wildmidi - Debian Package Tracker

general

source: wildmidi (main)
version: 0.4.6-1
maintainer: Bret Curtis (DMD)
uploaders: Sebastian Dröge [DMD] – Emmet Hikory [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.4.3-1
oldstable: 0.4.3-1
stable: 0.4.3-1
testing: 0.4.6-1
unstable: 0.4.6-1

versioned links

0.4.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.4.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libwildmidi-config
libwildmidi-dev
libwildmidi2
wildmidi

action needed

A new upstream version is available: 0.5.0 high

A new upstream version 0.5.0 is available, you should consider packaging it.

Created: 2026-07-24 Last update: 2026-10-23 11:30

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-111162: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().
CVE-2026-111163: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-111162: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().
CVE-2026-111163: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-111162: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().
CVE-2026-111163: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-111162: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo().
CVE-2026-111163: WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events. Attackers can supply a crafted HMI file placing a 0xfe 0x10 sub-event near the buffer end to read up to four bytes past the allocation, crashing the decoding application.

Created: 2026-10-16 Last update: 2026-10-16 08:33

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 911be78c7c7174ebff9d5fac62c883c6e67a696c
Author: Alexandre Detiste <tchet@debian.org>
Date:   Fri Aug 1 18:28:29 2025 +0200

    update doc

Created: 2021-02-13 Last update: 2026-10-18 12:01

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[rss feed]

[2025-08-22] wildmidi 0.4.6-1 MIGRATED to testing (Debian testing watch)
[2025-08-16] Accepted wildmidi 0.4.6-1 (source) into unstable (Alexandre Detiste)
[2019-02-12] wildmidi 0.4.3-1 MIGRATED to testing (Debian testing watch)
[2019-02-06] Accepted wildmidi 0.4.3-1 (source) into unstable (Bret Curtis) (signed by: Markus Koschany)
[2018-01-12] wildmidi 0.4.2-1 MIGRATED to testing (Debian testing watch)
[2018-01-07] Accepted wildmidi 0.4.2-1 (source) into unstable (Bret Curtis) (signed by: Markus Koschany)
[2016-09-25] wildmidi 0.4.0-2 MIGRATED to testing (Debian testing watch)
[2016-09-19] Accepted wildmidi 0.4.0-2 (source all amd64) into unstable (Bret Curtis) (signed by: Sebastian Dröge)
[2016-08-17] wildmidi 0.4.0-1 MIGRATED to testing (Debian testing watch)
[2016-08-11] Accepted wildmidi 0.4.0-1 (source all amd64) into unstable, unstable (Bret Curtis) (signed by: Sebastian Dröge)
[2015-05-19] wildmidi 0.3.8-2 MIGRATED to testing (Britney)
[2015-05-13] Accepted wildmidi 0.3.8-2 (source amd64 all) into unstable (Sebastian Dröge)
[2015-02-12] Accepted wildmidi 0.3.8-1 (source i386 all) into experimental (Bret Curtis) (signed by: Scott Howard)
[2014-06-17] wildmidi 0.3.7-1 MIGRATED to testing (Debian testing watch)
[2014-06-06] Accepted wildmidi 0.3.7-1 (source amd64 all) (Bret Curtis) (signed by: Sebastian Dröge)
[2014-04-09] wildmidi 0.3.5-1 MIGRATED to testing (Debian testing watch)
[2014-03-29] Accepted wildmidi 0.3.5-1 (source amd64 all) (Bret Curtis)
[2014-03-10] wildmidi 0.3.3-4 MIGRATED to testing (Debian testing watch)
[2014-02-27] Accepted wildmidi 0.3.3-4 (source amd64 all) (Bret Curtis)
[2014-02-23] wildmidi 0.3.3-3 MIGRATED to testing (Debian testing watch)
[2014-02-12] Accepted wildmidi 0.3.3-3 (source amd64 all) (Bret Curtis)
[2014-02-12] Accepted wildmidi 0.3.3-2 (source amd64 all) (Bret Curtis)
[2014-02-11] Accepted wildmidi 0.3.3-1 (source amd64 all) (Bret Curtis)
[2011-09-01] wildmidi 0.2.3.4-2.1 MIGRATED to testing (Debian testing watch)
[2011-08-21] Accepted wildmidi 0.2.3.4-2.1 (source all amd64) (Sam Hartman)
[2011-08-08] wildmidi 0.2.3.4-2 MIGRATED to testing (Debian testing watch)
[2011-07-28] Accepted wildmidi 0.2.3.4-2 (source i386 all) (Emmet Hikory) (signed by: Niels Thykier)
[2011-03-05] wildmidi 0.2.3.4-1 MIGRATED to testing (Debian testing watch)
[2011-02-22] Accepted wildmidi 0.2.3.4-1 (source amd64) (Emmet Hikory) (signed by: Stefano Rivera)
[2010-07-20] wildmidi 0.2.3.2-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 0
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.4.6-1