From: Raspbian automatic forward porter <root@raspbian.org>
Date: Thu, 1 Oct 2026 22:41:53 +0000 (+0100)
Subject: Merge version 1.0.11-1+rpi1+deb12u2 and 1.0.11-1+deb12u3 to produce 1.0.11-1+rpi1... 
X-Git-Tag: archive/raspbian/1.0.11-1+rpi1+deb12u3^0
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=531b98a1c5ef913143d7f40d655214d495d2a117;p=libde265.git

Merge version 1.0.11-1+rpi1+deb12u2 and 1.0.11-1+deb12u3 to produce 1.0.11-1+rpi1+deb12u3
---

531b98a1c5ef913143d7f40d655214d495d2a117
diff --cc debian/changelog
index b920c38,1f4cc63..761154e
--- a/debian/changelog
+++ b/debian/changelog
@@@ -1,9 -1,25 +1,32 @@@
- libde265 (1.0.11-1+rpi1+deb12u2) bookworm-staging; urgency=medium
++libde265 (1.0.11-1+rpi1+deb12u3) bookworm-staging; urgency=medium
 +
 +  [changes brought forward from 1.0.2-1+rpi1 by Peter Michael Green <plugwash@raspbian.org> at Sun, 04 Oct 2015 21:44:10 +0000]
 +  * Disable neon.
 +
-  -- Raspbian forward porter <root@raspbian.org>  Mon, 18 May 2026 21:34:11 +0000
++ -- Raspbian forward porter <root@raspbian.org>  Thu, 01 Oct 2026 22:41:52 +0000
++
+ libde265 (1.0.11-1+deb12u3) bookworm-security; urgency=high
+ 
+   * Non-maintainer upload by the LTS Team.
+   * Backport fixes for:
+     - CVE-2023-51792 - Buffer-Overflow
+     - CVE-2026-33164 - DoS (crash) (Closes: #1131469)
+     - CVE-2026-33165 - heap out-of-bounds write (Closes: #1131468)
+     - CVE-2024-38949 - Heap Buffer Overflow (Closes: #1074416)
+     - CVE-2024-38950 - Heap Buffer Overflow (same bug/patch as 2024-38949)
+     - CVE-2024-45382 - Heap Buffer Read Overflow
+     - CVE-2026-45383 - Heap Buffer Read Overflow
+     - CVE-2026-49295 - Out-of-bounds write (Closes: #1140431)
+     - CVE-2026-49337 - Unbounded memory accumulation (also #1140431)
+     - CVE-2026-49346 - Heap buffer overflow (also #1140431)
+     - CVE-2026-54240 - Heap Buffer Overflow
+     - CVE-2026-54241 - Heap Buffer Overflow
+   * Backport security fixes without CVE assigned yet:
+     - GHSA-xp3h-6f5r-8cxp - Use after free / double free
+       in concurrent execution enviornments (race conditions)
+     - GHSA-mm7m-v26f-wf8x - heap-use-after-free
+ 
+  -- Tobias Frost <tobi@debian.org>  Sun, 20 Sep 2026 13:47:08 +0200
  
  libde265 (1.0.11-1+deb12u2) bookworm; urgency=medium
  
diff --cc debian/patches/series
index 3a7f904,7d2182d..11a031e
--- a/debian/patches/series
+++ b/debian/patches/series
@@@ -11,4 -11,16 +11,15 @@@ CVE-2023-47471.patc
  CVE-2023-49465.patch
  CVE-2023-49467.patch
  CVE-2023-49468.patch
 -
+ CVE-2023-51792.patch
+ CVE-2026-33164+33165.patch
+ CVE-2024-38949+CVE-2024-38950.patch
+ CVE-2026-45382.patch
+ CVE-2026-45383.patch
+ CVE-2026-49295.patch
+ CVE-2026-49337.patch
+ CVE-2026-49346.patch
+ CVE-2026-54240_CVE-2026-54241.patch
+ TEMP-0000000-BB5891.patch
+ TEMP-0000000-E66AA0.patch
 +disable-neon.patch