Your message dated Fri, 23 Oct 2026 00:51:02 +0000
with message-id <[email protected]>
and subject line Bug#1151664: fixed in libimager-perl 1.040+dfsg-1
has caused the Debian Bug report #1151664,
regarding libimager-perl: CVE-2026-112202
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151664: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151664
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libimager-perl
Version: 1.037+dfsg-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for libimager-perl.
CVE-2026-112202[0]:
| Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds
| reads when consolidating GIF images. With `gif_consolidate => 1`,
| palette indices from the image are used without checking the colour
| table's bounds. The i_readgif_low routine reads beyond the heap
| allocation and copies the bytes into output pixels. The default GIF
| reader is not affected. The same code ships bundled in the Imager
| distribution. An attacker supplying a crafted GIF can disclose
| adjacent heap memory through the decoded output and may crash the
| process.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-112202
https://www.cve.org/CVERecord?id=CVE-2026-112202
[1] https://lists.security.metacpan.org/cve-announce/msg/44514169/
[2] https://github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897
[3]
https://github.com/tonycoz/imager/commit/dec96f12b3d8a7fd94e86264953a5e4919dd6036
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libimager-perl
Source-Version: 1.040+dfsg-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libimager-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libimager-perl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 23 Oct 2026 02:06:15 +0200
Source: libimager-perl
Architecture: source
Version: 1.040+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1151664
Changes:
libimager-perl (1.040+dfsg-1) unstable; urgency=medium
.
* Import upstream version 1.040+dfsg.
- GIF:
fix a malloc buffer read overflow in the gif_consolidate reader,
these could read past the end of the giflib supplied color map.
https://github.com/tonycoz/imager/security/advisories/GHSA-v4hp-5h6w-9897
CVE-2026-112202
Closes: #1151664
- The Imager C API major version has changed, any modules that depend on
the Imager C API will need to be rebuilt.
* debian/rules: set IMAGERAPI_VERSION to 7.
* Update upstream email address.
Checksums-Sha1:
e54d0b6183d78a85f80cf4c5604a55af0225121b 2684 libimager-perl_1.040+dfsg-1.dsc
b3568a1235590b03267f29be0184573bd3047daf 956904
libimager-perl_1.040+dfsg.orig.tar.xz
496f7c0410e793c34daa36c955c14b87434a345a 14156
libimager-perl_1.040+dfsg-1.debian.tar.xz
6eeb95bbca5661ed555afb3e1c9bdf3597b8404e 2109740
libimager-perl_1.040+dfsg-1.git.tar.xz
36b2081093464cb3fb232f173569b5825b18e63b 17780
libimager-perl_1.040+dfsg-1_source.buildinfo
Checksums-Sha256:
01bdb987cf26a02d059ba1eeb14e08a94e998304907cc1637053deec16c553d1 2684
libimager-perl_1.040+dfsg-1.dsc
59c3ac5cc6a6d500bad06d4d2e93b18662149bf8d3fb87f59f1e1c5c290d1bc6 956904
libimager-perl_1.040+dfsg.orig.tar.xz
e5b4499386051b2582b3d1bac85170c86214355926ce553aa1bbdf60d13eeb16 14156
libimager-perl_1.040+dfsg-1.debian.tar.xz
8585e7b1690393079f7828f094af78d9ea11f5b58b4e59420550a214245121b6 2109740
libimager-perl_1.040+dfsg-1.git.tar.xz
55820a37816b10f80a08f7d931f187b4ea5bd6738ef4bd442cf49d0eab0559e9 17780
libimager-perl_1.040+dfsg-1_source.buildinfo
Files:
09c094a8065710cc1da969f36a015252 2684 perl optional
libimager-perl_1.040+dfsg-1.dsc
72c15da509138b2b58e2c120341164e7 956904 perl optional
libimager-perl_1.040+dfsg.orig.tar.xz
036efeef93473073128163ff48c5b937 14156 perl optional
libimager-perl_1.040+dfsg-1.debian.tar.xz
db15ee2028fa98cff888b8e3bb1a73c5 2109740 perl None
libimager-perl_1.040+dfsg-1.git.tar.xz
fdfef90b19c5f359cb93b1ff83fffa56 17780 perl optional
libimager-perl_1.040+dfsg-1_source.buildinfo
Git-Tag-Info: tag=08730d91a38cb8e2832f4d00bbcc44479ae20525
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrap2QACgkQYG0ITkaD
wHls+hAArkwzUcZygEgHY1lzZ+uFxPS/qfA6G9DrW9r3umns/wJp0R5Pz49FX3Nh
4U9QPpIxgYNWY2PpjkIs8t5pQJZeCncGoFTO58QrKfmASigV9/A0vZ6/20EsI2KN
q5B+AQjcFESRmOxsuY1wy4urjhU1/UTJg2be/gxFRBbt7YjVUtKRVnpc9N9wC+LY
w8fmiiSJzM5W+RZ1EqA35tJ3H480OFfW/JbWdvALk7X0pkyJhTJsqsR81qlJUl6i
lMZGlhZqC0jxr3WUVCxGm+JBSGsgbhIE4WnXW7chkyAJBVM/ky/DwOkoO/rXsVSz
MpTJPWtpMVnlCwnYGTYOrB+v87vl9GnEn5PP6qh3P4MqqgdIqsT0d0W4zPw9ffQD
gvKyMavjF690HZyfMFO972q23reXp0zyMzFoQZpn2D1hY/n4M6jQJVrqdnyE71lT
bubvbYxbhkVUjGecyhZ8Ejnl9BXcv6ljcQTDykk+B38nEA1Ovx/sZHMW/auE2Zk5
T3oaBJ9u2BlltPZs00+S1ueJkznZhBVJze+tl1eZD2Vze3ZxneUF2JMl4SCbW51D
gu4U7GINYq5CFwC6JPxDqbVrO0KAxDCoHM2jb90KHJ0/JL3NDn+dHNaBHbOzRvKu
8e1qqNfuFTqftBErEYaIqFURbcmPmlMFOstEKYoOOa4qNEY/FBo=
=jLWi
-----END PGP SIGNATURE-----
pgp9j9T6s60Ir.pgp
Description: PGP signature
--- End Message ---
