Version in base suite: 1.0.15-1 Version in overlay suite: 1.0.15-1+deb13u1 Base version: libde265_1.0.15-1+deb13u1 Target version: libde265_1.0.15-1+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libd/libde265/libde265_1.0.15-1+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libd/libde265/libde265_1.0.15-1+deb13u2.dsc changelog | 7 ++++++ patches/CVE-2026-33164_CVE-2026-33165.patch | 31 ++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 39 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp7iunrg90/libde265_1.0.15-1+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp7iunrg90/libde265_1.0.15-1+deb13u2.dsc: no acceptable signature found diff -Nru libde265-1.0.15/debian/changelog libde265-1.0.15/debian/changelog --- libde265-1.0.15/debian/changelog 2026-08-06 05:05:03.000000000 +0000 +++ libde265-1.0.15/debian/changelog 2026-08-30 20:56:35.000000000 +0000 @@ -1,3 +1,10 @@ +libde265 (1.0.15-1+deb13u2) trixie-security; urgency=medium + + * CVE-2026-33164 (Closes: #1131469) + * CVE-2026-33165 (Closes: #1131468) + + -- Moritz Mühlenhoff Sun, 30 Aug 2026 22:56:35 +0200 + libde265 (1.0.15-1+deb13u1) trixie-security; urgency=medium * Non-maintainer upload by the Security Team. diff -Nru libde265-1.0.15/debian/patches/CVE-2026-33164_CVE-2026-33165.patch libde265-1.0.15/debian/patches/CVE-2026-33164_CVE-2026-33165.patch --- libde265-1.0.15/debian/patches/CVE-2026-33164_CVE-2026-33165.patch 1970-01-01 00:00:00.000000000 +0000 +++ libde265-1.0.15/debian/patches/CVE-2026-33164_CVE-2026-33165.patch 2026-08-30 20:56:29.000000000 +0000 @@ -0,0 +1,31 @@ +From c7891e412106130b83f8e8ea8b7f907e9449b658 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Sun, 15 Mar 2026 22:58:39 +0100 +Subject: [PATCH] fix reallocation of metadata array when ctb size changes + (thanks to Ana K.) + +--- libde265-1.0.15.orig/libde265/image.cc ++++ libde265-1.0.15/libde265/image.cc +@@ -461,8 +461,9 @@ de265_error de265_image::alloc_image(int + + // CTB info + +- if (ctb_info.width_in_units != sps->PicWidthInCtbsY || +- ctb_info.height_in_units != sps->PicHeightInCtbsY) ++ if (ctb_info.width_in_units != sps->PicWidthInCtbsY || ++ ctb_info.height_in_units != sps->PicHeightInCtbsY || ++ ctb_info.log2unitSize != sps->Log2CtbSizeY) + { + delete[] ctb_progress; + +--- libde265-1.0.15.orig/libde265/image.h ++++ libde265-1.0.15/libde265/image.h +@@ -150,7 +150,7 @@ template class MetaData + // private: + DataUnit* data; + int data_size; +- int log2unitSize; ++ uint8_t log2unitSize; + int width_in_units; + int height_in_units; + }; diff -Nru libde265-1.0.15/debian/patches/series libde265-1.0.15/debian/patches/series --- libde265-1.0.15/debian/patches/series 2026-08-06 05:04:35.000000000 +0000 +++ libde265-1.0.15/debian/patches/series 2026-08-30 20:56:17.000000000 +0000 @@ -12,3 +12,4 @@ CVE-2026-49295.patch CVE-2026-49346.patch CVE-2026-54240_CVE-2026-54241.patch +CVE-2026-33164_CVE-2026-33165.patch