-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: armhf Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: armhf Build Daemon (arm-ubc-05) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: bf2831174b9894c2df00e1656b77c02ab30bc2f9 178420 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_armhf.deb c9fe52197733ec3334e73c0aadd2c2ca4e742c0f 59272 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_armhf.deb e103432fe0be97b413992146626be29d1d39a6ff 72372 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_armhf.deb e34b72fa64d109473c2e5a94637a07e3bd03d7f3 38000 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_armhf.deb 1ce77482616765abab55d3c49a1c7d376c335709 64372 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_armhf.deb 7f508c27b284cdd4dec4dcb8aec59668da8b7c40 12951 libsdl2-image_2.8.8+dfsg-1+deb13u1_armhf-buildd.buildinfo Checksums-Sha256: 1cf1b91950820612337bbd12567122e812ae178fa1eac7c8b1db4cb5368561c8 178420 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_armhf.deb 0a84072662c3f8aba782cfbf370fba2aab8199f45d34e2a16dcfa886ebfa8689 59272 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_armhf.deb 491525ae1fa542623ef9d69333d1b9bc886cea50622d9847171e130c42000a41 72372 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_armhf.deb 1a576836146574708b38db5d7b4b8c5b831bb6293e0dea3308f449fda12b30da 38000 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_armhf.deb ac50b4cab910a0633ebabd9c0cacc417443d8cae54ada72dae6f89b7b1cc72ae 64372 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_armhf.deb 300aee5ba3fb609a30b58fd78c22c91e8722271fdac97c71d6ce8a5a00395040 12951 libsdl2-image_2.8.8+dfsg-1+deb13u1_armhf-buildd.buildinfo Files: 114aac38533adf822552480a919a5265 178420 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_armhf.deb 6751936fc65474e4e3707d2fee36b3db 59272 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_armhf.deb b7e5ec54573ccad106701567f2201041 72372 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_armhf.deb 8ad1aa4119db4cdaef47f1bbd10d720b 38000 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_armhf.deb 251cdd84fc5eee025a5d8cf1ac800908 64372 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_armhf.deb 9a86e653f33fac00c77cbcfcdbf34522 12951 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_armhf-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmqanVwACgkQnwznazfj XTrgrxAA1qXqrn1LESc+aAK/d6rk3yyEjcCwf4wUbZOwBXfMJ6jmmbdFF/1GF+t9 ueeXjz04nMOlvaqy5AmFuY4k3wr33t1jwEuzS+sEILH04QDPo3Y78mx707Lt+8ze XR9KRa9AMsH+wWX3UXJjTO9AzNXhrvirULdSqeGu6saZXructSUQpLNaYHN2E2As 2Ez0tH2kimRs+aDibzgMVpYhVKcu5cc3p8zEAPj9f8gUNM/KWGikMOjQlQ+4c/Hn +5AV99l+Nzovy1G3kjLTU6v6cRwXoj4saZKyoMwZ6MF1ZLrP/WOMFeWtr1rxjA3x zUcLfgTW71B8zrNB8WCFHPxf2pnwmHVnCirNMWQzuE9n2+b/ir6/c4xgMpM88btA sE/VOJLNWptzjAdK+zCTAZrs7uB5XzVsLXO9SmFoFE6Nn9h7e3vDyEXrE85Jmtoj l4qK+8VvySuXvTs2BDyb0MyAyndhe2T6eOvrw9rQG2fxWD/uY9evHRwt+yqO4JbY 17Ztxx7WPZRAA6bpxqzIjTqQxlTi1VrdZ6JN/sM+WLjAR0VEjL7LlB0kRf+UJFKK +A0RI2kBm4gIsWjnCriGFROS+SzSilWqO0iDuR1tJBqcVDdb2c/f1Ui+Ng8L3785 2ivaOwXf3+osHYhIn2ajT6Nv8fBLweSMuhrPq6BeuSWslFhYihk= =J6X6 -----END PGP SIGNATURE-----