Some of the reported CVEs are fixed in FreeImage's SVN. I can't help with solving vulnerabilities though. On 05/09/2023 14:07, Dominique Leuenberger wrote:

Hi packagers and contributors.

I was made aware of an issue around the package

freeimage https://build.opensuse.org/package/show/openSUSE:Factory/freeimage which has the devel project set to https://build.opensuse.org/package/show/graphics/freeimage

Unfortunately, we have no set package maintainer/bugowner on this package and even looking into the changes file it seems close to impossible to identify anybody really caring for this.

Is there anybody that feels responsible for this package? Most likely, the best chance is with anybody actually consuming the library:

...

zypper se -t srcpackage --requires freeimage

S | Name | Summary | Type --+---------------------+---------------------------------------------------------+----------- | allegro | A game programming library | srcpackage | deepin-image-editor | Libraries of Deepin Image editor | srcpackage | deepin-image-viewer | Deepin Image Viewer | srcpackage | imv | Image viewer for X11/Wayland | srcpackage | ogre | Object-Oriented Graphics Rendering Engine | srcpackage | photoqt | A Qt-based image viewer | srcpackage | python-scikit-image | Collection of algorithms for image processing in Python | srcpackage | slade | An editor for DOOM maps and WAD/PK3 archives | srcpackage

There is currently a few pending bugreports / CVE reports that should need to be addressed for this package.

Please let me know if you're using this package and are willing to be its maintainer.

Cheers, Dominique