-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 11 Aug 2026 00:10:00 +0200
Source: unzip
Binary: unzip unzip-dbgsym
Architecture: amd64
Version: 6.0-29+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: all / amd64 / i386 Build Daemon (x86-grnet-03) <buildd_amd64-x86-grnet-03@buildd.debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Description:
 unzip      - De-archiver for .zip files
Closes: 1142904 1142905 1142906
Changes:
 unzip (6.0-29+deb13u1) trixie-security; urgency=high
 .
   * Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
     (heap out-of-bounds read in EF_IZUNIX3 extra field handler)
   * Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
     (stack out-of-bounds NUL write in EF_SMARTZIP handler)
   * Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
     (heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
 8cab009982a342423e3d96123848bb627a7d75ef 277416 unzip-dbgsym_6.0-29+deb13u1_amd64.deb
 ecbd807449161f84993a3006323f4e82eb1a48de 5933 unzip_6.0-29+deb13u1_amd64-buildd.buildinfo
 b8536b5816fa245c8e1c3df6f84d812f15d51b7b 172916 unzip_6.0-29+deb13u1_amd64.deb
Checksums-Sha256:
 41f68dd8f6d9021b1bcefdbd2250a4d74b2adb4873235f2af76b803b4affada3 277416 unzip-dbgsym_6.0-29+deb13u1_amd64.deb
 32af73bffa11431fa7769255aa50c54490b13172199a65edb7f5e7dc346e47f1 5933 unzip_6.0-29+deb13u1_amd64-buildd.buildinfo
 fc11f8736bdec6fc46a6864f75bce0c8206a790df37dbcab5ddb25b1bf0f58f0 172916 unzip_6.0-29+deb13u1_amd64.deb
Files:
 639777187402ce69b120ef8d84627392 277416 debug optional unzip-dbgsym_6.0-29+deb13u1_amd64.deb
 63209540fcf5ec4af95f210db2bab274 5933 utils optional unzip_6.0-29+deb13u1_amd64-buildd.buildinfo
 e75cd18d9111fd89f57277a52007000d 172916 utils optional unzip_6.0-29+deb13u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE5ZI1lXv5WjhHIVjsN8Ugyu9dQiQFAmp69vwACgkQN8Ugyu9d
QiQ+Vg//XFQY/LYOqsUjhF2c/M9SXbTCW4X9LjyNQOH5rlRYg9G9Y3cAj8tIqYYj
wV9Z6TxZp3rl7JOlgg9pDwTePkL8HVLcNkgvpi2JbsJ0W6griUTcftyt8RDPO7uW
hotOwjIZ11dIP7SouTatVKxEB/XOU/+u7Y8zaHWwWOFUwaJjDwRYGqQ4JaOXIQyL
CffI8xgs0A8F2txPMSJO+ORPgCZWz8LEz9C1q+6hCZd66JVdIrgzpsmmQgwjaIG4
hCaFPCjsjiE7QMhLJjHGYuX99ygtqInDhFbkhOXXIDT/itSVHkmQpEgNCCpi3ZK9
D7DaEUVVhX9QYOZOqS9YVQ7b9uKeB8KuS/slyD0Uroe/ojaWIzokXg4OaH9Yedu5
GBKm5YvKUgO1ZUanFQRrRt5gNo4qadE5PiLebJVz8r8LGS1GPGIEjeRGSqhtA5K0
mDR1gCUwtqQc0NYhv+hadp+MJckmXpJOSDO2gSZy1RsANTrGtwiwN+lF01Gi1Hdd
mcGMeTjkfXTgNEz1KVnF/kp0kSLW+ikIpkZpuY+sl/LYjKtVf2ysfYn77q5xYcpe
Dc6QqECkfyJR2ztIuKZIwNPeu70mDbumIegadxgogRnOjIar/nzLb8ARrGFT1Ow0
n27kFOuR2HLuQy3KjohJfDAT/ea97IJWqlkhNB2616nvlMEgaHo=
=BkBg
-----END PGP SIGNATURE-----