Bug#1145182: trixie-pu: package glib2.0/2.84.4-3~deb13u5

[Simon McVittie]

Package: release.debian.org
Severity: normal
Tags: trixie d-i
X-Debbugs-Cc: glib2.0 at packages.debian.org, debian-boot at lists.debian.org
Control: affects -1 + src:glib2.0
User: release.debian.org at packages.debian.org
Usertags: pu

[ Reason ]
Fix CVE-2026-16118

[ Impact ]
Fixes something that upstream have treated as a vulnerability (although 
I'm unconvinced that it's practically exploitable on systems that aren't 
already compromised)

[ Tests ]
autopkgtests pass. Upgraded a trixie GNOME desktop system, it seems to 
work normally.

A test-build for amd64 and i386 (differing only in the changelog) is 
available at <https://people.debian.org/~smcv/13.7/glib2.0-deb13u5>.

[ Risks ]
I would say low risk, the changes are targeted and obvious.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
      - note that this assumes 2.84.4-3~deb13u4, 
        https://bugs.debian.org/1143852 was already accepted -
        please see that bug for the deb13u4 changes
  [x] the issue is verified as fixed in unstable

[ Changes ]
d/p/CVE-2026-16118/xdgmime-Check-if-caches-are-set-before-dumping-them.patch 
is probably not strictly required, but it was part of the upstream fix 
and is obviously harmless (it only touches test/debug code). The other 
patch is the actual bug fix.

[ Other info ]
Will need a d-i ack for the graphical installer. Includes the changes 
from 2.84.4-3~deb13u4 (https://bugs.debian.org/1143852), which I have 
not included in the debdiff here.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: glib2.0_2.84.4-3~deb13u5.diff
Type: text/x-diff
Size: 8982 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20260823/3bb57ebd/attachment.diff>