-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 02 Aug 2026 17:22:30 +0100 Source: glib2.0 Architecture: source Version: 2.88.3-2 Distribution: unstable Urgency: medium Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1141316 Changes: glib2.0 (2.88.3-2) unstable; urgency=medium . * Backport patches from 2.89.0 to harden D-Bus introspection parsing - d/p/gdbusintrospection-Add-some-assertions-before-array-deref.patch, d/p/tests-Improve-D-Bus-introspection-test-paths.patch, d/p/gdbusintrospection-Fix-XML-parser-state-handling-for-node.patch, d/p/fuzzing-Add-a-fuzz-test-for-g_dbus_node_info_new_for_xml.patch: Avoid a possible integer underflow if parsing malformed D-Bus introspection XML sent by a malicious service (glib#3932 upstream, CVE-2026-58016, Closes: #1141316) * d/tests/1065022-futureproofing: Make the test pass more reliably, by ensuring that user-session-migration gets removed rather than making libglib2.0-0t64 be reinstalled Checksums-Sha1: bf8c4ac06a9768582eff50dab4f29167ef919fed 5091 glib2.0_2.88.3-2.dsc 2a94b1e955cb1d31060f7240e8a7638c4519508e 145756 glib2.0_2.88.3-2.debian.tar.xz dff7f5b14b7cf6f15df098165b5d865ae224238c 15779444 glib2.0_2.88.3-2.git.tar.xz 40080502c431a3abaf23569f7a600bdc40973aa7 17556 glib2.0_2.88.3-2_source.buildinfo Checksums-Sha256: adc31bd6d4cb8684ca244c002465ea86d2a5be7f115e1ac6aeb48699f174bed6 5091 glib2.0_2.88.3-2.dsc 56cd728ff13c1d5b39ab9cf8001df330b1858054588e8490b34bff24a68b2010 145756 glib2.0_2.88.3-2.debian.tar.xz 9a25b1ee4914d57ee04f143239b23486c04df60165db9603b961583ef0ab9da4 15779444 glib2.0_2.88.3-2.git.tar.xz 5b5b7a465fba88fbce71f291c509b11b956058e95fe97ef08a80548c1002e83c 17556 glib2.0_2.88.3-2_source.buildinfo Files: c777505340d1585e560c7d32e80dc0ab 5091 libs optional glib2.0_2.88.3-2.dsc 491231247db8881178eff0807bf25431 145756 libs optional glib2.0_2.88.3-2.debian.tar.xz 7cece885a14f39308f253b27d6eee951 15779444 libs None glib2.0_2.88.3-2.git.tar.xz 846a668d2b31cb74fd555617b7dffdea 17556 libs optional glib2.0_2.88.3-2_source.buildinfo Git-Tag-Info: tag=054c63f5a9a53068744420901b2bd3ff3a3142d8 fp=7a073ad1ae694fa25bff62e5235c099d3eb33076 Git-Tag-Tagger: Simon McVittie <smcv@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmpvcAUACgkQYG0ITkaD wHnJ6RAAhBkvN7y95tekj8e1JQgcocvVo7NoafV0svkHeuZ78GPajJXNEcT325gH iYM8CkLSf/RPJJyYjQWHkdqPL7ToUSXoNBMRylkilk2ys5j9v75/ppIw/BOVHOOr 5ty8uJBJFR5G+8B5GjkCBOHjzwfvpmR7Og/uopFFDGICBvsSrUksYL+aEn2LuaS9 +1QG/eSiE0xHj397rv2MruVEZYkwvH4INlySEHWDMq4BdZ9TpOEOhsb5oi7qKswD lhmMHjhiPEAQix4BAfZx7IcZfjy85+yG7x9whix90nvwKeIbqXrIXgljnCpKiISe jp3rRXJmwaFgGRPUey5sW5J/TvPQ6B4aMWd532qXVREI87sUMYvWXNkm2ow09u4U evGrlaJjp57QC2BcONX0In7sN6esDTYOAMhH1rHlIhs0S+jLHiIpztUem9sV2hb+ Ucw7UONGGhcob+9JzeruQT15W3vBm4c8QhWhuSA3+ytEw1ERKZmWL7QBoNQWZFqm 3RKaJjMWWHMlIFp5q1n6Plrk0iiwClRfDLg4gTwz1GXcYrVRa36I2t67UcK4I5if x0IbSZg79ES5V0D5+BU+vSxOw1HACpC+WKfNc40xoun4GpfFLfiOYGf5sRGUezll 98iziz4YvWGwP6+Ty0VpWDztjwuNElscz0xPw2OUXVBhxrqpj04= =JvEb -----END PGP SIGNATURE-----
