From: Simon McVittie <smcv@debian.org>
Date: Thu, 20 Aug 2026 18:02:43 +0000 (+0100)
Subject: Update changelog
X-Git-Tag: archive/raspbian/2026.4-1+rpi1^2~6
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=7fb9c616b0746fddffe3fd45ba3120e3edf49966;p=ostree.git

Update changelog
---

diff --git a/debian/changelog b/debian/changelog
index 9f6a3901..8fe0205f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,9 +3,15 @@ ostree (2026.4-1) UNRELEASED; urgency=medium
   * New upstream release
     - Fix regression when downloading large Flatpak apps/runtimes
       (reopens: #1144105) (Closes: #1144283)
+  * d/p/static-delta-validate-bspatch-payload-offset-and-length.patch:
+    Add post-release patch to fix offset validation.
+    This was an out-of-bounds read when downloading from a
+    malicious/crafted ostree repository, but is not believed to
+    be practically exploitable for anything worse than a crash
+    (denial-of-service).
   * Mention #1144105, #1144106 in previous changelog entry
 
- -- Simon McVittie <smcv@debian.org>  Tue, 11 Aug 2026 10:25:22 +0100
+ -- Simon McVittie <smcv@debian.org>  Thu, 20 Aug 2026 19:02:09 +0100
 
 ostree (2026.3-1) unstable; urgency=medium