mapnik - Debian Package Tracker

general

source: mapnik (main)
version: 4.2.2+ds-1
maintainer: Debian GIS Project (archive) (DMD)
uploaders: Francesco Paolo Lovergine [DMD] – David Paleino [DMD] – Jérémy Lal [DMD] – Bas Couwenberg [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.1.0+ds-1
oldstable: 3.1.0+ds-3
stable: 4.0.7+ds-1
testing: 4.2.1+ds-2
unstable: 4.2.2+ds-1

versioned links

3.1.0+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.0+ds-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.0.7+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.2.2+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libmapnik-dev
libmapnik4.2
mapnik-doc
mapnik-utils

action needed

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2025-15537: A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Created: 2026-01-20 Last update: 2026-04-05 04:33

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2025-15537: A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Created: 2026-01-20 Last update: 2026-04-05 04:33

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.2.2+ds-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 84ca26740e25faf286a9f9811353c14b73b86f09
Author: Bas Couwenberg <sebastic@xs4all.nl>
Date:   Sat Apr 4 10:52:33 2026 +0200

    Fix changelog entry.

commit 110ef8819ecdc973254a0dc2cd0b6ae0c27c91f2
Author: Bas Couwenberg <sebastic@xs4all.nl>
Date:   Sat Apr 4 10:14:13 2026 +0200

    Bump Standards-Version to 4.7.4, changes: priority.

Created: 2026-04-04 Last update: 2026-04-04 11:31

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2025-15537: (postponed; to be fixed through a stable update) A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-15564: (needs triaging) A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-01-20 Last update: 2026-04-05 04:33

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2025-15537: (postponed; to be fixed through a stable update) A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-15564: (needs triaging) A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-01-20 Last update: 2026-04-05 04:33

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2026-03-31 Last update: 2026-03-31 15:01

news

[rss feed]

[2026-04-05] mapnik 4.2.2+ds-1 MIGRATED to testing (Debian testing watch)
[2026-03-30] Accepted mapnik 4.2.2+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2026-02-14] mapnik 4.2.1+ds-2 MIGRATED to testing (Debian testing watch)
[2026-02-12] Accepted mapnik 4.2.1+ds-2 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2026-02-02] mapnik 4.2.1+ds-1 MIGRATED to testing (Debian testing watch)
[2026-01-28] Accepted mapnik 4.2.1+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2026-01-08] mapnik 4.2.0+ds-1 MIGRATED to testing (Debian testing watch)
[2026-01-03] Accepted mapnik 4.2.0+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2026-01-02] Accepted mapnik 4.2.0+ds-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Sebastiaan Couwenberg)
[2025-11-15] mapnik 4.1.4+ds-1 MIGRATED to testing (Debian testing watch)
[2025-11-06] Accepted mapnik 4.1.4+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-10-30] mapnik 4.1.3+ds-2 MIGRATED to testing (Debian testing watch)
[2025-10-25] Accepted mapnik 4.1.3+ds-2 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-10-06] mapnik 4.1.3+ds-1 MIGRATED to testing (Debian testing watch)
[2025-10-01] Accepted mapnik 4.1.3+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-08-29] mapnik 4.1.2+ds-1 MIGRATED to testing (Debian testing watch)
[2025-08-22] Accepted mapnik 4.1.2+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-08-03] Accepted mapnik 4.1.2+ds-1~exp1 (source) into experimental (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-06-27] Accepted mapnik 4.1.1+ds-1~exp1 (source) into experimental (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-06-01] Accepted mapnik 4.1.0+ds-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Sebastiaan Couwenberg)
[2025-04-10] mapnik 4.0.7+ds-1 MIGRATED to testing (Debian testing watch)
[2025-04-05] Accepted mapnik 4.0.7+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-03-14] mapnik 4.0.6+ds-1 MIGRATED to testing (Debian testing watch)
[2025-03-02] Accepted mapnik 4.0.6+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-02-07] mapnik 4.0.5+ds-1 MIGRATED to testing (Debian testing watch)
[2025-02-02] Accepted mapnik 4.0.5+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2024-12-10] mapnik 4.0.4+ds-1 MIGRATED to testing (Debian testing watch)
[2024-12-04] Accepted mapnik 4.0.4+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2024-11-09] mapnik 4.0.3+ds-2 MIGRATED to testing (Debian testing watch)
[2024-11-04] Accepted mapnik 4.0.3+ds-2 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.2.1+ds-2
2 bugs