libmng - Debian Package Tracker

general

source: libmng (main)
version: 2.0.3+dfsg-5
maintainer: Kartik Mistry (DMD) (LowNMU)
arch: any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.10+dfsg-3.1
oldstable: 1.0.10+dfsg-3.1
stable: 1.0.10+dfsg-3.1
testing: 2.0.3+dfsg-5
unstable: 2.0.3+dfsg-5

versioned links

1.0.10+dfsg-3.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.0.3+dfsg-5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libmng-dev
libmng2

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-112008: libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.

Created: 2026-10-19 Last update: 2026-10-19 19:03

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-112008: libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.

Created: 2026-10-19 Last update: 2026-10-19 19:03

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-112008: libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.

Created: 2026-10-19 Last update: 2026-10-19 19:03

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-112008: libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr() that allows attackers to corrupt heap memory because ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries. Attackers can supply a crafted MNG file with MHDR, DHDR and a multi-record ORDR chunk to applications calling mng_read or mng_readdisplay, writing attacker-controlled data past the allocation and crashing the application.

Created: 2026-10-19 Last update: 2026-10-19 19:03

lintian reports 1 warning high

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2022-07-30 Last update: 2025-12-04 21:01

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2026-09-02 Last update: 2026-10-25 16:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.0.3+dfsg-6, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit e027086bd1bc28346769472cf3286a59fff63c51
Author: Kartik Mistry <kartik.mistry@gmail.com>
Date:   Tue Mar 10 20:45:39 2026 +0530

    SV to 4.7.3, Removed redundant field

commit 802ec9c1622bc8e980e38761678da8962b80b2f5
Author: Kartik Mistry <kartik.mistry@gmail.com>
Date:   Mon Dec 8 12:44:00 2025 +0530

    Use ?=

commit c669ed0376ddd91e0ffa383cf6acf01af21473cd
Author: Kartik Mistry <kartik.mistry@gmail.com>
Date:   Mon Dec 8 12:28:04 2025 +0530

    Reapplied the 'FTCBFS: uses build arch compiler' patch

Created: 2025-12-08 Last update: 2026-10-17 18:03

RFH: The maintainer is looking for help with this package. normal

The current maintainer is looking for someone who can help with the maintenance of this package. If you are interested in this package, please consider helping out. One way you can help is offer to be a co-maintainer or triage bugs in the BTS. Please see bug number #831389 for more information.

Created: 2017-12-02 Last update: 2018-11-23 16:54

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-12-13] libmng 2.0.3+dfsg-5 MIGRATED to testing (Debian testing watch)
[2025-12-04] Accepted libmng 2.0.3+dfsg-5 (source) into unstable (Kartik Mistry)
[2022-03-05] Accepted libmng 2.0.3+dfsg-4 (source) into experimental (Kartik Mistry)
[2018-11-23] Accepted libmng 2.0.3+dfsg-3 (source amd64) into experimental (Kartik Mistry)
[2018-11-23] Accepted libmng 2.0.3+dfsg-2 (source amd64) into experimental (Kartik Mistry)
[2016-08-06] Accepted libmng 2.0.3+dfsg-1 (source amd64) into experimental, experimental (Kartik Mistry)
[2014-08-14] libmng 1.0.10+dfsg-3.1 MIGRATED to testing (Britney)
[2014-08-08] Accepted libmng 1.0.10+dfsg-3.1 (source amd64) into unstable (Tobias Frost)
[2011-09-27] libmng 1.0.10-3 MIGRATED to testing (Debian testing watch)
[2011-09-16] Accepted libmng 1.0.10-3 (source amd64) (Kartik Mistry)
[2011-08-25] libmng 1.0.10-2 MIGRATED to testing (Debian testing watch)
[2011-08-14] Accepted libmng 1.0.10-2 (source amd64) (Kartik Mistry)
[2010-06-27] libmng 1.0.10-1 MIGRATED to testing (Debian testing watch)
[2010-06-16] Accepted libmng 1.0.10-1 (source amd64) (Kartik Mistry)
[2010-06-14] libmng 1.0.9-3 MIGRATED to testing (Debian testing watch)
[2010-06-03] Accepted libmng 1.0.9-3 (source amd64) (Kartik Mistry)
[2010-06-02] Accepted libmng 1.0.9-2 (source amd64) (Kartik Mistry)
[2006-04-24] libmng 1.0.9-1 MIGRATED to testing (Debian testing watch)
[2006-04-12] Accepted libmng 1.0.9-1 (source i386) (Shiju p. Nair) (signed by: tony mancill)
[2004-09-30] Accepted libmng 1.0.8-1 (i386 source) (Shiju p. Nair) (signed by: tony mancill)
[2003-04-03] Accepted libmng 1.0.5-1 (i386 source) (Shiju p. Nair) (signed by: tony mancill)
[2003-01-14] Accepted libmng 1.0.4-4 (i386 source) (Shiju p. Nair) (signed by: tony mancill)
[2002-12-29] Accepted libmng 1.0.4-3 (i386 source) (Luis Arocha)
[2002-10-10] Accepted libmng 1.0.4-2 (i386 source) (Luis Arocha)
[2002-10-08] Accepted libmng 1.0.4-1 (i386 source) (Luis Arocha)
[2002-06-03] Accepted libmng 1.0.3-4 (i386 source) (Luis Arocha)
[2002-01-05] Installed libmng 1.0.3-3 (i386 source) (Luis Arocha)
[2001-11-27] Installed libmng 1.0.3-2 (i386 source) (Ivan E. Moore II)
[2001-10-20] Installed libmng 1.0.3-1 (i386 source) (Ivan E. Moore II)
[2001-09-03] Installed libmng 1.0.2-2 (i386 source) (Ivan E. Moore II)

bugs [bug history graph]

all: 5
RC: 0
I&N: 2
M&W: 3
F&P: 0
patch: 1

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.0.3+dfsg-5
9 bugs (2 patches)