-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 30 Sep 2026 17:20:35 +0800
Source: vips
Binary: gir1.2-vips-8.0 libvips-dev libvips-tools libvips-tools-dbgsym libvips42t64 libvips42t64-dbgsym
Architecture: armhf
Version: 8.16.1-1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: armhf Build Daemon (arm-ubc-05) <buildd_arm64-arm-ubc-05@buildd.debian.org>
Changed-By: Tianyu Chen <billchenchina2001@gmail.com>
Description:
 gir1.2-vips-8.0 - GObject introspection data for VIPS
 libvips-dev - image processing system good for very large ones (dev)
 libvips-tools - image processing system good for very large ones (tools)
 libvips42t64 - image processing system good for very large ones
Changes:
 vips (8.16.1-1+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Debian Security Team.
   * Fix vulnerabilities:
     - CVE-2025-59933: validate image dimensions returned by the PDF and SVG loaders.
     - CVE-2026-33327: prevent integer overflow when allocating GIF images.
     - CVE-2026-33328: guard against image dimension overflows.
     - CVE-2026-35591: validate JPEG and JPEG 2000 components in the TIFF loader.
     - CVE-2026-35590: validate EXIF IFD indices.
     - CVE-2026-69242: ensure scanlines fit in INT_MAX.
     - CVE-2026-70654: fix maximum read size handling in vipsource.
     - CVE-2026-70653: avoid unsafe processing of legacy Radiance RLE data.
     - CVE-2026-70651: check the final image height of ImageMagick animations.
Checksums-Sha1:
 efe0ea0d744d8624db81c2a0fb886cc0fa4297ed 82384 gir1.2-vips-8.0_8.16.1-1+deb13u2_armhf.deb
 f6deec29aee5fd15ee2830e9035a8ab39458edee 278404 libvips-dev_8.16.1-1+deb13u2_armhf.deb
 4cdef1bfa5ac7fb5d5b8e7d76bdc586ce1419e76 43532 libvips-tools-dbgsym_8.16.1-1+deb13u2_armhf.deb
 a760956ecddcce48eba6c8e06446ac9d01db0c78 85224 libvips-tools_8.16.1-1+deb13u2_armhf.deb
 94e3008be63b514dc6c3b4687af57102040cad23 2955924 libvips42t64-dbgsym_8.16.1-1+deb13u2_armhf.deb
 43de43a38b4e5d82f05dbf7f22e7ca40c8afd948 1119492 libvips42t64_8.16.1-1+deb13u2_armhf.deb
 4c02ec9aef0df4b2ff1e994bd74ace4fa45429ca 19200 vips_8.16.1-1+deb13u2_armhf-buildd.buildinfo
Checksums-Sha256:
 33267be1e27fae98e83a79e249c0faeda586c3f729f3b6535fa524e888e0f1c9 82384 gir1.2-vips-8.0_8.16.1-1+deb13u2_armhf.deb
 9aacee03e0e7bf3d8d8ee0e7a732b72a76a5f4473ee2d064d96e79b047221ccd 278404 libvips-dev_8.16.1-1+deb13u2_armhf.deb
 cf52bcafa3e9288a70051cc2db1d1724ae4fa748561672b81b4fec5ca79f86cf 43532 libvips-tools-dbgsym_8.16.1-1+deb13u2_armhf.deb
 25c536fe9e4457767eb071ee00dfa3399645130c685aba359b1d34b0962e308c 85224 libvips-tools_8.16.1-1+deb13u2_armhf.deb
 06d2c1ff43e2045f0514722c59d74fd7425bede17e3ef674d8d1774979eceb53 2955924 libvips42t64-dbgsym_8.16.1-1+deb13u2_armhf.deb
 d736ca0af24bb3f777aedaedbb7c556d75f988b8155900ebfea46dab88839bc9 1119492 libvips42t64_8.16.1-1+deb13u2_armhf.deb
 b94e799cc24dba4b94b3348822d7fd88167b75c395846cebb0d75d1e6dd0e2d3 19200 vips_8.16.1-1+deb13u2_armhf-buildd.buildinfo
Files:
 128bccf2b68df295a183001fdd8861e7 82384 introspection optional gir1.2-vips-8.0_8.16.1-1+deb13u2_armhf.deb
 4d06816a07ee5f1ebb4f8820c725cd81 278404 libdevel optional libvips-dev_8.16.1-1+deb13u2_armhf.deb
 78584f87081f8266c6703d742722f344 43532 debug optional libvips-tools-dbgsym_8.16.1-1+deb13u2_armhf.deb
 47630f698bddd166a1ca9e0092e2b04a 85224 graphics optional libvips-tools_8.16.1-1+deb13u2_armhf.deb
 55969f0b066c28d90a8858ad5dcd2d6b 2955924 debug optional libvips42t64-dbgsym_8.16.1-1+deb13u2_armhf.deb
 ff9fdff77ba4b0ac1ded585345c4003c 1119492 libs optional libvips42t64_8.16.1-1+deb13u2_armhf.deb
 2ada4bafe328f31344052eb65def5e24 19200 libs optional vips_8.16.1-1+deb13u2_armhf-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmrLB5IACgkQnwznazfj
XTph/RAAofqGYdeaAO8MSizdfEZgb8y/5YNSibeyvC1lWK3HaayTNAKLFF0rpDXw
iK+QhupKhj7VjIbFxwlIjfjImddVjcrVqIdi9e97TjZqVUfOnV3XH0YmMs6zidOM
gSzssbwESKBPGqGKlDdLSL05vmOpbN4FzxkeUJU6pdpYqF7u3xsZ9ji82jZ8tmin
e+Oes5SRyp2Z+714TCTo8QJLx22JI9JPYIHB7lxIQPt+e23XuOBPcx81ZSnZEh9y
66q9uMts6ty28uI36d+AX/TcHxkYm3HM85FsrxWVFEkx1Vho03E+BXFZT5WPsrWC
InG0zFUZdJXKrkZGV/0EyuAcmR4QDP84/9vkDPMprH1FWHFllMYQrs/Qrf4s1FhS
daV6rznayaFC1kqKh1t6Kz3D1++hcXgHjMrp45MHgjlbtqOVutxTwt1uoalAW0l1
nkGwUKWzCdhfZvKhI2KLHWD1XASTzYb6YaRp1iGbYlYxqKM335cmqijOh14Cebwh
PFa77eGvNLdc9Bp3oL56sZRZvIqG24FR2ZFK1oc+mqUJBuHIanSw4KCu5CEXMCkJ
Hp33B7qUGQEL44KWK27aLbBkO+NCPbIEsXLAHdTDIZF9RiADaRopinb5JIygfhKN
KPY8499BUBjKx3yPciUBc+aBAGsGy3InYu9WTbtDtElV+0W1Ndk=
=ilCU
-----END PGP SIGNATURE-----