[From nobody Sat Oct 3 12:51:08 2026 Received: (at 1148902-close) by bugs.debian.org; 3 Oct 2026 11:49:17 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.2 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FVGT_m_MULTI_ODD, HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE,SPF_HELO_PASS,SPF_PASS, USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 112; hammy, 150; neutral, 185; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--UD:debian.tar.xz, 0.000-+--H*r:sk:fasolo. Return-path: <envelope@ftp-master.debian.org> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:34438) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCyEu-006b5Z-1x for 1148902-close@bugs.debian.org; Sat, 03 Oct 2026 11:49:17 +0000 Received: via submission from C=NA, ST=NA, L=Ankh Morpork, O=Debian SMTP, OU=Debian SMTP CA, CN=fasolo.debian.org, EMAIL=hostmaster@fasolo.debian.org (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <envelope@ftp-master.debian.org>) id 1xCyEu-002BIl-0j for 1148902-close@bugs.debian.org; Sat, 03 Oct 2026 11:49:16 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=KmxxJylod4VP6FHFPasw4K4oiGGQ/yf+m3Ia/12LDF4=; b=Twj3RrrRKcXAAKKKgBFMUXcj4o A035KCHYLxiXSrSb/UpUCL7nuZEBC1qr/72rdPe0AMmRzBPFTAO2RR8dz6VQUIFd0bFBeib5I9AlE ZsNTVsuoX3v862CiDEAfGyHatYh+/TrjNGXyAAd9zil+VeDb8lIYTgZXatDHo1UvPjr6mCr+80rp0 rJbc+cjeR/umn+yfAkWjtzim9WTqx7W5xhlUBLk0uzTjQhXhPZBvqdSnZKNRVUfo6fqeEQOBXPazi AJI9pOPdSjLldbRr8AxuE8IkLftCMxpr/xFGV5A+nAfW3H763BdhsOB+mNfJ0AmPvS0VxrecsE1R8 yTMlYGSg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <envelope@ftp-master.debian.org>) id 1xCyEt-00000007jGc-1mPz; Sat, 03 Oct 2026 11:49:15 +0000 From: Debian FTP Masters <ftpmaster@ftp-master.debian.org> Reply-To: =?utf-8?q?Jeremy_B=C3=ADcha?= <jbicha@ubuntu.com> To: 1148902-close@bugs.debian.org X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: librsvg Debian: DAK Debian-Changes: librsvg_2.63.2+dfsg-1_source.changes Debian-Source: librsvg Debian-Version: 2.63.2+dfsg-1 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1148902: fixed in librsvg 2.63.2+dfsg-1 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============9158690501100986256==" Message-Id: <E1xCyEt-00000007jGc-1mPz@fasolo.debian.org> Date: Sat, 03 Oct 2026 11:49:15 +0000 --===============9158690501100986256== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: librsvg Source-Version: 2.63.2+dfsg-1 Done: Jeremy B=C3=ADcha <jbicha@ubuntu.com> We believe that the bug you reported is fixed in the latest version of librsvg, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to 1148902@bugs.debian.org, and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Jeremy B=C3=ADcha <jbicha@ubuntu.com> (supplier of updated librsvg package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing ftpmaster@ftp-master.debian.org) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 03 Oct 2026 13:22:08 +0200 Source: librsvg Built-For-Profiles: derivative.ubuntu noudeb Architecture: source Version: 2.63.2+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debi= an.org> Changed-By: Jeremy B=C3=ADcha <jbicha@ubuntu.com> Closes: 1148902 Changes: librsvg (2.63.2+dfsg-1) unstable; urgency=3Dmedium . * New upstream release - SECURITY UPDATE: Fix use-after-free when processing SVG with Xincludes - CVE-2026-96889 (Closes: #1148902) * Create a vendor rule in debian/rules instead of a list of commands to run in debian/README.source * debian/rules: Update test .a file handling * Update vendored rust crates * Update debian/source/include-binaries * Remove obsolete pango workaround patch * Update minimum pango * Update debhelper compat to 14 * Run wrap-and-sort -ast Checksums-Sha1: f3e7eb5badbf44cfd0ba4fdf67326b3c04e89ee5 2955 librsvg_2.63.2+dfsg-1.dsc f5b06c048dc82210c272c787ca263ff413c56988 6760720 librsvg_2.63.2+dfsg.orig.ta= r.xz 9b989b9ddd1a19fe7b0aa6f8d4ab14d21fe5ddcb 14086564 librsvg_2.63.2+dfsg-1.debi= an.tar.xz 4fc9d78c58fc031cf421946aa87742bdbca01cf5 9757 librsvg_2.63.2+dfsg-1_source.b= uildinfo Checksums-Sha256: 48c717224e2da63520c34658b34cab721b400fcb5b87a28a70647696aedd4062 2955 librsv= g_2.63.2+dfsg-1.dsc 7adba68a78ad1d4ee2648dbbae51e50441b8ae20fa7b7b351dd3d0084ebe6e0d 6760720 lib= rsvg_2.63.2+dfsg.orig.tar.xz 2778b88bfae17862f97505bae64b41af3f0a0a8838e3cba24465f3e256589ded 14086564 li= brsvg_2.63.2+dfsg-1.debian.tar.xz e61115cbd77d76d3c0bf69dd1bb1f63f6c3498fa8c92681b24af33345f1ae4de 9757 librsv= g_2.63.2+dfsg-1_source.buildinfo Files: a3778e90d31c2e84a50648b9fbcc888b 2955 libs optional librsvg_2.63.2+dfsg-1.dsc 29a3b4a39936af3a2b20e176cd732491 6760720 libs optional librsvg_2.63.2+dfsg.o= rig.tar.xz 928bb949869e497e2a441129a8b96ed0 14086564 libs optional librsvg_2.63.2+dfsg-= 1.debian.tar.xz 57c700139192931e1a15a386a16e9f81 9757 libs optional librsvg_2.63.2+dfsg-1_so= urce.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmrA6F0ACgkQ5mx3Wuv+ bH2kzhAAybnd4qXZfZBAAeTHRcdSRCPKVRpfxYHxnb3y42k5WFlm8nz3bUdJo7lu kXJ3+bOIeDJc74jb2WJNn8PXXDFIHIZo/C3j8A51Oop7ZSXy9PRSHXN/if0v4sAy 1gTlZYN/UM/jU/ComB1vQVAsl/VeT8mItPzNi4YBgUdax3iA9GN+KFV+ojFzp8ym hNqRI4ygPlu96CltbpfOY5qmYWce+R41uYOSTVhQdglvN6FG16NP73AdKGhkk2Dm yNfrrDsmm6oBluR4ZaV+j/jeiikGk2ch+RoO2AE4+R2M1+eZMl9ndh29MD+9g36Q ySRplSP4LlVEs8rn3C6htcuXU5ZYGYHrP+qN0O/yA9+rdbHgipuzGpviWkidCLw2 4mgaPo9GHCUCcQKIW1VftEbNQ3IcVyLSVlk/9BJFlhidh9/X/V10UC+DV0FlCP5O 85N28IdH1+AzaUVCPpAyp0cMqjHKxzcyZpd6RytAZ7vhoc4vM/5rwBJq6ygjVnEP dkrzerQANlPrY/9XzVy8ui2gY801dW3FJk4W4VYnQU/iQdOVqdZi0agqwghBbBAC NUG9/7SP12K6KxpLhO0b9bt7Zsxna+CWATRTT9vqMxRzteFFtXnSgAfXML9PLACA fVnyHmsOJUnMDyPvwIh5pHcs2hCPPkak741hv0BjMGTcyH++91M=3D =3Dp0KK -----END PGP SIGNATURE----- --===============9158690501100986256== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCasDruwAKCRCb9qggYcy5 IchdAQC/2cwF4LUfQ6R9VSY8asikScOgAmXcnnqCqiaxm/ekKAD/X3v0ku3WRipE IPf9KiBLTGOaJNa2IX8MHgm80EpR9Ak= =ncPW -----END PGP SIGNATURE----- --===============9158690501100986256==-- ]