musescore3 - Debian Package Tracker

general

source: musescore3 (main)
version: 3.2.3+dfsg2-17
maintainer: Thorsten Glaser (DMD)
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 3.2.3+dfsg2-11
old-bpo: 3.2.3+dfsg2-16~bpo11+1
stable: 3.2.3+dfsg2-16
testing: 3.2.3+dfsg2-17
unstable: 3.2.3+dfsg2-17

versioned links

3.2.3+dfsg2-11: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.3+dfsg2-16~bpo11+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.3+dfsg2-16: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.3+dfsg2-17: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

musescore3 (4 bugs: 0, 1, 3, 0)
musescore3-common

action needed

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2023-44428: MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769.
CVE-2024-44866: A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via opening a crafted GuitarPro file.

Created: 2024-05-10 Last update: 2025-04-04 00:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2023-44428: MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769.
CVE-2024-44866: A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via opening a crafted GuitarPro file.

Created: 2024-05-10 Last update: 2025-04-04 00:00

debian/patches: 27 patches with invalid metadata, 90 patches to forward upstream high

Among the 138 debian patches available in version 3.2.3+dfsg2-17 of the package, we noticed the following issues:

27 patches with invalid metadata that ought to be fixed.
90 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2024-07-09 08:52

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-10-30 Last update: 2025-04-21 21:01

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 3.2.3+dfsg2-18, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit c2325bc976a9436a9c730bc0387e1c402ccc200b
Merge: 04042306 53f05c70
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 21 02:36:17 2025 +0000

    Merge branch 'rochade'
    
    XXX the new patches cxx20-warnings, msgs-manageable,
    XXX especially importmidi-asserts, need manual merging

commit 53f05c704250018f7e299c9780a5dc88952e4c0a
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Mon Apr 21 01:56:52 2025 +0000

    debug message balance

commit 8032b7570f2d6abb2498d674fb749d951068900c
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Mon Apr 21 01:19:41 2025 +0000

    update lintian overrides, second round

commit e92f0cf7e9fdd4c6dbca5357a395bace69135a49
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Mon Apr 21 01:17:35 2025 +0000

    in the nōn-dev{2,3}-fontfixes branches we need to override this

commit 74fabcd61a81d5cf7360abf4b5cb7214b91ec04d
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Mon Apr 21 01:17:07 2025 +0000

    avoid “I: : sometext” when no file/function are given

commit ed40ac94bbb1cae74eb6698e81f1e4dfd2d49f7b
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Mon Apr 21 00:22:33 2025 +0000

    oh well, did enough creative work in 2025 I suppose

commit 73dcec576c90fa3c1836ff4b1ad431acaf24bcf2
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Mon Apr 21 00:20:06 2025 +0000

    refresh \(modulo lintian\)

commit 06e6a880964e24707fdc378f3928ed2545f3a3c5
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Mon Apr 21 00:05:08 2025 +0000

    first round of trying to get sanity into lintian again

commit 04042306c8288beec978bf91564ebbc9e182f584
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 21 00:03:12 2025 +0000

    bit of lintian override handling

commit 844672bc7cb05debacddaca2ac19eac768db1358
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 23:51:31 2025 +0000

    lintian says to not write snail mail to the FSF any more

commit c6a2f5625b744aaa443376c4c9d87a5ae89d1d38
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 23:46:30 2025 +0000

    libfreetype6-dev (>= 2.5.2) → libfreetype-dev for sid,
    lintian insists

commit 57d3bb64bce2c83d268891fbacbf3bf4c42f30f0
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 23:35:31 2025 +0000

    plug some more compiler warnings and a missing "all.h"

commit 8c515cdd2a25a3b03dfd453d5bc4078076a73110
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 23:33:05 2025 +0000

    more unexpected ANSI colour codes

commit d9a1e79275b99d46c1026eecf4c190b5dc4e86b3
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 22:50:51 2025 +0000

    raise its chance to compile

commit a5c3f82b1973150a9a8b34d746459e7cffa762ba
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 22:04:11 2025 +0000

    not everything using all.h links against libmscore :/

commit 33166714253478635fb9aa88e9cb7ddcd87f9815
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 21:34:07 2025 +0000

    bump S-V, no change needed

commit 1572283183c8e2c1585d5fade27b7a7a242542c0
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 21:31:51 2025 +0000

    backport another CVE fix

commit e4719dd14dfda8e231a5d80d48f8adb642f06da3
Merge: 0beb6075 180dafeb
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 21:04:30 2025 +0000

    Merge branch 'rochade'

commit 180dafebc4e5bb9a17b48fd6912c2e2dacc4cc42
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 21:02:26 2025 +0000

    don’t arm the assert’s abort() just before the freeze

commit 25d65f2b7ca00b5a74a834c4458c96a8804b3292
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 20:51:23 2025 +0000

    better documentation for the dev{2,3}-fontfixes branches

commit 0beb60754bdf74d8295464d99fc64bdec97d7105
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 20:41:31 2025 +0000

    refresh patches in master branch

commit ad6fde53864e88192fbe9ef4e034a8ba52ef8230
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 20:34:45 2025 +0000

    align patch order with dev3-fontfixes branch

commit 40e2491957e9dd2fb74b4fe8974b9f7707fa9a6f
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 20:31:07 2025 +0000

    actually do Update MuseJazz Text font

commit 8e9756857b9e15bd42ea79d7243723158618f47b
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 20:19:00 2025 +0000

    update MuseJazz Text situation

commit 1367968ebe978d540a53561d2858558f80f2cf23
Merge: d194b476 fb11c3d9
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 20:14:00 2025 +0000

    Bring branch 'master' to state before dev3-fontfixes

commit d194b47651e1e16ef7963518b3641c89fa5d92db
Merge: 0131b573 fcddc3b7
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 20:08:45 2025 +0000

    Merge branch 'rochade' into master

commit 0131b573e7f9fdfa76a3f569377ec11a42e81b3f
Author: mirabilos <tg@debian.org>
Date:   Mon Aug 19 00:58:28 2024 +0200

    adjust log levels for the new formatter
    
    (which will be merged from the rochade branch later)
    
    (cherry picked from commit eb9d82ff29c849eb5d0d0dbd1703072d3f0c20c3)

commit 3c83b2bf085a696dd70d8bc4da9f22a555892208
Author: mirabilos <tg@debian.org>
Date:   Sun Aug 18 18:42:02 2024 +0200

    fix a CVE, while not relevant to us, the optimisation potential is
    
    (cherry picked from commit 483babc46872d25482216bad87f49f71e4f6c13a)

commit a5e4625a16822af63825799bfaceb29120b32316
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:12:06 2024 +0200

    commit updated MuseJazzText.otf file
    
    preferred format to work with/source, cf. commit 379486e4
    
    source: commit 9014df48742f442ce8c482cd2bb3fd29c49e7f50 upstream
    (cherry picked from commit eb828622f7014145d224bab60898967ba1a23f88)
    
    note from another commit in master branch:
        we want to update it to the latest version to get back kerning lost
        during external foundry working, and it’s easier to just update all
        font binaries the same way

commit 551aad38548545ff69af029484301cdf91cea1b6
Author: mirabilos <tg@debian.org>
Date:   Tue Apr 16 18:22:51 2024 +0200

    paste MuseJazz source situation resolution to 3.0.2+dfsg1-1 entry:
    
    this was discussed, at length, in https://musescore.org/en/node/277756
    and IRL at FOSDEM; MuseJazz for 3.x is a new font, and MuseJazz Text
    is a mix of the old MuseJazz and the former and both were done by an
    external studio, which doesn’t use FontForge, and new versions¹ now
    just start from the .otf files, which are suitable enough
    
    ① we’ll probably want to backport 9014df48742f442ce8c482cd2bb3fd29c49e7f50
      that fixes kerning in MuseJazzText, though it’s binary-only
    
    (cherry picked from commit 379486e416931614efe9628ae4d067a3bed9e3f4)

commit fb11c3d96f94b2a1a0b747fe1974eae176140408
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 19:43:01 2025 +0000

    split off what we’re going to put into dev3-fontfixes

commit 6f39eaaee634aac073b86737097fb3c98ccbb6a5
Author: mirabilos <tg@debian.org>
Date:   Sun Apr 20 19:42:08 2025 +0000

    open branch dev3-fontfixes from last upload

commit fcddc3b768a4d411c8d740e5eafa14dfa925d71f
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 19:31:03 2025 +0000

    update branch overview

commit f34164c3f7b97d22f2a8dcc731e291f93220b170
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 19:26:07 2025 +0000

    revert to the form for the +dfsg4 origtgz

commit 4b84109019655b1db03fe3fde89a6642d68c491f
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 19:21:54 2025 +0000

    next upload will be 2.3.2+dfsg4-16 from here ⇒ trixie

commit e9563083852f08a17c8bf424a9dfae02a1a863b5
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 19:20:46 2025 +0000

    switch d/{repack,watch} to previous upload’s, rm regen/

commit f974dd9e065ec173f29f0199cd4dd399abe5cf5c
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 19:18:34 2025 +0000

    Revert going from +dfsg4 to "musescore2_2.3.2+dfsg5.orig.tar.xz"
    in branch rochade, but not dev2-fontfixes
    
    This reverts commit db23a6c570a1052971461ec1343f2ee7e1b98330.

commit d7ea9923db37fa79ebebaa6ac4ceec3913fb6172
Author: mirabilos <m$(date +%Y)@mirbsd.de>
Date:   Sun Apr 20 19:15:50 2025 +0000

    split out the parts for the debian/regen/fonts/ stuff
    
    they are nowhere near ready, doing this on the current
    version makes few sense shortly before freezing fully,
    and we need to work on the existing one, so we use the
    current origtgz (2:dfsg4, 3:dfsg2) for this; the regen
    stuff is going to move into new git branches, for now:
    dev{2,3}-fontfixes

commit eb9d82ff29c849eb5d0d0dbd1703072d3f0c20c3
Author: mirabilos <tg@debian.org>
Date:   Mon Aug 19 00:58:28 2024 +0200

    adjust log levels for the new formatter
    
    (which will be merged from the rochade branch later)

commit 618b577864e972844bcbc52e23e8a1fa0db02bd5
Author: mirabilos <tg@debian.org>
Date:   Mon Aug 19 00:54:18 2024 +0200

    adjust log levels for the new formatter

commit c927fb753180d77c9db9898902090d4ec94bea86
Author: mirabilos <tg@debian.org>
Date:   Mon Aug 19 00:44:54 2024 +0200

    bunch of reliability improvements:
    
    - audit the Capella import somewhat, to hopefully fix CVE-2023-44428
    - arm asserts, but give the user an out, to not inconvenience them
    - install a message formatter for improved legibility
    - hide debug messages when not running with -d / --debug

commit 483babc46872d25482216bad87f49f71e4f6c13a
Author: mirabilos <tg@debian.org>
Date:   Sun Aug 18 18:42:02 2024 +0200

    fix a CVE, while not relevant to us, the optimisation potential is

commit ce9d97728d578448ca9a8f99d76383940600b10d
Merge: bb284e10 0eae721f
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 22:54:45 2024 +0200

    Merge branch 'gcc14'

commit bb284e10fb5620ee16659a59ab2985c0024fbc2e
Merge: 22c20950 b215de27
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:55:41 2024 +0200

    Merge branch 'rochade'

commit b215de27f29077c3ee542b5256758550b7afa5b7
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:55:11 2024 +0200

    note ©

commit e15a55ee13fae35f879cb80973e231a2e5b3af87
Author: mirabilos <tg@debian.org>
Date:   Sun Aug 14 04:41:39 2022 +0200

    cmake’s ctest can surprise with colour output :/
    
    (cherry picked from commit 3469d57de96988a2e6e729588aa925e7985fcd0e)

commit 22c20950ca8302ba9c531d09f61cad9a950a5ac3
Merge: 03cddcef 6ccad635
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:50:23 2024 +0200

    Merge branch 'rochade'

commit 03cddcef7676bfca48a448dfb8a201b34812e5a2
Merge: c915dcac 0aaefca4
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:22:40 2024 +0200

    Merge branch 'gcc14'

commit 6ccad635218bf700ba5dce261c91120fa2b5159d
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:09:00 2024 +0200

    we’ll have to pull ahead a GCC 14 bugfix release first

commit c915dcac8a28f98ed3ad007138952010a927b4c3
Merge: 1dfe6099 3372f811
Author: mirabilos <tg@debian.org>
Date:   Mon Jul 8 19:08:35 2024 +0200

    Merge branch 'gcc14'

commit ecc772136051a815c1b206cbe8a6872078ad5049
Author: mirabilos <tg@debian.org>
Date:   Sat Jun 29 13:18:44 2024 +0200

    more rebranding seems to be going on…

commit 4a0f61c7d51096df9d24dbdbeff0deb08f3b9678
Author: mirabilos <tg@debian.org>
Date:   Fri May 10 20:24:35 2024 +0200

    add a security note that better not just be implicit

commit 1dfe60991b866983ea3e67d5d7aea640db4cb897
Merge: e992e0a4 d32ad08d
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:47:42 2024 +0200

    Merge branch 'rochade'

commit d32ad08d635f42c6d52cc067dac9f3dd13e79ee6
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:45:35 2024 +0200

    fixes from master applicable here, too
    
    (could be that even more are, but I don’t have the bandwidth to
    look)

commit e992e0a46a2342718419e0afcc842010f074b5e6
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:42:40 2024 +0200

    docuemnt changes so far

commit 84bb95e5c49348c044c71690ca0718a8e6fa18f7
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:10:58 2024 +0200

    small tweak to reduce delta to musescore2

commit ef26fc4270232540471f1e764e2152cacb41acab
Merge: 587c4186 0c13efbf
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:09:31 2024 +0200

    Merge branch 'rochade'

commit 0c13efbfe5c96dfe3325f5ca6030f67fadebba6b
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:09:03 2024 +0200

    small tweak to reduce delta to musescore3

commit 587c41869796ab1819c367c4748c6854f1458d0a
Merge: 30d19d6b 0ec826aa
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 23:05:08 2024 +0200

    Merge branch 'rochade'

commit 0ec826aad530fba2233f4163a59f3644503b5a52
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 22:50:52 2024 +0200

    update and complete

commit 4940f98e91a4eb85affc79a3c352b08367de17b4
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 22:38:48 2024 +0200

    note down changes so far

commit 7479d8aec52e96c5b61772b2be33a6ef77db5210
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 22:23:54 2024 +0200

    erase another uscan tmpfile

commit 91ebc1150d56e9bc3c756c53eeeed6e673adb611
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 21:25:42 2024 +0200

    fix typo

commit 89a68a066780c54de705d048027101d46b7d6f1c
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 21:22:52 2024 +0200

    fix pasto

commit 0bbfb72a072bbec9bab8fefdfba8b878e63b6e7e
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 21:05:09 2024 +0200

    switch to mode=git, otherwise things get too tricky for uscan…
    
    for git, do not use --clamp-mtime, force --mtime to something
    sensible, here the annotated tag’s time if present and the
    commit’s otherwise, as they use lightweight tags mostly ☹

commit 3dc76fd53c48af8374b0db81f6e6944d62abf61a
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 18:24:40 2024 +0200

    adjust for old vs new versions
    
    - drop Bug-Submit and related properties, no new bugreports
      accepted
    - drop MuseScore BVBA-related, it’s been sold out to Muse Group
    - Mu͒seScore Studio
    - drop tutorials link, which now has v4-only contents

commit 8b2ceab815f538ee29b1e84d7de07c898a56be06
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 18:18:32 2024 +0200

    it is now Mu͒seScore Studio + plans for musescore-snapshot
    
    musescore.com is now Mu͒seScore Catalogue; the äpps are now
    Mu͒seScore Sheet Music for Android and iOS; all these by
    Muse Group (which is the new owner company)
    
    musescore-snapshot will be Mu͒seScore 3 Evolution, which is
    a fork (“3.7”) by developers of the former (pre-takeover)
    community, with user contributions (keeping Catalogue
    compatibility where possible)

commit 61d7deb90419140ee8f3487bb17393446e8f363b
Author: mirabilos <tg@debian.org>
Date:   Sat May 4 17:49:44 2024 +0200

    better keep the patchlevel across the +dfsg repack bump
    
    makes it easier for humans to quickly check versions

commit d2e036a2fa804819d8f34576ea18ebc1c23d4376
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:31:50 2024 +0200

    up to commit 30d19d6b1128e7e717d94a04b3d24ff52d0074e2 (master)

commit 46bf45ac2ee29adf6f4c0fe0a2c0cff0c9eca227
Merge: aec4131c db23a6c5
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:27:40 2024 +0200

    Merge tag '2.3.2+dfsg5' into rochade
    
    musescore2_2.3.2+dfsg5.orig.tar.xz

commit db23a6c570a1052971461ec1343f2ee7e1b98330
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:27:16 2024 +0200

    musescore2_2.3.2+dfsg5.orig.tar.xz

commit aec4131c5eaee10b77a9bc883ecf91c9ca45139e
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:21:10 2024 +0200

    exclude some prebuilt font files and bump repacksuffix:
    
    see commit cbab6282d73ffe9f09ae5df2d8c06250f4c16ca3 and following
    in master (musescore3 packaging) branch

commit 30d19d6b1128e7e717d94a04b3d24ff52d0074e2
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:15:34 2024 +0200

    use subdirectory hierarchy under debian/regen/ for easy application

commit eb828622f7014145d224bab60898967ba1a23f88
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:12:06 2024 +0200

    commit updated MuseJazzText.otf file
    
    preferred format to work with/source, cf. commit 379486e4
    
    source: commit 9014df48742f442ce8c482cd2bb3fd29c49e7f50 upstream

commit 14f125621151efc13676e356880b3040049c037f
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:11:08 2024 +0200

    debian/regen/ will be the location for the new font files

commit be248bdb063e6ffd020503ac7f3e0da99a6342f3
Merge: 565322f9 8086707b
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:08:26 2024 +0200

    Merge tag '3.2.3+dfsg3'
    
    musescore3_3.2.3+dfsg3.orig.tar.xz

commit 8086707bb9eb735c540a331f36933774404c7af1
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 21:07:22 2024 +0200

    musescore3_3.2.3+dfsg3.orig.tar.xz

commit 565322f9bfcb0c1c555a9a0e89bf834ce44cdff0
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 20:49:29 2024 +0200

    also exclude MuseJazzText.otf: while “good” (see previous commit),
    we want to update it to the latest version to get back kerning lost
    during external foundry working, and it’s easier to just update all
    font binaries the same way

commit cbab6282d73ffe9f09ae5df2d8c06250f4c16ca3
Author: mirabilos <tg@debian.org>
Date:   Wed Apr 17 20:47:57 2024 +0200

    exclude some prebuilt font files and bump repacksuffix:
    
    there is sufficient evidence that the shipped files weren’t cleanly
    built from the sources, and we will want to rebuild all of them now
    anyway, and it’s much easier this way

commit 379486e416931614efe9628ae4d067a3bed9e3f4
Author: mirabilos <tg@debian.org>
Date:   Tue Apr 16 18:22:51 2024 +0200

    paste MuseJazz source situation resolution to 3.0.2+dfsg1-1 entry:
    
    this was discussed, at length, in https://musescore.org/en/node/277756
    and IRL at FOSDEM; MuseJazz for 3.x is a new font, and MuseJazz Text
    is a mix of the old MuseJazz and the former and both were done by an
    external studio, which doesn’t use FontForge, and new versions¹ now
    just start from the .otf files, which are suitable enough
    
    ① we’ll probably want to backport 9014df48742f442ce8c482cd2bb3fd29c49e7f50
      that fixes kerning in MuseJazzText, though it’s binary-only

commit 4bed98c870ad37bfc68fb712c0ce4879d73019bf
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 22:07:20 2024 +0200

    more to do…

commit c4ad14816b22fbee79b9df444c3423c286d3aa4f
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 22:04:12 2024 +0200

    more to do…

commit e893a6f0016e10ae7b2cab15504e36c536e82018
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 22:01:32 2024 +0200

    third truckload (as TODO), seems to be only one but huge commit

commit 3008cd848064440bffa89a81345fcf2518012f41
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 21:58:22 2024 +0200

    add about two truckloads of backports, with one more to come

commit afbaafcd4f37a27efb99805d590f05958df1ce87
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 14:41:00 2024 +0200

    more repo/branch planning

commit 6ee048a836dd739f8d13aa2f3734c09e8c0b869e
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 14:30:50 2024 +0200

    committed

commit 07a054607c34cf87bac960447c7d7f2442a4d718
Author: mirabilos <tg@debian.org>
Date:   Mon Apr 15 14:12:06 2024 +0200

    bit of release/branch planning

commit 7b500ff43bf9e2450057a896a7ee26a66af35795
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 16:45:51 2024 +0100

    more branch split considerations

commit 150e287524d5e95680fd774ce0561823d0a80197
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 16:44:18 2024 +0100

    oops

commit e4dda66c804c5f3a85dd34ea78ac4ad554ed0447
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 16:42:08 2024 +0100

    gcc on focal/riscv64 crashes on this (jammy is ok)

commit d1ef7332083c9575bbd93a8f44faf4a362351f8b
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 15:40:45 2024 +0100

    omit git-repo-specific file from .debian.tar.gz

commit efea5ab4e02cc2c4f1c9a55a544e2f537d6d6fde
Author: mirabilos <tg@debian.org>
Date:   Wed Feb 7 15:38:58 2024 +0100

    bring some order into the git branches

commit 49c5ccdc892e63cca894338cbf96b897df229e2a
Merge: 4cecfe0f 0906a66c
Author: mirabilos <tg@debian.org>
Date:   Wed Oct 11 01:23:03 2023 +0200

    Merge branch 'rochade'

commit 0906a66c80075e1d23f21a21118c6fc27f941871
Author: mirabilos <tg@debian.org>
Date:   Wed Oct 11 01:22:52 2023 +0200

    fix binfile output

commit 4cecfe0ff5765dbf38d2127110911ffa1102271d
Merge: 07f9deec 094f7033
Author: mirabilos <tg@debian.org>
Date:   Sun Oct 1 01:37:02 2023 +0200

    Merge branch 'rochade'

commit 094f7033f4a09318f6313a72fed125884dec7adb
Author: mirabilos <tg@debian.org>
Date:   Sun Oct 1 01:25:42 2023 +0200

    update d/watch and redo d/repack based on polyphone’s

commit 85145531fe6d603486eb60c24be112afd17bcaef
Author: mirabilos <tg@debian.org>
Date:   Sun Oct 1 01:23:57 2023 +0200

    mu͒4 update

commit 07f9deecac2384913656242a0a7779cd22565e72
Author: mirabilos <tg@debian.org>
Date:   Sat Sep 30 23:17:06 2023 +0200

    fix obtaining prereleases, work around GitHub bug, make reusable

commit 32345739f77d7e8d5082b034a4cd39799ac8c015
Author: mirabilos <tg@debian.org>
Date:   Sat Sep 30 22:29:26 2023 +0200

    reindent (no change)

Created: 2023-10-01 Last update: 2025-04-21 03:57

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2025-04-11 Last update: 2025-04-11 03:31

Build log checks report 2 warnings low

Build log checks report 2 warnings

Created: 2021-02-11 Last update: 2024-07-12 15:00

No known security issue in bookworm wishlist

There are 2 open security issues in bookworm.

2 ignored issues:

CVE-2023-44428: MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MuseScore. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CAP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-20769.
CVE-2024-44866: A buffer overflow in the GuitarPro1::read function of MuseScore Studio v4.3.2 allows attackers to to execute arbitrary code or cause a Denial of Service (DoS) via opening a crafted GuitarPro file.

Created: 2024-05-10 Last update: 2025-04-04 00:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.2 instead of 4.7.0).

Created: 2025-02-21 Last update: 2025-02-27 13:24

news

[rss feed]

[2024-07-14] musescore3 3.2.3+dfsg2-17 MIGRATED to testing (Debian testing watch)
[2024-07-08] Accepted musescore3 3.2.3+dfsg2-17 (source) into unstable (Thorsten Glaser)
[2022-08-22] Accepted musescore3 3.2.3+dfsg2-16~bpo11+1 (source) into bullseye-backports (Thorsten Glaser)
[2022-08-22] Accepted musescore3 3.2.3+dfsg2-15~bpo11+1 (source all amd64) into bullseye-backports, bullseye-backports (Debian FTP Masters) (signed by: Thorsten Glaser)
[2022-08-19] musescore3 3.2.3+dfsg2-16 MIGRATED to testing (Debian testing watch)
[2022-08-14] Accepted musescore3 3.2.3+dfsg2-16 (source) into unstable (Thorsten Glaser)
[2022-08-13] musescore3 3.2.3+dfsg2-15 MIGRATED to testing (Debian testing watch)
[2022-08-07] Accepted musescore3 3.2.3+dfsg2-15 (source) into unstable (Thorsten Glaser)
[2022-08-07] Accepted musescore3 3.2.3+dfsg2-14 (source) into unstable (Thorsten Glaser)
[2022-05-11] musescore3 3.2.3+dfsg2-12 MIGRATED to testing (Debian testing watch)
[2022-05-01] Accepted musescore3 3.2.3+dfsg2-12 (source) into unstable (Thorsten Glaser)
[2021-06-18] Accepted musescore3 3.2.3+dfsg2-11~bpo10+1 (source) into buster-backports->backports-policy, buster-backports (Debian FTP Masters) (signed by: Thorsten Glaser)
[2021-06-14] musescore3 3.2.3+dfsg2-11 MIGRATED to testing (Debian testing watch)
[2021-06-05] Accepted musescore3 3.2.3+dfsg2-11 (source) into unstable (Thorsten Glaser)
[2021-03-30] musescore3 3.2.3+dfsg2-10 MIGRATED to testing (Debian testing watch)
[2021-03-05] Accepted musescore3 3.2.3+dfsg2-10 (source) into unstable (Thorsten Glaser)
[2021-02-23] Accepted musescore3 3.2.3+dfsg2-9~bpo10+1 (source) into buster-backports (Thorsten Glaser)
[2021-02-21] musescore3 3.2.3+dfsg2-9 MIGRATED to testing (Debian testing watch)
[2021-02-11] Accepted musescore3 3.2.3+dfsg2-9 (source) into unstable (Thorsten Glaser)
[2021-02-06] musescore3 3.2.3+dfsg2-8 MIGRATED to testing (Debian testing watch)
[2021-02-01] Accepted musescore3 3.2.3+dfsg2-8 (source) into unstable (Thorsten Glaser)
[2020-11-09] Accepted musescore3 3.2.3+dfsg1-7~bpo10+1 (source all i386) into buster-backports, buster-backports (Debian FTP Masters) (signed by: Thorsten Glaser)
[2020-10-30] musescore3 3.2.3+dfsg1-7 MIGRATED to testing (Debian testing watch)
[2020-10-25] Accepted musescore3 3.2.3+dfsg1-7 (source) into unstable (Thorsten Glaser)
[2020-10-22] Accepted musescore3 3.2.3+dfsg1-6 (source all amd64) into unstable, unstable (Debian FTP Masters) (signed by: Thorsten Glaser)

bugs [bug history graph]

all: 5
RC: 0
I&N: 2
M&W: 3
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 3.2.3+dfsg2-17
1 bug