blender - Debian Package Tracker

general

source: blender (main)
version: 5.0.1+dfsg-3
maintainer: Debian Multimedia Maintainers (archive) (DMD)
uploaders: Matteo F. Vescovi [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.83.5+dfsg-5+deb11u1
o-o-sec: 2.83.5+dfsg-5+deb11u1
oldstable: 3.4.1+dfsg-2
stable: 4.3.2+dfsg-2
unstable: 5.0.1+dfsg-3

versioned links

2.83.5+dfsg-5+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.4.1+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.3.2+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.0.1+dfsg-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

blender (19 bugs: 0, 12, 7, 0)
blender-data (3 bugs: 0, 2, 1, 0)

action needed

A new upstream version is available: 5.2.0 high

A new upstream version 5.2.0 is available, you should consider packaging it.

Created: 2025-11-26 Last update: 2026-07-21 14:00

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-60103: Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

Created: 2026-07-14 Last update: 2026-07-20 17:00

AppStream hints: 1 error and 2 warnings for blender,blender-data high

AppStream found metadata issues for packages:

blender: 1 warning
blender-data: 1 error and 1 warning

You should get rid of them to provide more metadata about this software.

Created: 2020-06-01 Last update: 2024-01-27 03:06

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

blender-data could have its dependency on python3 annotated with :any

Created: 2016-09-14 Last update: 2026-07-21 12:30

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-07-01 Last update: 2026-07-01 18:00

lintian reports 5 warnings normal

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-02-03 Last update: 2025-04-11 03:30

debian/patches: 2 patches to forward upstream low

Among the 3 debian patches available in version 5.0.1+dfsg-3 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-07-20 20:00

1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:

CVE-2026-60103: (needs triaging) Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-07-14 Last update: 2026-07-20 17:00

1 low-priority security issue in bookworm low

There is 1 open security issue in bookworm.

1 issue left for the package maintainer to handle:

CVE-2026-60103: (postponed; to be fixed through a stable update) Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted .blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure.

You can find information about how to handle this issue in the security team's documentation.

Created: 2026-07-14 Last update: 2026-07-20 17:00

Issues found with some translations low

Automatic checks made by the Debian l10n team found some issues with the translations contained in this package. You should check the l10n status report for more information.

Issues can be things such as missing translations, problematic translated strings, outdated PO files, unknown languages, etc.

Created: 2023-08-22 Last update: 2023-08-22 10:04

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.3).

Created: 2025-02-21 Last update: 2026-07-20 15:20

testing migrations

This package will soon be part of the auto-imath transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
excuses:
- Migration status for blender (- to 5.0.1+dfsg-3): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ blender unsatisfiable Build-Depends(-Arch) on s390x: architecture-is-little-endian
- ∙ ∙ Missing build on riscv64
- ∙ ∙ Missing build on s390x
- ∙ ∙ Autopkgtest deferred on riscv64: missing arch:riscv64 build
- ∙ ∙ Autopkgtest deferred on s390x: missing arch:s390x build
- ∙ ∙ Lintian check waiting for test results - info
- ∙ ∙ Too young, only 1 of 5 days old
- Additional info (not blocking):
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/b/blender.html
- ∙ ∙ Reproduced on amd64 - info
- ∙ ∙ Reproduced on arm64 - info
- ∙ ∙ Reproduced on armhf - info
- ∙ ∙ Reproduced on i386 - info
- Not considered

news

[rss feed]

[2026-07-20] Accepted blender 5.0.1+dfsg-3 (source) into unstable (Antoine Lassagne) (signed by: Paride Legovini)
[2026-07-02] Accepted blender 5.0.1+dfsg-2 (source) into experimental (Antoine Lassagne) (signed by: Paride Legovini)
[2026-03-09] Accepted blender 5.0.1+dfsg-1 (source) into experimental (Antoine Lassagne) (signed by: Paride Legovini)
[2026-01-09] blender REMOVED from testing (Debian testing watch)
[2025-02-08] blender 4.3.2+dfsg-2 MIGRATED to testing (Debian testing watch)
[2025-02-02] Accepted blender 4.3.2+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2025-01-11] Accepted blender 4.3.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-12-04] Accepted blender 4.3.0+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-10-28] Accepted blender 4.2.3+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2024-10-26] Accepted blender 4.2.3+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2024-10-25] Accepted blender 4.2.3+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-09-28] Accepted blender 4.2.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-09-09] Accepted blender 4.2.1+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2024-06-26] Accepted blender 4.1.1+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2024-06-16] Accepted blender 4.1.1+dfsg-2 (source) into experimental (Matteo F. Vescovi)
[2024-06-16] Accepted blender 4.1.1+dfsg-1 (source) into experimental (Matteo F. Vescovi)
[2024-03-26] blender REMOVED from testing (Debian testing watch)
[2024-01-20] blender 4.0.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2023-12-31] Accepted blender 4.0.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2023-09-06] Accepted blender 3.6.2+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2023-08-20] Accepted blender 3.6.2+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2023-08-01] blender REMOVED from testing (Debian testing watch)
[2023-01-28] blender 3.4.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2023-01-28] blender 3.4.1+dfsg-2 MIGRATED to testing (Debian testing watch)
[2023-01-17] Accepted blender 3.4.1+dfsg-2 (source) into unstable (Matteo F. Vescovi)
[2023-01-14] Accepted blender 3.4.1+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2022-12-22] blender 3.3.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-10-22] Accepted blender 3.3.1+dfsg-1 (source) into unstable (Matteo F. Vescovi)
[2022-09-08] Accepted blender 3.2.2+dfsg-3 (source) into unstable (Matteo F. Vescovi)
[2022-09-04] Accepted blender 3.2.2+dfsg-2 (source) into unstable (Matteo F. Vescovi)

bugs [bug history graph]

all: 21 23
RC: 0
I&N: 14
M&W: 7 9
F&P: 0
patch: 0

links

homepage
lintian (0, 5)
buildd: logs, cross
popcon
browse source code
other distros
security tracker
screenshots
l10n (-, 100)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 5.0.1+dfsg-1ubuntu3
patches for 5.0.1+dfsg-1ubuntu3