-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 30 Sep 2026 17:20:35 +0800
Source: vips
Architecture: source
Version: 8.16.1-1+deb13u2
Distribution: trixie-security
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <gcs@debian.org>
Changed-By: Tianyu Chen <billchenchina2001@gmail.com>
Changes:
 vips (8.16.1-1+deb13u2) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Debian Security Team.
   * Fix vulnerabilities:
     - CVE-2025-59933: validate image dimensions returned by the PDF and SVG loaders.
     - CVE-2026-33327: prevent integer overflow when allocating GIF images.
     - CVE-2026-33328: guard against image dimension overflows.
     - CVE-2026-35591: validate JPEG and JPEG 2000 components in the TIFF loader.
     - CVE-2026-35590: validate EXIF IFD indices.
     - CVE-2026-69242: ensure scanlines fit in INT_MAX.
     - CVE-2026-70654: fix maximum read size handling in vipsource.
     - CVE-2026-70653: avoid unsafe processing of legacy Radiance RLE data.
     - CVE-2026-70651: check the final image height of ImageMagick animations.
Checksums-Sha1:
 c0036e64b421885478daa09c848480c4e7dac83f 2248 vips_8.16.1-1+deb13u2.dsc
 d619ca267bf46414d36755a53c33716901e97d42 33514440 vips_8.16.1.orig.tar.gz
 64c14a8a67d1ee5532dcfeceb9227d42cedab618 19176 vips_8.16.1-1+deb13u2.debian.tar.xz
 d9e50c6507641f37245acb67c042f2c97b66b303 11650 vips_8.16.1-1+deb13u2_source.buildinfo
Checksums-Sha256:
 5e4a1cc2b06e14b42335bfe38931cf9bf1a31db6b262633ba04fcd45637b2a18 2248 vips_8.16.1-1+deb13u2.dsc
 df960c3df02da8ae16ee19e79c9428e955d178242a8f06064e07e0c417238e6e 33514440 vips_8.16.1.orig.tar.gz
 63c6cac2e4ea4892ca204a5034f349fec43b4908962f15ce0381f1c777f7fc50 19176 vips_8.16.1-1+deb13u2.debian.tar.xz
 312e4921205ec1d87b15e2b0b7935f321aa60164925f264e2b8d6763b19e399d 11650 vips_8.16.1-1+deb13u2_source.buildinfo
Files:
 9d37934ec1e306622ee6f2eaf34a6b4f 2248 libs optional vips_8.16.1-1+deb13u2.dsc
 b82092f96af48d4474e798fbfbac09af 33514440 libs optional vips_8.16.1.orig.tar.gz
 2df205fed9291b680ace774afd96372e 19176 libs optional vips_8.16.1-1+deb13u2.debian.tar.xz
 8a8b2e3ee88397715a6940328eaa0c24 11650 libs optional vips_8.16.1-1+deb13u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmrLAesACgkQ+GQ1dHE8
m66jnwf/cV0ZnEb39SjM5tU+DezVv7ci2mtTi0gylATAOnLMl4ImZXcqK+UOTvLu
eDnqfpaJmr6RKzlWwqEO7eQDAhjTrp6MZzeDT99MqYpZKYUkrjsQqmxRwB33+VrT
uOJ0/sE2iIrHi7HRv2jIh/rAX1+33pOhFwFYnhKSS1wB6U9CP+dGGnYrf5P+rLE/
b13zK+IR2tnbweKMxnjMhS1YFVCoiaz3q4+xSc/FVjWcJm2Gb9ox5mYsEWM37u42
vWbipXyMCfUgPzxE8FRQyCMyedQvx3se0BPkaVqUqxavuoBVSfS5YQq69aUKBEJt
HsOVAF365Fv3vRADAKe6iNyWm0cEPQ==
=dLQL
-----END PGP SIGNATURE-----