-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: riscv64
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: riscv64 Build Daemon (rv-manda-02) <buildd_riscv64-rv-manda-02@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 dd68fb2238419fa4daf297ce3c6fd120868454bb 380316 aom-tools-dbgsym_3.12.1-1+deb13u1_riscv64.deb
 685dbda04e2e0b6d8aa076780199f2190ac11685 116096 aom-tools_3.12.1-1+deb13u1_riscv64.deb
 ef70d0f919f229ac49298876afb7d026e291eb53 13860 aom_3.12.1-1+deb13u1_riscv64-buildd.buildinfo
 524faf0f327031bfba4f1876878fe74448a6ddc8 3310252 libaom-dev_3.12.1-1+deb13u1_riscv64.deb
 7af66ee6c9843bba70976dbe4936a3de5907cf7a 4168728 libaom3-dbgsym_3.12.1-1+deb13u1_riscv64.deb
 84005c32f7102aa37abae7ea60426231c9cb740e 1295140 libaom3_3.12.1-1+deb13u1_riscv64.deb
Checksums-Sha256:
 cf90d3e044518c7c6e86d95d25ff4d13fbd3f9573b7ed27b13985247df96c7a0 380316 aom-tools-dbgsym_3.12.1-1+deb13u1_riscv64.deb
 afa6f0914d59b703ea1184311d19f3493a3cac3c0a9de7aa37140038798fb492 116096 aom-tools_3.12.1-1+deb13u1_riscv64.deb
 a84ecb2fb8f0a7e7864d0581b453d691e6e63c18ad54f2c3027de2f073e36c8a 13860 aom_3.12.1-1+deb13u1_riscv64-buildd.buildinfo
 37a70118819c14bb45ae264cac11284874d5e60dceb6d88e4a45962a69862184 3310252 libaom-dev_3.12.1-1+deb13u1_riscv64.deb
 6a342370f4e0a2223f247ff858dcb62dcfde193e3e60f0873d037e7e68c5447a 4168728 libaom3-dbgsym_3.12.1-1+deb13u1_riscv64.deb
 03a80cd6634444e5fc9d432e14f36c72088fa11e0f5310aeb2eaeb872bce8409 1295140 libaom3_3.12.1-1+deb13u1_riscv64.deb
Files:
 483ccbb86ce6232b8f06033cc69c75f6 380316 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_riscv64.deb
 0f6aa7587bc71bfc7a5bbb6fe0d43cc5 116096 video optional aom-tools_3.12.1-1+deb13u1_riscv64.deb
 0e0cb3eb35f39c6817e7d93680db488b 13860 video optional aom_3.12.1-1+deb13u1_riscv64-buildd.buildinfo
 9dbb718a69ef9415537ab1205a5e3778 3310252 libdevel optional libaom-dev_3.12.1-1+deb13u1_riscv64.deb
 5307daeed54319130a3958932798d3a5 4168728 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_riscv64.deb
 42f39cc260cd43e3125167fb6b2d4911 1295140 libs optional libaom3_3.12.1-1+deb13u1_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEER+evXFzNzDWbUDPF7SlJcp2g6OIFAmpxymcACgkQ7SlJcp2g
6OLVGw/8CQukNjqsmvbZamLqZwIKo+BRxQV7PMyc8+H6z48KHYKte3Z1o0NXxAiq
Kb24CoUvQXF4egXIFjSs5SIg2kKwD/S7N16+WM4v1nsxUlkv1Ci4Mdu8cwv0hp6u
NeCb4wAcvxJPHBCdra2exwpeDkD52BM157vv3G3zd7FEq7V0DIZP9PeipMlc6deh
Yl/fYa1I5+7fGg97V+p5OAQ56GyXmX+RwTqNWaROJy3z8dV4uXxnCkjbsFRbpEQR
c2w986xy8P0FYp0iwMJUqX5eOSVr29ut7DvfGUMGIO/RJIzUimjrqUzsCIaM1vtd
miyGt59jcRTDQFWw2RFNu1O1d6V0/3wxdaWZcArF6YrZtm0QCQJkHJayz4gF38dd
IbqahdN4GLIP/Zi4Sa7z4brACbVoX6AUTHt1Qr/9/doqEKUhz9tU++1LeWNrFvLx
iUo6bUR08s8yGURPNIZu1aOCs5hLQQ5WD9WesCTEouX+YE59dg4Yl35CUAtkKpa5
iKg3o0A2Q4buKoI4vL43NFOi4F7QrpDSPMbOZReomd/qzbXIFBGAn6t+Etelxz+H
FW6xXHutDlj5aDsSGWwrB1XflcsFQq+dU6e6FsD3aOkGpFln9utBtJB0bIu8sMtb
T5FgJjDdW8ssIx68Nb3/s6HILGkNhfxKC0oZHXSg5JpkNn8TRHQ=
=XQ5c
-----END PGP SIGNATURE-----