Package: release.debian.org Severity: normal Tags: trixie User: [email protected] Usertags: pu
Please consider cimg 3.5.2+dfsg-1+deb13u2 for trixie proposed-updates. The current trixie package, 3.5.2+dfsg-1+deb13u1, fails to build against the openexr security update (DSA-6618-1). Its examples use OpenEXR's inline Array2D template, whose updated validation code introduces direct references to Iex exceptions. The examples currently link only OpenEXR and Imath, so the linker rejects the missing explicit Iex dependency: undefined reference to symbol '_ZTIN7Iex_3_16ArgExcE' libIex-3_1.so.30: error adding symbols: DSO missing from command line The failure occurs while linking curve_editor2d during the package's build-time tests. The installed examples used by autopkgtest fail for the same reason. This is a build-compatibility regression associated with the openexr update, not a separate cimg vulnerability or a demonstrated startup failure in existing applications. The proposed fix adds -lIex to OPENEXR_LIBS in examples/Makefile. Iex is already provided by libopenexr-dev, so no new package dependency is needed. The debdiff contains only this one-line patch, the public API and the existing security patches are unchanged. The equivalent linker behavior is already present in CImg 4.0.4+dfsg-1, which uses pkg-config to obtain OpenEXR's compiler and linker flags. Its old Imath.patch is disabled. This stable update uses the smaller explicit linker addition rather than changing the flag-discovery mechanism. diff -Nru cimg-3.5.2+dfsg/debian/changelog cimg-3.5.2+dfsg/debian/changelog --- cimg-3.5.2+dfsg/debian/changelog 2026-05-08 19:47:35.000000000 +0800 +++ cimg-3.5.2+dfsg/debian/changelog 2026-11-10 19:54:15.000000000 +0800 @@ -1,3 +1,12 @@ +cimg (3.5.2+dfsg-1+deb13u2) trixie; urgency=medium + + * Non-maintainer upload. + * Fix FTBFS with the OpenEXR 3.2.12 security update by linking Iex + explicitly when building the OpenEXR-enabled examples. This also + fixes the installed examples used by autopkgtest. + + -- Aron Xu <[email protected]> Tue, 10 Nov 2026 19:54:15 +0800 + cimg (3.5.2+dfsg-1+deb13u1) trixie; urgency=medium * Non-maintainer upload. diff -Nru cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch --- cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch 1970-01-01 07:30:00.000000000 +0730 +++ cimg-3.5.2+dfsg/debian/patches/openexr-iex.patch 2026-11-10 19:54:15.000000000 +0800 @@ -0,0 +1,22 @@ +Description: Link Iex when building OpenEXR-enabled examples + OpenEXR 3.2.12 validates dimensions in the inline Array/Array2D templates. + Instantiating these templates can introduce direct Iex::ArgExc references, + so the examples must link Iex explicitly rather than relying on OpenEXR + to load it as a runtime dependency. +Author: Aron Xu <[email protected]> +Forwarded: not-needed +Last-Update: 2026-11-10 + +Index: cimg-3.5.2+dfsg/examples/Makefile +=================================================================== +--- cimg-3.5.2+dfsg.orig/examples/Makefile ++++ cimg-3.5.2+dfsg/examples/Makefile +@@ -249,7 +249,7 @@ HEIF_LIBS = -lheif + OPENEXR_DEFINE = -Dcimg_use_openexr + OPENEXR_INCDIR = -I/usr/include/OpenEXR -I/usr/include/Imath + OPENEXR_CFLAGS = $(OPENEXR_DEFINE) $(OPENEXR_INCDIR) +-OPENEXR_LIBS = -lOpenEXR -lImath ++OPENEXR_LIBS = -lOpenEXR -lImath -lIex + + # Flags to enable native support for various video files, using the FFMPEG library. + # ( http://www.ffmpeg.org/ ) diff -Nru cimg-3.5.2+dfsg/debian/patches/series cimg-3.5.2+dfsg/debian/patches/series --- cimg-3.5.2+dfsg/debian/patches/series 2026-05-08 19:47:35.000000000 +0800 +++ cimg-3.5.2+dfsg/debian/patches/series 2026-11-10 19:47:36.000000000 +0800 @@ -5,3 +5,4 @@ Imath.patch fix-cve-2026-42144.patch fix-cve-2026-42146.patch +openexr-iex.patch
