[Git][security-tracker-team/security-tracker][master] Reserve DLA-4411-1 for libgd2

[Guilhem Moulin (@guilhem)]

Guilhem Moulin pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7249af1f by Guilhem Moulin at 2025-12-16T08:52:04+01:00
Reserve DLA-4411-1 for libgd2

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -381014,7 +381014,6 @@ CVE-2021-40813 (A cross-site scripting (XSS) vulnerability in the "Zip content"
 CVE-2021-40812 (The GD Graphics Library (aka LibGD) through 2.3.2 has an out-of-bounds ...)
 	{DLA-3781-1}
 	- libgd2 2.3.3-1
-	[bullseye] - libgd2 <no-dsa> (Minor issue)
 	[stretch] - libgd2 <no-dsa> (Minor issue)
 	NOTE: https://github.com/libgd/libgd/issues/750#issuecomment-914872385
 	NOTE: https://github.com/libgd/libgd/commit/6f5136821be86e7068fcdf651ae9420b5d42e9a9
@@ -387937,7 +387936,6 @@ CVE-2021-38116 (Possible Elevation of Privilege Vulnerability  in iManager has b
 CVE-2021-38115 (read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) thr ...)
 	{DLA-3781-1}
 	- libgd2 2.3.3-1 (bug #991912)
-	[bullseye] - libgd2 <no-dsa> (Minor issue)
 	[stretch] - libgd2 <no-dsa> (Minor issue)
 	NOTE: https://github.com/libgd/libgd/issues/697
 	NOTE: https://github.com/libgd/libgd/commit/8b111b2b4a4842179be66db68d84dda91a246032 (gd-2.3.3~1)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[16 Dec 2025] DLA-4411-1 libgd2 - security update
+	{CVE-2021-38115 CVE-2021-40145 CVE-2021-40812}
+	[bullseye] - libgd2 2.3.0-2+deb11u1
 [16 Dec 2025] DLA-4410-1 binwalk - security update
 	{CVE-2022-4510}
 	[bullseye] - binwalk 2.3.1+dfsg1-1+deb11u1


=====================================
data/dla-needed.txt
=====================================
@@ -192,11 +192,6 @@ lemonldap-ng
   NOTE: 20251009: Backporting CVE-2024-52948 (abhijith)
   NOTE: 20251028: Still working in CVE-2024-52948 (abhijith)
 --
-libgd2 (guilhem)
-  NOTE: 20251130: Added by Front-Desk (rouca)
-  NOTE: 20251130: Fix CVE-2021-40812/CVE-2021-38115 regression from upgrade from buster (rouca)
-  NOTE: 20251130: Check also CVE in libwmf embed copy of libgd2. (rouca)
---
 libsoup2.4
   NOTE: 20250408: Added by Front-Desk (Beuc)
   NOTE: 20250427: libsoup2.4 2.72.0-2+deb11u2 (bullseye) uploaded ...



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7249af1ffe46d0c7d385737f131c0a4483f6546a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7249af1ffe46d0c7d385737f131c0a4483f6546a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20251216/7b13fc10/attachment-0001.htm>