From: Raspbian automatic forward porter Date: Wed, 22 Jul 2026 02:22:04 +0000 (+0100) Subject: Merge version 3.7.0+really3.7.0-5+rpi1 and 3.7.0+really3.7.0-7 to produce 3.7.0+reall... X-Git-Tag: archive/raspbian/3.7.0+really3.7.0-7+rpi1^0 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=299e0cd217dbddc3ff9849b35ce9e1042d093b00;p=dcmtk.git Merge version 3.7.0+really3.7.0-5+rpi1 and 3.7.0+really3.7.0-7 to produce 3.7.0+really3.7.0-7+rpi1 --- 299e0cd217dbddc3ff9849b35ce9e1042d093b00 diff --cc debian/changelog index b40af147,dd60af9d..3b645ead --- a/debian/changelog +++ b/debian/changelog @@@ -1,9 -1,23 +1,30 @@@ - dcmtk (3.7.0+really3.7.0-5+rpi1) forky-staging; urgency=medium ++dcmtk (3.7.0+really3.7.0-7+rpi1) forky-staging; urgency=medium + + [changes brought forward from 3.6.7-13+rpi1 by Peter Michael Green at Wed, 19 Jun 2024 20:44:47 +0000] + * Disable stack clash protection, it causes assembler errors on raspbian. + - -- Raspbian forward porter Sun, 21 Jun 2026 15:41:30 +0000 ++ -- Raspbian forward porter Wed, 22 Jul 2026 02:22:04 +0000 ++ + dcmtk (3.7.0+really3.7.0-7) unstable; urgency=medium + + * d/patches/CVE-2026-*.patch: new security patches. + This change includes a patch queue addressing CVE-2026-50003, + CVE-2026-50254, CVE-2026-35505, CVE-2026-52868 and CVE-2026-44628. + The latter CVE-2026-44628 is divided into two patches to match + upstream's commits. These changes fix a range of issues, including + risks of path traversals, denial of services and information leaks. + (Closes: #1141411) + + -- Étienne Mollier Mon, 06 Jul 2026 22:39:03 +0200 + + dcmtk (3.7.0+really3.7.0-6) unstable; urgency=medium + + * CVE-2026-12805.patch: new: fix CVE-2026-12805. + This patch fixes a risk of buffer overflow by ensuring negative error + codes in XMLNode::parseFile are properly handled, as well a NULL + values. (Closes: #1140562) + + -- Étienne Mollier Mon, 22 Jun 2026 22:22:11 +0200 dcmtk (3.7.0+really3.7.0-5) unstable; urgency=high