Your message dated Sun, 18 Oct 2026 09:00:29 +0000
with message-id <[email protected]>
and subject line Bug#1121912: fixed in freeimage 4.2.1+ds-1~exp1
has caused the Debian Bug report #1121912,
regarding freeimage: open security issues
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1121912: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1121912
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: freeimage
Version: 3.18.0+ds2-11
Severity: serious
Tags: security
X-Debbugs-Cc: [email protected]
Hi,
It looks like freeimage is dead upstream (last upstream release in 2018,
upstream
maintainer email bounces[1]). With many open security issues[2], I believe
freeimage
is not in a shape to be released in Debian, and should be removed.
This bug at RC severity should kick it out of testing for the time being, and if
nobody is willing to take over it and look at the security issues, it should
eventually be dropped from sid as well.
Cheers,
Emilio
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082375
[2] https://security-tracker.debian.org/tracker/source-package/freeimage
--- End Message ---
--- Begin Message ---
Source: freeimage
Source-Version: 4.2.1+ds-1~exp1
Done: Anton Gladky <[email protected]>
We believe that the bug you reported is fixed in the latest version of
freeimage, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Anton Gladky <[email protected]> (supplier of updated freeimage package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 17 Oct 2026 19:26:24 +0200
Source: freeimage
Binary: libfreeimage-dev libfreeimage4 libfreeimage4-dbgsym
libfreeimageplus-dev libfreeimageplus4 libfreeimageplus4-dbgsym
Architecture: source amd64
Version: 4.2.1+ds-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Science Maintainers
<[email protected]>
Changed-By: Anton Gladky <[email protected]>
Description:
libfreeimage-dev - Support library for graphics image formats (development
files)
libfreeimage4 - Support library for graphics image formats (library)
libfreeimageplus-dev - C++ wrappers for FreeImage (development files)
libfreeimageplus4 - C++ wrappers for freeimage (library)
Closes: 1055305 1059152 1060691 1060862 1068718 1082375 1121912 1138102
Changes:
freeimage (4.2.1+ds-1~exp1) experimental; urgency=medium
.
* New upstream release: switch to FreeImageRe 4.2.1, a maintained fork
(Closes: #1121912). FreeImage itself is dead upstream with open
security issues; FreeImageRe carries CVE fixes and active
maintenance.
* CMake-based build, replacing the old Makefile-based one.
* SONAME bump (libfreeimage3 -> libfreeimage4, libfreeimageplus3 ->
libfreeimageplus4): abidiff against the previous upload found a
removed function and a changed signature.
* FreeImagePlus ported forward from FreeImage 3.18 (upstream dropped
it), with the changes listed in Wrapper/FreeImagePlus/PORTING.txt.
fipImage::getHistogram() keeps the FreeImage 3.18 implementation.
* Vendor a pinned Yato copy (a header-only FreeImageRe dependency with
no Debian package).
* Build against the system jxrlib; the embedded copy is removed from
the orig tarball.
* Load libheif by its SONAME, so HEIF/AVIF support works without
libheif-dev installed, and recommend libheif1.
* Build the library with the colour order the installed header uses on
the host architecture (BGR on little-endian, RGB on big-endian).
* Drop libfreeimageplus-doc for now (doxygen config not ported yet).
* debian/copyright, debian/patches: rewritten for the new source.
Upstream-Contact now points to the FreeImageRe project.
(Closes: #1082375)
* The switch to FreeImageRe supersedes packaging FreeImage r1909.
(Closes: #1068718)
* autopkgtest: enable the per-format upstream tests and add a
FreeImagePlus test.
* debian/watch: convert to version 5 and track upstream releases.
* Security fixes included in FreeImageRe:
- CVE-2020-24292: ICO load() buffer overflow.
- CVE-2020-24293, CVE-2020-24294, CVE-2020-24295: PSD plugin
buffer overflows. (Closes: #1059152)
- CVE-2021-40266: TIFF ReadPalette NULL pointer dereference.
(Closes: #1055305)
- CVE-2023-47992: _MemoryReadProc integer overflow.
- CVE-2023-47993: Exif ReadInt32 out-of-bounds read.
- CVE-2023-47994: BMP LoadPixelDataRLE4 integer overflow.
- CVE-2023-47996: Exif jpeg_read_exif_dir integer overflow.
- CVE-2023-47997: FreeImage_AllocateBitmap infinite loop.
(Closes: #1060691)
- CVE-2023-47995: FreeImage_AllocateBitmap excessive allocation.
(Closes: #1060862)
- CVE-2024-28579, CVE-2024-28582: HDR plugin memory errors.
* Remove Ghislain Antony Vaillant from Uploaders. (Closes: #1138102)
Checksums-Sha1:
25792cb2b9fc436ed323fb63f50f78523ee44f3d 2497 freeimage_4.2.1+ds-1~exp1.dsc
4ae20a22185c1271148e0b41b5f9c7ec0f24fc39 2389796 freeimage_4.2.1+ds.orig.tar.xz
bf59f99d124f4adde428015f9df97fd74915d74a 24616
freeimage_4.2.1+ds-1~exp1.debian.tar.xz
05432d374a78d120b13cb2a7db1608c3a4984a51 9861
freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
aef64501651fe98a66165665b89498446b1801b2 56948
libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
1129e8bd5c8f1645b52ba23460073122edcef5c2 2989772
libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
bbaf282015c84d5fb038a4c2ded3444f9dcc4d93 422808
libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
c9e9d4e42a6e4a182ef1a80e2e897fc48ab126ba 44780
libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
db83a7f547377db9be7cb4004075211fc4e29548 42888
libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
8f2cbc9454e61c69d03402d4fbab430251122685 46584
libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
Checksums-Sha256:
cc555c504d3748e21058be4088702812aec99d3eeacc72dc2cc0bbefb3f66bf7 2497
freeimage_4.2.1+ds-1~exp1.dsc
bfb3309bd0601d438ace8fe483187dfa77ab132389b6e055c63c9c657a5c98a6 2389796
freeimage_4.2.1+ds.orig.tar.xz
a41ffa93e0028226cf2154153848cb48e1d56c2b4b7016f838abe0ad83ac1533 24616
freeimage_4.2.1+ds-1~exp1.debian.tar.xz
d6a5db8f0817fdb661c4c7081cc43a8ee986fcd3006925b9b947270f93adda75 9861
freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
8eb5d82b5d7b78c50d47e44eedcc86ec6ff403db10ba89a12ca94e1bb90ed268 56948
libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
6b91d049bf106575b699fa033f1a45f42057b3048f5f569c43546d2dec5c9abe 2989772
libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
7fb84f7815dd12476202f9166b447eaa7f93292f4bf0faa9da57b994d42fe69a 422808
libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
7aac4c8b66922db5e62d65bb1c36785b8fb8a7ac2c5e20e487d4d95eb7259f21 44780
libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
9dd72889fbaea1d4f7f3d154534150804a33a6764697d1ca52e3d60f6f876d5a 42888
libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
144be88ca8e4a558d54424128c25a865b34a6568e8685fb60b29eb3c67254ca5 46584
libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
Files:
d97762914cf6ecaa27d8471f04fdec3b 2497 libs optional
freeimage_4.2.1+ds-1~exp1.dsc
c307bd18bc4f878384871f2d34bcc40d 2389796 libs optional
freeimage_4.2.1+ds.orig.tar.xz
3beebefad9e4d0649564f6c5047c7553 24616 libs optional
freeimage_4.2.1+ds-1~exp1.debian.tar.xz
4c8bbc302d13b90c078183244c04322e 9861 libs optional
freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
1350ed28f47858740188da4f8ad8f622 56948 libdevel optional
libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
0d787fc0aa85e413696e2eaee4d990f7 2989772 debug optional
libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
78992a1f1a40eee5aaf6482ec2e1c4ee 422808 libs optional
libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
32cab240df7ea1ef7d15d8f33f9aa53b 44780 libdevel optional
libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
f45c407eae5a3ae638851f6b1ed6af5b 42888 debug optional
libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
10359d3f90c1e7cce4d9a7939ed8d02a 46584 libs optional
libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmrTsCIRHGdsYWRrQGRl
Ymlhbi5vcmcACgkQ0+Fzg8+n/wZC7g/+KTszaHoQ2qW2xlkheNCJnEXM3J7wKwon
iqHdLdPlKvTGtBSXL+n1MuEKV7mkiu9Q2UjXbBh7LLK99pBm4NOKBDQ+6dQGUh7P
lsCraMBSOFwhRcDaUMd0DVk02gDJdB6WOQw8gYFJ7s7BAqP5ewpjPKHcnMbrH8+2
7/cZdKbdf2xwsq4r/HAEJywHu5rvhcj09Hlci0yQ+Xou4yo55boy/U1hJ7f4YXGE
6vzAj03ncjpabpYPOslLPIFOqQeLu+8D4Y4pUV1JjFi2bz4KLVM7aRhL2MDGJykW
7ZQAfORb+TWj42BvGlX1eJQ1YkGSEPRP9VTUME3vLc1ZA+jmWD2QPUX9WewjPbLg
yBT1DdOHOa4Ih4clv57jNd5iyE+kpYO0uyywJlUMahX51AieI3O81aEjDC5T1+vc
RP9p0puwK+VRJ6m7tEl+KsU2hYhbsxvFnOXHtsBVUcLdvwyA5oKpEHQfhPbsCMqD
+/GCqoHVda0PWGDdpCF8hJE6dgfU831Pdpm9kkGExevmJl4qD/YRe00i5E2+niy5
wzhGIlze1PvmbTnNp3jFbhPMfEyom45eiIP9s2zRnj+Kf1hMRVAFpQIijm0W4Yqp
lio+IiWmFf4+o15zP4794NiJ98sJw3crCczvPu45Alz6A01QD2seqWhvvMKcFKYa
21SlrT2Jkk4=
=jxyq
-----END PGP SIGNATURE-----
pgp1dCiVRG13T.pgp
Description: PGP signature
--- End Message ---
