-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: armhf
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: armhf Build Daemon (arm-conova-01) <buildd_arm64-arm-conova-01@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 cf65afa5d3f6a375e588d04abe7b140d36735b49 410900 aom-tools-dbgsym_3.12.1-1+deb13u1_armhf.deb
 0d6a1767accab7b6ff4e13c8499c47b118c07625 106552 aom-tools_3.12.1-1+deb13u1_armhf.deb
 82831d8e1e161afef3ee8842f7a96b8171188434 13764 aom_3.12.1-1+deb13u1_armhf-buildd.buildinfo
 2b143c1e862e443feb0c75fd4df83f1f84b5fba7 1315400 libaom-dev_3.12.1-1+deb13u1_armhf.deb
 f826b8a18c7300cceebf5777837499802de8c8b3 4385124 libaom3-dbgsym_3.12.1-1+deb13u1_armhf.deb
 86803193dd505163cba9c9b1043331a90a6def9f 1146588 libaom3_3.12.1-1+deb13u1_armhf.deb
Checksums-Sha256:
 ee6caae0d1199ca77449bb8122eb411ac72338435520dda54b1df062288a577d 410900 aom-tools-dbgsym_3.12.1-1+deb13u1_armhf.deb
 7fbaad8659cfeaac5606fb390b148e43dc0384e20c2379bb35cbf379227e3eec 106552 aom-tools_3.12.1-1+deb13u1_armhf.deb
 c5996f8e15b52ef778efcd9c231c6d9ad39670c5c956d26ddbbebf54ed8dc805 13764 aom_3.12.1-1+deb13u1_armhf-buildd.buildinfo
 1fe77cbdcd8f613d7af2409adeb5e094eced88068449a956a82a560ef2c33fe5 1315400 libaom-dev_3.12.1-1+deb13u1_armhf.deb
 016db7cabbd252d9471fa6e654aa5fc61d671560d225bba8bbdeeaa172701926 4385124 libaom3-dbgsym_3.12.1-1+deb13u1_armhf.deb
 b42cbf497d5fa9c53a336e393f371992eff7d7c56c706b6937660dd9ab4735f2 1146588 libaom3_3.12.1-1+deb13u1_armhf.deb
Files:
 590d5f331bc02516f1188c1d456c607b 410900 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_armhf.deb
 645790794aead4bd4a9ccfdee24fb353 106552 video optional aom-tools_3.12.1-1+deb13u1_armhf.deb
 b60b2908c759cff8550e878c990520c7 13764 video optional aom_3.12.1-1+deb13u1_armhf-buildd.buildinfo
 a1bc358db2aef22fa636231d27e569b5 1315400 libdevel optional libaom-dev_3.12.1-1+deb13u1_armhf.deb
 9dfcd3399d5140c2172789eb86a5bae0 4385124 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_armhf.deb
 6e3664f326df3fcc099117f39136a3e4 1146588 libs optional libaom3_3.12.1-1+deb13u1_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEO4qAQUSIo2p/kVRf8U6eOZMpj68FAmpxwGgACgkQ8U6eOZMp
j68S+w//QA/FeAq1eRYSFLvCqH186x30TDuwQF4I7L8vb51mtQZTa4+4pjDhr1hM
gzRXyaKCurB7eYQrGoo8pVHEeI44MamGs6VppDXCOM2c6+fqtIbrX5s79FLZl5HU
3d7Vs54dC7JHsJenzEZL3igFUU+52DvSoNhelmRTLuei+krsPoRICOZvXG7cbN3F
03xtQfm2eMBDuiA5enewUV41b6aHMYD52TUT53mzbBt/S32L99NFzfJZWMmi9sod
AnG+mz1vxZHl3Gdf80RzatNm1Ii6ijaKQqpR2qROhvlCvPE/wf0Sb40JtYAdLdSv
o8ym2a3Z6YisbgsaOw32yLtzSNn6G5IQ4hQ9LSgwbgHOnwRyNdd3COHwVH5OLCPe
IcUJpFYRR583eIePFw0/kx0fgDRaXOlB4k/aI2hMAmr6ED5pn60RgXyMPWP4NSs7
JDcOYqDNE1hwOqVbfF0U+SMVgPWcNhJhTCfgSqbJ2W0mbKeVUN+xpst5LZXKXqgL
fAGx7H3YHLsfMTkIyhAES3Jpc3Jw6ye5uUiqjiCcl6iXTRmgMGqVval32BG+ztA2
rqG7UP3+4n12+K6CAVQSzo8Y45dgzEudcruyVBAdOufD4hsYf+euXRb5yQc9Uo98
fcc41sHWV7CohmzX8zFj0zdO6USwY/0NKNSnt+mt91dQZTUzRms=
=0o09
-----END PGP SIGNATURE-----