-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: libaom-doc
Architecture: all
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 libaom-doc - AV1 Video Codec Library -- Documentation
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 625ccef5a28a26cd5957c78c9ab658eb32f19745 13017 aom_3.12.1-1+deb13u1_all-buildd.buildinfo
 ded77df102f27be66436de538a7b0d1b8254e959 1291872 libaom-doc_3.12.1-1+deb13u1_all.deb
Checksums-Sha256:
 6ebc8264688868c66828cd333dabe85b5cb6b8c8fec81fb6fde357aae9024207 13017 aom_3.12.1-1+deb13u1_all-buildd.buildinfo
 3ee88d80f3eb8a637929003024104873c1c5f27fc06175b1769e63f11a03f07e 1291872 libaom-doc_3.12.1-1+deb13u1_all.deb
Files:
 e3e9064132837bf5730d8bd8fd990c96 13017 video optional aom_3.12.1-1+deb13u1_all-buildd.buildinfo
 a4db75484a73fde2d8d2bb8e29460038 1291872 doc optional libaom-doc_3.12.1-1+deb13u1_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmpxvzUACgkQmgPNRvTf
/zfhVg/5AQV1vEue2N9obqnjVHr2EUFWaj9b1QJgBzKskIRfClIaeVEcJ2vENzj1
ZX6XR7lA2bYpVfK65ubkAdVsklQ/GXaCEa0QgIpgtfJt/WYuRCMU6OzIq/2llBaV
LxOvefmISV6kSGOpQnwT1tyaNNT90gnPBIAl1BCOw/pFIbtdcgJxzf7OaJcdIrmS
woerq6RnoXaWBM0CpTGM+EKNjGY/oPPUVNGkR2/wtcK4eQe/gVcl1veg1/5Vm3E4
YUktmHeobBCIIrcaxi8ZSwNmYZAGl64EogAo/O5KTKLNxHgnyUs/1apn7e+UR25+
bVbTgQBzlGv9akBvt5MzAKDfp2SPzpmqdNlaHfdFU3wzL3t/9Qr+8aM1QyRthpqK
0K98xtWYmsKUEUa/dh2twJbMpwUCCl1y8ZIg/73hKI4Fov7DwpxvBlXpRdeoM0jC
JqYMtCerWlOmGC9NK+Sy41MWqmcyFy0X5QFAFvif/qr9gxTtw1lLFGDxP2UD1sep
+c7wI+HWOQR6bVFRpVe09YlSJjwBylpmazsldUiV9AZ7twlXjRKTKOHR6hzKuZY4
ZZu7L3RCPmNvEEraRwHBdqdyJ1wgwP8Yxnn6zx0/0cQZCYZkq2Sylkzj7grdy38x
PvyxlBc3fqsp2waeZPuypbKeMQ/4nDaVe0uYu2lThemb65XdFDk=
=B9DT
-----END PGP SIGNATURE-----