-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: amd64 Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: all / amd64 / i386 Build Daemon (x86-conova-01) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: 5b489df2ed8f1bfdbbcc0a3d78e7d92abce00554 180904 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_amd64.deb 7821f3f91a8abc8a8256562cf8f3c0b1b2c20611 67880 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_amd64.deb 6630296ba442f908783eb8efa12083a9d679ef9f 81088 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_amd64.deb 4bb882e995e4a4d327b06b56a8d40d98570572c5 36576 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_amd64.deb 6f56ee5222501137aff404d3205f931019aab03e 67344 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_amd64.deb 5bf1e96dbd5589bdaaa3245b8e867936cd006f99 12959 libsdl2-image_2.8.8+dfsg-1+deb13u1_amd64-buildd.buildinfo Checksums-Sha256: a7c84594a0da9732cdabc02a936a8a74201a3e7de4246760b40b632c24c1f7fa 180904 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_amd64.deb 3df007d463b84c3dd1d82cd91adc10cbeab5a2531357cfd9af21b3d81b2ebdf5 67880 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_amd64.deb 7b64a6222e521816fca46a437a77c1248f16b3db5d753b348e44c02fecc6bc92 81088 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_amd64.deb 2890237a05f08c719d950f077b4e42825f261cd13d1e3672bb1b0da78abf4386 36576 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_amd64.deb fe40bf99219c7d2cd467c39c1c39bd9df8fd9fa484f068d8ecb26e3af9146554 67344 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_amd64.deb fea8577974738cf7018c91b0fa7ecdd8ce8fb2e3c1621284d7d81b76a77201b5 12959 libsdl2-image_2.8.8+dfsg-1+deb13u1_amd64-buildd.buildinfo Files: 78f1bc4fd5591ad9dc9585ab9d6a64fb 180904 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_amd64.deb 07260dd8fd90ca75d5471c4aa5cb6ff4 67880 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_amd64.deb ce67aef00393988cc1f1fffa1473da32 81088 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_amd64.deb 8d1df8e791e531c829a669cc26760eb0 36576 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_amd64.deb 957f366066e88222215952b970058545 67344 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_amd64.deb 736ee2d236557c8867fcf61b7185fe74 12959 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_amd64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7cQ9mRD4+dWjjrb6PkCWRKsh20cFAmqamucACgkQPkCWRKsh 20csNQ//YyWWU9lAJnNkZ3j66fWw/HQq2VZctmy4c3DqYvWjlEn/f0G7UO7R3Jlp kqc/LCJizn7hCqgpVb/55nJokNojRTQmVooey1RiQbLIoENxOpyD4qUcrOfY4Pci kqtc/kGYON3zZZJM6VAi7NmXCF4AcT+G9foinE5bZgz+cfBm+2uy6ZzO2RPkPYLM m/hKBNOXfQsrJp6a3wXKRjHoq0hQe5tHYE089/hPiBufJ0gF8+2VKF+iVQBkjHKL TO/PvlSkC0u/WFytxdfofENDfvPMWnD1+9tJFjFfKen642vIdhopmkmIABpLB28R XyWxewrI9FFhARVHeUH5h1/MeHvceyC4exWKVpWgsNeDmQeew+38g9BvHOUylAbd DD+PqFTftaowUeeLx9ChykQ2wH0fR/Qk5qgFFFXT7Vl1e4F/dpcpx87udRm/VQnm vaR/7PIa8QbDbFPMYMqlzV3zN56fRPjnzP4NvXp4QZGpFPw3U4LWVbvpoZcIe3pH ntCt+BRI1RjKK4Xc29MZOR25rjt10OHFKRAd2mrLEtdAaDDUDv6q0Ss4ZAEyQUls 8UK0n029QFL5j6+LDhy9OFi0fynW7Pkjnqea24hrdfBIfitUt2nClxVGxSxfLP76 rkBtlk1E/M+4hB63D9HkG9QqodLFy1hga9y+TaLXJJgE0r94PFA= =gGdi -----END PGP SIGNATURE-----