musescore2 - Debian Package Tracker

general

source: musescore2 (main)
version: 2.3.2+dfsg4-15
maintainer: Thorsten Glaser (DMD)
arch: all any
std-ver: 4.5.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 2.3.2+dfsg4-15
stable: 2.3.2+dfsg4-15
testing: 2.3.2+dfsg4-15
unstable: 2.3.2+dfsg4-15

versioned links

2.3.2+dfsg4-15: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

musescore
musescore-common

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In debian/watch no matching files for watch line
  https://api.github.com/repos/musescore/MuseScore/tags?per_page=200 https:[^"]*/tarball/v?(2\.[0-9](?:[0-9.]*(?:%25pre)?[0-9]+)?)(?="|$) debian debian/repack

Created: 2021-03-21 Last update: 2024-12-03 14:33

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2023-44428: MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769.

Created: 2024-05-10 Last update: 2024-10-29 22:00

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2023-44428: MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769.

Created: 2024-05-10 Last update: 2024-10-29 22:00

lintian reports 12 warnings high

Lintian reports 12 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-04-23 Last update: 2024-10-06 08:02

debian/patches: 2 patches with invalid metadata, 16 patches to forward upstream high

Among the 42 debian patches available in version 2.3.2+dfsg4-15 of the package, we noticed the following issues:

2 patches with invalid metadata that ought to be fixed.
16 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2023-02-27 20:59

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.3.2+dfsg5-16, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 618b577864e972844bcbc52e23e8a1fa0db02bd5
Author: mirabilos <tg@debian.org>
Date:   Mon Aug 19 00:54:18 2024 +0200

    adjust log levels for the new formatter

commit c927fb753180d77c9db9898902090d4ec94bea86
Author: mirabilos <tg@debian.org>
Date:   Mon Aug 19 00:44:54 2024 +0200

    bunch of reliability improvements:
    
    - audit the Capella import somewhat, to hopefully fix CVE-2023-44428
    - arm asserts, but give the user an out, to not inconvenience them
    - install a message formatter for improved legibility
    - hide debug messages when not running with -d / --debug

commit b215de27f29077c3ee542b5256758550b7afa5b7
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:55:11 2024 +0200

    note ©

commit e15a55ee13fae35f879cb80973e231a2e5b3af87
Author: mirabilos <tg@debian.org>
Date:   Sun Aug 14 04:41:39 2022 +0200

    cmake’s ctest can surprise with colour output :/
    
    (cherry picked from commit 3469d57de96988a2e6e729588aa925e7985fcd0e)

commit 6ccad635218bf700ba5dce261c91120fa2b5159d
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:09:00 2024 +0200

    we’ll have to pull ahead a GCC 14 bugfix release first

commit ecc772136051a815c1b206cbe8a6872078ad5049
Author: mirabilos <tg@debian.org>
Date:   Sat Jun 29 13:18:44 2024 +0200

    more rebranding seems to be going on…

commit 4a0f61c7d51096df9d24dbdbeff0deb08f3b9678
Author: mirabilos <tg@debian.org>
Date:   Fri May 10 20:24:35 2024 +0200

    add a security note that better not just be implicit

commit d32ad08d635f42c6d52cc067dac9f3dd13e79ee6
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:45:35 2024 +0200

    fixes from master applicable here, too
    
    (could be that even more are, but I don’t have the bandwidth to
    look)

commit 0c13efbfe5c96dfe3325f5ca6030f67fadebba6b
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:09:03 2024 +0200

    small tweak to reduce delta to musescore3

commit 0ec826aad530fba2233f4163a59f3644503b5a52
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 22:50:52 2024 +0200

    update and complete

commit 4940f98e91a4eb85affc79a3c352b08367de17b4
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 22:38:48 2024 +0200

    note down changes so far

commit 7479d8aec52e96c5b61772b2be33a6ef77db5210
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 22:23:54 2024 +0200

    erase another uscan tmpfile

commit 91ebc1150d56e9bc3c756c53eeeed6e673adb611
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 21:25:42 2024 +0200

    fix typo

commit 89a68a066780c54de705d048027101d46b7d6f1c
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 21:22:52 2024 +0200

    fix pasto

commit 0bbfb72a072bbec9bab8fefdfba8b878e63b6e7e
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 21:05:09 2024 +0200

    switch to mode=git, otherwise things get too tricky for uscan…
    
    for git, do not use --clamp-mtime, force --mtime to something
    sensible, here the annotated tag’s time if present and the
    commit’s otherwise, as they use lightweight tags mostly ☹

commit 3dc76fd53c48af8374b0db81f6e6944d62abf61a
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 18:24:40 2024 +0200

    adjust for old vs new versions
    
    - drop Bug-Submit and related properties, no new bugreports
      accepted
    - drop MuseScore BVBA-related, it’s been sold out to Muse Group
    - Mu͒seScore Studio
    - drop tutorials link, which now has v4-only contents

commit 8b2ceab815f538ee29b1e84d7de07c898a56be06
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 18:18:32 2024 +0200

    it is now Mu͒seScore Studio + plans for musescore-snapshot
    
    musescore.com is now Mu͒seScore Catalogue; the äpps are now
    Mu͒seScore Sheet Music for Android and iOS; all these by
    Muse Group (which is the new owner company)
    
    musescore-snapshot will be Mu͒seScore 3 Evolution, which is
    a fork (“3.7”) by developers of the former (pre-takeover)
    community, with user contributions (keeping Catalogue
    compatibility where possible)

commit 61d7deb90419140ee8f3487bb17393446e8f363b
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 17:49:44 2024 +0200

    better keep the patchlevel across the +dfsg repack bump
    
    makes it easier for humans to quickly check versions

commit d2e036a2fa804819d8f34576ea18ebc1c23d4376
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:31:50 2024 +0200

    up to commit 30d19d6b1128e7e717d94a04b3d24ff52d0074e2 (master)

commit 46bf45ac2ee29adf6f4c0fe0a2c0cff0c9eca227
Merge: aec4131c db23a6c5
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:27:40 2024 +0200

    Merge tag '2.3.2+dfsg5' into rochade
    
    musescore2_2.3.2+dfsg5.orig.tar.xz

commit db23a6c570a1052971461ec1343f2ee7e1b98330
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:27:16 2024 +0200

    musescore2_2.3.2+dfsg5.orig.tar.xz

commit aec4131c5eaee10b77a9bc883ecf91c9ca45139e
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:21:10 2024 +0200

    exclude some prebuilt font files and bump repacksuffix:
    
    see commit cbab6282d73ffe9f09ae5df2d8c06250f4c16ca3 and following
    in master (musescore3 packaging) branch

commit afbaafcd4f37a27efb99805d590f05958df1ce87
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 14:41:00 2024 +0200

    more repo/branch planning

commit 6ee048a836dd739f8d13aa2f3734c09e8c0b869e
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 14:30:50 2024 +0200

    committed

commit 07a054607c34cf87bac960447c7d7f2442a4d718
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 14:12:06 2024 +0200

    bit of release/branch planning

commit 7b500ff43bf9e2450057a896a7ee26a66af35795
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 16:45:51 2024 +0100

    more branch split considerations

commit 150e287524d5e95680fd774ce0561823d0a80197
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 16:44:18 2024 +0100

    oops

commit e4dda66c804c5f3a85dd34ea78ac4ad554ed0447
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 16:42:08 2024 +0100

    gcc on focal/riscv64 crashes on this (jammy is ok)

commit d1ef7332083c9575bbd93a8f44faf4a362351f8b
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 15:40:45 2024 +0100

    omit git-repo-specific file from .debian.tar.gz

commit efea5ab4e02cc2c4f1c9a55a544e2f537d6d6fde
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 15:38:58 2024 +0100

    bring some order into the git branches

commit 0906a66c80075e1d23f21a21118c6fc27f941871
Author: mirabilos <tg@debian.org>
Date:   Wed Oct 11 01:22:52 2023 +0200

    fix binfile output

commit 094f7033f4a09318f6313a72fed125884dec7adb
Author: mirabilos <tg@debian.org>
Date:   Sun Oct 1 01:25:42 2023 +0200

    update d/watch and redo d/repack based on polyphone’s

commit 85145531fe6d603486eb60c24be112afd17bcaef
Author: mirabilos <tg@debian.org>
Date:   Sun Oct 1 01:23:57 2023 +0200

    mu͒4 update

commit 343c072d9179680c49bea31c63ed8b9be54ccb0e
Author: mirabilos <tg@debian.org>
Date:   Sun Aug 7 00:11:47 2022 +0200

    work around github API breakage

Created: 2022-08-07 Last update: 2024-12-03 17:01

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2020-08-06 Last update: 2024-03-13 15:15

No known security issue in bookworm wishlist

There is 1 open security issue in bookworm.

1 ignored issue:

CVE-2023-44428: MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769.

Created: 2024-05-10 Last update: 2024-10-29 22:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.0 instead of 4.5.1).

Created: 2021-08-18 Last update: 2024-04-07 13:14

news

[rss feed]

[2021-06-18] Accepted musescore2 2.3.2+dfsg4-15~bpo10+1 (source) into buster-backports->backports-policy, buster-backports (Debian FTP Masters) (signed by: Thorsten Glaser)
[2021-06-14] musescore2 2.3.2+dfsg4-15 MIGRATED to testing (Debian testing watch)
[2021-06-05] Accepted musescore2 2.3.2+dfsg4-15 (source) into unstable (Thorsten Glaser)
[2021-03-30] musescore2 2.3.2+dfsg4-14 MIGRATED to testing (Debian testing watch)
[2021-03-05] Accepted musescore2 2.3.2+dfsg4-14 (source) into unstable (Thorsten Glaser)
[2021-02-23] Accepted musescore2 2.3.2+dfsg4-12~bpo10+1 (source) into buster-backports (Thorsten Glaser)
[2021-02-06] musescore2 2.3.2+dfsg4-12 MIGRATED to testing (Debian testing watch)
[2021-01-31] Accepted musescore2 2.3.2+dfsg4-12 (source) into unstable (Thorsten Glaser)
[2020-11-13] Accepted musescore2 2.3.2+dfsg3-11~bpo9+1 (source all i386) into stretch-backports-sloppy->backports-policy, stretch-backports-sloppy (Debian FTP Masters) (signed by: Thorsten Glaser)
[2020-11-09] Accepted musescore2 2.3.2+dfsg3-11~bpo10+1 (source all i386) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Thorsten Glaser)
[2020-11-03] musescore2 2.3.2+dfsg3-11 MIGRATED to testing (Debian testing watch)
[2020-10-29] Accepted musescore2 2.3.2+dfsg3-11 (source) into unstable (Thorsten Glaser)
[2020-08-12] musescore2 2.3.2+dfsg3-10 MIGRATED to testing (Debian testing watch)
[2020-08-06] Accepted musescore2 2.3.2+dfsg3-10 (source) into unstable (Thorsten Glaser)
[2020-08-06] Accepted musescore2 2.3.2+dfsg3-9 (source all amd64) into unstable, unstable (Debian FTP Masters) (signed by: Thorsten Glaser)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 12)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.3.2+dfsg4-15build3