Hi,

The following vulnerabilities were published for golang-golang-x-image.

CVE-2026-46601[0]:
| The webp decoder can panic when processing a VP8 chunk with
| dimensions that do not match the canvas size.


CVE-2026-46602[1]:
| The TIFF decoder does not set a limit on the size of tiles in tiled
| images, permitting a malicious or corrupt image containing a very
| large tile to cause unbounded memory consumption.


CVE-2026-46604[2]:
| The TIFF decoder can panic when decoding an invalid image with an
| out-of-bounds strip offset.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-46601
https://www.cve.org/CVERecord?id=CVE-2026-46601
[1] https://security-tracker.debian.org/tracker/CVE-2026-46602
https://www.cve.org/CVERecord?id=CVE-2026-46602
[2] https://security-tracker.debian.org/tracker/CVE-2026-46604
https://www.cve.org/CVERecord?id=CVE-2026-46604

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
golang-golang-x-image, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1140919@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Josefsson <simon@josefsson.org> (supplier of updated golang-golang-x-image package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 21 Aug 2026 22:25:28 +0200
Source: golang-golang-x-image
Architecture: source
Version: 0.45.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Simon Josefsson <simon@josefsson.org>
Closes: 1140919 1144496
Changes:
 golang-golang-x-image (0.45.0-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream
     - CVE-2026-46601 CVE-2026-46602 CVE-2026-46604 (Closes: #1140919)
     - CVE-2026-46603 (Closes: #1144496)
   * Add B-D/D on x-sys
   * Use compat 14
Checksums-Sha1:
 aac9564d3f3455b883fd7ab300332da108f61174 2561 golang-golang-x-image_0.45.0-1.dsc
 3082680536bb392b010345a58dd67eb04162538e 3406652 golang-golang-x-image_0.45.0.orig.tar.xz
 1616bfc7ba45d800082402fe10943e2e0a05c49b 6380 golang-golang-x-image_0.45.0-1.debian.tar.xz
 10e6835fe8bce588172833fa1b83a8375548ef8c 6137656 golang-golang-x-image_0.45.0-1.git.tar.xz
 edd96f55e9e37fcf8920534ed982a07ec902a0ed 17720 golang-golang-x-image_0.45.0-1_source.buildinfo
Checksums-Sha256:
 a388dda115fa4c43d8c88b1b6877248273bc0050e7313c2743af5011dad18f37 2561 golang-golang-x-image_0.45.0-1.dsc
 259db91352c2e207701c22d1ad2b4c3329558b44fb23e83e6546ab38135a377f 3406652 golang-golang-x-image_0.45.0.orig.tar.xz
 fcab3184d87300cfb0f0e650e27e8db98df872c5785647b89dfc5adc1319625e 6380 golang-golang-x-image_0.45.0-1.debian.tar.xz
 77bd02c06c664c5766c60350ac14039f3b959d7fbf0b1bfad95f87316394c1ab 6137656 golang-golang-x-image_0.45.0-1.git.tar.xz
 18cec03e926cf67358e65eb5e4079242dd2bc8aa069341886cdaec61c250fb88 17720 golang-golang-x-image_0.45.0-1_source.buildinfo
Files:
 c1812109e51a59f00fc8255eeb806d78 2561 golang optional golang-golang-x-image_0.45.0-1.dsc
 144819de60a49c7ef23e2ceb3da8ad0b 3406652 golang optional golang-golang-x-image_0.45.0.orig.tar.xz
 e236e1537ddc4bbe0e68ec38b52d1ff8 6380 golang optional golang-golang-x-image_0.45.0-1.debian.tar.xz
 0be50675d5701c41132d6e8d6c35e065 6137656 golang None golang-golang-x-image_0.45.0-1.git.tar.xz
 2927c5976358be4efceb50cb4fc05786 17720 golang optional golang-golang-x-image_0.45.0-1_source.buildinfo
Git-Tag-Info: tag=90bb3352a5652ad291df609e5952e2b55911469e fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <simon@josefsson.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqIumcACgkQYG0ITkaD
wHlMRA//dmgsGZAMw4+Ilc3/NoKa0bs6Yzkk6bZW4w/q6lbLDiIpgr66c9o2eav6
Dr7+3Zz3pOwtvvTTHhrum1OW5yCQ2TY6AXo/DKUjVxZZUQNookJZpbAmsVjeQ/Bf
mwaUSnDdwHZgBGhO/4niiybcFe1zKlloyh1ier8wkIjrrBve5oxAAvg4bhXS57yl
Pnblf4+FD1Paai8TtP5/RaafPeIB1T06sWiQs/2q3OLlFEgyMu3MLUgz5lZt5D1A
u9tUTMzxd2kUG7gmb1aan9m8eklOoZtM3Ek06yoTmWvxhnG2dntw/ibCJek3fyQ2
WydY5MbbM4B0bRRqd9XTA27/hB2vF3+P00eQmNouRHvHCil5rIHz+4DQ8rhJnJoS
KxAZE6tyZKtXDYGTVJt9pyV0G7UCzYt/oq4Qd5+ImSeW+T3rEqS0X+0H5aSsbnu+
7TxFpSkkwrxyJEpVGS3jE87ibmlEdhj9pn6FzLUrw5mzp8l6JcN7hZYCPumliH0L
cQuBJaoqz2UCmPeNgaN4aVSUEg9xOr+7WypWbwLj5r7rW/2jpkGCIxIuKFf0+Ie6
lLNG8xM0g1zb7RktmSymUbAS53JBxtheYGOrKF87onr3FI0LCi9kh4dyEje8T0Tc
paEz72c5AoiA8yGKvY4mU7GFODCiXwI6ii95FIiHjHxv4j85zoo=
=whfx
-----END PGP SIGNATURE-----