From 7fb9c616b0746fddffe3fd45ba3120e3edf49966 Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Thu, 20 Aug 2026 19:02:43 +0100 Subject: [PATCH] Update changelog --- debian/changelog | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/debian/changelog b/debian/changelog index 9f6a3901..8fe0205f 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,9 +3,15 @@ ostree (2026.4-1) UNRELEASED; urgency=medium * New upstream release - Fix regression when downloading large Flatpak apps/runtimes (reopens: #1144105) (Closes: #1144283) + * d/p/static-delta-validate-bspatch-payload-offset-and-length.patch: + Add post-release patch to fix offset validation. + This was an out-of-bounds read when downloading from a + malicious/crafted ostree repository, but is not believed to + be practically exploitable for anything worse than a crash + (denial-of-service). * Mention #1144105, #1144106 in previous changelog entry - -- Simon McVittie Tue, 11 Aug 2026 10:25:22 +0100 + -- Simon McVittie Thu, 20 Aug 2026 19:02:09 +0100 ostree (2026.3-1) unstable; urgency=medium -- 2.39.5