-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 04 Aug 2026 16:49:18 +0800
Source: aom
Binary: aom-tools aom-tools-dbgsym libaom-dev libaom3 libaom3-dbgsym
Architecture: i386
Version: 3.12.1-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) <buildd_amd64-x86-grnet-03@buildd.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Description:
 aom-tools  - AV1 Video Codec Library -- Tools
 libaom-dev - AV1 Video Codec Library -- Development Files
 libaom3    - AV1 Video Codec Library
Changes:
 aom (3.12.1-1+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Backport upstream security fixes for four encoder vulnerabilities.
     - debian/patches/0004-CVE-2026-56209-56210-56211-svc-layer-id-bounds-check.patch:
       Validate the spatial and temporal layer ids passed to the
       AOME_SET_SPATIAL_LAYER_ID and AV1E_SET_SVC_LAYER_ID codec controls
       against the configured number of layers.
       Fixes: CVE-2026-56210, CVE-2026-56209 and CVE-2026-56211.
     - debian/patches/0005-CVE-2026-56208-lap-stats-buffer-overflow.patch:
       Size the first-pass stats buffer to at least MAX_GF_LENGTH_LAP + 1, use
       a compacting sliding window in Look-Ahead Processing mode and correct an
       off-by-one in the rest_frames computation, fixing an out-of-bounds
       access to the first-pass stats array triggered by a small
       g_lag_in_frames (CVE-2026-56208).
   * debian/patches/0006-svc-add-more-spatial-temporal-layer-validation.patch:
     Reject SVC spatial and temporal layer counts outside the supported range
     in AOME_SET_NUMBER_SPATIAL_LAYERS and AV1E_SET_SVC_PARAMS, and report an
     invalid parameter rather than relying on an assert() for the fixed-SVC
     layer count limit. This is a pre-existing out-of-bounds access in 3.12.1,
     included here because the layer id validation added above derives its
     bounds from these counts.
Checksums-Sha1:
 0f6a29829566f989eb7c1b2e10c8167a4a01be11 410900 aom-tools-dbgsym_3.12.1-1+deb13u1_i386.deb
 ffcb5a4040588f0f856f5e6716396c487a792831 119716 aom-tools_3.12.1-1+deb13u1_i386.deb
 597865e76bab2772d5c4c0783340b3cfe0d9690a 13924 aom_3.12.1-1+deb13u1_i386-buildd.buildinfo
 2d8f06abcb0404250e10ca56b523e578fc43493c 2205316 libaom-dev_3.12.1-1+deb13u1_i386.deb
 c3d92bb1e7bc5091e65e1f148af603ee4be51e85 11595200 libaom3-dbgsym_3.12.1-1+deb13u1_i386.deb
 91236b3791ac0e229e397b33273b9134a8472de7 1907888 libaom3_3.12.1-1+deb13u1_i386.deb
Checksums-Sha256:
 1caa140c204f6dbab721f11c68746cf2861902d4669f13e04147cf61abc0cbbc 410900 aom-tools-dbgsym_3.12.1-1+deb13u1_i386.deb
 4236cdc82b73e17108c6954327f19a9eaf32ac3f996f09affd6531a9d1a5c612 119716 aom-tools_3.12.1-1+deb13u1_i386.deb
 2350fdaca3b62110ad7216527a4359becc546b5108327d416f0b30d1b0ebb1a5 13924 aom_3.12.1-1+deb13u1_i386-buildd.buildinfo
 725ba875d75d551aa39e683e88c5a3047ec5bda0d0deee6300332cd3d05affd5 2205316 libaom-dev_3.12.1-1+deb13u1_i386.deb
 f3aa24fbfd32a69d2088178219f572f82c7eb258392a35187df79504c27e3611 11595200 libaom3-dbgsym_3.12.1-1+deb13u1_i386.deb
 b6dce665c425c598b4acb4712dac2e47cdd8fecab467b386dd393fd658032038 1907888 libaom3_3.12.1-1+deb13u1_i386.deb
Files:
 0c876fca83f893534c0795724d65ce2e 410900 debug optional aom-tools-dbgsym_3.12.1-1+deb13u1_i386.deb
 92611b24d3cd46c3fb4439c2f142a8a4 119716 video optional aom-tools_3.12.1-1+deb13u1_i386.deb
 e2f3072e315713c6c43307d860674ffb 13924 video optional aom_3.12.1-1+deb13u1_i386-buildd.buildinfo
 bc01e4340da508cceb3cc5cbaa133c76 2205316 libdevel optional libaom-dev_3.12.1-1+deb13u1_i386.deb
 48c4c7440751fac566abeb38ed5b9837 11595200 debug optional libaom3-dbgsym_3.12.1-1+deb13u1_i386.deb
 fd4d6243c5b991fa66dfe3a742316c59 1907888 libs optional libaom3_3.12.1-1+deb13u1_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmpxv54ACgkQN8Ugyu9d
QiQQAxAAu21SnRgvXtZfteoWWa/75pnWgtAQuuYa0kzya5XkDK38/lRQPmqljLhb
kE4es2PSAD6F9tSNKRfS436KKekOevuYRrOlvqxWjNVmHMc0sBLkB87akLe8Wp74
NmSXxl6AvXzUqlrNITWhfQ6ekQBFmQR7kOVy4c69YEONl+NOtJiXmDAIdOgcXAG4
Tj0nS5YaeM0rdlMZndc989Kdu31zHHBsB98RzFdsmTFkLMxy47fyDz0floaPk2KB
qnq4UV00mVEiIWr5DbrjK/kJhSF+/c/LIaDzxNzA1brmmFMFEZ7VB9kShJerShNW
gC0DcvHaNWr1mv3Vi35w/WsoPZKR/QNEJ3tVpF4muZmOIQsaezXXNTBLs56qZLzO
4tTWu8K/x11ZkL8Ele52gYJcER6YVxk1oPwjeWdvQsqO/U9EScyd6yiECDyQo7Bl
fNGMpoThofzrZqmV+VTXuGNScYWEyiQzONuQNyu4Mz5ADor2QgWXessbWwymo9Ey
omuT1Pi6CNfjUEy5MiRQE+jF77NPr3bffVglEuREBjBIgVLOQv0yJ8RRKtlKwaQV
zu6XMACeCmY2H/bw4vL5bRmXFXZWx+IM4uW2LXdDm3cZf44bTuNOdF+hKRFAZ7Qq
yDJKeUcjHhlnRJYWEeXVKOy3ulwrsltm1AkTdG5HqB1cXo2Hws8=
=xJaw
-----END PGP SIGNATURE-----