-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: amd64
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: amd64 / i386 Build Daemon (x86-csail-01) <buildd_amd64-x86-csail-01@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 2d9bea1ca24740dc664f9ea5a910632d614c8e4b 439964 aom-tools-dbgsym_3.12.1-1+deb13u1_amd64.deb
 8fd95c663372f8174d25d0cabbac88ec87ec197d 119432 aom-tools_3.12.1-1+deb13u1_amd64.deb
 efc66e3f03faddb62b6c2bc12edbf00d7d86432f 14060 aom_3.12.1-1+deb13u1_amd64-buildd.buildinfo
 a0ef544e9bdf5005e1254ae737d6bbd93aa48d2a 2122488 libaom-dev_3.12.1-1+deb13u1_amd64.deb
 0d086f75429de5345c58e3a313f97e9e69fcfead 12105428 libaom3-dbgsym_3.12.1-1+deb13u1_amd64.deb
 10bbb28b6e0f3e2439f9a83acd615c409e5b7fab 1871712 libaom3_3.12.1-1+deb13u1_amd64.deb
Checksums-Sha256:
 10f90ea597cefda287fa35027284ae8ae7ec8a22ac0124bf94f3b43f7790fecf 439964 aom-tools-dbgsym_3.12.1-1+deb13u1_amd64.deb
 38aff20287f591636649078075cde1e9208a6dc5c423227fe488e894ace5e603 119432 aom-tools_3.12.1-1+deb13u1_amd64.deb
 5c5eea2f82083c21d7a710c03441773c216215beac02d89751d1d3ecccd1c651 14060 aom_3.12.1-1+deb13u1_amd64-buildd.buildinfo
 8cb41e9b8eb0b0b0f116c19e46328f6fa9a7d9df224310960a013ebb2ed8d311 2122488 libaom-dev_3.12.1-1+deb13u1_amd64.deb
 d221c160641b27e86d0bd48310cbd17a2539652ebdc7e320996a01a6a3a7e76b 12105428 libaom3-dbgsym_3.12.1-1+deb13u1_amd64.deb
 743eec7c94ae30295bc557ebac3dfae948e7390e89a2743c585d56297e9d312e 1871712 libaom3_3.12.1-1+deb13u1_amd64.deb
Files:
 6dfa9a0f54765a286488cd3391addc9a 439964 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_amd64.deb
 6a978e6550a49a179b264dd8439d4142 119432 video optional aom-tools_3.12.1-1+deb13u1_amd64.deb
 7c0e35ca5159e32e45360349082ce30d 14060 video optional aom_3.12.1-1+deb13u1_amd64-buildd.buildinfo
 99ee6b96ea6a97a07d58ef91591eec58 2122488 libdevel optional libaom-dev_3.12.1-1+deb13u1_amd64.deb
 4ae8c038cef98f0bfffe0af0f206ec97 12105428 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_amd64.deb
 af6c0449754a8c6a219ecd5f11c54f70 1871712 libs optional libaom3_3.12.1-1+deb13u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmpxvzUACgkQYg9P9sm2
dfGQ7xAAkrV5KtvXiSczlsWwXm7bPnMCup6dtxGsoFhCzzK4IMlO7ogWVTy8RSrD
aWTGJXudZlMxkxLzcGDudxs4g21DoOCCPgUPbM9yM6YJCTnKByOQmQfJvWX/x/jz
PgFXtpHmE6/ArvW7RSL84k4FjHYz7UOGs3wGibGmTIkT3NXxyFUTFxHadfryYla+
QXHdgg0rK0+785cTZGjBnxQK6tI0RSdcgyFaJL2NtNoyHVqA/dUoF4UH6/vM9C87
gAQuwZg7vTq+0MdrmQbv7dKYNAs2pJ4Hjj3l8jj75sTZltBuEF3FhJZgOcoMByPY
4U7csMLY8CgywS51ieZjl5wjUtEZkncfd8R0soHGXybZdi76tILJLV1NqNvFJ2KL
fwyiF+8VXxneEB3i2jdSHY6gWlKXuqli0uAJ9KfdS0QuhonN2P/5++ARgvRVSDAz
kZyERbtCRSqeLx6H6sMo2j4xR2LDeK/NVocqYNfzS7oCAxoRPFxtieAlif+tm0eq
NDvdtQ8PlTKO7x8JcPDPkYYGDeS54BaUgZYKM+20KnBYQYyFumkzM7h4mZmiLyyC
7nfB+/XEQbEDjAKqlTB6XoSMLC1kFJqJ/RMo+nDl4YhpzRQ12CM0kCRMmZJUQRrb
AQgEgYXm9XPei/nItIQm7wkTVn9HCw4yp0i+zTRmBXirxk3aIfs=
=i8KO
-----END PGP SIGNATURE-----