-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 24 Jan 2026 09:32:42 +0100
Source: libpng1.6
Architecture: source
Version: 1.6.48-1+deb13u2
Distribution: trixie
Urgency: medium
Maintainer: Maintainers of libpng1.6 packages <libpng1.6@packages.debian.org>
Changed-By: Tobias Frost <tobi@debian.org>
Closes: 1125443 1125444
Changes:
 libpng1.6 (1.6.48-1+deb13u2) trixie; urgency=medium
 .
   * Backporting fixes from 1.6.54 for stable:
     - CVE-2026-22801 - Heap buffer over-read (Closes: #1125444
     - CVE-2026-22695 - Heap buffer over-read (Closes: #1125443)
Checksums-Sha1:
 c8959d319b9da00d3171910a24009ff1dd3e4c9a 2305 libpng1.6_1.6.48-1+deb13u2.dsc
 4a0d9412d92e7052f187ba3287875b0220466306 1572923 libpng1.6_1.6.48.orig.tar.gz
 91d08fb71012bf246784905efcdd01b9d7d7be95 41492 libpng1.6_1.6.48-1+deb13u2.debian.tar.xz
 df0778cf0edb915e7ef81771307a69fcfb0623d5 7453 libpng1.6_1.6.48-1+deb13u2_source.buildinfo
Checksums-Sha256:
 abd2e997805e0124e62b8150fa1624a663cdef2a44a59474b3d7f5f7052f3846 2305 libpng1.6_1.6.48-1+deb13u2.dsc
 b17e99026055727e8cba99160c3a9a7f9af788e9f786daeadded5a42243f1dd0 1572923 libpng1.6_1.6.48.orig.tar.gz
 f259d39054b1015cab39f2619885369018a683257a9cc58ad8124b6b988e94fe 41492 libpng1.6_1.6.48-1+deb13u2.debian.tar.xz
 e8bc306822ed25a30bde4f84052834120655db7de13d76b2deb3d14a7dbb0ce8 7453 libpng1.6_1.6.48-1+deb13u2_source.buildinfo
Files:
 9384d959bc74402e1bf72be424fdf986 2305 libs optional libpng1.6_1.6.48-1+deb13u2.dsc
 be6cc9e411c26115db3b9eab1159a1d9 1572923 libs optional libpng1.6_1.6.48.orig.tar.gz
 c354592c4effdc85fb8a966fb135e786 41492 libs optional libpng1.6_1.6.48-1+deb13u2.debian.tar.xz
 41245a750bd8e516962d3b24b7cd66b2 7453 libs optional libpng1.6_1.6.48-1+deb13u2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAml0wnYACgkQkWT6HRe9
XTZ5OA//cxSs6DArzg87EuzCHpGc84mOHRcplCcGsxw/c/ymOiD0exSTVMrsmXsu
mVTLWlncCFWeqctzAejFqQiU+qJG+18dznS1vSwK6/cza+sgQOTiTj1vYANot78s
Fk6p7w3sArVGbMzl/yEUQ0cf/2hFEzOG+klS8afiGpcxEZEditwFgUGOhYb5j68H
/Hh118G0KcZbX+7Z2PEb7sfNtTk5vmbO5gpZtw0EiEMIyI/0B/w4x5WC5Y76R1Vb
JJJnm8iQleQnAExQ4tSJbx4o2876HE0HnLsw+bJovTZ6IM5nt0ifCy+U+riDKvkc
J3BMY2legooNtuYaiBa0osdft801HpDMX7JNmF0VxgdhtWPSuPISLr2Y5y9/5zGq
HytxXc625B73uLc3Sq8SLu+ClWWkmD3xPi/jR/+KI7eGau3wkh+sRrROg1SZV+TZ
a2PjxkvrSn6IM1bghzFbypt1tdQ01k9S9BTBcY10fI/1oqxX+cDBrMM8uScgec7G
RSZ38VDNeseGLfzK030dmyCvfU364bhAPLuAiLBGJFDF9HQCsKDRI/eIVcXW7eqs
4+Jix8gKV2LEuxKmWudzlSJAp0QzLYqUf1/mRSv5puXv+Wtk6w4nnKWAGX7SxSBo
PCC9qX7Qyo+TrKmAPmK3Wjl/HWwMFffZ5GzDVMpin6AZCgzIwh8=
=8gRj
-----END PGP SIGNATURE-----