CVE-2025-15537

NameCVE-2025-15537
DescriptionA security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to heap-based buffer overflow. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mapnik (PTS)bullseye3.1.0+ds-1vulnerable
bookworm3.1.0+ds-3vulnerable
trixie4.0.7+ds-1vulnerable
forky, sid4.2.0+ds-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mapniksource(unstable)(unfixed)

Notes

https://github.com/mapnik/mapnik/issues/4543

Search for package or bug name: Reporting problems