-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 10 Aug 2026 11:20:12 +0100
Source: ostree
Architecture: source
Version: 2026.3-1
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Changes:
ostree (2026.3-1) unstable; urgency=medium
.
* New upstream release
- Prevent heap buffer overflow on 32-bit systems if downloading from an
attacker-controlled OSTree repository
(GHSA-xppc-j946-vcj7, RHEL-189207, no known CVE)
- Set memory limits for LZMA decoding to prevent resource exhaustion if
downloading from an attacker-controlled OSTree repository
(GHSA-7cgc-gp99-6jmm, RHEL-189208, no known CVE)
* d/libostree-1-1.symbols: Update
Checksums-Sha1:
7a61d48c76958aa0a48995c5336c6686300d1579 3659 ostree_2026.3-1.dsc
46b2822c93e56e9cf678f4314f1b1d986d066037 2165280 ostree_2026.3.orig.tar.xz
b580495177d1a6e926e60a91fe2a759f6fde371a 31836 ostree_2026.3-1.debian.tar.xz
41d395ec2808bda5aac9c52eba0dd9884b1d9224 4354928 ostree_2026.3-1.git.tar.xz
85e399434af49e8c6718593eda513867b285f8ed 17552 ostree_2026.3-1_source.buildinfo
Checksums-Sha256:
584ab87ec3565b3ae845ad58c9cee16ef5c06dc42a7fa35bc9be686af842ea04 3659 ostree_2026.3-1.dsc
e560e47631d1f703e9ed3425e8909ccd87fa2992422c07348ca88ec98943c8fb 2165280 ostree_2026.3.orig.tar.xz
ce396d26ff9f7deddbda198373419529cc8196e8c24e66f2552d45af08d70636 31836 ostree_2026.3-1.debian.tar.xz
8c965e3e9d19652a4f207a0e101f97384992b3f778283f91f322d95af688eb20 4354928 ostree_2026.3-1.git.tar.xz
a44d3fc373507160ee828d163513feb820d07cd1e6487c679a2da077a905936f 17552 ostree_2026.3-1_source.buildinfo
Files:
292336a57d9d300f855e4e46ce0ac9f9 3659 admin optional ostree_2026.3-1.dsc
e669c668266267a8566d3accad9f7c68 2165280 admin optional ostree_2026.3.orig.tar.xz
fe36a297053d2004d9f560e3aa825bdb 31836 admin optional ostree_2026.3-1.debian.tar.xz
9a61df59ec6529ad5f6ab76c8a787104 4354928 admin None ostree_2026.3-1.git.tar.xz
ad6e490391594292c67fb50486b1385e 17552 admin optional ostree_2026.3-1_source.buildinfo
Git-Tag-Info: tag=915e7e051618df3a7e81252acdbd60a57c6aec04 fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <smcv@debian.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmp54LkACgkQYG0ITkaD
wHmPeQ/+MP/VDo4qf/1Q/SDYCJ8WLw3Q2Pwro4WDxXhI7dE4tcmNCpwKnujcKyul
nVFj1PgHLJNKvCK/evZ29Nrogkm9xb6LFFHk/ewRzg4gJiaEzn4YD+fCaqbnmJ7x
FgJ8lPpNWNCzu7LDCR1X+zrB3PRkIfuJF3G3WW8rwG/OoOeRb/yM6VN9THkzsdtX
bz5Z7Zfxo5qALU7yjQwXYPV0AQWQf+rGfCA5wJ4nYCWMg7iqZ/bpPiIliUaE6an0
gbUfXnqmoN9E5JnuPjBJwrIMxCubtSxiFZER1qkoQK8eCQWgQgLbRbR4+DnKdXTt
TmZ25ibiBUjLVaOmQMXyy6y/oscpyHLOWRnTX1cJmoaZnXPRtEv2Y/BL9vUEE2M7
l3xn0WtTdkJqTA4AOnf8Q1ZKm2lMAOXS8KSsKGVMqWfD/KqiCG9XGCrTtLXDXrfP
GORRiwjE/3XyhRk7nyiP37lacw14N3fzGWoXBwhmc7atKxONgpfVaymKP/+A2Ol8
j1EohndaFHIhqnK+CPznGCwoGEYUrzcicVHUaLVd/PrKMT4lbR+pqePxTLaLxLeT
+DTSSDclTeZHbqtnEm8Ngpvdbt0Mu2ZsJmOXoqPJVwSXQ7cun/nxIdNGkSKrCjAt
EGRNWRqmGs3do8D/a1X6KCbwmQIC3V09VFKNedbH1Wd2/cb98kQ=
=W+o7
-----END PGP SIGNATURE-----
