mapnik - Debian Package Tracker

general

source: mapnik (main)
version: 4.2.1+ds-1
maintainer: Debian GIS Project (archive) (DMD)
uploaders: Francesco Paolo Lovergine [DMD] – David Paleino [DMD] – Jérémy Lal [DMD] – Bas Couwenberg [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 3.1.0+ds-1
oldstable: 3.1.0+ds-3
stable: 4.0.7+ds-1
testing: 4.2.1+ds-1
unstable: 4.2.1+ds-1

versioned links

3.1.0+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.1.0+ds-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.0.7+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.2.1+ds-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libmapnik-dev
libmapnik4.2
mapnik-doc
mapnik-utils

action needed

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2025-15537: A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-15564: A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Created: 2026-01-20 Last update: 2026-02-09 15:30

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2025-15537: A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-15564: A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Created: 2026-01-20 Last update: 2026-02-09 15:30

2 security issues in bullseye high

There are 2 open security issues in bullseye.

1 important issue:

CVE-2025-15564: A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

1 issue postponed or untriaged:

CVE-2025-15537: (postponed; to be fixed through a stable update) A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Created: 2026-02-08 Last update: 2026-02-09 15:30

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-02-02 Last update: 2026-02-12 09:31

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.2.1+ds-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 79c99570080da1a90c40bb36f44951e7869c77d4
Author: Bas Couwenberg <sebastic@xs4all.nl>
Date:   Fri Feb 6 17:12:12 2026 +0100

    Drop obsolete libboost-system-dev (build) dependency. (closes: #1127078)

Created: 2026-02-06 Last update: 2026-02-06 17:33

2 low-priority security issues in trixie low

There are 2 open security issues in trixie.

2 issues left for the package maintainer to handle:

CVE-2025-15537: (postponed; to be fixed through a stable update) A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-15564: (needs triaging) A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-01-20 Last update: 2026-02-09 15:30

2 low-priority security issues in bookworm low

There are 2 open security issues in bookworm.

2 issues left for the package maintainer to handle:

CVE-2025-15537: (postponed; to be fixed through a stable update) A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2025-15564: (needs triaging) A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-01-20 Last update: 2026-02-09 15:30

testing migrations

This package will soon be part of the auto-boost-defaults transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
This package will soon be part of the auto-icu transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-02-02] mapnik 4.2.1+ds-1 MIGRATED to testing (Debian testing watch)
[2026-01-28] Accepted mapnik 4.2.1+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2026-01-08] mapnik 4.2.0+ds-1 MIGRATED to testing (Debian testing watch)
[2026-01-03] Accepted mapnik 4.2.0+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2026-01-02] Accepted mapnik 4.2.0+ds-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Sebastiaan Couwenberg)
[2025-11-15] mapnik 4.1.4+ds-1 MIGRATED to testing (Debian testing watch)
[2025-11-06] Accepted mapnik 4.1.4+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-10-30] mapnik 4.1.3+ds-2 MIGRATED to testing (Debian testing watch)
[2025-10-25] Accepted mapnik 4.1.3+ds-2 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-10-06] mapnik 4.1.3+ds-1 MIGRATED to testing (Debian testing watch)
[2025-10-01] Accepted mapnik 4.1.3+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-08-29] mapnik 4.1.2+ds-1 MIGRATED to testing (Debian testing watch)
[2025-08-22] Accepted mapnik 4.1.2+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-08-03] Accepted mapnik 4.1.2+ds-1~exp1 (source) into experimental (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-06-27] Accepted mapnik 4.1.1+ds-1~exp1 (source) into experimental (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-06-01] Accepted mapnik 4.1.0+ds-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Sebastiaan Couwenberg)
[2025-04-10] mapnik 4.0.7+ds-1 MIGRATED to testing (Debian testing watch)
[2025-04-05] Accepted mapnik 4.0.7+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-03-14] mapnik 4.0.6+ds-1 MIGRATED to testing (Debian testing watch)
[2025-03-02] Accepted mapnik 4.0.6+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2025-02-07] mapnik 4.0.5+ds-1 MIGRATED to testing (Debian testing watch)
[2025-02-02] Accepted mapnik 4.0.5+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2024-12-10] mapnik 4.0.4+ds-1 MIGRATED to testing (Debian testing watch)
[2024-12-04] Accepted mapnik 4.0.4+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2024-11-09] mapnik 4.0.3+ds-2 MIGRATED to testing (Debian testing watch)
[2024-11-04] Accepted mapnik 4.0.3+ds-2 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2024-10-30] Accepted mapnik 4.0.3+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2024-09-01] mapnik 4.0.2+ds-1 MIGRATED to testing (Debian testing watch)
[2024-08-27] Accepted mapnik 4.0.2+ds-1 (source) into unstable (Bas Couwenberg) (signed by: Sebastiaan Couwenberg)
[2024-08-26] Accepted mapnik 4.0.2+ds-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Sebastiaan Couwenberg)

bugs [bug history graph]

all: 2
RC: 0
I&N: 1
M&W: 0
F&P: 1
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.2.1+ds-1ubuntu1
2 bugs
patches for 4.2.1+ds-1ubuntu1