-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: armel
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: armel Build Daemon (arm-ubc-03) <buildd_arm64-arm-ubc-03@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 92bf33d4552501cb6b7ccea9b43e9e93fca34ceb 406472 aom-tools-dbgsym_3.12.1-1+deb13u1_armel.deb
 a6b4891ce4011b4fc2bb0daa3540ca6370d0cb95 105432 aom-tools_3.12.1-1+deb13u1_armel.deb
 82d4585660010f5dff88c321c1373388b32324a6 13750 aom_3.12.1-1+deb13u1_armel-buildd.buildinfo
 59d8b5f01698b670bc2b696dca603d71547496e1 1313468 libaom-dev_3.12.1-1+deb13u1_armel.deb
 3db2ee7fc7d743fa00c16d64a8d25d87febeed82 4363220 libaom3-dbgsym_3.12.1-1+deb13u1_armel.deb
 956735fae7b0a5057c3b045c140dea391822f00c 1138756 libaom3_3.12.1-1+deb13u1_armel.deb
Checksums-Sha256:
 8769b9e9927505ddde615d5bd051dc849b27ffab5ff4ca52d4be975e14ccbcbb 406472 aom-tools-dbgsym_3.12.1-1+deb13u1_armel.deb
 7445b0d19e9d00f56a719e365713a0eab6510d51dd2b1a31637182dd2653d60b 105432 aom-tools_3.12.1-1+deb13u1_armel.deb
 515cf3d1c692dbbd4b6cd679b4fdf8fd1029ab403f8fb75797dac91adbc636b0 13750 aom_3.12.1-1+deb13u1_armel-buildd.buildinfo
 1a87c0f7f7b914388b34214eb02d5034bb380c3242a277a1cba3a8bb3161c866 1313468 libaom-dev_3.12.1-1+deb13u1_armel.deb
 23413f1054baf504d95a1667dd8994f703a8c7bc58a61e16423028b9a27d6a00 4363220 libaom3-dbgsym_3.12.1-1+deb13u1_armel.deb
 f3fcf9de5d85f4211ea141857e9ef5dfbc1fc035140e348a9e347f1ba9f97a45 1138756 libaom3_3.12.1-1+deb13u1_armel.deb
Files:
 64ae8d32fca8d2b1094ad16a5d746072 406472 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_armel.deb
 80cb8345aac54412f03029f135c41ca7 105432 video optional aom-tools_3.12.1-1+deb13u1_armel.deb
 b32844b4955aa386b2e358660dafdf67 13750 video optional aom_3.12.1-1+deb13u1_armel-buildd.buildinfo
 4dd9bd53ac7fba3f2d3e5d59cdf02b0e 1313468 libdevel optional libaom-dev_3.12.1-1+deb13u1_armel.deb
 ee9a900158527f886e8e7a6e9f33bd25 4363220 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_armel.deb
 2d43a3c42d729a40509c06e4d5ac35a6 1138756 libs optional libaom3_3.12.1-1+deb13u1_armel.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE2kd8oHy+LXk/nybqvzDqKQSGl8UFAmpxwMwACgkQvzDqKQSG
l8Ugrw/9FnQs3qrWZVM/EEsZgq1Pux27jvqHbtjZqaf6I6oJGkvZxgVsxpw4VJfF
RTJ7nEfXpA9hmI+PfZm+jB+oJjpta7aNpf4pSaqS5bwT4db1OnhQvP8PvhFLdfbN
9vRX4+15EfPk4pNr6crIKeAk9HcAc2piSDl5eFGRy3rdRZmxaXBrU4N+3NDopVYj
r5fBFBarvsV6/Qml+WXNWo9LiRcVJMt++M8XfjdFNg63NSYsCTlsOIIlHEzkIw73
D5uEErt5Xla7r/rTJKtbciwZq75bo4sXh39UZI+B5Oc2QuoLYe5LvRxENbfMJXOB
bqUB4Iazzd+46K8z8samIqV8rirKOtbtfpJxDszS9KnLS6xfjRrOoFyztFmGwKwe
l7GWR9xr90AfW5phNPns6KNCUEs8UGTx7h8+RQFHDm5p2AS9theIO2Zh4G/U7kCy
tK7Fun5JQfzg9Lm7HCwpCjNlJ9z535mmtCTvcx/7h5mhcTf038D1sAWfhJPpiqUw
wrGmF2XOOgBjLVkYpqksejPKpDwREWbqCv+Ru+GjC2rGisJ+VpknVbPlxwakYC6K
RWIBMxhp28vcu9GgsuLOxX3F4Z7kHgMT3mBlKmgM3EfU1AnIgIeu2f8YB6Q2sb4J
p5O+vaurkw7nFF6A80LBLHJHVOCRB8w9BWdNRVB25m6xWee5ae8=
=OrEw
-----END PGP SIGNATURE-----