Your message dated Mon, 19 Oct 2026 09:34:21 +0000
with message-id <[email protected]>
and subject line Bug#1150455: fixed in eog 50.4-1
has caused the Debian Bug report #1150455,
regarding eog: CVE-2026-107651
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150455: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150455
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: eog
Version: 50.3-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Forwarded: https://gitlab.gnome.org/GNOME/eog/-/issues/342
Hi,
The following vulnerability was published for eog.
CVE-2026-107651[0]:
| A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow
| exists in the PNG metadata reader due to improper state handling
| when parsing split metadata chunks. A remote attacker could exploit
| this flaw by enticing a user into opening a specially crafted PNG
| file, potentially leading to arbitrary code execution or a Denial of
| Service (DoS) via application crash.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-107651
https://www.cve.org/CVERecord?id=CVE-2026-107651
[1] https://gitlab.gnome.org/GNOME/eog/-/issues/342
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: eog
Source-Version: 50.4-1
Done: Jeremy Bícha <[email protected]>
We believe that the bug you reported is fixed in the latest version of
eog, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jeremy Bícha <[email protected]> (supplier of updated eog package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 19 Oct 2026 11:15:22 +0200
Source: eog
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 50.4-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Extras Maintainers
<[email protected]>
Changed-By: Jeremy Bícha <[email protected]>
Closes: 1150455
Changes:
eog (50.4-1) unstable; urgency=high
.
* New upstream release
- Fix heap buffer overflow in png metadata reader (CVE-2026-107651)
(Closes: #1150455)
Checksums-Sha1:
6e94aaf258151cdbc8ecf96481ac01a0010b6d92 2471 eog_50.4-1.dsc
f836f7f7d7d959856def7ea376779f8b5a47e420 4736268 eog_50.4.orig.tar.xz
cacf4a1450f30c3f3b5ad190da87f1cd01666569 16380 eog_50.4-1.debian.tar.xz
e180e1837e813f593dbee8d683146e24640fe189 8639 eog_50.4-1_source.buildinfo
Checksums-Sha256:
bc6150ba13360112e6daec32b9fe67dd389e8242767a4b17431b6ee83025dc04 2471
eog_50.4-1.dsc
db9a11ebad2fb1e5199c529d0eab8e566bd2d5138585ac467e5f6752206486c9 4736268
eog_50.4.orig.tar.xz
8983a7845d5ba0d59022673b68447ad20ee1f0a5054c5c918ac4f6a0a435a44e 16380
eog_50.4-1.debian.tar.xz
234ee00b3b7d5070d01929ac469d6813166f5df1d07c3b29e9102a52369e4656 8639
eog_50.4-1_source.buildinfo
Files:
d9510651cb1fba679b43f6fae5c34dd2 2471 gnome optional eog_50.4-1.dsc
2d790d70052ff8aa0a5f04b130fe15e3 4736268 gnome optional eog_50.4.orig.tar.xz
bf0bcc403232859d93b0c9b881ca8390 16380 gnome optional eog_50.4-1.debian.tar.xz
5927390755a7acd5745be2781bbb6849 8639 gnome optional
eog_50.4-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrV38EACgkQ5mx3Wuv+
bH2dSQ/5ATxEgOJoLrIc2A4eZMOsFP7HjCUbEOLkADnbGYCfRBRCdqA5pMIEPqhW
ANftbCoOEqLR3Im3SpbnftCKD/8VwhTZO70Zv+3A8nmAtRJLNx/bEucR10Zah7aG
8ZSCZEqNpzAd0FZMfreBy8kLTd7iFrdF1fBKOPutIgHYTnM1+56qHLFixw7HA+rb
6MEzOe060+Zv6+vfxqr2pumGrtgiWI+kx/FwQuEb5fRXRy8J4XmB+mzhT5cmhXp3
1JyUaUz2S8QPb44sjzwT7zI6ls2XxOrpKEieyTC8mSTUIuJsnjVDp5mVrUbFeuUo
+LhwhfTivoOMmacvORdTrnjbzRiJKXNYraW3yuVkag8tcAk6qImVTWpOuzCTU22s
L6LomFWRx9+hWf+y1/xSaPwI3ZcXu0zPc2m4j00dgUR4HS/eQfueqdoqo42PaGf7
7Z7opxo4KnNSCs+IkIpDiLow0heKoaI6SkCa/YZjPRN4a3WMXopeBktJuT+MeABW
ROUra6v2jUt2+EqeGX0WIJk8qQsp9M/Ek5dPSEZVwLZeBbFny6kLDxgYSDT+oFYl
PA8rAh+D9jPwlSs8FnPfbobgioV+Pl++TZp7Fx0CNQ5GV+vXnYLzUhmqZkCjv0Or
y0W1DfD7zjcck1HDWwVqSF7JDE8qsLYChB6YXLsPrgME+dQCErA=
=XP5p
-----END PGP SIGNATURE-----
pgp8ppongpWqg.pgp
Description: PGP signature
--- End Message ---
