Version in base suite: 2.3.3-13 Base version: libgd2_2.3.3-13 Target version: libgd2_2.3.3-14~deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libg/libgd2/libgd2_2.3.3-13.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libg/libgd2/libgd2_2.3.3-14~deb13u1.dsc changelog | 7 ++++ control | 2 - gbp.conf | 2 - patches/0006-libgd-patch-for-CVE-2026-9672.patch | 33 +++++++++++++++++++++++ patches/series | 1 5 files changed, 43 insertions(+), 2 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpz3_hhhkc/libgd2_2.3.3-13.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpz3_hhhkc/libgd2_2.3.3-14~deb13u1.dsc: no acceptable signature found diff -Nru libgd2-2.3.3/debian/changelog libgd2-2.3.3/debian/changelog --- libgd2-2.3.3/debian/changelog 2025-04-27 12:54:43.000000000 +0000 +++ libgd2-2.3.3/debian/changelog 2026-07-31 05:23:31.000000000 +0000 @@ -1,3 +1,10 @@ +libgd2 (2.3.3-14~deb13u1) trixie-security; urgency=high + + * Change the homepage to https://libgd.github.io (Closes: #1143151) + * libgd patch for CVE-2026-9672 + + -- Ondřej Surý Fri, 31 Jul 2026 07:23:31 +0200 + libgd2 (2.3.3-13) unstable; urgency=medium * Disable libraqm support as it breaks vertical text diff -Nru libgd2-2.3.3/debian/control libgd2-2.3.3/debian/control --- libgd2-2.3.3/debian/control 2025-04-27 12:54:43.000000000 +0000 +++ libgd2-2.3.3/debian/control 2026-07-31 05:23:31.000000000 +0000 @@ -19,7 +19,7 @@ Vcs-Git: https://salsa.debian.org/debian/libgd2.git Vcs-Browser: https://salsa.debian.org/debian/libgd2 Standards-Version: 3.9.3 -Homepage: http://www.libgd.org/ +Homepage: https://libgd.github.io/ Package: libgd-tools Architecture: any diff -Nru libgd2-2.3.3/debian/gbp.conf libgd2-2.3.3/debian/gbp.conf --- libgd2-2.3.3/debian/gbp.conf 2025-04-27 12:54:43.000000000 +0000 +++ libgd2-2.3.3/debian/gbp.conf 2026-07-31 05:23:31.000000000 +0000 @@ -3,5 +3,5 @@ [DEFAULT] pristine-tar = True sign-tags = True -debian-branch = debian/main +debian-branch = debian/trixie upstream-branch = upstream diff -Nru libgd2-2.3.3/debian/patches/0006-libgd-patch-for-CVE-2026-9672.patch libgd2-2.3.3/debian/patches/0006-libgd-patch-for-CVE-2026-9672.patch --- libgd2-2.3.3/debian/patches/0006-libgd-patch-for-CVE-2026-9672.patch 1970-01-01 00:00:00.000000000 +0000 +++ libgd2-2.3.3/debian/patches/0006-libgd-patch-for-CVE-2026-9672.patch 2026-07-31 05:23:31.000000000 +0000 @@ -0,0 +1,33 @@ +From: Ilija Tovilo +Date: Tue, 28 Jul 2026 02:48:11 +0200 +Subject: libgd patch for CVE-2026-9672 + +Patch by Pierre Joye (pierrejoye). + +(cherry picked from commit fcd691b377d02285740744bee17c0f298be227d5) +--- + src/gd_gif_in.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/gd_gif_in.c b/src/gd_gif_in.c +index 2b6b34e..65b778f 100644 +--- a/src/gd_gif_in.c ++++ b/src/gd_gif_in.c +@@ -530,7 +530,7 @@ LWZReadByte_(gdIOCtx *fd, LZW_STATIC_DATA *sd, char flag, int input_code_size, i + } + + for(; i < (1 << MAX_LWZ_BITS); ++i) { +- sd->table[0][i] = sd->table[1][0] = 0; ++ sd->table[0][i] = sd->table[1][i] = 0; + } + + sd->sp = sd->stack; +@@ -664,7 +664,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap) + unsigned char c; + int xpos = 0, ypos = 0, pass = 0; + int v, i; +- LZW_STATIC_DATA sd; ++ LZW_STATIC_DATA sd = {0}; + + /* Initialize the Compression routines */ + if(!ReadOK(fd, &c, 1)) { diff -Nru libgd2-2.3.3/debian/patches/series libgd2-2.3.3/debian/patches/series --- libgd2-2.3.3/debian/patches/series 2025-04-27 12:54:43.000000000 +0000 +++ libgd2-2.3.3/debian/patches/series 2026-07-31 05:23:31.000000000 +0000 @@ -3,3 +3,4 @@ 0003-tests-make-a-little-change-for-autopkgtest.patch 0004-Revert-upstream-318-fix-to-fix-the-PHP-5.6-8.0-FTBFS.patch 0005-Fix-847-enable-back-GD_BICUBIC-interpolation-methods.patch +0006-libgd-patch-for-CVE-2026-9672.patch