-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Wed, 07 Oct 2026 21:01:07 +0200 Source: opencolorio Binary: libopencolorio-dev libopencolorio2.6 libopencolorio2.6-dbgsym opencolorio-tools python3-pyopencolorio Architecture: source amd64 Version: 2.6.0+dfsg-1 Distribution: experimental Urgency: medium Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org> Changed-By: Matteo F. Vescovi <mfv@debian.org> Description: libopencolorio-dev - complete color management solution - development libopencolorio2.6 - complete color management solution - runtime opencolorio-tools - complete color management solution - utilities python3-pyopencolorio - complete color management solution - Python bindings Closes: 1141498 Changes: opencolorio (2.6.0+dfsg-1) experimental; urgency=medium . * New upstream release (Closes: #1141498) This release fixes CVE-2026-42450: | OpenColorIO is a color management framework for visual effects and | animation. Prior to version 2.5.2, `FileFormatSpi3D.cpp:163` uses | `sscanf` with `%s` into 64-byte stack buffers when parsing LUT data | lines. Input comes from `lineBuffer[4096]`, so a crafted .spi3d file | can overflow by ~4000 bytes on non-Windows. * debian/: SONAME bump 2.5 -> 2.6 * debian/control: debhelper bump 13 -> 14 * debian/control: S-V bump 4.7.3 -> 4.7.4 (no changes needed) Checksums-Sha1: 7b00c18ca1b338273ac64eddd34c09e58f1a93f4 2983 opencolorio_2.6.0+dfsg-1.dsc ef31b8bc33e62e245788b71d07076e1d7cceafb9 10227756 opencolorio_2.6.0+dfsg.orig.tar.xz 5fc67ae2e6820bf116a2d5615fa105f58fc147ef 18492 opencolorio_2.6.0+dfsg-1.debian.tar.xz b5ac390dfb1dcc76ea718aed8a8c5240fb3e7c7d 87952 libopencolorio-dev_2.6.0+dfsg-1_amd64.deb 67682044a99f145a05cff52fc5703182b3f89968 36722708 libopencolorio2.6-dbgsym_2.6.0+dfsg-1_amd64.deb 0fb828307336fd71934e4c0023c07339054d34b5 2081348 libopencolorio2.6_2.6.0+dfsg-1_amd64.deb 0a3d08e7fa243090d42957e1d6ceec32eca4d28f 197628 opencolorio-tools_2.6.0+dfsg-1_amd64.deb 3df13f9d4fe4c06f351a520cff7973689e807aab 17282 opencolorio_2.6.0+dfsg-1_amd64.buildinfo 635dab401baedffb8f10220bfa5638bc797119c7 1210224 python3-pyopencolorio_2.6.0+dfsg-1_amd64.deb Checksums-Sha256: dc9cbb68b3b31b0107f111df1ef2c84b15a22d39ee4f98fc371c41afce202ae9 2983 opencolorio_2.6.0+dfsg-1.dsc 655b6d8ce11424fc64d6cd58f6d3f598aacc79d375d46b67cce77084b665850b 10227756 opencolorio_2.6.0+dfsg.orig.tar.xz c47aaaaf7c71f600d6f35fe207eaea7fc15eed9c2c252880ef920703e1ae7417 18492 opencolorio_2.6.0+dfsg-1.debian.tar.xz 0caf451912cd25d727a8d9d1526dffd564b932c4d31f4dc86520f78c3e784d63 87952 libopencolorio-dev_2.6.0+dfsg-1_amd64.deb 0aa3d8628445d0e58743600a5d2eac83a57bd9401434801f32934904192a4eac 36722708 libopencolorio2.6-dbgsym_2.6.0+dfsg-1_amd64.deb de4e077568b3a41935a464192347016167915db90be3ea73ae7b95250b89584c 2081348 libopencolorio2.6_2.6.0+dfsg-1_amd64.deb 510bb4e16526a25c4d61bf895f27a52bc611eaae772fb0952f713687da219d14 197628 opencolorio-tools_2.6.0+dfsg-1_amd64.deb 82391b2ec38c1c33eb868782a437fc11c7980d3930395d331d02aff8d4d34e62 17282 opencolorio_2.6.0+dfsg-1_amd64.buildinfo a745b89e4e66b4362fe47e17a0888fc73b60932c797686e403becfc9847828a0 1210224 python3-pyopencolorio_2.6.0+dfsg-1_amd64.deb Files: aec5fedd8b001b7e77b2e25a097ebea8 2983 libs optional opencolorio_2.6.0+dfsg-1.dsc 2129f8ccf5f21638a900bf354833cdb9 10227756 libs optional opencolorio_2.6.0+dfsg.orig.tar.xz 2ead9b0dc1a5100cd33dd656e4d01316 18492 libs optional opencolorio_2.6.0+dfsg-1.debian.tar.xz 415b03428a30efda19cd79483bd9a3ca 87952 libdevel optional libopencolorio-dev_2.6.0+dfsg-1_amd64.deb 14246b3ef09471deeeb4c6547fd70baf 36722708 debug optional libopencolorio2.6-dbgsym_2.6.0+dfsg-1_amd64.deb 3a303ca9f56b9b568d570fbb89543b6d 2081348 libs optional libopencolorio2.6_2.6.0+dfsg-1_amd64.deb 233814f5619020fc8ffb44c87fed06ee 197628 utils optional opencolorio-tools_2.6.0+dfsg-1_amd64.deb 5d51c6baa72862a7b7ffbc5309c3e264 17282 libs optional opencolorio_2.6.0+dfsg-1_amd64.buildinfo f075945036b01444e9a4ab4ce436a524 1210224 python optional python3-pyopencolorio_2.6.0+dfsg-1_amd64.deb -----BEGIN PGP SIGNATURE----- Comment: Debian powered! iQKTBAEBCgB9FiEE890J+NqH0d9QRsmbBhL0lE7NzVoFAmrGnEpfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEYz REQwOUY4REE4N0QxREY1MDQ2Qzk5QjA2MTJGNDk0NEVDRENENUEACgkQBhL0lE7N zVrQWA//bM6qOaxw7V/BtKmTK9c37LTG6uSkVkSzSTiA6dFvcXj+ET/DFxAx1Mlw 71kx0XT3ZClS50ChZ5r07fslJK+y3SUKjPCCNHoEQk5JLpmCoGbvLI+RogKP7N7H 3cnv75xJJIUIXEDcaskWv5EhqU2jZkCRpont0T31tNp3Uu4IIQLDjtma4dQ+n8cN lo94BVuiPmhtn/Hrnoo2xFJkAWs+hHzV3VuicmkUjNuYkdD8qD63+Tbgde56gVoi ehhWQxH33lTjSPUcev3dBiYRYDdPc3Fo33hjy6gLFoNxhjrZHfjqAA7QGLV0Ribr 7F/OO1fY9U63QdjG+9C70r6xHYIL6ELkrFDJyQROSqQQx8DkcrIQpxMP2OTdx84k 5XrzBebWHdE7WavtjOgp68ZRNhHa+UBJO4hN6bPOEJkjrCNxz/UJfsMTgSbglNux e05cb1PBzM8EskpDZZJYWQ9ju58AXEBpCf5LdSDux+87YhVctMsJZTMTrJThVBKQ UeEYx3Z1CRrGEG3HVtwVETJGmD3+DI5vSN88Z7OTjg3qSULtA3C70JrwJgzkp5qH QGB+wEb6Da0f+VxYn3f7YpkGecQZVS1zPLrxaxvm547+e8M5DbLqpdciiu3+jqmG CNEmWWjrOQxCSWXhoIxPG1Dtm7ICmgz1JeIPYjsIGEQh0H8KQQc= =O5M8 -----END PGP SIGNATURE-----
