-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 23 Aug 2026 14:45:36 +0100 Source: libsdl2-image Binary: libsdl2-image-2.0-0 libsdl2-image-2.0-0-dbgsym libsdl2-image-dev libsdl2-image-tests libsdl2-image-tests-dbgsym Architecture: s390x Version: 2.8.8+dfsg-1+deb13u1 Distribution: trixie Urgency: medium Maintainer: s390x Build Daemon (ziehrer) Changed-By: Simon McVittie Description: libsdl2-image-2.0-0 - Image loading library for Simple DirectMedia Layer 2, libraries libsdl2-image-dev - Image loading library for Simple DirectMedia Layer 2, development libsdl2-image-tests - Image loading library for Simple DirectMedia Layer 2 - tests Closes: 1133010 Changes: libsdl2-image (2.8.8+dfsg-1+deb13u1) trixie; urgency=medium . [ Aquila Macedo Costa ] * d/p/Fixed-out-of-bounds-read-in-XCF-image-loader-thanks-Sebas.patch: Import upstream patch for CVE-2026-35444 (Closes: #1133010) * d/patches: Add selected upstream malformed-image parser robustness fixes: - d/p/xpm-Remove-QUICK_COLORHASH-replace-it-with-inline-code-th.patch: check XPM color hash entries before use - d/p/Fix-heap-buffer-overflow-WRITE-in-LBM-palette-CWE-122.patch: fix LBM palette overflow - d/p/xcf-Fix-heap-buffer-overflow-READ-in-XCF-RLE-decoder-CWE-.patch: add XCF RLE decoder bounds checks - d/p/Fix-heap-buffer-overflow-READ-in-XCF-do_layer_surface-CWE.patch, d/p/xcf-Added-an-SDL_SetError-when-rejecting-out-of-bounds-ti.patch: add XCF do_layer_surface tile bounds check, report invalid XCF tile data through SDL_SetError() - d/p/xcf-fix-null-pointer-dereference-when-read_xcf_hierarchy-.patch: check XCF hierarchy read failures before dereferencing - d/p/tga-reject-images-with-zero-width-or-height.patch: reject TGA images with zero width or height - d/p/Fixed-out-of-bound-read-in-GIF-decoder.patch: fix out-of-bounds reads in the GIF decoder . [ Simon McVittie ] * d/control, d/gbp.conf: Branch for trixie * d/patches: Improve patch metadata: add CVE ID, Debian bug number, upstream commit references, etc. * d/patches: Re-export patches with their mechanically-generated names and apply them in the same order that upstream did, to make it more obvious how this version compares with 2.8.12 * d/patches: Add additional robustness fixes for parsing malformed images: - d/p/xcf-Permit-empty-strings-in-read_string.patch: Avoid an out-of-bounds write if XCF files contain a zero-length string - d/p/IMG_xcf.c-read_string-add-back-the-positive-string-size-c.patch: Harden XCF parsing against extremely long strings Checksums-Sha1: 31b2786b88692283773e1a4908e54a47c7ab4d30 180024 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_s390x.deb d4736f259b2a53b5d05ff63fc1416bc1a6f8b234 67984 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_s390x.deb ce8e1583a6abdad05593e856c475ff04a7298ad4 81928 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_s390x.deb 0698287fece56e3d3a176f0646bc05ff8dbf7021 36192 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_s390x.deb 161bb71b4f4e152fdea600286bfb0f462a3134e6 65696 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_s390x.deb a4e28f458b6405b14811aba87b531938fcda630d 12736 libsdl2-image_2.8.8+dfsg-1+deb13u1_s390x-buildd.buildinfo Checksums-Sha256: 577cd74215e2d2caed000b0831699b6370d62e96a166dd2e21c01e96e92623bc 180024 libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_s390x.deb 7c191630ad6a30fbda54e81873489db5fd624368dde2b79ac3f09a4d5f97847a 67984 libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_s390x.deb ddbe6618414ccfb2fd9922c18ab927b757aac1624e7bf8c2d7abb1bc7be4b347 81928 libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_s390x.deb 5b388f63cd27faf9663e7707ed4b20c87f87fc2e1bb7d3e048f06b423a727b64 36192 libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_s390x.deb c0a4328643e0f0306d3b4c30dd26fe12c4a05b2865c47103a8d9ae74af453e48 65696 libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_s390x.deb 8ef79b4dad5f857005ed358cd972f5145a934b9644c793333854d4b60ca88793 12736 libsdl2-image_2.8.8+dfsg-1+deb13u1_s390x-buildd.buildinfo Files: f5d4dff0689e0f3d87ecb0f038d4b62d 180024 debug optional libsdl2-image-2.0-0-dbgsym_2.8.8+dfsg-1+deb13u1_s390x.deb 5f41f375201460545a6b144812badbcf 67984 libs optional libsdl2-image-2.0-0_2.8.8+dfsg-1+deb13u1_s390x.deb fbe9ffeb8296bee2e4beb6446dbbbf10 81928 libdevel optional libsdl2-image-dev_2.8.8+dfsg-1+deb13u1_s390x.deb ca4b92ca325cbd1689f0ea45e3e60281 36192 debug optional libsdl2-image-tests-dbgsym_2.8.8+dfsg-1+deb13u1_s390x.deb 6c0e67c74ee1e53f1f5ff4b1f959765a 65696 misc optional libsdl2-image-tests_2.8.8+dfsg-1+deb13u1_s390x.deb 8b5d44020a825e59ff5fb0063572e86c 12736 libs optional libsdl2-image_2.8.8+dfsg-1+deb13u1_s390x-buildd.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEl0BM/nR+Oj597wRWMWUFebkHnoQFAmqanIIACgkQMWUFebkH noTkuQ//cekntDr78NTCLFTilp8XZD4Lf8y2Md5/bc8Gax4x+dwVz5BAc8uDfzQ1 snY+OtSVu2M+MdoISmqD8mfbtDKA/i6uvM3D9LHSh4pE2YO1FezEXP8jH/cfxUYU wgZEOKz0UWDmLS/DiRSE/PjMBcXrpwuSxVzr9W2yVJ8umFeDHjcJi/2DZl8Lpayd oQj7ycSJZp4/7zHT0VIUJqIP2tNP7FMgUgX7A0AZr5JeXargL/YefWO4eE6o+yLN /eZywY251gviAI0+dJQYCHPXutK3O12xWNc60Sn/fXzpl1vS/nyemTjXHrkSJQ+h gdOqpDlc56UXv3Ll3uRNYfiMvM1md9qZy/oCPyUym4d/bdgY077wTLpx8qvtPwXx d6qtC5jNfzBEshVXdmvXM/yInAqZl6IO/JGPR1QK71cSmo45Vg8Y/XIfFYrMYCuw 8zTAaiY+QKylPQ95iaE5ZMuqVyUVSgHNkDpqsfsSOm5yyv1i7pGnp8/R4EODbaQp /EjjIoQK0dl+6TVBefyBDCs8Eg6++4TUp+NADm4j2ekYZEV4PshIgEm2LdZQDkE3 NBklzTvVnq76oUtitKTces2qx3TzQ3qiEDNcn0VprIFvPXUU+pFqRj2nc5Np/SO1 kHoOxmPKKbCXYHR14DiXDIpu8DbqEnE/z5Yt5w/QWFfH6d6BZLw= =g1Er -----END PGP SIGNATURE-----