CVE-2025-15564

NameCVE-2025-15564
DescriptionA vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mapnik (PTS)bullseye3.1.0+ds-1vulnerable
bookworm3.1.0+ds-3vulnerable
trixie4.0.7+ds-1vulnerable
forky, sid4.2.1+ds-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
mapniksource(unstable)4.2.1+ds-2

Notes

[trixie] - mapnik <no-dsa> (Minor issue)
[bookworm] - mapnik <no-dsa> (Minor issue)
[bullseye] - mapnik <postponed> (Minor issue)
https://github.com/mapnik/mapnik/issues/4545
Fixed by: https://github.com/mapnik/mapnik/commit/fd54b92004f29e223345ddcbcc36257abd94952b
Tests: https://github.com/mapnik/mapnik/commit/e82980257651ec472561ccb9f78678ef58c75f83

Search for package or bug name: Reporting problems