Debian Patches

Status for inkscape/1.2.2-2+deb12u1

Patch Description Author Forwarded Bugs Origin Last update
skip-test-librevenge.patch skip all the librevenge comparison tests I had a quick look and it seems to me that the produced files look identical to my eye but `compare` claims they are not.
Probably this started with librevenge 0.0.5, as in december 2022 these tests were fine, to be further investigated.		 Mattia Rizzolo <mattia@debian.org> no 2023-01-10
skip-test-glyph-big-endian.patch skip this test that fail on s390x, ppc64, sparc64 Here the failure is real, but let's just ignore it since it only concerns BE Mattia Rizzolo <mattia@debian.org> not-needed upstream 2023-01-10
skip-test-use.patch skip test-use According to upstream, this is a false positive Mattia Rizzolo <mattia@debian.org> not-needed upstream 2023-01-10
timeout-test-lpe.patch increaste timeout for this test https://buildd.debian.org/status/fetch.php?pkg=inkscape&arch=mipsel&ver=1.2.2-1&stamp=1671553799&raw=0
https://buildd.debian.org/status/fetch.php?pkg=inkscape&arch=mips64el&ver=1.2.2-1&stamp=1671566710&raw=0
In the past it took ~60 seconds, but suddenly it timeouted after 180.
Let's try increasing this.		 Mattia Rizzolo <mattia@debian.org> not-needed 2022-12-21
python3.patch Don't consider `python` a valid python[23]? interpreter. Just to be safe, don't even try to look it up.
Should be safe to drop the patch once python2 is not around anymore.		 Mattia Rizzolo <mattia@debian.org> not-needed 2020-05-07
skip-tests.patch skip tests that are currently failing not-needed upstream
test-output-page.patch partial patch from upstream to ease the next patch no upstream, 699da8c402e8fce05b08021d1bfff779499d711c 2022-12-18
fuzzy_tests.patch [PATCH 1/2] Fuzzy bitmap comparison in CLI rendering tests
Enhance the CLI testing framework with the ability to compare raster
output (either produced by Inkscape or converted from a vector format
with ImageMagick) using the L2 distance in the image space. Each such
"fuzzy" test can set a maximum allowed percentage difference between
the two compared images. This technique is applied to four multipage
output tests, fixing the spurious failures due to subtle differences
in rasterization artifacts between platforms and library versions.

Fixes https://gitlab.com/inkscape/inbox/-/issues/7304		 Rafael Siejakowski <rs@rs-math.net> no 2022-07-10
skip-test-lpe.patch skip test 31 - test_lpe64 this fails on ard64, s390x, ppc64el not-needed upstream 2022-12-20
skip-test-8_png_check_output.patch skip test 241 - cli_export-png-color-mode-gray-8_png_check_output this fails on arm64, s390x, ppc64el
allegedly a precision error in the gamma		 not-needed upstream 2022-12-20
CVE-2026-4980.patch Limit XInclude processing to shortcut keys files.
This patch fixes a security vulnerability when using the batch or
command-line processing features of Inkscape. The flaw allows an author
of a malicious SVG file to trivially specify the href of a local or
remote file to bring in as a `<text>` body or other element. The exact impact
to security will depend a lot on the context in which inkscape is being
run, but in the worst-case scenario this can lead to leaking of private
information, credentials, etc. Formally, this is a Local File Inclusion
(LFI) and Server Side Request Forgery (SSRF) vulnerability vector.

XInclude processing is retained for shortcut "keys" files _only_, which
seems to have been the original intent behind the commit that introduced
the vulnerability:
https://gitlab.com/inkscape/inkscape/-/commit/e6eee384cc7202d63136a3a1a8a5ccb990989d78

diff --git a/src/xml/repr-io.cpp b/src/xml/repr-io.cpp		 Jeremy Stashewsky <jstash@gmail.com> no https://gitlab.com/inkscape/inkscape/-/commit/5b7e540900ebdfa6a5d6c5475193f5025160dbc5 2023-05-01

All known versions for source package 'inkscape'

Links