Source Package: libimager-perl (1.019+dfsg-1+b2)
Perl extension for generating 24-bit images
The following binary packages are built from this source package:
- libimager-perl
Perl extension for generating 24-bit images
Packages / Debian 12 (Bookworm) / Source / perl / libimager-perl
Known vulnerabilities
Matching against OpenFactory catalog package versions is in progress.
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2026-112202] Published: libimager-perl: CVE-2026-112202 | Medium | AffectedDetails (2)
|
| [CVE-2026-102505] Published: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of on | High(7.8) | AffectedDetails (2)
|
| [CVE-2026-102504] Published: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is siz | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-93018] Published: Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p. The palette is allocated uninitialis | Medium(5.5) | AffectedDetails (2)
|
| [CVE-2026-93019] Published: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The reader unpacks the two-byte colour map length into a signed sho | Critical(9.1) | AffectedDetails (2)
|
| [CVE-2026-73639] Published: libimager-perl: CVE-2026-73639 | Critical(9.1) | AffectedDetails (2)
|
| [CVE-2026-73638] Published: libimager-perl: CVE-2026-73638 | Medium(6.2) | AffectedDetails (2)
|
| [CVE-2026-19082] Published: Imager versions from 0.45_02 before 1.034 for Perl may expose adjacent heap bytes via strlen() over-read from zero-count ASCII EXIF entries in copy_string_tags. copy_string_tags() computes an ASCII E | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-14454] Published: Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed. Imager mishandled large EXIF IFD entry count values, treating them as negative numbers. This could lead to an at | Critical(9.8) | AffectedDetails (2)
|
| [CVE-2026-13708] Published: Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for e | High(7.5) | AffectedDetails (2)
|
| [CVE-2026-13705] Published: Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run w | High(7.1) | AffectedDetails (2)
|
| [CVE-2026-8669] Published: Imager versions through 1.030 for Perl allow a heap out of bounds (OOB) write on crafted multi-frame GIF files. Imager::File::GIF's i_readgif_multi_low allocates a single per-row buffer GifRow sized | Medium(6.5) | AffectedDetails (2)
|
| [CVE-2024-53901] Published: libimager-perl: CVE-2024-53901 | Medium | AffectedDetails (2)
|
Fixed and unaffected versions (3)
| CVE | Severity | Version impact |
|---|---|---|
| [CVE-2008-1928] Published: libimager-perl: CVE-2008-1928 | Medium | FixedDetails (2)
|
| [CVE-2007-2459] Published: libimager-perl: CVE-2007-2459 | Medium | FixedDetails (2)
|
| [CVE-2006-0053] Published: libimager-perl: CVE-2006-0053 | Medium | FixedDetails (2)
|
Last synced:
Sources
- Debian 12 (Bookworm) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-amd64:9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-amd64/Packages.xz
- Expected SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Observed SHA-256
- 9e0b5aabb2465b3d2e7a7fe27f9913846277833f7a2826e7767acccff5b588c5
- Result
- match verified
- Debian 12 (Bookworm) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
bookworm-main-arm64:2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
Repository-signature verification record- Signed-object SHA-256
- 77737fa4b34f2693e982cc9ee35736816c35a7778fc2d326cc1bbf5b301fe1aa
- Signer fingerprint
- 4CB50190207B4758A3F73A796ED0E7B82643E131
- Keyring revision
- debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017 - Tool and policy
- gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1 - Verification time
- Sep 1, 2026
Repository metadata hash linkage- Path
- main/binary-arm64/Packages.xz
- Expected SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Observed SHA-256
- 2ddb1737692e8c45c53e8d57c0ce4cd21c78c5703b830c3226b1423566a06c00
- Result
- match verified