-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: i386 Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: amd64 / i386 Build Daemon (x86-ubc-01) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: 9b8816db7ef5f5bc1a10887bd2fdd63b3c15eb00 168616 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_i386.deb 858621ecf0807781b81e68036126171a3aa0fc35 71672 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_i386.deb b58043989185913c0cf021ce46307fdf919503b3 86456 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_i386.deb 2559b5ebf9bfb2ba4ee46d8599ffbb6df20f5ffe 35412 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_i386.deb 8e9f6f9d77414d735e8e95e457e289a2446a1ccf 69328 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_i386.deb 6bd3c3e3ebde88c3e522b143bb6040ed73ff5d9c 12851 libsdl2-image_2.8.8+dfsg-1+deb13u1_i386-buildd.buildinfo Checksums-Sha256: f0cf381d6703d5fc5e2b25c7a3418833df0e56d13020a64694670ce0fdd535a0 168616 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_i386.deb ac0bbeed2e7a12176f62eacb2704dad2f7be32e7ee9ac7bf026a1b633e0bab94 71672 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_i386.deb 34e3d42a589fde4e5a28d0c2296aa16f632d9ba87cfd23aedd8ac8149c577a82 86456 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_i386.deb 7a988fa2e554ecbadf9a8673d29a553efd2eb22fecc7a870c6f6fccf7008aa2e 35412 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_i386.deb 2e66af2b350089cc9d26c1f775a087156869e4698f9b5150da666f9690103951 69328 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_i386.deb 5ddb8d35083843e36549a3f06b7cfd1158f5cc3208d21c132b437adf72efd39c 12851 libsdl2-image_2.8.8+dfsg-1+deb13u1_i386-buildd.buildinfo Files: 9d1871f85bf20f7de9c9abd9c24a6603 168616 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_i386.deb 888890aa464fa3c3905108df9a902a3d 71672 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_i386.deb c91235fea72a826f762362524df24497 86456 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_i386.deb 8153cb146fe870455bfb8a268c96480d 35412 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_i386.deb 392c064fc237a8aa91cf0f401099c8bc 69328 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_i386.deb da3e6c06c0bae79e4c5bd6754371cb47 12851 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_i386-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEmtr4KUMaso2EQ6NrTwt/65ON6zcFAmqam6cACgkQTwt/65ON 6zfnCA//ZTRhkOPy20KpRJp9H+L3yYmuSyR9JqJjdCsIvL7WlZCAj+aSrRhR1Rn6 GjSXGTIMBHl7vkRDwb5KCvT42bDpTSrEtwVTzEtUbx+OqS8jqyQQv7glTSBrbYsI sGQzl0XAPsE7te5IuXpuJZNyR5gfKWeQ0XbIIIvR2llTFt4EUXvG/3TsXsJxeD1I Af0ZHWkhLqbXqrBw7RHQWCYMBdhNjj3HLEW3AWeCJeilUt+ikmmjfFSKLEW4sX4I AU08H4XSrC4nWnFj/0B9lxE/z9GIS/MA7laYY0eMwlR/9xFUUxv/y6SoWlT3g/Fv XFtzv3ofJuk5P++014+OEPq/qygsvRzO865gXVinFBvSpbFe8uE+dEoxVW5A0WLO 6Gu8TFDXW2bJ5dYPDbDlbjnXwIM/oPDR07sOPV5f2laWTBI42hQuWhRF70Zh4DDs FeaFzFOs1SaATN+PT8bfL3NvRvdBw/DcE9HFHiD0SYTmWCasGfbS6d8Ed8L7bk5A fQCHG4ttWi1pkphZ3wamgl/HBArg8TuC45+AMZHUrm5PCT6ipEEbx1LJWgR6jqVj 4V8h4aZqPn1Tu1XjNaZeuvL6RGaEZ/ZKEhB3QHTrmevBTh7HetEsjcfZ8rnOcwcl 8KWpG6rbzfYMt+iqmUxOv1MvD7sdJMU8zV+bcc9m3cg84pWQpDY= =kNMQ -----END PGP SIGNATURE-----