-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: arm64 Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: arm64 Build Daemon (arm-ubc-01) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: 401a0279e4b4e058bdad27ab2ca63c0b65a9a33b 173764 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_arm64.deb 6e35e5d303111b37525edd9ac4dc4f5363669f2b 63076 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_arm64.deb 854be416772f4c9535a2e307dd17c4cee23ec782 78276 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_arm64.deb 6d6c77d71cd0239eeb455f98ecf5564c9572b73c 37264 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_arm64.deb 6b09132fcf092367090cf045ff14d4cef4fa293c 66320 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_arm64.deb 3125d8db62b5f18f9727ddeac8c25e762c7548bc 13009 libsdl2-image_2.8.8+dfsg-1+deb13u1_arm64-buildd.buildinfo Checksums-Sha256: 829e8c12e18f199d51e074bc178905dcd0d5c8a3fa30be547a2e8cef7b24364c 173764 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_arm64.deb e878cc4837973d9eefad5348c6481a03f0653b0e8072219c630564e23291e507 63076 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_arm64.deb 17b083d68ef5c89f80a7a83746b950d3174fb1c702823c2e8e9f9d9e340c2908 78276 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_arm64.deb 115a54f22ed348094dcd84468f11b2c64176ee18adbe0344f1a098e059a1a2be 37264 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_arm64.deb bbbafe8c52f7cd90058e46659d7cff8d83666031242a76e86bf565ade23f9195 66320 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_arm64.deb 55660fe68f5f198ba61b7dd511351db276ed2a17e83be20e4317fc92729417ec 13009 libsdl2-image_2.8.8+dfsg-1+deb13u1_arm64-buildd.buildinfo Files: 6dae70a4cc37beb70787464a016ed966 173764 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_arm64.deb a4341374d9c4bb13f4700a684f990eb0 63076 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_arm64.deb 890475a7a11ba59966d8537d56dff67f 78276 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_arm64.deb 0fdfc629bc3f1583401fa4bfc6e351e8 37264 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_arm64.deb 13fc18c9a0ef568615d7b5f4c752e227 66320 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_arm64.deb 5c2a302d4bd309d031c7468e674c8a5b 13009 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_arm64-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0Ha//LlsGOpbQ/H4xqCFmsOWgoYFAmqanV0ACgkQxqCFmsOW goaqyg/8CGBTEixz9ZAwoCz+dlXCrMd1ZMbFp65gJ4+IRzy1W+WgmoNhsZ05DWOV ilQ3Ix05R0wtue1N+3Rx8LeP09jlml9QduMacHC/VqJihcDkuNCMq7H4sjvMNmzj C/hVfbrodzragmTOuck1sz8j1+rUzG773FWG9pEsU+p9fGI4EmqsXH9bb+DF48u3 Q1qkcBNHpF0fOpQcc0lKIU1nnwxzjfeFqmQZC0nS3Um5bgvNvU4dIZpHZ/3W7uWR mz6pqACQNI59NvIziQYIHvKtFuUIM/PQo0tnWqiK8GeTApATj5dPSoC4simKrQJ6 kAZ6MVnHuhdEtLW4Ffn2fQTXeU7uoJQNpJ3pfwrMglTdWpuqkESIVcw3f4FFdC2b aPDK9Qe0bapgnRT2uSy9qU2zVuMwXQfKeLhAcudYFp01srvgYRD4DSgUYLKWs3dU g6EDPDNiB2n7Ldy7qlVNBM3BNUQ03wF6wFXA8tYEWMDBdfJIOB9SYAc93rGiZ+rS s9vP1lap2EG0cGdXtLPxdtVhZ1X8cuvWzNTR8xqC7xkYUew28O2aW7Frkuh0OJAp k/rENQppb1JIl5RbV70FcEKptDiy6AewJx/fBZQzkwAeg+TR67nysHyI55lMf39l M6eQGo5WTewYa4gH3amOrHHBTSqu4a4Us8mQl206q55iSiTlZt4= =yNlL -----END PGP SIGNATURE-----