[From nobody Tue Oct  6 14:07:09 2026
Received: (at submit) by bugs.debian.org; 18 Apr 2026 18:32:06 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-10.9 required=4.0 tests=BAYES_00,FOURLA,
 FROMDEVELOPER,MD5_SHA1_SUM,NO_RELAYS,XMAILER_REPORTBUG autolearn=ham
 autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 94; hammy, 150; neutral, 139; spammy,
 0. spammytokens: hammytokens:0.000-+--H*F:U*carnil,
 0.000-+--XDebbugsCc, 0.000-+--X-Debbugs-Cc, 0.000-+--HTo:N*Debian,
 0.000-+--H*Ad:N*Bug
Return-path: <carnil@debian.org>
Received: via submission by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <carnil@debian.org>) id 1wEASb-00HNTa-2X
 for submit@bugs.debian.org; Sat, 18 Apr 2026 18:32:06 +0000
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Salvatore Bonaccorso <carnil@debian.org>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: libgphoto2: CVE-2026-40333 CVE-2026-40334 CVE-2026-40335
 CVE-2026-40336 CVE-2026-40338 CVE-2026-40339 CVE-2026-40340 CVE-2026-40341
Message-ID: <177653712380.63171.16453613965938913739.reportbug@eldamar.lan>
X-Mailer: reportbug 13.2.0
Date: Sat, 18 Apr 2026 20:32:03 +0200
Delivered-To: submit@bugs.debian.org

U291cmNlOiBsaWJncGhvdG8yClZlcnNpb246IDIuNS4zMy0xClNldmVyaXR5OiBpbXBvcnRhbnQK
VGFnczogc2VjdXJpdHkgdXBzdHJlYW0KWC1EZWJidWdzLUNjOiBjYXJuaWxAZGViaWFuLm9yZywg
RGViaWFuIFNlY3VyaXR5IFRlYW0gPHRlYW1Ac2VjdXJpdHkuZGViaWFuLm9yZz4KCkhpLAoKVGhl
IGZvbGxvd2luZyB2dWxuZXJhYmlsaXRpZXMgd2VyZSBwdWJsaXNoZWQgZm9yIGxpYmdwaG90bzIu
CgpDVkUtMjAyNi00MDMzM1swXToKfCBsaWJncGhvdG8yIGlzIGEgY2FtZXJhIGFjY2VzcyBhbmQg
Y29udHJvbCBsaWJyYXJ5LiBJbiB2ZXJzaW9ucyB1cCB0bwp8IGFuZCBpbmNsdWRpbmcgMi41LjMz
LCB0d28gZnVuY3Rpb25zIGluIGNhbWxpYnMvcHRwMi9wdHAtcGFjay5jCnwgYWNjZXB0IGEgZGF0
YSBwb2ludGVyIGJ1dCBubyBsZW5ndGggcGFyYW1ldGVyLCBwZXJmb3JtaW5nIHVuYm91bmRlZAp8
IHJlYWRzLiBUaGVpciBjYWxsZXJzIGluIHB0cF91bnBhY2tfRU9TX2V2ZW50cygpIGhhdmUgeHNp
emUgYXZhaWxhYmxlCnwgYnV0IG5ldmVyIHBhc3MgaXQsIGxlYXZpbmcgYm90aCBmdW5jdGlvbnMg
dW5hYmxlIHRvIHZhbGlkYXRlIHJlYWRzCnwgYWdhaW5zdCB0aGUgYWN0dWFsIGJ1ZmZlciBib3Vu
ZGFyeS4gQ29tbWl0CnwgMTgxN2VjZWFkMjBjMmFhZmE3NTQ5ZGFjOTYxOWZlMzhmNDdiMmY1MyBw
YXRjaGVzIHRoZSBpc3N1ZS4KCgpDVkUtMjAyNi00MDMzNFsxXToKfCBsaWJncGhvdG8yIGlzIGEg
Y2FtZXJhIGFjY2VzcyBhbmQgY29udHJvbCBsaWJyYXJ5LiBJbiB2ZXJzaW9ucyB1cCB0bwp8IGFu
ZCBpbmNsdWRpbmcgMi41LjMzLCBhIG1pc3NpbmcgbnVsbCB0ZXJtaW5hdG9yIGV4aXN0cyBpbgp8
IHB0cF91bnBhY2tfQ2Fub25fRkUoKSBpbiBjYW1saWJzL3B0cDIvcHRwLXBhY2suYyAobGluZSAx
Mzc3KS4gVGhlCnwgZnVuY3Rpb24gY29waWVzIGEgZmlsZW5hbWUgaW50byBhIDEzLWJ5dGUgYnVm
ZmVyIHVzaW5nIHN0cm5jcHkKfCB3aXRob3V0IGV4cGxpY2l0bHkgbnVsbC10ZXJtaW5hdGluZyB0
aGUgcmVzdWx0LiBJZiB0aGUgc291cmNlIGRhdGEKfCBpcyBleGFjdGx5IDEzIGJ5dGVzIHdpdGgg
bm8gbnVsbCB0ZXJtaW5hdG9yLCB0aGUgYnVmZmVyIGlzIGxlZnQKfCB1bnRlcm1pbmF0ZWQsIGxl
YWRpbmcgdG8gb3V0LW9mLWJvdW5kcyByZWFkcyBpbiBhbnkgc3Vic2VxdWVudAp8IHN0cmluZyBv
cGVyYXRpb24uIENvbW1pdCAyNTlmYzdkM2JmZTUzNGNlNGIxMTRjNDY0ZjU1YjQ0ODY3MGFiODcz
CnwgcGF0Y2hlcyB0aGUgaXNzdWUuCgoKQ1ZFLTIwMjYtNDAzMzVbMl06CnwgbGliZ3Bob3RvMiBp
cyBhIGNhbWVyYSBhY2Nlc3MgYW5kIGNvbnRyb2wgbGlicmFyeS4gVmVyc2lvbnMgdXAgdG8KfCBh
bmQgaW5jbHVkaW5nIDIuNS4zMyBoYXZlIGFuIG91dC1vZi1ib3VuZHMgcmVhZCBpbgp8IGBwdHBf
dW5wYWNrX0RQVigpYCBpbiBgY2FtbGlicy9wdHAyL3B0cC1wYWNrLmNgIChsaW5lcyA2MjLigJM2
MjkpLiBUaGUKfCBVSU5UMTI4IGFuZCBJTlQxMjggY2FzZXMgYWR2YW5jZSBgKm9mZnNldCArPSAx
NmAgd2l0aG91dCB2ZXJpZnlpbmcKfCB0aGF0IDE2IGJ5dGVzIHJlbWFpbiBpbiB0aGUgYnVmZmVy
LiBUaGUgZW50cnkgY2hlY2sgYXQgbGluZSA2MDkgb25seQp8IGd1YXJhbnRlZXMgYCpvZmZzZXQg
PCB0b3RhbGAgKGF0IGxlYXN0IDEgYnl0ZSBhdmFpbGFibGUpLCBsZWF2aW5nIHVwCnwgdG8gMTUg
Ynl0ZXMgdW52YWxpZGF0ZWQuIENvbW1pdAp8IDQzM2JkZTk4ODhkNzBhYTcyNmUzMjc0NGNkNzUx
ZDdkYmU5NDM3OWEgcGF0Y2hlcyB0aGUgaXNzdWUuCgoKQ1ZFLTIwMjYtNDAzMzZbM106CnwgbGli
Z3Bob3RvMiBpcyBhIGNhbWVyYSBhY2Nlc3MgYW5kIGNvbnRyb2wgbGlicmFyeS4gVmVyc2lvbnMg
dXAgdG8KfCBhbmQgaW5jbHVkaW5nIDIuNS4zMyBoYXZlIGEgbWVtb3J5IGxlYWsgaW4gYHB0cF91
bnBhY2tfU29ueV9EUEQoKWAKfCBpbiBgY2FtbGlicy9wdHAyL3B0cC1wYWNrLmNgIChsaW5lcyA4
ODTigJM4ODUpLiBXaGVuIHByb2Nlc3NpbmcgYQp8IHNlY29uZGFyeSBlbnVtZXJhdGlvbiBsaXN0
IChpbnRyb2R1Y2VkIGluIDIwMjQrIFNvbnkgY2FtZXJhcyksIHRoZQp8IGZ1bmN0aW9uIG92ZXJ3
cml0ZXMgZHBkLT5GT1JNLkVudW0uU3VwcG9ydGVkVmFsdWUgd2l0aCBhIG5ldwp8IGNhbGxvYygp
IHdpdGhvdXQgZnJlZWluZyB0aGUgcHJldmlvdXMgYWxsb2NhdGlvbiBmcm9tIGxpbmUgODU3LiBU
aGUKfCBvcmlnaW5hbCBhcnJheSBhbmQgYW55IHN0cmluZyB2YWx1ZXMgaXQgY29udGFpbnMgYXJl
IGxlYWtlZCBvbiBldmVyeQp8IHByb3BlcnR5IGRlc2NyaXB0b3IgcGFyc2UuIENvbW1pdAp8IDQw
NGZmMDJjNzVmM2NiMjgwMTk2ZmMyNjBhNjNjNGQyNmNmMWE4ZjYgZml4ZXMgdGhlIGlzc3VlLgoK
CkNWRS0yMDI2LTQwMzM4WzRdOgp8IGxpYmdwaG90bzIgaXMgYSBjYW1lcmEgYWNjZXNzIGFuZCBj
b250cm9sIGxpYnJhcnkuIFZlcnNpb25zIHVwIHRvCnwgYW5kIGluY2x1ZGluZyAyLjUuMzMgaGF2
ZSBhbiBvdXQtb2YtYm91bmRzIHJlYWQgaW4gdGhlCnwgUFRQX0RQRkZfRW51bWVyYXRpb24gY2Fz
ZSBvZiBgcHRwX3VucGFja19Tb255X0RQRCgpYCBpbgp8IGBjYW1saWJzL3B0cDIvcHRwLXBhY2su
Y2AgKGxpbmUgODU2KS4gVGhlIGZ1bmN0aW9uIHJlYWRzIGEgMi1ieXRlCnwgZW51bWVyYXRpb24g
Y291bnQgTiB2aWEgYGR0b2gxNm8oZGF0YSwgKnBvZmZzZXQpYCB3aXRob3V0IHZlcmlmeWluZwp8
IHRoYXQgMiBieXRlcyByZW1haW4gaW4gdGhlIGJ1ZmZlci4gVGhlIHN0YW5kYXJkIGBwdHBfdW5w
YWNrX0RQRCgpYAp8IGF0IGxpbmUgNzA0IGhhcyB0aGlzIGV4YWN0IGNoZWNrLCBjb25maXJtaW5n
IHRoZSBTb255IHZhcmlhbnQKfCBvbWl0dGVkIGl0IGJ5IG92ZXJzaWdodC4gQ29tbWl0CnwgM2I5
Zjk2OTZiZTc2YWU1MWRjYTk4M2Q5ZGQ4Y2U1ODZhMjU2MTg0NSBmaXhlcyB0aGUgaXNzdWUuCgoK
Q1ZFLTIwMjYtNDAzMzlbNV06CnwgbGliZ3Bob3RvMiBpcyBhIGNhbWVyYSBhY2Nlc3MgYW5kIGNv
bnRyb2wgbGlicmFyeS4gVmVyc2lvbnMgdXAgdG8KfCBhbmQgaW5jbHVkaW5nIDIuNS4zMyBoYXZl
IGFuIG91dC1vZi1ib3VuZHMgcmVhZCBpbgp8IGBwdHBfdW5wYWNrX1NvbnlfRFBEKClgIGluIGBj
YW1saWJzL3B0cDIvcHRwLXBhY2suY2AgKGxpbmUgODQyKS4gVGhlCnwgZnVuY3Rpb24gcmVhZHMg
dGhlIEZvcm1GbGFnIGJ5dGUgdmlhIGBkdG9oOG8oZGF0YSwgKnBvZmZzZXQpYAp8IHdpdGhvdXQg
YSBwcmlvciBib3VuZHMgY2hlY2suIFRoZSBzdGFuZGFyZCBgcHRwX3VucGFja19EUEQoKWAgYXQK
fCBsaW5lcyA2ODbigJM2ODcgY29ycmVjdGx5IHZhbGlkYXRlcyBgKm9mZnNldCArIHNpemVvZih1
aW50OF90KSA+CnwgZHBkbGVuYCBiZWZvcmUgdGhpcyBzYW1lIHJlYWQsIGJ1dCB0aGUgU29ueSB2
YXJpYW50IG9taXRzIHRoaXMgY2hlY2sKfCBlbnRpcmVseS4gQ29tbWl0IDA5ZjhhOTQwYjFlNDE4
YjU2OTNmNWMxMWUzMDE2YTFhZDJjZWE2MmQgZml4ZXMgdGhlCnwgaXNzdWUuCgoKQ1ZFLTIwMjYt
NDAzNDBbNl06CnwgbGliZ3Bob3RvMiBpcyBhIGNhbWVyYSBhY2Nlc3MgYW5kIGNvbnRyb2wgbGli
cmFyeS4gVmVyc2lvbnMgdXAgdG8KfCBhbmQgaW5jbHVkaW5nIDIuNS4zMyBoYXZlIGFuIG91dC1v
Zi1ib3VuZHMgcmVhZCB2dWxuZXJhYmlsaXR5IGluCnwgYHB0cF91bnBhY2tfT0koKWAgaW4gYGNh
bWxpYnMvcHRwMi9wdHAtcGFjay5jYCAobGluZXMgNTMw4oCTNTYzKS4gVGhlCnwgZnVuY3Rpb24g
dmFsaWRhdGVzIGBsZW4gPCBQVFBfb2lfU2VxdWVuY2VOdW1iZXJgIChpLmUuLCBsZW4gPCA0OCkK
fCBidXQgc3Vic2VxdWVudGx5IGFjY2Vzc2VzIG9mZnNldHMgNDjigJM1NiwgdXAgdG8gOSBieXRl
cyBiZXlvbmQgdGhlCnwgdmFsaWRhdGVkIGJvdW5kYXJ5LCB2aWEgdGhlIFNhbXN1bmcgR2FsYXh5
IDY0LWJpdCBvYmplY3RzaXplCnwgZGV0ZWN0aW9uIGhldXJpc3RpYy4gQ29tbWl0IDdjN2Y1MTVi
Yzg4YzNkMGM0MDk4YWM5NjVkMzEzNTE4ZTBjY2JlMzMKfCBmaXhlcyB0aGUgaXNzdWUuCgoKQ1ZF
LTIwMjYtNDAzNDFbN106CnwgbGliZ3Bob3RvMiBpcyBhIGNhbWVyYSBhY2Nlc3MgYW5kIGNvbnRy
b2wgbGlicmFyeS4gSW4gdmVyc2lvbnMgdXAgdG8KfCBhbmQgaW5jbHVkaW5nIDIuNS4zMywgYW4g
b3V0IG9mIGJvdW5kIHJlYWQgaW4KfCBwdHBfdW5wYWNrX0VPU19Gb2N1c0luZm9FeCBjb3VsZCBi
ZSB1c2VkIHRvIGNyYXNoIGxpYmdwaG90bzIgd2hlbgp8IHByb2Nlc3NpbmcgaW5wdXQgZnJvbSB1
bnRydXN0ZWQgVVNCIGRldmljZXMuIENvbW1pdAp8IGMzODViMzRhZjI2MDU5NWRmYmI1ZjkzMjk1
MjZiZTUxNTg5ODU5ODcgY29udGFpbnMgYSBwYXRjaC4gTm8ga25vd24KfCB3b3JrYXJvdW5kcyBh
cmUgYXZhaWxhYmxlLgoKCklmIHlvdSBmaXggdGhlIHZ1bG5lcmFiaWxpdGllcyBwbGVhc2UgYWxz
byBtYWtlIHN1cmUgdG8gaW5jbHVkZSB0aGUKQ1ZFIChDb21tb24gVnVsbmVyYWJpbGl0aWVzICYg
RXhwb3N1cmVzKSBpZHMgaW4geW91ciBjaGFuZ2Vsb2cgZW50cnkuCgpGb3IgZnVydGhlciBpbmZv
cm1hdGlvbiBzZWU6CgpbMF0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcvdHJh
Y2tlci9DVkUtMjAyNi00MDMzMwogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/aWQ9
Q1ZFLTIwMjYtNDAzMzMKWzFdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3JnL3Ry
YWNrZXIvQ1ZFLTIwMjYtNDAzMzQKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3JkP2lk
PUNWRS0yMDI2LTQwMzM0ClsyXSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9yZy90
cmFja2VyL0NWRS0yMDI2LTQwMzM1CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29yZD9p
ZD1DVkUtMjAyNi00MDMzNQpbM10gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5vcmcv
dHJhY2tlci9DVkUtMjAyNi00MDMzNgogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNvcmQ/
aWQ9Q1ZFLTIwMjYtNDAzMzYKWzRdIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4ub3Jn
L3RyYWNrZXIvQ1ZFLTIwMjYtNDAzMzgKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVjb3Jk
P2lkPUNWRS0yMDI2LTQwMzM4Cls1XSBodHRwczovL3NlY3VyaXR5LXRyYWNrZXIuZGViaWFuLm9y
Zy90cmFja2VyL0NWRS0yMDI2LTQwMzM5CiAgICBodHRwczovL3d3dy5jdmUub3JnL0NWRVJlY29y
ZD9pZD1DVkUtMjAyNi00MDMzOQpbNl0gaHR0cHM6Ly9zZWN1cml0eS10cmFja2VyLmRlYmlhbi5v
cmcvdHJhY2tlci9DVkUtMjAyNi00MDM0MAogICAgaHR0cHM6Ly93d3cuY3ZlLm9yZy9DVkVSZWNv
cmQ/aWQ9Q1ZFLTIwMjYtNDAzNDAKWzddIGh0dHBzOi8vc2VjdXJpdHktdHJhY2tlci5kZWJpYW4u
b3JnL3RyYWNrZXIvQ1ZFLTIwMjYtNDAzNDEKICAgIGh0dHBzOi8vd3d3LmN2ZS5vcmcvQ1ZFUmVj
b3JkP2lkPUNWRS0yMDI2LTQwMzQxCgpQbGVhc2UgYWRqdXN0IHRoZSBhZmZlY3RlZCB2ZXJzaW9u
cyBpbiB0aGUgQlRTIGFzIG5lZWRlZC4KClJlZ2FyZHMsClNhbHZhdG9yZQo=
]