-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Fri, 10 Jul 2026 16:34:09 +0200 Source: tiff Architecture: source Version: 4.7.0-3+deb13u3 Distribution: trixie-security Urgency: high Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org> Changed-By: Salvatore Bonaccorso <carnil@debian.org> Closes: 1141320 Changes: tiff (4.7.0-3+deb13u3) trixie-security; urgency=high . * Non-maintainer upload by the Security Team. * Address heap-based buffer overflow in pixarlog (CVE-2026-12912) (Closes: #1141320) - pixarlog: fix heap-buffer-overflow in 8BITABGR decode with stride 3 - pixarlog: add comment explaining 4-byte advance in ABGR decode - pixarlog: complete ABGR bounds check for multi-row strip decoding - pixarlog: error out on invalid ABGR output buffer sizes Checksums-Sha1: f3d03d9c9d01c0dde179979004ce2d29889acdbc 2442 tiff_4.7.0-3+deb13u3.dsc 7189a4f61dbaa8e9bc60ee72c63e335be7008d62 28212 tiff_4.7.0-3+deb13u3.debian.tar.xz caa0302d83539ecebacf9de9e8c462eca49a80d9 6300 tiff_4.7.0-3+deb13u3_source.buildinfo Checksums-Sha256: 51cdbd32322b5d35ef35677ace1cb7cd6591325da4ecd470ec6ccefab47d6a29 2442 tiff_4.7.0-3+deb13u3.dsc c0cbcb717e20a69964bfa7471cbb0137dd39a451434932972bc7fbcdb86345f8 28212 tiff_4.7.0-3+deb13u3.debian.tar.xz 12b3f217f1089247d721d3627698106b9b759ac4dce652d28c18afc1193ec0e8 6300 tiff_4.7.0-3+deb13u3_source.buildinfo Files: 7a3f9a3291c5472eca3d88db16fe2a17 2442 libs optional tiff_4.7.0-3+deb13u3.dsc abfac5faff6c0a86a31a97e79da7046d 28212 libs optional tiff_4.7.0-3+deb13u3.debian.tar.xz a2c060cbb8bcdd2c85b68722eed44bca 6300 libs optional tiff_4.7.0-3+deb13u3_source.buildinfo -----BEGIN PGP SIGNATURE----- iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmpb48hfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89E7G8P/RVbYOELKkX4YffwXdcY/Uke6Oi5CXCr Bp3kRH/jECZLSHMKtWhBpeU3k04MPqCYZUKTimboVZLmfn/1KhmYL3XoRRrUy0qD qN+CxS8PaVIydpL12BNpsAOAPQKrH5Of0rfbssqUeycL1+qfyZrzdQD6YTCSwMlX vvc5fx12angNIS9YijA9PMYVbSH99vVy+HZkKnnECnjOc8NHXbSiGzKk52fz242t TlxzmW+Cgtb8n6RXAOd+IPnDjXIimnuaJY9wJl+40LvB6miDFBR0zD25IbmFdAPG l7W3tfS3LsY4BaL/6+3RrxSxBINZFuUWLZs/pWrcbAP3QaCPAu5ZKAUFIHJafSO/ W536VbNW5Og4qf71m1IRONL+xD/5/l78jKYbacfgMFDs8tCCqkvJty4Mf0z49MmQ 2zezGfuJTXFuMROQNJyZeC0XPMZMc77OW1M+5nTkC88GaIOAkiVP41FpLiehoMXd YSTCIiGGemMKFrEN46URoGQrAjpsY5viQdv3K86w2H192Vizzk8r15lo790tvPnp r8MNC6HopI/ZQmkZ6P2wPoLWFVTS8yMxIh5h5/D4aA288ttStv5HVaB4NfZMKbur h6XTRQ0zsew8dJ5odjtXevG98I9EKvVS89QPD5cNVP4et0N6gKv+Z4C9GgKhvo5o 7UvUbcaR18Du =NVhi -----END PGP SIGNATURE-----
