Packages / Debian 13 (Trixie) / Source / introspection / vips

Source Package: vips (8.16.1-1+deb13u2)

GObject introspection data for VIPS

The following binary packages are built from this source package:

gir1.2-vips-8.0
GObject introspection data for VIPS
libvips42t64
image processing system good for very large ones
libvips-dev
image processing system good for very large ones (dev)
libvips-doc
image processing system good for very large ones (doc)
libvips-tools
image processing system good for very large ones (tools)

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-88360] Published: Sep 24, 2026, 12:00:00 AM UTC libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of four bytes, the mmap-based loader can expose pixel da	High(7.5)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13
[CVE-2026-70654] Published: Aug 20, 2026, 9:07:25 PM UTC libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, applications that define unusual custom libvips sources and use them to process untrusted uncompressed PPM im	Medium(5.8)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-70653] Published: Aug 20, 2026, 9:06:26 PM UTC libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, the old-style Radiance RLE decoder in libvips/foreign/radiance.c can process a repeat marker at the beginning	Medium(4.8)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-70651] Published: Aug 20, 2026, 9:05:38 PM UTC libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, libvips built without libtiff support but with ImageMagick support can overflow the combined frame height whi	Medium(6.9)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-69242] Published: Aug 20, 2026, 9:02:58 PM UTC libvips is a fast image processing library with low memory needs. Prior to version 8.18.3, a crafted many-band TIFF processed through VipsForeignLoadTiff can evade scanline validation in libvips/iofun	High(8.4)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-35591] Published: Jul 20, 2026, 4:24:50 PM UTC libvips is a fast image processing library with low memory needs. The `tiffload` operation in libvips versions before and including 8.18.1 could incorrectly determine the number of channels in a JPEG	High(7.3)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-35590] Published: Jul 20, 2026, 4:23:33 PM UTC libvips is a fast image processing library with low memory needs. The EXIF decoder within libvips versions before and including 8.18.1 was not verifying the range of EXIF tag groups before passing dat	Medium(6.8)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-33328] Published: Jul 20, 2026, 4:22:22 PM UTC libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the `gifload` operation could incorrectly determine dimensions leading to a	Medium(6.8)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-33327] Published: Jul 20, 2026, 4:21:16 PM UTC libvips is a fast image processing library with low memory needs. The `vipsload` operation in versions before and including 8.18.0 could incorrectly determine image dimensions leading to an integer ov	High(7.3)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` nvd · vips · debian · 13
[CVE-2026-6491] Published: Apr 17, 2026, 1:45:11 PM UTC A security vulnerability has been detected in libvips up to 8.18.2. The affected element is the function im_minpos_vec of the file libvips/deprecated/vips7compat.c of the component nip2 Handler. Such	Medium(6.1)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected nvd · vips · debian · 13
[CVE-2025-59933] Published: Sep 29, 2025, 10:04:09 PM UTC vips: CVE-2025-59933	Medium(6.8)	Affected Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Affected · Fixed: `8.16.1-1+deb13u2` dsa · vips · debian · 13
[CVE-2021-27847] Published: Jul 15, 2021, 4:15:00 PM UTC vips: CVE-2021-27847	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:55:27 PM UTC Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.8.3-1` dsa · vips · debian · 13
[CVE-2020-20739] Published: Nov 20, 2020, 7:15:00 PM UTC vips: CVE-2020-20739	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:48:57 PM UTC Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.9.0-1` dsa · vips · debian · 13
[CVE-2019-6976] Published: Jan 26, 2019, 11:29:00 PM UTC vips: CVE-2019-6976	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:44:53 PM UTC Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.7.4-1` dsa · vips · debian · 13
[CVE-2018-7998] Published: Mar 9, 2018, 7:29:00 PM UTC vips: CVE-2018-7998	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:37:49 PM UTC Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.4.5-2` dsa · vips · debian · 13
[CVE-2010-3364] Published: Oct 20, 2010, 6:00:04 PM UTC vips: CVE-2010-3364	Low	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:05:02 PM UTC Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `7.14.5-2` dsa · vips · debian · 13

Fixed and unaffected versions (4)

CVE	Severity	Version impact
[CVE-2026-3284] Published: Feb 27, 2026, 3:02:09 AM UTC A vulnerability was found in libvips 8.19.0. Impacted is the function vips_extract_area_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_area results in integer	Medium(5.5)	Fixed Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13
[CVE-2026-3283] Published: Feb 27, 2026, 2:32:12 AM UTC A vulnerability has been found in libvips 8.19.0. This issue affects the function vips_extract_band_build of the file libvips/conversion/extract.c. The manipulation of the argument extract_band leads	Low(3.3)	Fixed Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13
[CVE-2026-3282] Published: Feb 27, 2026, 2:32:09 AM UTC A flaw has been found in libvips 8.19.0. This vulnerability affects the function vips_unpremultiply_build of the file libvips/conversion/unpremultiply.c. Executing a manipulation of the argument alpha	Low(3.3)	Fixed Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13
[CVE-2026-3281] Published: Feb 27, 2026, 2:02:10 AM UTC A vulnerability was detected in libvips 8.19.0. This affects the function vips_bandrank_build of the file libvips/conversion/bandrank.c. Performing a manipulation of the argument index results in heap	Medium(6.6)	Fixed Details (10) `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · all · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · amd64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13 `8.16.1-1+deb13u1` · arm64 · trixie Fixed · Fixed: `8.16.1-1+deb13u1` nvd · vips · debian · 13

[Next results]

Last synced: Oct 28, 2026, 2:55:43 AM UTC

[CVE catalog]

Sources

Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Observed SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Result
match verified
Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Observed SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Result
match verified
Debian SecurityOct 27, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-amd64:cbc4bef76e3c37ead4980674b88d8b1cd971e3ef018f45488da6b988f55946f3
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/trixie-security/InRelease
Signed-object SHA-256
e7fa27c6347540f93dc90c68b4361e02148fc15bdd516a816d6f56449c3c3baf
Signer fingerprint
B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Oct 28, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
cbc4bef76e3c37ead4980674b88d8b1cd971e3ef018f45488da6b988f55946f3
Observed SHA-256
cbc4bef76e3c37ead4980674b88d8b1cd971e3ef018f45488da6b988f55946f3
Result
match verified