[1.6.1] Five tests are failing with libxml2 >=2.13.5
PS: For anyone who likes to play with the issue in isolation, a minimal reproducer is this: # LANG='invalid value' python3 -c 'import locale; locale.setlocale(locale.LC_ALL, "")' Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/lib/python3.11/locale.py", line 627, in setlocale return _setlocale(category, locale) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ locale.Error: unsupported locale setting
While this seems fixed in Git, I have hit this issue with the latest release 0.21.2. Please consider cutting a new release with the fix. Thank you!
[7.9.1] CMake build system installs optipng binary without executable permissions
@thecybersandeep greetings, any updates on the topics of CVE number and/or availability of a patch? Thanks!
@bcodres thanks! At https://nvd.nist.gov/vuln/detail/CVE-2022-28506 I found… giflib_poc asan_report_giflib.png …now and I confirm your results. I think that means that we have four CVEs all being about the same thing… CVE-2022-28506 CVE-2023-48161 CVE-2024-45993 CVE-2025-31344 …, that the previous fix was incomplete, and that giflib-5.2.2-cve-2025-31344.patch completes it. Thanks for your help! Best, Sebastian
I checked Git masteragainst the two cases just now. The first case — command ./gif2rgb -s — I confirm as fixed (by commit 38e39296dea689c0ca972f6abb2e6cc180dfbd8f that is attributed to issue 153). The second case — command yes '' | ./gif2rgb -s 1 2 — fails with the exact same LeakSanitizer output on master of today (at 8bed392c280ad2c237e8bf1beca6f8f68f893e87).
@bcodres @mmuzila since related commit 368f28c0034ecfb6dd4b3412af4cc589a56e0611 says CVE-2022-28506 rather than CVE-2024-45993 I assume that CVE-2022-28506 is the same also?