-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 07 Nov 2026 19:53:34 +0300 Source: qtbase-opensource-src Architecture: source Version: 5.15.19+dfsg-7 Distribution: unstable Urgency: medium Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org> Changed-By: Dmitry Shachnev <mitya57@debian.org> Closes: 1151189 1152313 1152937 Changes: qtbase-opensource-src (5.15.19+dfsg-7) unstable; urgency=medium . * Backport upstream patch to prevent out-of-bounds read in QJsonDocument fromBinaryData (CVE-2026-101201, closes: #1152313). * Backport upstream patch to fix crash converting an empty URL CBOR tag to JSON (CVE-2026-105924, closes: #1152937). * Backport upstream patch to fix crash when fontconfig fallback pattern has no charset (closes: #1151189). Checksums-Sha1: 3d2f98d5c23d0fa60f5b6a09fe8ff6b5d17438d3 5470 qtbase-opensource-src_5.15.19+dfsg-7.dsc 8c703ee587cf63c938ecfea6c655bf50afc85a23 240064 qtbase-opensource-src_5.15.19+dfsg-7.debian.tar.xz fee64825947bbe4479dbac6a702d1f5048071d63 17995 qtbase-opensource-src_5.15.19+dfsg-7_source.buildinfo Checksums-Sha256: 2172e8d35ead304f624ecbd8cc734e0dc321dc8ecb272837a4e86af2db1873ba 5470 qtbase-opensource-src_5.15.19+dfsg-7.dsc a65ebcca7a40b767b91661619fdbbbb31861e878125d8e3954960d0c4e4f7131 240064 qtbase-opensource-src_5.15.19+dfsg-7.debian.tar.xz 9b818e04254cf3724ad5fe93b40122fc0ab576ced1b90423f42ea64c1086f7ff 17995 qtbase-opensource-src_5.15.19+dfsg-7_source.buildinfo Files: 92d6235e24601bc0c314d429567fff99 5470 libs optional qtbase-opensource-src_5.15.19+dfsg-7.dsc 38033e6d04c7ecf996969baa25d97d9e 240064 libs optional qtbase-opensource-src_5.15.19+dfsg-7.debian.tar.xz 86d6b3eb5c7f9daf85ade9595bce567f 17995 libs optional qtbase-opensource-src_5.15.19+dfsg-7_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJHBAEBCgAxFiEE8kKZ/xu8kBi5BqTLYCaTbS8ciuAFAmrvWKgTHG1pdHlhNTdA ZGViaWFuLm9yZwAKCRBgJpNtLxyK4Db1D/40D6zSZimuXA9A2wJeHdGrkFK+thl8 VRVC/kL9kd+HrH2YzkaA6FRpv4nCI7IpSJmMSd9E/4FmAqs67G/00VyZ+aCY/u3z kQNjD0x2OgldfUbQdUvcep2y1MLrUiUXIkZXmIjGReCwKpxVZ+wrXavUPESwd90X HvsnKEivEPk+MJIHGpt6zp/V8PiNHCFt68DZs4DmiOUq29SZobfpA1i50KjLHJH+ S8FaO2BIGmWlJzKcjlXvoNPy7FtPPfcRtgdkQffZ2WOZEOEkRWLZlNOk21PmYCX9 yG0HxVCKjtBaUOKwLaYIcq7xKutWsm7EU9JQtubCmJbaEC+cPlNfbv1b7zTIyLGR TkgtjUZxuBW3aFljO5YbEIFvFUym2wchhO7ycYM4ucRR19Zl9yTOBK8JIrlG80yO bL7nDpysaZSJ/mxMrAmmVp6Q8Cpgr4eEP1NIWQbXm5inDVwf/SBcHVJxEfAw0HDb J3UvcU8OnkjXRsa9N+FYEX4E/E0l+6tvz2CwCDXyGDNUHYbF1YYWvWtWXwHzoVf9 36npCnFNKtt1dC0hGho9wtvO/AEXTo3sLFYCcywTHrn0HwaPiYfPuQUA1WgpQS9Z GlzwaMjf8dDlr3LBUBHr03/sisfsjHXc91SCoWOG1RUp1ux/A/jOJPc30WyZui6K 6uEy0m77OHEDbA== =qnQs -----END PGP SIGNATURE-----
