-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: s390x
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: s390x Build Daemon (zandonai) <buildd_s390x-zandonai@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 6d11171e45a85a889df812ce328c03fdb81f3877 418376 aom-tools-dbgsym_3.12.1-1+deb13u1_s390x.deb
 e5a240af2e01ad7773e9acb44a608195469ebed3 115596 aom-tools_3.12.1-1+deb13u1_s390x.deb
 f72042607b98235c14998b5be8ea7456c8e2dff9 13564 aom_3.12.1-1+deb13u1_s390x-buildd.buildinfo
 6733c73e8391075df1c22923754398a6431f8445 1497704 libaom-dev_3.12.1-1+deb13u1_s390x.deb
 b7cda60b3a205895fb55ab6976bbf286a99e988b 4631272 libaom3-dbgsym_3.12.1-1+deb13u1_s390x.deb
 74f76176bf871535268cc7abcaec30d2fe50bfe8 1334924 libaom3_3.12.1-1+deb13u1_s390x.deb
Checksums-Sha256:
 3e39d2158c3c7d700fba839af58b9dbfee898e75252ecaf6db853f30f70b5379 418376 aom-tools-dbgsym_3.12.1-1+deb13u1_s390x.deb
 2eb43a30c6b4882454bcd2b56536a4cce4f0105dd3485991ea520e73f2f203b3 115596 aom-tools_3.12.1-1+deb13u1_s390x.deb
 41cac92ba0bbef868a9b7ea4458d1ec8819a70c1e166f46d3cdb65a1553319eb 13564 aom_3.12.1-1+deb13u1_s390x-buildd.buildinfo
 c7eddf78b8338055f214ec0d86ef3cb210d016d4b23f6d098be3984fc4dde9de 1497704 libaom-dev_3.12.1-1+deb13u1_s390x.deb
 28b8d14b966198b92831becfb40ee53a33dc48ab44483065209fe2ef228988a7 4631272 libaom3-dbgsym_3.12.1-1+deb13u1_s390x.deb
 f9b2f87ac3f40ca89c78a5de165ff66f730820d7b04fe2345c0162d3f698ac8f 1334924 libaom3_3.12.1-1+deb13u1_s390x.deb
Files:
 ddc5bbfd279af3323ef8329563ad1890 418376 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_s390x.deb
 373f4695a406d537a8a947c4bcfcc426 115596 video optional aom-tools_3.12.1-1+deb13u1_s390x.deb
 e25a177d4769738aa7bd2b4a3c67a080 13564 video optional aom_3.12.1-1+deb13u1_s390x-buildd.buildinfo
 08507256449af947b16d82494ae722f9 1497704 libdevel optional libaom-dev_3.12.1-1+deb13u1_s390x.deb
 f4c835b60d79a43877c808bd3acc34dd 4631272 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_s390x.deb
 f2ce23630960ae143602cb189cd72222 1334924 libs optional libaom3_3.12.1-1+deb13u1_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEENly2ANlpa4eeqnluvVOPI7pYNpgFAmpxwA4ACgkQvVOPI7pY
NpiUWw/+JnLbQtO3qbbAC8rnvltc1hKyGzoINEUMd2hou/Mafwqgds+Z3PgH00yt
uVqk1ihFmq76Q1dUughbdzJRAswwXdwkf0N30Yu0UdPb+tZc0/v5Vn4lZDYslqj6
x1QiNXkzRJvED86LA+nn2jijYWWl5aOoyZnS6PqkafOe0ELFq1LgbjR6UNMBM1mS
Cvr9GNmXbYMCmum2SmH3NGUdkHGwkVaryO6NwGbf/s36u7o2mdLKl/QFIOFyq6kF
51R+syMWBDgLa2BqWjV039yoh6iGdcBQfCb17w25Qqpcv4fxYx/snWWA6k6fiIL9
bWeHb3zFD7+qll6tpBwaF1ONcSOmkk4tG1mSwYvG0FvbXXWeiSQi9KqczjJRtQs5
khK6L23aQMhgtMDZ535odnl/5sCjnt5cPmG91S1DYBraNrWsJaRPSG5ngKRvJ1Tq
qe9AWAMHszyyWrwyokxU4d9dcR4QEI4aXsG9SluA+PiwmyF+sAAbCLhFqmMhdQQh
jS73XyJRzT97PxULLJKIdm2fJRCnsW7bUhOVa8WoXQw/BNkzOteCUfZ9Q4I8vKaU
M6A4wGq/bNFrLBq+KZdTewsOrrs4MZYW8STeF82SXt0+a8xz3zRzvD6xJI3hZ3Rt
hzonqW3kLei5i5KiMiR2jp2U8FXkIWjY2OXREScYaOYATR8yXeM=
=CEg0
-----END PGP SIGNATURE-----