From: Simon McVittie <smcv@debian.org>
Date: Mon, 10 Aug 2026 10:19:29 +0000 (+0100)
Subject: Update changelog
X-Git-Tag: archive/raspbian/2026.4-1+rpi1^2~13
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=929a17f0a211964107d804516d1c2dd223e4f947;p=ostree.git

Update changelog
---

diff --git a/debian/changelog b/debian/changelog
index 13cc1b8e..bfe92558 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,10 +1,12 @@
 ostree (2026.3-1) UNRELEASED; urgency=medium
 
   * New upstream release
-    - Prevent heap buffer overflow on 32-bit systems
-      (RHEL-189207, no known CVE)
-    - Set memory limits for LZMA decoding to prevent resource exhaustion
-      (RHEL-189208, no known CVE)
+    - Prevent heap buffer overflow on 32-bit systems if downloading from an
+      attacker-controlled OSTree repository
+      (GHSA-xppc-j946-vcj7, RHEL-189207, no known CVE)
+    - Set memory limits for LZMA decoding to prevent resource exhaustion if
+      downloading from an attacker-controlled OSTree repository
+      (GHSA-7cgc-gp99-6jmm, RHEL-189208, no known CVE)
 
  -- Simon McVittie <smcv@debian.org>  Mon, 10 Aug 2026 11:09:00 +0100