted libjpeg-turbo 1:1.4.1-2 (source all amd64) into unstable (Ondřej Surý)
[2015-08-02] libjpeg-turbo 1:1.4.1-1 MIGRATED to testing (Britney)
[2015-07-28] Accepted libjpeg-turbo 1:1.4.80-115-gfb907b2-1 (source all amd64) into experimental (Ondřej Surý)
[2015-07-28] Accepted libjpeg-turbo 1:1.4.1-1 (source all amd64) into unstable (Ondřej Surý)
[2015-05-16] libjpeg-turbo 1:1.4.0-7 MIGRATED to testing (Britney)

bugs [bug history graph]

all: 13
RC: 0
I&N: 9
M&W: 4
F&P: 0
patch: 6

links

homepage
lintian (0, 7)
buildd: logs, checks, clang, reproducibility, cross
popcon
browse source code
edit tags
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.0.3-0ubuntu2
20 bugs (2 patches)
patches for 2.0.3-0ubuntu2