jpeg-xl - Debian Package Tracker

general

source: jpeg-xl (main)
version: 0.9.2-10
maintainer: Debian PhotoTools Maintainers (archive) (DMD)
uploaders: Mathieu Malaterre [DMD]
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

stable: 0.7.0-10
testing: 0.9.2-10
unstable: 0.9.2-10
exp: 0.10.3-5

versioned links

0.7.0-10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.9.2-10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.10.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.10.3-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.10.3-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

jpeg-xl-doc
libjpegxl-java
libjxl-dev
libjxl-devtools
libjxl-gdk-pixbuf
libjxl-tools
libjxl0.9

action needed

A new upstream version is available: 0.11.1 high

A new upstream version 0.11.1 is available, you should consider packaging it.

Created: 2022-09-26 Last update: 2024-12-11 15:00

The VCS repository is not up to date, push the missing commits. high

vcswatch reports that the current version of the package is not in its VCS.
Either you need to push your commits and/or your tags, or the information about the package's VCS are out of date. A common cause of the latter issue when using the Git VCS is not specifying the correct branch when the packaging is not in the default one (remote HEAD branch), which is usually "master" but can be modified in salsa.debian.org in the project's general settings with the "Default Branch" field). Alternatively the Vcs-Git field in debian/control can contain a "-b <branch-name>" suffix to indicate what branch is used for the Debian packaging.

Created: 2024-07-06 Last update: 2024-12-06 04:30

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2024-11403: There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.
CVE-2024-11498: There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.

Created: 2024-11-25 Last update: 2024-12-01 20:30

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2024-11403: There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.
CVE-2024-11498: There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.

Created: 2024-11-25 Last update: 2024-12-01 20:30

4 security issues in bookworm high

There are 4 open security issues in bookworm.

1 important issue:

CVE-2024-11403: There exists an out of bounds read/write in LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99. The JPEG decoder used by the JPEG XL encoder when doing JPEG recompression (i.e. if using JxlEncoderAddJPEGFrame on untrusted input) does not properly check bounds in the presence of incomplete codes. This could lead to an out-of-bounds write. In jpegli which is released as part of the same project, the same vulnerability is present. However, the relevant buffer is part of a bigger structure, and the code makes no assumptions on the values that could be overwritten. The issue could however cause jpegli to read uninitialised memory, or addresses of functions.

3 issues left for the package maintainer to handle:

CVE-2023-0645: (needs triaging) An out of bounds read exists in libjxl. An attacker using a specifically crafted file could cause an out of bounds read in the exif handler. We recommend upgrading to version 0.8.1 or past commit https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159 https://github.com/libjxl/libjxl/pull/2101/commits/d95b050c1822a5b1ede9e0dc937e43fca1b10159
CVE-2023-35790: (needs triaging) An issue was discovered in dec_patch_dictionary.cc in libjxl before 0.8.2. An integer underflow in patch decoding can lead to a denial of service, such as an infinite loop.
CVE-2024-11498: (needs triaging) There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space (up to 256mb is possible, maybe 512mb), potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend upgrading past commit 65fbec56bc578b6b6ee02a527be70787bbd053b0.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-06-10 Last update: 2024-12-01 20:30

lintian reports 1 error and 1 warning high

Lintian reports 1 error and 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2024-07-05 Last update: 2024-07-31 17:04

2 bugs tagged patch in the BTS normal

The BTS contains patches fixing 2 bugs, consider including or untagging them.

Created: 2024-02-25 Last update: 2024-12-11 20:00

Depends on packages which need a new maintainer normal

The packages that jpeg-xl depends on which need a new maintainer are:

docbook-xml (#802368)
- Build-Depends: docbook-xml

Created: 2023-09-01 Last update: 2024-12-11 19:30

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2024-10-09 Last update: 2024-12-11 15:33

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2024-10-31 Last update: 2024-10-31 11:30

debian/patches: 3 patches to forward upstream low

Among the 8 debian patches available in version 0.9.2-10 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2024-07-05 23:47

testing migrations

This package will soon be part of the auto-jpeg-xl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2024-09-27] Accepted jpeg-xl 0.10.3-5 (source) into experimental (Mathieu Malaterre)
[2024-07-23] Accepted jpeg-xl 0.10.3-4 (source) into experimental (Mathieu Malaterre)
[2024-07-21] Accepted jpeg-xl 0.10.3-3 (source) into experimental (Mathieu Malaterre)
[2024-07-21] Accepted jpeg-xl 0.10.3-2 (source all amd64) into experimental (Debian FTP Masters) (signed by: Mathieu Malaterre)
[2024-07-07] jpeg-xl 0.9.2-10 MIGRATED to testing (Debian testing watch)
[2024-07-06] Accepted jpeg-xl 0.10.3-1 (source all amd64) into experimental (Debian FTP Masters) (signed by: Mathieu Malaterre)
[2024-07-05] Accepted jpeg-xl 0.9.2-10 (source) into unstable (Mathieu Malaterre)
[2024-07-01] jpeg-xl 0.9.2-9 MIGRATED to testing (Debian testing watch)
[2024-06-26] Accepted jpeg-xl 0.9.2-9 (source) into unstable (Mathieu Malaterre)
[2024-06-12] Accepted jpeg-xl 0.9.2-8 (source) into experimental (Mathieu Malaterre)
[2024-06-11] Accepted jpeg-xl 0.9.2-7 (source) into experimental (Mathieu Malaterre)
[2024-06-10] Accepted jpeg-xl 0.9.2-6 (source) into experimental (Mathieu Malaterre)
[2024-06-07] Accepted jpeg-xl 0.9.2-5 (source) into experimental (Mathieu Malaterre)
[2024-06-07] Accepted jpeg-xl 0.9.2-4 (source) into experimental (Mathieu Malaterre)
[2024-06-07] Accepted jpeg-xl 0.9.2-3 (source) into experimental (Mathieu Malaterre)
[2024-06-04] Accepted jpeg-xl 0.9.2-2 (source all i386) into experimental (Debian FTP Masters) (signed by: Mathieu Malaterre)
[2024-06-03] Accepted jpeg-xl 0.9.2-1 (source all i386) into experimental (Debian FTP Masters) (signed by: Mathieu Malaterre)
[2024-06-02] jpeg-xl 0.8.2-4 MIGRATED to testing (Debian testing watch)
[2024-05-31] Accepted jpeg-xl 0.8.2-4 (source) into unstable (Mathieu Malaterre)
[2024-05-22] Accepted jpeg-xl 0.8.2-3 (source) into experimental (Mathieu Malaterre)
[2024-05-21] Accepted jpeg-xl 0.8.2-2 (source) into experimental (Mathieu Malaterre)
[2023-10-12] jpeg-xl 0.7.0-10.2 MIGRATED to testing (Debian testing watch)
[2023-10-12] jpeg-xl 0.7.0-10.2 MIGRATED to testing (Debian testing watch)
[2023-10-11] Accepted jpeg-xl 0.8.2-1 (source) into experimental (Mathieu Malaterre)
[2023-10-10] Accepted jpeg-xl 0.8.1-2 (source) into experimental (Mathieu Malaterre)
[2023-10-10] Accepted jpeg-xl 0.8.1-1 (source) into experimental (Mathieu Malaterre)
[2023-10-09] Accepted jpeg-xl 0.8.0-1 (source all amd64) into experimental (Debian FTP Masters) (signed by: Mathieu Malaterre)
[2023-10-08] Accepted jpeg-xl 0.7.0-10.2 (source) into unstable (Boyuan Yang)
[2023-10-07] Accepted jpeg-xl 0.7.0-10.1 (source) into unstable (Boyuan Yang)
[2023-10-06] Removed 0.9.0~git20230623.689da0f-4 from experimental (Debian FTP Masters)

bugs [bug history graph]

all: 5
RC: 1
I&N: 3
M&W: 1
F&P: 0
patch: 2

links

homepage
lintian (1, 1)
buildd: logs, exp, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.10.3-4ubuntu1
1 bug
patches for 0.10.3-4ubuntu1