From: Raspbian automatic forward porter Date: Tue, 8 Sep 2026 04:50:59 +0000 (+0100) Subject: Merge version 2026.2-1+rpi1 and 2026.4-1 to produce 2026.4-1+rpi1 X-Git-Tag: archive/raspbian/2026.4-1+rpi1^0 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=efec9db4ff4d0790069848cbc0de77fe73cbc1a5;p=ostree.git Merge version 2026.2-1+rpi1 and 2026.4-1 to produce 2026.4-1+rpi1 --- efec9db4ff4d0790069848cbc0de77fe73cbc1a5 diff --cc debian/changelog index a2a9725f,f9710f35..68f9800b --- a/debian/changelog +++ b/debian/changelog @@@ -1,9 -1,30 +1,37 @@@ - ostree (2026.2-1+rpi1) forky-staging; urgency=medium ++ostree (2026.4-1+rpi1) forky-staging; urgency=medium + + [changes brought forward from 2020.8-2+rpi1 by Peter Michael Green at Tue, 15 Dec 2020 11:54:45 +0000] + * Disable testsuite. + - -- Raspbian forward porter Wed, 22 Jul 2026 03:14:28 +0000 ++ -- Raspbian forward porter Tue, 08 Sep 2026 04:50:59 +0000 ++ + ostree (2026.4-1) unstable; urgency=medium + + * New upstream release + - Fix regression when downloading large Flatpak apps/runtimes + (reopens: #1144105) (Closes: #1144283) + * d/p/static-delta-validate-bspatch-payload-offset-and-length.patch: + Add post-release patch to fix offset validation. + This was an out-of-bounds read when downloading from a + malicious/crafted ostree repository, but is not believed to + be practically exploitable for anything worse than a crash + (denial-of-service). + * Mention #1144105, #1144106 in previous changelog entry + + -- Simon McVittie Thu, 20 Aug 2026 20:16:44 +0100 + + ostree (2026.3-1) unstable; urgency=medium + + * New upstream release + - Prevent heap buffer overflow on 32-bit systems if downloading from an + attacker-controlled OSTree repository + (GHSA-xppc-j946-vcj7, RHEL-189207, no known CVE; Closes: #1144106) + - Set memory limits for LZMA decoding to prevent resource exhaustion if + downloading from an attacker-controlled OSTree repository + (GHSA-7cgc-gp99-6jmm, RHEL-189208, no known CVE; Closes: #1144105) + * d/libostree-1-1.symbols: Update + + -- Simon McVittie Mon, 10 Aug 2026 11:20:12 +0100 ostree (2026.2-1) unstable; urgency=medium