-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 05 Sep 2026 19:08:11 +0200
Source: aom
Architecture: source
Version: 3.6.0-1+deb12u3
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
Changed-By: Andreas Henriksson <andreas@fatal.se>
Changes:
aom (3.6.0-1+deb12u3) bookworm-security; urgency=medium
.
* Non-maintainer upload by the LTS Team.
* Backport upstream security fixes for four encoder vulnerabilities.
- debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
Validate the spatial and temporal layer ids passed to the
AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
against the configured number of layers.
Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
- debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
a compacting sliding window in Look-Ahead Processing mode and correct an
off-by-one in the rest_frames computation, fixing an out-of-bounds
access to the first-pass stats array triggered by a small
g_lag_in_frames (CVE-2026-56208).
* debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
Reject SVC spatial and temporal layer counts outside the supported range
in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
invalid parameter rather than relying on an assert() for the fixed-SVC
layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
included here because the layer id validation added above derives its
bounds from these counts.
Checksums-Sha1:
670c9faf9ac4ac8111ce07501702573b1a29fb49 2239 aom_3.6.0-1+deb12u3.dsc
59674bda5736ee0743bdbcbcead266535a8164eb 5268170 aom_3.6.0.orig.tar.gz
970b35b0a1fdeeefd51fffd548e2ad66eb3221fa 28012 aom_3.6.0-1+deb12u3.debian.tar.xz
f20c0082572abc002ba18c8c009639cc38de17cb 7499 aom_3.6.0-1+deb12u3_source.buildinfo
Checksums-Sha256:
8d11a3b529c65d55f11cf85244e2826d2e249e8dc7f4c484cb13370313a3b235 2239 aom_3.6.0-1+deb12u3.dsc
2ba213822cb1528b5558d6727125654e14d1b2d7505bd1fc8afa36c2e9e9f94a 5268170 aom_3.6.0.orig.tar.gz
79ae3cf9a422308fce165b018866307e4b5592dfe7d34774e4f7ab8899f52011 28012 aom_3.6.0-1+deb12u3.debian.tar.xz
502bd83ad692d0e87d63f5a089f478ccd03646b3a701f2102cee764bd7a7d6c4 7499 aom_3.6.0-1+deb12u3_source.buildinfo
Files:
63877912ded9352c371bcab57929d074 2239 video optional aom_3.6.0-1+deb12u3.dsc
25c85e7801cdb30b36969ee8e8cd46fc 5268170 video optional aom_3.6.0.orig.tar.gz
942dd1ef23b499fa3168da96821df286 28012 video optional aom_3.6.0-1+deb12u3.debian.tar.xz
18611589a9876d17e047a13e9949940c 7499 video optional aom_3.6.0-1+deb12u3_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE+uHltkZSvnmOJ4zCC8R9xk0TUwYFAmqdTIAACgkQC8R9xk0T
UwbXeA//TJxCCeQKtdYsKzn2YxXuqo7UJSscdJ2d0ew5BUAGSt1QfaZs5EOa107F
qXb9JhTyZgareh0VF+GXYFcwfcC+sxUKoe6Xo8fgsIA5Jv1xTbjBpb/d7kvEVuQo
+YJKky1jDZSHliKdNf97wEoKFBrWYjhpGLvanXy8WnTkxzO2lWNk0gsZ3f3UTVno
biItBrErdtEG99WAJk6Gh2CJ413CI5t88m5Q+2Nqs5j/WFbV/Iy0JIE4JXTDY5Ry
JQXM31/SQjsD9wP/CR0aJZvwxYJgQXnaIGkvV8RSkUbGH22d+57NlPRjs6eK5H1p
gLAB5CXYwCrPX30c2t/m/DrYLS4V3Zjf9oU4ueEK4vHU3ehiAkTnN7AndNlkqX4C
C3vso5xatfrcjDzV0D6uLYDDj79BWXS+2JvlMy/y9ic5afryk/W1C6IWl11SUoJg
ztNRgyI7IJ153XYDsXVi2WjpITnuhK5MVvicMl8VVyld/nRztpE2nzd+s5f3Eztt
PmVBkyC+pYDiYmCcnOr7C9hQW7ijE8BzNY/2qumf+jtX6kjOL3hjhyXbK1ATjKoJ
KNMfK5l1Gmh2StWioQbpB9FPCOKfZvE1zsFnn1c9HnNtCFYcQMy7tlWKGrx0M8L+
rscSnRfc1Fo4Rq7IEwNpwhSZcfxLFh18pC9iro7lx4WzPQhhq5k=
=/9iA
-----END PGP SIGNATURE-----
