-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: armel Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: armel Build Daemon (arm-ubc-04) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: d8507084bb64756e00aa5e642527f98567cdc423 183936 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_armel.deb 903be40adf34f5a6d38eae9ecd48c80c0241d5ad 62408 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_armel.deb 58c5f4b1045cab0c0a1653c659108c73dd2abf03 74500 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_armel.deb 8f5ab90abfc212ad404d30fbe31d9d59a1944d7d 37900 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_armel.deb acf0fee58414620770ee6364d763624086cc10ef 64232 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_armel.deb 56a872832a2d87f07a2e1bb07714eb1ae3799402 12905 libsdl2-image_2.8.8+dfsg-1+deb13u1_armel-buildd.buildinfo Checksums-Sha256: cebb9974567bb3dc5fe94b470d9a2de29e376d3faef36289ffdf968b2a5aa9d0 183936 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_armel.deb 1d7d0ca2617d1ed03002f8f10678d7b3d317055f33ac79ec3fdc725b81b1b8b6 62408 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_armel.deb 9370c9f3b457d008da4f87eac05d61e6211a434c5b169fbfb6ee82f2443b9136 74500 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_armel.deb f046f0918c9d2efe20b44388141fbcea1e04b71bb7a1897e9c0edfbfbeb08f43 37900 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_armel.deb 8a108115c84e0a8f4b000c63b5449bb0a6b8fd6497a8eaceb679b4409a1da91d 64232 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_armel.deb 68b6782ec36174d5ba97c3605a5575ec3e3ce998f56e7f31fb2db8c2aeb38071 12905 libsdl2-image_2.8.8+dfsg-1+deb13u1_armel-buildd.buildinfo Files: eee7873aa9f4d1e4b630c3179548a92e 183936 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_armel.deb 50c9cd65fe0db6ed668fcf3d62021305 62408 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_armel.deb d0cdb0f9ac9becb4b7e6ed4c4d841bfb 74500 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_armel.deb 2fe352c578f3123e2befe536ed7ad45a 37900 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_armel.deb 8d5b7f364ac08eaa33494b7cc1b3b88a 64232 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_armel.deb c7617c73ef3f3939b321396ff36e6aad 12905 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_armel-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEECx5fXZYVNP9tMtwlK1PZBedPspoFAmqanQIACgkQK1PZBedP sprUOw/6AlR5jToeHxLDOlZP0Tcoj0G/Rew3Faj2v6ZmcDDub2wV1/VE5fWweYsQ s2EkG+S/i7M/TdoGLyOWmJiIOcRg1/w5bREdNfr0FuKDyzpo/7CY1EWtgXWTAWFg c4yUh0j/MbtzAYFoCrgn+FSYq9x1KU96GwlKJwni5exOFKPSKAReGrCBmkqLXpMr nTz2WhdeKfrCYU6c139NadBQJTI0yBO9Jj8uL2rC5ZJIQZRbLVW9N3YdVtotwCmo e9gRjidrEbeZwzp5vve9kwFn1LxTHys4ZsZ3B6ErSFNO5AjuAsODKnzLyGeqUvsA TveSVztksQZxNPFOMFY/BfRydO/X79v95VcLnmOF55yPsFZliMppF61qBxj1ngx8 GdmDTeIESsYMm1SQuSCYl1WaARv4yikc4XOBJLqtI956/vsSj9A8HLdxsPolmaQF cnEyLrtJqqwrTYYphNf1QhcDr2Iz3CY16NG73Ir954TQW3hPNxiUD338r85FJF72 N36jNi69XTDcCr7emSqwlB87Uen8LX/vkD0RcjDp+9h9MnLTACXhAa5kOBCYmMTF 1/TKNjyLqbXdvPf/x57Of7SpJMaReVkoF9AYIX2dEQNDZXY7tpSLbzcYSdLc85Vx mq4m2FcDok4eRUcvMIKNW+hk1eSraJemyGfst8xJMOqsNTrfs28= =JvCj -----END PGP SIGNATURE-----