Version in base suite: 0.11.2-0.1~deb13u2

Base version: jpeg-xl_0.11.2-0.1~deb13u2
Target version: jpeg-xl_0.11.2-0.1~deb13u3
Base file: /srv/ftp-master.debian.org/ftp/pool/main/j/jpeg-xl/jpeg-xl_0.11.2-0.1~deb13u2.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/j/jpeg-xl/jpeg-xl_0.11.2-0.1~deb13u3.dsc

 changelog                    |    6 ++++++
 patches/CVE-2026-52584.patch |   35 +++++++++++++++++++++++++++++++++++
 patches/series               |    1 +
 3 files changed, 42 insertions(+)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpdjtl13j8/jpeg-xl_0.11.2-0.1~deb13u2.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpdjtl13j8/jpeg-xl_0.11.2-0.1~deb13u3.dsc: no acceptable signature found
diff -Nru jpeg-xl-0.11.2/debian/changelog jpeg-xl-0.11.2/debian/changelog
--- jpeg-xl-0.11.2/debian/changelog	2026-06-11 18:15:43.000000000 +0000
+++ jpeg-xl-0.11.2/debian/changelog	2026-10-13 08:57:03.000000000 +0000
@@ -1,3 +1,9 @@
+jpeg-xl (0.11.2-0.1~deb13u3) trixie-security; urgency=medium
+
+  * CVE-2026-52584 (Closes: #1142476)
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Tue, 13 Oct 2026 10:57:03 +0200
+
 jpeg-xl (0.11.2-0.1~deb13u2) trixie-security; urgency=medium
 
   * CVE-2025-70103 (Closes: #1138575)
diff -Nru jpeg-xl-0.11.2/debian/patches/CVE-2026-52584.patch jpeg-xl-0.11.2/debian/patches/CVE-2026-52584.patch
--- jpeg-xl-0.11.2/debian/patches/CVE-2026-52584.patch	1970-01-01 00:00:00.000000000 +0000
+++ jpeg-xl-0.11.2/debian/patches/CVE-2026-52584.patch	2026-10-13 08:51:53.000000000 +0000
@@ -0,0 +1,35 @@
+From 2cdc4c78b6f08c09ae70627d99900446b4450b47 Mon Sep 17 00:00:00 2001
+From: Eugene Kliuchnikov <eustas@google.com>
+Date: Fri, 26 Jun 2026 11:24:49 +0200
+Subject: [PATCH] Fix possible overflow in APNG decoder (#4870)
+
+--- jpeg-xl-0.11.2.orig/lib/extras/dec/apng.cc
++++ jpeg-xl-0.11.2/lib/extras/dec/apng.cc
+@@ -878,6 +878,7 @@ Status DecodeImageAPNG(const Span<const
+     const RectT<uint64_t>& vp = current_frame.viewport;
+     size_t xsize = static_cast<size_t>(vp.xsize());
+     size_t ysize = static_cast<size_t>(vp.ysize());
++    JXL_ENSURE(ctx.frameRaw.rows.size() <= ysize);
+     JXL_ASSIGN_OR_RETURN(PackedImage image,
+                          PackedImage::Create(xsize, ysize, format));
+     for (size_t y = 0; y < ysize; ++y) {
+@@ -962,7 +963,7 @@ Status DecodeImageAPNG(const Span<const
+             /*delay_den=*/png_get_uint_16(payload.data() + 22), raw_viewport,
+             static_cast<DisposeOp>(dispose_op), static_cast<BlendOp>(blend_op)};
+ 
+-        if (!raw_viewport.Intersection(image_rect).IsSame(raw_viewport)) {
++        if (!raw_viewport.IsInside(image_rect)) {
+           // Cropping happened.
+           return JXL_FAILURE("PNG frame is outside of image rect");
+         }
+--- jpeg-xl-0.11.2.orig/lib/jxl/base/rect.h
++++ jpeg-xl-0.11.2/lib/jxl/base/rect.h
+@@ -109,7 +109,7 @@ class RectT {
+ 
+   bool IsSame(const RectT& other) const {
+     return x0_ == other.x0_ && xsize_ == other.xsize_ && y0_ == other.y0_ &&
+-           ysize_ <= other.ysize_;
++           ysize_ == other.ysize_;
+   }
+ 
+   // Returns true if this Rect fully resides in the given image. ImageT could be
diff -Nru jpeg-xl-0.11.2/debian/patches/series jpeg-xl-0.11.2/debian/patches/series
--- jpeg-xl-0.11.2/debian/patches/series	2026-06-11 17:22:17.000000000 +0000
+++ jpeg-xl-0.11.2/debian/patches/series	2026-10-13 08:51:42.000000000 +0000
@@ -7,3 +7,4 @@
 0001-Fix-test-on-loong64-4654.patch
 disable_test.patch
 CVE-2025-70103.patch
+CVE-2026-52584.patch