Hi,

It looks like freeimage is dead upstream (last upstream release in 2018, upstream
maintainer email bounces[1]). With many open security issues[2], I believe freeimage
is not in a shape to be released in Debian, and should be removed.

This bug at RC severity should kick it out of testing for the time being, and if
nobody is willing to take over it and look at the security issues, it should
eventually be dropped from sid as well.

Cheers,
Emilio

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1082375
[2] https://security-tracker.debian.org/tracker/source-package/freeimage

Sigh. I'm upstream for a project that uses libfreeimage. Does anybody
have any recommendations for a replacement? Preferably with a C (not
C++) API?

Thanks for keeping tabs on this.

Sigh. I'm upstream for a project that uses libfreeimage. Does anybody
have any recommendations for a replacement? Preferably with a C (not
C++) API?

Thanks for keeping tabs on this.

There are quite a few reverse dependencies, I guess those needs to be
tackled first.


$ ssh mirror.ftp-master.debian.org "dak rm -Rn freeimage"
Will remove the following packages from unstable:

 freeimage | 3.18.0+ds2-11 | source
libfreeimage-dev | 3.18.0+ds2-11 | amd64, arm64, armhf, i386, ppc64el,
riscv64, s390x
libfreeimage3 | 3.18.0+ds2-11 | amd64, arm64, armhf, i386, ppc64el,
riscv64, s390x
libfreeimageplus-dev | 3.18.0+ds2-11 | amd64, arm64, armhf, i386,
ppc64el, riscv64, s390x
libfreeimageplus-doc | 3.18.0+ds2-11 | all
libfreeimageplus3 | 3.18.0+ds2-11 | amd64, arm64, armhf, i386, ppc64el,
riscv64, s390x

Maintainer: Debian Science Maintainers
<debian-science-maintainers@lists.alioth.debian.org>
------------------- Reason -------------------

----------------------------------------------

Checking reverse dependencies...
# Broken Depends:
apriltag: apriltag
colmap: colmap [amd64 arm64 i386 ppc64el riscv64 s390x]
deepin-album: deepin-album
deepin-image-viewer: deepin-image-viewer
forge: libforge1t64
gl-image-display: libgl-image-display0
libkysdk-applications: libkysdk-applications
mrcal: libmrcal4
nvidia-cuda-samples/contrib: nvidia-cuda-samples
ogre-1.12: libogre1.12.10t64
ogre-1.9: libogre-1.9.0t64
opencascade: libocct-ivtk-dev
             libocct-visualization-7.8
             libocct-visualization-7.9
             libocct-visualization-dev
perceptualdiff: perceptualdiff
photoqt: photoqt [amd64 arm64 armhf ppc64el riscv64 s390x]
posterazor: posterazor
ruby-image-science: ruby-image-science

# Broken Build-Depends:
apriltag: libfreeimage-dev
colmap: libfreeimage-dev
deepin-album: libfreeimage-dev
deepin-image-viewer: libfreeimage-dev
dtkgui: libfreeimage-dev
forge: libfreeimage-dev
gl-image-display: libfreeimage-dev
imv: libfreeimage-dev
kew: libfreeimage-dev
libkysdk-applications: libfreeimage-dev
                       libfreeimageplus-dev
mrcal: libfreeimage-dev
ogre-1.12: libfreeimage-dev
ogre-1.9: libfreeimage-dev
opencascade: libfreeimage-dev
perceptualdiff: libfreeimage-dev
photoqt: libfreeimageplus-dev
posterazor: libfreeimage-dev
ruby-image-science: libfreeimage-dev
xtrkcad: libfreeimage-dev

Dependency problem found.
2018, upstream
believe freeimage
being, and if
should
https://security-tracker.debian.org/tracker/source-package/freeimage

Possibly switching to this fork might help down the road: https://github.com/agruzdev/FreeImageRe

/me got also several mails about future removals, noteable opencascade
which would drop a lot of software I'm caring about (e.g freecad,
slic3r-prusa etc.)

It looks like that there has been a fork of freeimage,
https://github.com/agruzdev/FreeImageRe that might be able to close the
gap a bit, there are recent commits and also a MR targeting a few of
the open CVEs.

(As science-team member, I offer to help to get the package updated.)

I am not a team member, just an observation:

Closest to being a maintainer inside the team would be Anton Gladky
(added to Cc) who hasn't touched the package for 3.5 years.

I'd guess the relevant question is now whether your "offer to help to
get the package updated" implies that you are willing to become the
maintainer of the package inside the team.

cu
Adrian

To ensure everyone is on the same page:
- ogre-1.12 1.12.10+dfsg2-8 no longer build-depends on libfreeimage-dev
- ogre-14 is making its way through NEW, without a build-dep on libfreeimage-dev

So OGRE is no longer reliant on FreeImage,
be it the unmaintained original or the active fork.

With this e-mail I am proposing a much shorter CC list that should focus
on people who still need a FreeImage replacement in the archive.
(you can omit me too, my interest about FreeImage was limited to OGRE)

Hello all,

I will try to have a look and maybe upload to experimental the proposed
fork.
Let us see how it works.

Best regards

Anton


Am Sa., 17. Jan. 2026 um 16:13 Uhr schrieb Antoine Le Gonidec <
vv221@debian.org>:

We believe that the bug you reported is fixed in the latest version of
opencascade, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1121912@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tobias Frost <tobi@debian.org> (supplier of updated opencascade package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 01 Feb 2026 12:27:02 +0100
Source: opencascade
Architecture: source
Version: 7.9.2+dfsg-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Tobias Frost <tobi@debian.org>
Closes: 1121912
Changes:
 opencascade (7.9.2+dfsg-4) unstable; urgency=medium
 .
   * Build without freeimage. (Closes: #1121912)
Checksums-Sha1:
 a5409ccfabd39cc820547acd80f48192619a808d 3633 opencascade_7.9.2+dfsg-4.dsc
 63cf5fef72e721d774575be780be3f6b5422a0b2 36498344 opencascade_7.9.2+dfsg.orig.tar.xz
 627b5ef79f92a5a37697a0e7b4726bde1c35f798 67076 opencascade_7.9.2+dfsg-4.debian.tar.xz
 86e2506668ec500f474bfb49ad48325fb91ed82e 25924 opencascade_7.9.2+dfsg-4_source.buildinfo
Checksums-Sha256:
 48ad45cac616163d3e64a9bfd1cc490b74b34db2279160c7b798b7fb6028d3fe 3633 opencascade_7.9.2+dfsg-4.dsc
 f6e272b6aaa14743a611eb4b8d7affa98986cdcaa60f5a91ca7ac46b177b7181 36498344 opencascade_7.9.2+dfsg.orig.tar.xz
 bb2225b558c1dfdf0b8b29a09334f34c59cc116e871e1e65ff3402db41637393 67076 opencascade_7.9.2+dfsg-4.debian.tar.xz
 12fe5dae51f5d7d866686dddc59cebd677d13d2ff329811ac0450ad44c6433af 25924 opencascade_7.9.2+dfsg-4_source.buildinfo
Files:
 2c475b21f13e90478bc5b3bf8fd6054f 3633 science optional opencascade_7.9.2+dfsg-4.dsc
 eb95eb1d90d8e9ec64efa728c4991f26 36498344 science optional opencascade_7.9.2+dfsg.orig.tar.xz
 845b02625b7c391386f0ecc1c1bfc054 67076 science optional opencascade_7.9.2+dfsg-4.debian.tar.xz
 51177fdc2fdc1006ae1acc8eb1931697 25924 science optional opencascade_7.9.2+dfsg-4_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAml/WHIACgkQkWT6HRe9
XTb92xAA3FwJRAXPOPho0PiH7+2ONm9+i5K6a5MZ9NYW8LVrgjiYhjcRe5iQ0TJq
D11ZMVUSKsO9tOlY7umUr2T5+aCrLmhK/GXi1skoocJfZnYT9JT3CZzmGNZxKBb+
HKaoMaT2KnkfseYr8CKpznAniCkQ+z52/5ZeaPOBT5qu83SpD0w5ybD4s7J4ucu0
EOLgdAplDzbQxuh53QquFYm5KGU6Y82UD3a0PeUGj2vFBIelf6AekTtGlFtHJRjv
6HWMod3JihcXDS2FQMBJGE6ZymA0dLfNDZG5QYjaNLciT9rO5ic+XkSgjVu+s6XU
1GYR04eFbCKhkYLZcO5/E1jaeSVyWeZ4m5KQoAxZsUw0QAeCvp8YL259521M8GWl
iivmFiVosdIqKOBxI+l1pE0gwyxteuSy7DJcK+BbxiH6XWxmljt5UGa8VRQ+4/sh
G3pFRaCqyoJNtsaxzoNkY+Qj+vhtCbkN8GWIAvDphtJeJptmeXHQmGe/1t/nNheE
xgFDgO5loBgXmEEH3InqeMD6Vjpis0s4uZ2ti5C84aL5GQ6aSd5Wfqc8eXu+YRS0
1elxvuAMnM5oWr7ouVVrT6F+5yt8IV0z30LMYCOY0cfZvtsDAteLzNfqjZ34ZapU
WwFzdtOmqwEO4SG7yqrqWcmQTStnoc1QFyeT/mdIyDA/Ic3dlmQ=
=gcAC
-----END PGP SIGNATURE-----

Hello,

Bug #1121912 in opencascade reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/science-team/opencascade/-/commit/fdd9a50da7030cfe500bc7733482a73910a3dbc5

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1121912

Hello,

Bug #1121912 in opencascade reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/science-team/opencascade/-/commit/f671ca3ee09f1b15c356a4c94ab5be7f7c196d36

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1121912

On 2026-01-17 Anton Gladky <gladk@debian.org> wrote:
[freeimage]

Hello Antony,

is there anything I can help you with?

cu Andreas

We believe that the bug you reported is fixed in the latest version of
freeimage, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1121912@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Anton Gladky <gladk@debian.org> (supplier of updated freeimage package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 17 Oct 2026 19:26:24 +0200
Source: freeimage
Binary: libfreeimage-dev libfreeimage4 libfreeimage4-dbgsym libfreeimageplus-dev libfreeimageplus4 libfreeimageplus4-dbgsym
Architecture: source amd64
Version: 4.2.1+ds-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Anton Gladky <gladk@debian.org>
Description:
 libfreeimage-dev - Support library for graphics image formats (development files)
 libfreeimage4 - Support library for graphics image formats (library)
 libfreeimageplus-dev - C++ wrappers for FreeImage (development files)
 libfreeimageplus4 - C++ wrappers for freeimage (library)
Closes: 1055305 1059152 1060691 1060862 1068718 1082375 1121912 1138102
Changes:
 freeimage (4.2.1+ds-1~exp1) experimental; urgency=medium
 .
   * New upstream release: switch to FreeImageRe 4.2.1, a maintained fork
     (Closes: #1121912). FreeImage itself is dead upstream with open
     security issues; FreeImageRe carries CVE fixes and active
     maintenance.
   * CMake-based build, replacing the old Makefile-based one.
   * SONAME bump (libfreeimage3 -> libfreeimage4, libfreeimageplus3 ->
     libfreeimageplus4): abidiff against the previous upload found a
     removed function and a changed signature.
   * FreeImagePlus ported forward from FreeImage 3.18 (upstream dropped
     it), with the changes listed in Wrapper/FreeImagePlus/PORTING.txt.
     fipImage::getHistogram() keeps the FreeImage 3.18 implementation.
   * Vendor a pinned Yato copy (a header-only FreeImageRe dependency with
     no Debian package).
   * Build against the system jxrlib; the embedded copy is removed from
     the orig tarball.
   * Load libheif by its SONAME, so HEIF/AVIF support works without
     libheif-dev installed, and recommend libheif1.
   * Build the library with the colour order the installed header uses on
     the host architecture (BGR on little-endian, RGB on big-endian).
   * Drop libfreeimageplus-doc for now (doxygen config not ported yet).
   * debian/copyright, debian/patches: rewritten for the new source.
     Upstream-Contact now points to the FreeImageRe project.
     (Closes: #1082375)
   * The switch to FreeImageRe supersedes packaging FreeImage r1909.
     (Closes: #1068718)
   * autopkgtest: enable the per-format upstream tests and add a
     FreeImagePlus test.
   * debian/watch: convert to version 5 and track upstream releases.
   * Security fixes included in FreeImageRe:
     - CVE-2020-24292: ICO load() buffer overflow.
     - CVE-2020-24293, CVE-2020-24294, CVE-2020-24295: PSD plugin
       buffer overflows. (Closes: #1059152)
     - CVE-2021-40266: TIFF ReadPalette NULL pointer dereference.
       (Closes: #1055305)
     - CVE-2023-47992: _MemoryReadProc integer overflow.
     - CVE-2023-47993: Exif ReadInt32 out-of-bounds read.
     - CVE-2023-47994: BMP LoadPixelDataRLE4 integer overflow.
     - CVE-2023-47996: Exif jpeg_read_exif_dir integer overflow.
     - CVE-2023-47997: FreeImage_AllocateBitmap infinite loop.
       (Closes: #1060691)
     - CVE-2023-47995: FreeImage_AllocateBitmap excessive allocation.
       (Closes: #1060862)
     - CVE-2024-28579, CVE-2024-28582: HDR plugin memory errors.
   * Remove Ghislain Antony Vaillant from Uploaders. (Closes: #1138102)
Checksums-Sha1:
 25792cb2b9fc436ed323fb63f50f78523ee44f3d 2497 freeimage_4.2.1+ds-1~exp1.dsc
 4ae20a22185c1271148e0b41b5f9c7ec0f24fc39 2389796 freeimage_4.2.1+ds.orig.tar.xz
 bf59f99d124f4adde428015f9df97fd74915d74a 24616 freeimage_4.2.1+ds-1~exp1.debian.tar.xz
 05432d374a78d120b13cb2a7db1608c3a4984a51 9861 freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
 aef64501651fe98a66165665b89498446b1801b2 56948 libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
 1129e8bd5c8f1645b52ba23460073122edcef5c2 2989772 libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 bbaf282015c84d5fb038a4c2ded3444f9dcc4d93 422808 libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
 c9e9d4e42a6e4a182ef1a80e2e897fc48ab126ba 44780 libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
 db83a7f547377db9be7cb4004075211fc4e29548 42888 libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 8f2cbc9454e61c69d03402d4fbab430251122685 46584 libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
Checksums-Sha256:
 cc555c504d3748e21058be4088702812aec99d3eeacc72dc2cc0bbefb3f66bf7 2497 freeimage_4.2.1+ds-1~exp1.dsc
 bfb3309bd0601d438ace8fe483187dfa77ab132389b6e055c63c9c657a5c98a6 2389796 freeimage_4.2.1+ds.orig.tar.xz
 a41ffa93e0028226cf2154153848cb48e1d56c2b4b7016f838abe0ad83ac1533 24616 freeimage_4.2.1+ds-1~exp1.debian.tar.xz
 d6a5db8f0817fdb661c4c7081cc43a8ee986fcd3006925b9b947270f93adda75 9861 freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
 8eb5d82b5d7b78c50d47e44eedcc86ec6ff403db10ba89a12ca94e1bb90ed268 56948 libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
 6b91d049bf106575b699fa033f1a45f42057b3048f5f569c43546d2dec5c9abe 2989772 libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 7fb84f7815dd12476202f9166b447eaa7f93292f4bf0faa9da57b994d42fe69a 422808 libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
 7aac4c8b66922db5e62d65bb1c36785b8fb8a7ac2c5e20e487d4d95eb7259f21 44780 libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
 9dd72889fbaea1d4f7f3d154534150804a33a6764697d1ca52e3d60f6f876d5a 42888 libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 144be88ca8e4a558d54424128c25a865b34a6568e8685fb60b29eb3c67254ca5 46584 libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
Files:
 d97762914cf6ecaa27d8471f04fdec3b 2497 libs optional freeimage_4.2.1+ds-1~exp1.dsc
 c307bd18bc4f878384871f2d34bcc40d 2389796 libs optional freeimage_4.2.1+ds.orig.tar.xz
 3beebefad9e4d0649564f6c5047c7553 24616 libs optional freeimage_4.2.1+ds-1~exp1.debian.tar.xz
 4c8bbc302d13b90c078183244c04322e 9861 libs optional freeimage_4.2.1+ds-1~exp1_amd64.buildinfo
 1350ed28f47858740188da4f8ad8f622 56948 libdevel optional libfreeimage-dev_4.2.1+ds-1~exp1_amd64.deb
 0d787fc0aa85e413696e2eaee4d990f7 2989772 debug optional libfreeimage4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 78992a1f1a40eee5aaf6482ec2e1c4ee 422808 libs optional libfreeimage4_4.2.1+ds-1~exp1_amd64.deb
 32cab240df7ea1ef7d15d8f33f9aa53b 44780 libdevel optional libfreeimageplus-dev_4.2.1+ds-1~exp1_amd64.deb
 f45c407eae5a3ae638851f6b1ed6af5b 42888 debug optional libfreeimageplus4-dbgsym_4.2.1+ds-1~exp1_amd64.deb
 10359d3f90c1e7cce4d9a7939ed8d02a 46584 libs optional libfreeimageplus4_4.2.1+ds-1~exp1_amd64.deb
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEu71F6oGKuG/2fnKF0+Fzg8+n/wYFAmrTsCIRHGdsYWRrQGRl
Ymlhbi5vcmcACgkQ0+Fzg8+n/wZC7g/+KTszaHoQ2qW2xlkheNCJnEXM3J7wKwon
iqHdLdPlKvTGtBSXL+n1MuEKV7mkiu9Q2UjXbBh7LLK99pBm4NOKBDQ+6dQGUh7P
lsCraMBSOFwhRcDaUMd0DVk02gDJdB6WOQw8gYFJ7s7BAqP5ewpjPKHcnMbrH8+2
7/cZdKbdf2xwsq4r/HAEJywHu5rvhcj09Hlci0yQ+Xou4yo55boy/U1hJ7f4YXGE
6vzAj03ncjpabpYPOslLPIFOqQeLu+8D4Y4pUV1JjFi2bz4KLVM7aRhL2MDGJykW
7ZQAfORb+TWj42BvGlX1eJQ1YkGSEPRP9VTUME3vLc1ZA+jmWD2QPUX9WewjPbLg
yBT1DdOHOa4Ih4clv57jNd5iyE+kpYO0uyywJlUMahX51AieI3O81aEjDC5T1+vc
RP9p0puwK+VRJ6m7tEl+KsU2hYhbsxvFnOXHtsBVUcLdvwyA5oKpEHQfhPbsCMqD
+/GCqoHVda0PWGDdpCF8hJE6dgfU831Pdpm9kkGExevmJl4qD/YRe00i5E2+niy5
wzhGIlze1PvmbTnNp3jFbhPMfEyom45eiIP9s2zRnj+Kf1hMRVAFpQIijm0W4Yqp
lio+IiWmFf4+o15zP4794NiJ98sJw3crCczvPu45Alz6A01QD2seqWhvvMKcFKYa
21SlrT2Jkk4=
=jxyq
-----END PGP SIGNATURE-----