exceptions.json

{
  "schema": 1,
  "comment": "Reviewed CVE exceptions applied by apply-exceptions.py. Each covers the listed CVEs on the listed binary packages only while they are built from one of the reviewed source versions, and only until it expires. Anything else falls back to being reported, flagged for review. See README.md, 'Exceptions'.",
  "exceptions": [
    {
      "id": "libwmflite-embedded-gd",
      "source": "libwmf",
      "sourceVersions": ["0.2.12-5.1", "0.2.13-1.1"],
      "packages": ["libwmflite-0.2-7"],
      "affectedPackages": ["libwmf-0.2-7", "libwmf-0.2-7-gtk", "libwmf-bin", "libwmf-dev"],
      "vulnerabilities": ["CVE-2007-3476", "CVE-2007-3477", "CVE-2007-3996", "CVE-2009-3546"],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "reason": "These are libgd CVEs. Debian tracks them against source libwmf (open, 'unimportant') because libwmf embeds a private copy of gd in src/extra/gd. That copy is linked only into libwmf-0.2-7 (and so libwmf-0.2-7-gtk, libwmf-bin and libwmf.a in libwmf-dev). libwmflite is built from api.c, bbuf.c, meta.c, player.c and recorder.c alone (src/Makefile.am, libwmflite_la_SOURCES, identical in 0.2.12 and 0.2.13) and contains no gd code.",
      "evidence": [
        "src/Makefile.am in libwmf_0.2.12.orig.tar.gz and libwmf_0.2.13.orig.tar.gz: libwmflite_la_SOURCES = api.c bbuf.c meta.c player.c recorder.c; the bundled gd ($(LIBGD) = extra/gd/libgd.la) is in libwmf_la_LIBADD only",
        "debian/control has no libgd build-dependency, so configure falls back to the bundled gd for libwmf-0.2-7",
        "nm -D on libwmflite-0.2.so.7 from libwmflite-0.2-7 0.2.12-5.1 and 0.2.13-1.1+b3 (arm64): no gd symbols; libwmf-0.2.so.7 from libwmf-0.2-7 exports the bundled gd's gdFont*/gdSinT/gdCosT tables",
        "https://security-tracker.debian.org/tracker/CVE-2009-3546 (libgd2 resolved; libwmf unfixed, unimportant)"
      ],
      "reviewedBy": "Gordon Hollingworth",
      "reviewed": "2026-11-05",
      "expires": "2027-11-05"
    }
  ]
}