-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: arm64
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: arm64 Build Daemon (arm-ubc-01) <buildd_arm64-arm-ubc-01@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 f6991e1279e6818d07582012233fb72c72f2b6ec 431776 aom-tools-dbgsym_3.12.1-1+deb13u1_arm64.deb
 e9768d6659fd5055c32a5abb2593a526829dffb6 113532 aom-tools_3.12.1-1+deb13u1_arm64.deb
 6418a2a9a00aaf6ec06ae17164ddb5e9f23cba09 13940 aom_3.12.1-1+deb13u1_arm64-buildd.buildinfo
 b3f5bd64008ac2a74b6600603b1267353308c34d 1918644 libaom-dev_3.12.1-1+deb13u1_arm64.deb
 f0ac77e0ae7bfc6498ba46b5d5c57394dac3933c 12420140 libaom3-dbgsym_3.12.1-1+deb13u1_arm64.deb
 2df3419f1ff8be8ce001e80a7a987b7c4a605c71 1670644 libaom3_3.12.1-1+deb13u1_arm64.deb
Checksums-Sha256:
 5adc8578d72ea78366e4025345e2e03bbe0fbfa080d5d526f5e889ef287a1b5c 431776 aom-tools-dbgsym_3.12.1-1+deb13u1_arm64.deb
 58eff57400172ded1575c26d35dc96f54590e47d4718d3728134e52617d22b9b 113532 aom-tools_3.12.1-1+deb13u1_arm64.deb
 d88a7fdf47ad829e67d94372dc5d0243351a0dca12d9c19e7cf087b3bdff61c8 13940 aom_3.12.1-1+deb13u1_arm64-buildd.buildinfo
 a533b91d03f23e57b2e79eabc9c01aa870c0fb90466fc746058bdd32d69592a4 1918644 libaom-dev_3.12.1-1+deb13u1_arm64.deb
 1d005cf992c349c45a222f2e1f4fa61ec8200c7a57c5f28f613b8c81bcc6453a 12420140 libaom3-dbgsym_3.12.1-1+deb13u1_arm64.deb
 552e2bd21772a39713a0c63e814039f558b355d048f0d0bfc4009658253cc1e9 1670644 libaom3_3.12.1-1+deb13u1_arm64.deb
Files:
 03593ca53b104c13ff00ee020a2d76d9 431776 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_arm64.deb
 4b2f9f7df17b2191e698c3d4a8249f5d 113532 video optional aom-tools_3.12.1-1+deb13u1_arm64.deb
 ddc302ab07cbc76c7c4c85c6873b929f 13940 video optional aom_3.12.1-1+deb13u1_arm64-buildd.buildinfo
 76817dcda463280f99ac9e71213c340e 1918644 libdevel optional libaom-dev_3.12.1-1+deb13u1_arm64.deb
 19dd6c349f280f4e6abe59f071438239 12420140 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_arm64.deb
 02a13e1ce4b2a81bbe74ff5929329c67 1670644 libs optional libaom3_3.12.1-1+deb13u1_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0Ha//LlsGOpbQ/H4xqCFmsOWgoYFAmpxv1QACgkQxqCFmsOW
goZL1g//adgCvtGU2pj6LJ4FINDD8Rh7d/73ih7cDypr8ZnFuop+/8NJhIVYAVdi
0YKMZxpZauoZKu2QBjdFEnARFb9ML0NToA4PFQ2xY8+X/p7KAhSC3C3cNml2larz
3iryuPfIjMyODJUGTJNNwRT4SLMz3G1MTwih492KpduoUynf8NQeeKjiiYSmX06j
JasIjIy9Qp4wVdKsA3laQikvS7Wg7YsEOCljLt0QOn3Paace6yH3R7HsumtgeFY1
DsAJNAdpDGkFka9M18U849gjBIoIiB5gmB5jjLpgInjP8mRt/1uuZbLlVHVq/6hh
4aeViyPHeLyh9YipYcxvev8a4IdmkElhxYHRrWi1kCwt2Je8EhVt7LNb6e5CsfsK
MYDdpczcRXyDAEaKZTkmz5Apv3yeqpAIb3Xg/cWqjw/BIPsQXoVB8iX9Sb8lnOxw
7XtRn1+GNHlDeX2niQ8SIbNf+4XrRq74Og8tQwxxe27J8WpGJ768iCf6EedyMsCK
JViUzrt/aeLaDXMHKFT1ov4GJOxkCiny9dzqCHFK/QzW0vQHnFGz/LK0zGF+PqXx
9Rg3+vdA0RV1kwNCQTB4xBKuAxs0/CviS3riWBUPPs8dwGbBAQhDI/tOnI2WOF2m
fxQmw8m0sptHY3bhOZYEiLjaHsIPzipYiYta5SwbBtR1yO4zqn8=
=qPrd
-----END PGP SIGNATURE-----