-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5960-1                   security@debian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
July 07, 2025                         https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : djvulibre
CVE ID         : CVE-2025-53367
Debian Bug     : 1108729

Antonio Morales discovered an out-of-bounds write in the
MMRDecoder::scanruns method in djvulibre, a library and set of tools to
handle documents in the DjVu format, which may result in the execution
of arbitrary code if a specially crafted document is processed.

For the stable distribution (bookworm), this problem has been fixed in
version 3.5.28-2.1~deb12u1.

We recommend that you upgrade your djvulibre packages.

For the detailed security status of djvulibre please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/djvulibre

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmhsJHFfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND
z0RezQ/9GRPD002gQMFD7xxvrVTe6sZuBzazZ3w8TrpxyeserTejGVzo5eGaNahz
EBx5IykonFN6IpHn6uwwGBY4aRmhxs09M9L1c4nwS9gWy2boO3Bx+DTW/2aYPNNU
QdNmXFTgr2ZRxueVxTe6brs7snKEqVD18exBQNpux+8Llnha73RZUXwdphcBQDVK
nvCTsy6tWmbhcvKvNMPQeW+B4+0l6qcGwhd6DnrnOdZx0FYzo5K5mE20R6orEkrp
R55y0q/C6VAQ5kz2+y6/7dY86tpbY4MR/Qw4n4/2aqhBmK+ckG21WMglRlBeSwjl
sc9E4ryx05W31AGwBON9uEF/jpp1uRAkce9wX1rsB8kfiOatSCTt1JYRtkp2ydTn
QOw5yw3A1jeoOQKNMh91LRUY2OBmW3VTi9P0zItuFuPjUA3nfOzGu9KtWqRh2A3U
IivYJgYSEs1sqY7qIpuODgag3ydSgw8X0b9eNyMCLW9oQqx6pOzS2fgRFBA8TJC8
0aiwMakXf3paLzbvq1X+U2LXsTR8EUw/P+zEN8muPSvE7orsM7SdgCCsLP4Bam9M
bBrTjPHkZDkE7HeCDWg8jbkRdIXoUuq9kz/zVb/0a93Pp00iP6OqnkKtVqDS7Fxj
oIH22qFeqpSYTgOp5Cmj66tkGu6w1WbLG6I2UdYyLRyEzjo0VRA=
=/bAB
-----END PGP SIGNATURE-----