-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: ppc64el
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: ppc64el Build Daemon (ppc64el-conova-01) <buildd_ppc64el-ppc64el-conova-01@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 87b9d11e6910f418f301c58ab3f5605cee455457 416864 aom-tools-dbgsym_3.12.1-1+deb13u1_ppc64el.deb
 e64c6ec1e2cfe66882978e2727cb6879f4c12c39 125120 aom-tools_3.12.1-1+deb13u1_ppc64el.deb
 5054fba46afd4805afcc7700a823d75ed8725ec0 13967 aom_3.12.1-1+deb13u1_ppc64el-buildd.buildinfo
 33a8eda100148dbb99f9a4e63e0773a63df2318e 1535800 libaom-dev_3.12.1-1+deb13u1_ppc64el.deb
 18f423d63d4e036a6a1352ebb5cf9ab50990f300 4601596 libaom3-dbgsym_3.12.1-1+deb13u1_ppc64el.deb
 cda74a30692be77cefe84f21638fffa91072ae0b 1326648 libaom3_3.12.1-1+deb13u1_ppc64el.deb
Checksums-Sha256:
 77e666c4c0496a6ef259cac4467c74fddd160c607555a3f6e67c11eb5beea4b3 416864 aom-tools-dbgsym_3.12.1-1+deb13u1_ppc64el.deb
 d245b54ef9fc9c940203d2e0f3c04947604fbcc101140430868b8491f9148baa 125120 aom-tools_3.12.1-1+deb13u1_ppc64el.deb
 e461e35cae430e3ef4800a2c3ed11903edc5fbdd310615d154cd4ed216fbb5a2 13967 aom_3.12.1-1+deb13u1_ppc64el-buildd.buildinfo
 db9f37fa25541667c33ad92165744fac24101cd30cfac9e896e309e6b7c547a9 1535800 libaom-dev_3.12.1-1+deb13u1_ppc64el.deb
 8c1ce788a0fe6f1e1748ec7e7548c6b18556ba5ae9b2b0afd3406ea97056c1d1 4601596 libaom3-dbgsym_3.12.1-1+deb13u1_ppc64el.deb
 302202b163f4f4fb27c5940273a3ce1c44b1fc45a2015ca0ad42599beb679819 1326648 libaom3_3.12.1-1+deb13u1_ppc64el.deb
Files:
 7b50cd8ed4fe0817e30645ffcdec9a5b 416864 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_ppc64el.deb
 d98ceab082f72e56a77f0ad710c4ed37 125120 video optional aom-tools_3.12.1-1+deb13u1_ppc64el.deb
 7f9c8889325f68e53bcb70c336f63e25 13967 video optional aom_3.12.1-1+deb13u1_ppc64el-buildd.buildinfo
 01c4172459bd06d77bed21e8f0b9fb1e 1535800 libdevel optional libaom-dev_3.12.1-1+deb13u1_ppc64el.deb
 8a1f6abadab76d02a1ac4e46d7e70c19 4601596 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_ppc64el.deb
 15885410fd45b55355f2a8dc2076f009 1326648 libs optional libaom3_3.12.1-1+deb13u1_ppc64el.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEDoRc43uRWMOoIqIgDNLUPhbmg7MFAmpxv/UACgkQDNLUPhbm
g7P4Vw/9HQf9DpyRp32aJGV8l8paa3fmh2HwicY4LaU067k3FNZtmvTqdl0Wxm00
is01ONWCBtjWJtR3KWe+gBS4oAfNS0ahlU8P/P41vC8oLdyhwUrOIhQbpG54OT4c
hzpd5QIt8CJV6MXj2grCjCrEMzbnd4rchzCwvSu2ieX2VVzRSjt/JIhEdvD06FlL
+vOIMFSsEHAjv/1c/z9NPQLdRGuXfG/f2RDm9jZ525AQOzz+DQayuqImF9s2DMP0
7aur/iifAkIld/KRMV3y+nw/yTue+TIR/2Mv54ivfKwIF4mQ+9F75BzGpRBgwAre
IReFcQBQzyfjxBc+LaAYB8j8haBe5ysHviptoUen0mX27nbMQo/jsZjOLHYMZDer
CoEfoRnadq/XBX8xgTD1Mx2FogSjYy+dyPOgJptraVedOuwD/2do5cBceSRj0kq7
avvyHjGOS7w9RJLQSPolpnPnMzE0FQYaUL8eOpItY1bJgdAN+0s2bb3n6AkN/KbK
XsMkJ7VQmLiyZ1NEa1N3HW30g48b2roWxfZ7F7UerjlqJqRHnBGMTelisd/MmsYE
6qRNOd8phv6iGuZYtI4+hyvN0PtqxFJqHe0H3Shx0Po+8vwx5GEW2GAew6gP3ylP
6TPA8eH1nfYUSVh0YBeOGP69Ffg+rt4k1x/CklNlcFj2mvOxs6M=
=mgn2
-----END PGP SIGNATURE-----