[From nobody Mon Jul 6 20:05:09 2026 Received: (at submit) by bugs.debian.org; 6 Jul 2026 18:29:16 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-8.9 required=4.0 tests=BAYES_00, FOURLA, FROMDEVELOPER, FUZZY_APPLE,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 29; hammy, 150; neutral, 97; spammy, 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil, 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--H*Ad:N*Bug, 0.000-+--H*Ad:N*Tracking Return-path: <carnil@debian.org> Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96) (envelope-from <carnil@debian.org>) id 1wgo4A-007Igg-1d for submit@bugs.debian.org; Mon, 06 Jul 2026 18:29:16 +0000 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit From: Salvatore Bonaccorso <carnil@debian.org> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: libimager-perl: CVE-2026-13705 CVE-2026-13708 Message-ID: <178336255351.3634223.11383915037199270525.reportbug@eldamar.lan> X-Mailer: reportbug 13.2.0+nmu1 Date: Mon, 06 Jul 2026 20:29:13 +0200 Delivered-To: submit@bugs.debian.org Source: libimager-perl Version: 1.031+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org> Hi, The following vulnerabilities were published for libimager-perl. CVE-2026-13705[0]: | Imager versions before 1.032 for Perl have a heap out-of-bounds read | in the bundled Imager::File::SGI reader via a 16-bit RLE literal run | in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if | (count > data_left), but count is a pixel count while every 16-bit | sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] | and advances two bytes per pixel, so a run with data_left / 2 < | count <= data_left passes the guard yet consumes 2 * count bytes and | reads past the end of the buffer. The 8-bit path is unaffected | because there one pixel is one byte. Reading a crafted SGI image | through Imager->read triggers the over-read before the parser | rejects the malformed image, which can crash the process. CVE-2026-13708[1]: | Imager::File::JPEG versions before 1.003 for Perl leak heap memory | when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. | i_readjpeg_wiol walks the marker list libjpeg returns and, for each | APP13 marker, allocates a new buffer with *iptc_itext = | mymalloc(...) and overwrites the previous pointer without freeing | it. Only the final payload is later turned into a Perl scalar and | freed, so a JPEG with N such markers leaks the first N-1 payloads on | every read. In a long-lived process, such as an upload or | thumbnailing service, repeated reads accumulate these leaks and | exhaust available memory, a denial of service. The same handler | ships bundled in the Imager distribution, where versions before | 1.032 are affected and the fix ships in 1.032. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-13705 https://www.cve.org/CVERecord?id=CVE-2026-13705 https://lists.security.metacpan.org/cve-announce/msg/41572386/ [1] https://security-tracker.debian.org/tracker/CVE-2026-13708 https://www.cve.org/CVERecord?id=CVE-2026-13708 https://lists.security.metacpan.org/cve-announce/msg/41572486/ Regards, Salvatore ]