[pkg-gnupg-maint] gnupg2_2.4.9-8_multi.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 10 Oct 2026 15:36:45 +0200
Source: gnupg2
Architecture: source
Version: 2.4.9-8
Distribution: unstable
Urgency: medium
Maintainer: Debian GnuPG Maintainers <pkg-gnupg-maint at lists.alioth.debian.org>
Changed-By: Andreas Metzler <ametzler at debian.org>
Closes: 1150168
Changes:
 gnupg2 (2.4.9-8) unstable; urgency=medium
 .
   * Add upstream patchset for CVE-2026-105712
     gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data
     in an archive. When extracting an untrusted archive with --directory
     (aka -C) into an existing directory containing a pre-existing symlink,
     gpgtar can follow that symlink and create or overwrite a file outside
     the selected extraction directory. The write is limited by the
     extraction user's filesystem permissions. An archive extracted into a
     fresh empty directory does not have this risk.
     https://static.dev.gnupg.org/T8159.html (Closes: #1150168)
Checksums-Sha1: 
 eca456f7321804f6d7f9d5bd6b69d7528d268111 5459 gnupg2_2.4.9-8.dsc
 f9b45ee04e1e8ad20c82f4b1f249592440050c3b 110392 gnupg2_2.4.9-8.debian.tar.xz
Checksums-Sha256: 
 aa955788f65d6f476642be6ee0c77084a093c0d6533fabb46afdb39c549a7219 5459 gnupg2_2.4.9-8.dsc
 69e954dc52f1a674bf567aa40064e24ca230210394975a6cddf98742e2a6f882 110392 gnupg2_2.4.9-8.debian.tar.xz
Files: 
 4bef3973b08bb8eda8ba615cf64bf067 5459 utils optional gnupg2_2.4.9-8.dsc
 a233452166751126c7bbe2662b5f698d 110392 utils optional gnupg2_2.4.9-8.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0uCSA5741Jbt9PpepU8BhUOCFIQFAmrKQhQACgkQpU8BhUOC
FITR6RAAiXb6g8L2Dg7seL/SbJnU/U/tuQKW60g6OOlEpZ4ugZeQvf3QOkUN+Vw1
rYJdIjfH38V0M+YHY03LHC3ouo5Fi86BEUqUjtswImeWNmg7Fjtyv7l7dWUuBdIF
QdCqXoPw5MAtwyvjULFNCu5Ohtar7RdCmL1j6wP1w9tJk/o/82vPoFhPSPX1O6OM
9oy1g8KTmlNbPk0VAGziku5nADFk/uAmUNAwnHKiCAuVN4EyKLiH7FBN1iUCFfbH
E7SLTGOkZz3YDEe99IVlsq+urmpvFxdT38aAsp6PZBRZ1pGQ72lrEV6EtmJm/dD2
t1WnVKSK5TpOpoop6HwMkAMo9uocqioYFyaFNk0XFruydledohqUbnTiVpVNtf2g
93HTYK5RsiF1mANgOMUu+Ofd+yvzgk83bFkDkUaQdcZk28HNu/6FeNwBZqCUQWF0
YGS4hJZ1SS+3FjkqP86DEBOvATi32NMOMXoYn1X97QjBzryUmp1dAGgdyNKxdOia
9NEZGq3PurhRvB5pNl/msJVeMooh9I+TQllzPxFbb9jywzdxZlx6R4i7LqwT8QeC
w5MkEWlPWTfjKLaI95NOtVWZ8k2utGE1SEfLDl1Jcs27YFyh8YQpisl8AfBE8+pB
GuDVaLFgI5DV1RiipDXtRMtEgu9T55rAXKvvuoUkBqW0U+jMu6g=
=NcXc
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnupg-maint/attachments/20261010/787b5184/attachment.sig>