On 4/18/26 2:30 PM, Stuart Henderson wrote:
> On 2026/04/18 14:00, Volker Schlecht wrote:
>> On 4/18/26 11:43 AM, Stuart Henderson wrote:
>>> On 2026/04/17 21:33, Volker Schlecht wrote:
>>>> FWIW: It's CVE-2025-53367
>>>>
>>>> Unbuntu has the best writeup I could find in 2 minutes:
>>>> https://ubuntu.com/security/CVE-2025-53367
>>>
>>> "This issue has been patched in version 3.5.29."
>>>
>>> I'm not seeing anything that looks particularly worrying in the
>>> 3.5.28->3.5.29 diff, and there are some other improvements we don't
>>> have in patches, want to give this a spin?
>>
>> Had that (sans AUTOCONF_VERSION) in my list of diffs for after release :-)
>>
>> Yesterday I shied back from confirming that some of the patches fixing
>> security issues and which still apply, are all covered in 3.5.29

> Everything built ok, btw.
> 
> The CVE numbers listed in the comments in old patches are listed as
> being fixed in 3.5.29, though I see the DjVuPort.{cpp,h} changes are
> not present upstream (and still carried in patches in Debian).
> 
> However if I try the PoC from https://bugzilla.redhat.com/show_bug.cgi?id=1943411
> with any of (3.5.28 with current patches, 3.5.29 as sent, 3.5.29 with
> DjVuPort patches reinstated) I get the same:
> 
> ddjvu: [1-12517] Malformed INCL chunk. Slashes, backslashes, or colons are not allowed.
> ddjvu: Unexpected End Of File.
> ddjvu: Cannot decode document.

It seems they didn't include all the patches verbatim, see comments here:

https://sourceforge.net/p/djvu/djvulibre-git/ci/cd8b5c97b27a5c1dc83046498b6ca49ad20aa9b6/