vtk9 - Debian Package Tracker

general

source: vtk9 (main)
version: 9.5.2+dfsg3-4
maintainer: Debian Science Maintainers (archive) (DMD)
uploaders: Anton Gladky [DMD] – Nico Schlömer [DMD] – Gert Wollny [DMD]
arch: all any
std-ver: 4.7.3
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 9.0.1+dfsg1-8
oldstable: 9.1.0+really9.1.0+dfsg2-5+deb12u1
stable: 9.3.0+dfsg1-4
testing: 9.5.2+dfsg3-4
unstable: 9.5.2+dfsg3-4

versioned links

9.0.1+dfsg1-8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.1.0+really9.1.0+dfsg2-5+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.3.0+dfsg1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
9.5.2+dfsg3-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libvtk9-dev (1 bugs: 0, 0, 1, 0)
libvtk9-java
libvtk9-qt-dev (1 bugs: 0, 1, 0, 0)
libvtk9.5
libvtk9.5-qt
python3-vtk9 (1 bugs: 0, 1, 0, 0)
vtk9 (3 bugs: 0, 3, 0, 0)
vtk9-doc
vtk9-examples

action needed

4 security issues in sid high

There are 4 open security issues in sid.

4 important issues:

CVE-2025-57106: Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data.
CVE-2025-57107: Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.
CVE-2025-57108: Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.
CVE-2025-57109: Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations.

Created: 2025-10-30 Last update: 2026-02-05 05:00

4 security issues in forky high

There are 4 open security issues in forky.

4 important issues:

CVE-2025-57106: Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data.
CVE-2025-57107: Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.
CVE-2025-57108: Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.
CVE-2025-57109: Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations.

Created: 2025-10-30 Last update: 2026-02-05 05:00

Multiarch hinter reports 1 issue(s) high

There are issues with the multiarch metadata for this package.

libvtk9-dev conflicts on 5 files starting with /usr/include/vtk-9.5/vtk on any two of amd64, arm64, armhf, i386, and 3 more

Created: 2024-06-07 Last update: 2026-02-05 04:02

A new upstream version is available: 9.6.0.rc3 high

A new upstream version 9.6.0.rc3 is available, you should consider packaging it.

Created: 2025-12-28 Last update: 2026-02-05 03:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 9.5.2+dfsg3-5, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 89a430d1da1497e2e9862d4f7cfed9d4fe98766e
Author: Drew Parsons <dparsons@debian.org>
Date:   Tue Feb 3 14:50:26 2026 +0100

    disable viskores on alpha
    
    alpha is 64-bit but also exceeds available memory
    
    [  5%] Generating the wrap hierarchy for VTK::ImagingCore
    cd /build/reproducible-path/vtk9-9.5.2+dfsg3/debian/build/Imaging/Core && ../../bin/vtkWrapHierarchy-9.5 -MF /build/reproducible-path/vtk9-9.5.2+dfsg3/debian/build/Imaging/Core/CMakeFiles/vtkImagingCore-hierarchy.txt.d @/build/reproducible-path/vtk9-9.5.2+dfsg3/debian/build/Imaging/Core/CMakeFiles/vtkImagingCore-hierarchy.None.args -o /build/reproducible-path/vtk9-9.5.2+dfsg3/debian/build/lib/alpha-linux-gnu/vtk-9.5/hierarchy/VTK/vtkImagingCore-hierarchy.txt /build/reproducible-path/vtk9-9.5.2+dfsg3/debian/build/Imaging/Core/CMakeFiles/vtkImagingCore-hierarchy.data @/build/reproducible-path/vtk9-9.5.2+dfsg3/debian/build/Imaging/Core/CMakeFiles/vtkImagingCore-hierarchy.depends.args
    /usr/bin/alpha-linux-gnu-ld.bfd: CMakeFiles/viskores_cont.dir/UnknownArrayHandle.cxx.o: .got subsegment exceeds 64K (size 96168)
    /usr/bin/alpha-linux-gnu-ld.bfd: failed to set dynamic section sizes: no error

commit 0fdc3cbf46af7a58e41efc86dc7bf0595d1249bf
Author: Drew Parsons <dparsons@debian.org>
Date:   Tue Feb 3 14:36:03 2026 +0100

    document that 9.5.2+dfsg3-3 disabled viskores on 32-bit arches
    
    hadn't been added to changelog in commit
    e10222dfcf4141437dcc36fa9a54e411e4b9f0a5

commit 2ebe857f7aca36b59b6d870d6692683be11e371e
Author: Drew Parsons <dparsons@debian.org>
Date:   Fri Jan 30 11:53:04 2026 +0100

    refresh patches

commit 50df715912b76362a07810b67b8586298c9bcf02
Author: Drew Parsons <dparsons@debian.org>
Date:   Fri Jan 30 11:50:41 2026 +0100

    add debian patch findEXPAT_version_fix_MR12826.patch
    
    applies upstream MR#12826 to fix expat version handling
    
    Closes: #1050506

Created: 2026-01-30 Last update: 2026-02-03 14:32

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-01-29 Last update: 2026-01-29 12:30

4 low-priority security issues in trixie low

There are 4 open security issues in trixie.

4 issues left for the package maintainer to handle:

CVE-2025-57106: (needs triaging) Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data.
CVE-2025-57107: (needs triaging) Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.
CVE-2025-57108: (needs triaging) Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.
CVE-2025-57109: (needs triaging) Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations.

You can find information about how to handle these issues in the security team's documentation.

Created: 2025-10-30 Last update: 2026-02-05 05:00

5 low-priority security issues in bookworm low

There are 5 open security issues in bookworm.

4 issues left for the package maintainer to handle:

CVE-2025-57106: (needs triaging) Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing GLTF accessor data.
CVE-2025-57107: (needs triaging) Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accessor objects fails to properly validate buffer boundaries before performing memory read operations.
CVE-2025-57108: (needs triaging) Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector members are accessed after the underlying memory has been freed, specifically when handling GLTF files with corrupted or invalid mesh reference structures.
CVE-2025-57109: (needs triaging) Kitware VTK (Visualization Toolkit) 9.5.0 is vulnerable to Heap Use-After-Free in vtkGLTFImporter::ImportActors. When processing GLTF files with invalid scene node references, the application accesses string members of mesh objects that have been previously freed during actor import operations.

You can find information about how to handle these issues in the security team's documentation.

1 ignored issue:

CVE-2021-42521: There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx. The vendor didn't check the return value of libxml2 API 'xmlDocGetRootElement', and try to dereference it. It is unsafe as the return value can be NULL and that NULL pointer dereference may crash the application.

Created: 2023-06-10 Last update: 2026-02-05 05:00

debian/patches: 13 patches to forward upstream low

Among the 13 debian patches available in version 9.5.2+dfsg3-4 of the package, we noticed the following issues:

13 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-01-28 20:30

news

[rss feed]

[2026-02-05] vtk9 9.5.2+dfsg3-4 MIGRATED to testing (Debian testing watch)
[2026-01-28] Accepted vtk9 9.5.2+dfsg3-4 (source) into unstable (Drew Parsons)
[2026-01-28] Accepted vtk9 9.5.2+dfsg3-3 (source) into unstable (Drew Parsons)
[2026-01-28] Accepted vtk9 9.5.2+dfsg3-2 (source) into unstable (Drew Parsons)
[2026-01-27] Accepted vtk9 9.5.2+dfsg3-1 (source) into unstable (Drew Parsons)
[2025-10-31] vtk9 9.5.2+dfsg2-4 MIGRATED to testing (Debian testing watch)
[2025-10-27] Accepted vtk9 9.5.2+dfsg2-4 (source) into unstable (Dominique Belhachemi)
[2025-10-24] Accepted vtk9 9.5.2+dfsg2-3 (source) into unstable (Dominique Belhachemi)
[2025-10-23] Accepted vtk9 9.5.2+dfsg2-2 (source) into unstable (Dominique Belhachemi)
[2025-10-23] vtk9 9.5.2+dfsg2-1 MIGRATED to testing (Debian testing watch)
[2025-10-19] Accepted vtk9 9.1.0+really9.1.0+dfsg2-5+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Santiago Vila)
[2025-10-13] Accepted vtk9 9.5.2+dfsg2-1 (source) into unstable (Dominique Belhachemi)
[2025-10-01] Accepted vtk9 9.5.2+dfsg2-1~exp4 (source) into experimental (Dominique Belhachemi)
[2025-10-01] Accepted vtk9 9.5.2+dfsg2-1~exp3 (source) into experimental (Dominique Belhachemi)
[2025-09-29] Accepted vtk9 9.5.2+dfsg2-1~exp2 (source) into experimental (Dominique Belhachemi)
[2025-09-27] Accepted vtk9 9.5.2+dfsg2-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Dominique Belhachemi)
[2025-09-27] Accepted vtk9 9.5.2+dfsg1-1~exp1 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Dominique Belhachemi)
[2025-09-18] vtk9 9.3.0+dfsg1-7 MIGRATED to testing (Debian testing watch)
[2025-09-04] Accepted vtk9 9.3.0+dfsg1-7 (source) into unstable (Dominique Belhachemi)
[2025-09-01] Accepted vtk9 9.3.0+dfsg1-6 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2025-08-22] Accepted vtk9 9.3.0+dfsg1-5 (source) into unstable (Santiago Vila)
[2025-02-18] vtk9 9.3.0+dfsg1-4 MIGRATED to testing (Debian testing watch)
[2025-02-15] Accepted vtk9 9.3.0+dfsg1-4 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2025-02-07] vtk9 9.3.0+dfsg1-3 MIGRATED to testing (Debian testing watch)
[2025-01-28] Accepted vtk9 9.3.0+dfsg1-3 (source) into unstable (Anton Gladky)
[2025-01-27] vtk9 9.3.0+dfsg1-2 MIGRATED to testing (Debian testing watch)
[2025-01-23] Accepted vtk9 9.3.0+dfsg1-2 (source) into unstable (Bastian Germann) (signed by: bage@debian.org)
[2024-12-05] vtk9 9.3.0+dfsg1-1.1 MIGRATED to testing (Debian testing watch)
[2024-11-22] Accepted vtk9 9.3.0+dfsg1-1.1 (source) into unstable (Emilio Pozuelo Monfort)
[2024-06-22] vtk9 9.3.0+dfsg1-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 13
RC: 0
I&N: 10
M&W: 3
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 9.5.2+dfsg2-4ubuntu1
6 bugs
patches for 9.5.2+dfsg2-4ubuntu1