-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 29 Jul 2026 03:53:35 +0200
Source: libraw
Binary: libraw-doc
Architecture: all
Version: 0.21.4-2+deb13u1
Distribution: trixie
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Description:
 libraw-doc - raw image decoder library (documentation)
Closes: 1132655 1133845
Changes:
 libraw (0.21.4-2+deb13u1) trixie; urgency=high
 .
   * Non-maintainer upload.
   * Fix CVE-2026-5342: nikon_load_padded_packed_raw() out-of-bounds read
     due to missing buffer and dimension validation (closes: #1132655).
   * Fix CVE-2026-20884: deflate_dng_load_raw() integer overflow vulnerability
     (closes: #1133845).
   * Fix CVE-2026-20889: x3f_thumb_loader() heap-based buffer overflow
     vulnerability (closes: #1133845).
   * Fix CVE-2026-21413: lossless_jpeg_load_raw() heap-based buffer overflow
     vulnerability (closes: #1133845).
   * Fix CVE-2026-24450: uncompressed_fp_dng_load_raw() integer overflow
     vulnerability (closes: #1133845).
   * Fix CVE-2026-24660: x3f_load_huffman() heap-based buffer overflow
     vulnerability (closes: #1133845).
   * Add d/salsa-ci.yml for Salsa CI.
Checksums-Sha1:
 566bba7ffe8e6f44162c7b75436181d98f1e8a57 125624 libraw-doc_0.21.4-2+deb13u1_all.deb
 bd87df7c5961cc479ce172a25778f9d7ced5df1f 5879 libraw_0.21.4-2+deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 891592a5dd5346993531b5d7b7d59f31092730254e6203be133fbbba042edd4e 125624 libraw-doc_0.21.4-2+deb13u1_all.deb
 074d2ed9bd12698eb4d8d289d6d107a3f55be3994142a1805c626e2aaa8326fd 5879 libraw_0.21.4-2+deb13u1_all-buildd.buildinfo
Files:
 ad5bb49999c06e568ef299c76d5db52f 125624 doc optional libraw-doc_0.21.4-2+deb13u1_all.deb
 9af5b95a0064f1d3ae9a58fdbdf83884 5879 libs optional libraw_0.21.4-2+deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmqcX/sACgkQmgPNRvTf
/zer8A/+OJLbMTSuUZJW5LHxPRe06+YM1zeVCDH2L8hbXDEFErzsnaNRa8c9myX4
FUZHAQFtGTJSVPUdkchaGFF4m5gSAFXaK/3iaWoGNuQm0/rsmjfm8Ld9Bv7Q5A1o
RUnQoKoz8iVS9K6mrfpZCnlrdeBhxheD3NAqTyVArSgmUDdXY2G9b7YfxPBjtSC6
GQe+MofuXHjN8h8Y3OAQGhhP8dagmJ7lJBGUnQk92mFCC4RKcts+4eR4lFQRNA0e
pKljNhiTQb7EPq7XbXH9oDWJgLASFJ308yk5ZY/T9UMwp03pxGDE9BjEOQtHVMTC
I4+YWfnUkNKApXIXindaNWimJt0zFVg1uxdLUoFb+WfcZ6DCxtuxVixDKHDiN4Xy
wwi/PVVD90roorurdMDrOkxQEcU1I9sNdbaCbPGmhMlZY+1qxtGtfH7LfQq+jA9R
k/KmLsdeXGUkOf/44DB86A3QPg+N7EH7ua5le8BgI5JN42VtN/PoolVCkQXmbuyY
hLFQy0SRIXhqUWkrxYSqs2zyg356GWFV/Ho0dM9uRSIcsSPwVgHIXEP9H2ULAJVC
OA8hNAe4OIhfAQH3cKToLHyAGjaarv0I+by7lZMu5IVMQP414N9aecYeTHYEjjJM
jab56V2HtMzcwUHCFueCjOLMvsWYKifgdDtE9DzgnLDk1nNnVW4=
=ci8V
-----END PGP SIGNATURE-----