Version in base suite: 1.26.2-1+deb13u1 Base version: gst-plugins-base1.0_1.26.2-1+deb13u1 Target version: gst-plugins-base1.0_1.26.2-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/gst-plugins-base1.0/gst-plugins-base1.0_1.26.2-1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/g/gst-plugins-base1.0/gst-plugins-base1.0_1.26.2-1+deb13u2.dsc changelog | 6 ++++++ patches/CVE-2026-18297.patch | 16 ++++++++++++++++ patches/series | 1 + 3 files changed, 23 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpfv6_dlz8/gst-plugins-base1.0_1.26.2-1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpfv6_dlz8/gst-plugins-base1.0_1.26.2-1+deb13u2.dsc: no acceptable signature found diff -Nru gst-plugins-base1.0-1.26.2/debian/changelog gst-plugins-base1.0-1.26.2/debian/changelog --- gst-plugins-base1.0-1.26.2/debian/changelog 2026-03-14 21:51:46.000000000 +0000 +++ gst-plugins-base1.0-1.26.2/debian/changelog 2026-09-07 20:53:41.000000000 +0000 @@ -1,3 +1,9 @@ +gst-plugins-base1.0 (1.26.2-1+deb13u2) trixie-security; urgency=medium + + * CVE-2026-18297 + + -- Moritz Mühlenhoff Mon, 07 Sep 2026 22:53:41 +0200 + gst-plugins-base1.0 (1.26.2-1+deb13u1) trixie-security; urgency=medium * CVE-2026-2921 diff -Nru gst-plugins-base1.0-1.26.2/debian/patches/CVE-2026-18297.patch gst-plugins-base1.0-1.26.2/debian/patches/CVE-2026-18297.patch --- gst-plugins-base1.0-1.26.2/debian/patches/CVE-2026-18297.patch 1970-01-01 00:00:00.000000000 +0000 +++ gst-plugins-base1.0-1.26.2/debian/patches/CVE-2026-18297.patch 2026-09-07 20:53:36.000000000 +0000 @@ -0,0 +1,16 @@ +From fce1e9e1f5aeb96d16b09f05563537e029277d3b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= +Date: Fri, 19 Jun 2026 13:48:16 +0300 +Subject: [PATCH] opusdec: Don't use any channel positions for >64 channels + +--- gst-plugins-base1.0-1.26.2.orig/ext/opus/gstopusdec.c ++++ gst-plugins-base1.0-1.26.2/ext/opus/gstopusdec.c +@@ -359,6 +359,8 @@ gst_opus_dec_negotiate (GstOpusDec * dec + GST_DEBUG_OBJECT (dec, "Using a default of 2 channels"); + dec->n_channels = 2; + pos = NULL; ++ } else if (dec->n_channels > 64) { ++ pos = NULL; + } + + if (dec->sample_rate == 0) { diff -Nru gst-plugins-base1.0-1.26.2/debian/patches/series gst-plugins-base1.0-1.26.2/debian/patches/series --- gst-plugins-base1.0-1.26.2/debian/patches/series 2026-03-14 21:51:25.000000000 +0000 +++ gst-plugins-base1.0-1.26.2/debian/patches/series 2026-09-07 20:53:26.000000000 +0000 @@ -1,2 +1,3 @@ 0001-skip-failing-tests.patch CVE-2026-2921.patch +CVE-2026-18297.patch