Version in base suite: 2.13.3+dfsg-1+deb13u1 Base version: freetype_2.13.3+dfsg-1+deb13u1 Target version: freetype_2.13.3+dfsg-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/f/freetype/freetype_2.13.3+dfsg-1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/f/freetype/freetype_2.13.3+dfsg-1+deb13u2.dsc changelog | 6 +++++ patches/CVE-2026-95512.patch | 46 +++++++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 53 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj5xv6mte/freetype_2.13.3+dfsg-1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpj5xv6mte/freetype_2.13.3+dfsg-1+deb13u2.dsc: no acceptable signature found diff -Nru freetype-2.13.3+dfsg/debian/changelog freetype-2.13.3+dfsg/debian/changelog --- freetype-2.13.3+dfsg/debian/changelog 2026-03-17 20:21:54.000000000 +0000 +++ freetype-2.13.3+dfsg/debian/changelog 2026-10-11 10:53:20.000000000 +0000 @@ -1,3 +1,9 @@ +freetype (2.13.3+dfsg-1+deb13u2) trixie; urgency=medium + + * debian/patches: Fix CVE-2026-95512 (Closes: #1149953). + + -- Hugh McMaster Sun, 11 Oct 2026 21:53:20 +1100 + freetype (2.13.3+dfsg-1+deb13u1) trixie-security; urgency=medium * CVE-2026-23865 (Closes: #1129606) diff -Nru freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch --- freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch 1970-01-01 00:00:00.000000000 +0000 +++ freetype-2.13.3+dfsg/debian/patches/CVE-2026-95512.patch 2026-10-11 10:53:20.000000000 +0000 @@ -0,0 +1,46 @@ +From f3ca71c9900fe860849b3163a6e2c1e765b291d9 Mon Sep 17 00:00:00 2001 +From: Alexei Podtelezhnikov +Date: Mon, 7 Sep 2026 15:02:23 -0400 +Subject: [PATCH] * src/cid/cidload.c (cid_read_subrs): Limit overlaps. + +Overlaps between subroutine dictionaries can be useful but prone to +abuses. The arbitrary limit can be adjusted in the future. Fixes #1457. + +Bug: https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1457 +Bug-Debian: https://bugs.debian.org/1149953 +Last-Update: 2026-10-05 + +--- + src/cid/cidload.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/src/cid/cidload.c b/src/cid/cidload.c +index 1a0e6b156..b9ab1b9e0 100644 +--- a/src/cid/cidload.c ++++ b/src/cid/cidload.c +@@ -517,6 +517,7 @@ + CID_Subrs subr; + FT_UInt max_offsets = 0; + FT_ULong* offsets = NULL; ++ FT_ULong cum_len = 0; + PSAux_Service psaux = (PSAux_Service)face->psaux; + + +@@ -584,6 +585,14 @@ + /* now, compute the size of subrs charstrings, */ + /* allocate, and read them */ + data_len = offsets[num_subrs] - offsets[0]; ++ cum_len += data_len; ++ ++ if ( cum_len / 4 > stream->size ) ++ { ++ FT_ERROR(( "cid_read_subrs: excessive overlaps\n" )); ++ error = FT_THROW( Invalid_File_Format ); ++ goto Fail; ++ } + + if ( FT_QNEW_ARRAY( subr->code, num_subrs + 1 ) || + FT_QALLOC( subr->code[0], data_len ) ) +-- +GitLab + diff -Nru freetype-2.13.3+dfsg/debian/patches/series freetype-2.13.3+dfsg/debian/patches/series --- freetype-2.13.3+dfsg/debian/patches/series 2026-03-17 20:21:34.000000000 +0000 +++ freetype-2.13.3+dfsg/debian/patches/series 2026-10-11 10:53:20.000000000 +0000 @@ -3,3 +3,4 @@ no-web-fonts.patch hide-donations-information.patch CVE-2026-23865.patch +CVE-2026-95512.patch