-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 11 Aug 2026 00:10:00 +0200
Source: unzip
Binary: unzip unzip-dbgsym
Architecture: arm64
Version: 6.0-29+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: arm64 Build Daemon (arm-conova-04) <buildd_arm64-arm-conova-04@buildd.debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Description:
 unzip      - De-archiver for .zip files
Closes: 1142904 1142905 1142906
Changes:
 unzip (6.0-29+deb13u1) trixie-security; urgency=high
 .
   * Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
     (heap out-of-bounds read in EF_IZUNIX3 extra field handler)
   * Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
     (stack out-of-bounds NUL write in EF_SMARTZIP handler)
   * Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
     (heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
 a97b18d219f8296c1717dbe55affe5fc68045229 272732 unzip-dbgsym_6.0-29+deb13u1_arm64.deb
 e05b6e7376e97947953568276975ba088a3d01c1 5917 unzip_6.0-29+deb13u1_arm64-buildd.buildinfo
 0fdc275de9421319a3b69597e61d9a801804f7b3 163616 unzip_6.0-29+deb13u1_arm64.deb
Checksums-Sha256:
 24c7b9a57125c265698342d9dd361dae657243278e56bf14a288af06f09fc896 272732 unzip-dbgsym_6.0-29+deb13u1_arm64.deb
 0e8c475e8b9e3bd4fd7244733940cee46b8eb12a045faa00e84cbe09a0102cd2 5917 unzip_6.0-29+deb13u1_arm64-buildd.buildinfo
 b455bc70ff59f790c619802f921fc5bd22ab25acb6394fd7505f34b93c5b2cdb 163616 unzip_6.0-29+deb13u1_arm64.deb
Files:
 3c4237b0335a768e66ed0a020738503a 272732 debug optional unzip-dbgsym_6.0-29+deb13u1_arm64.deb
 a24f40fd8bec63d0ebcfe3389168618c 5917 utils optional unzip_6.0-29+deb13u1_arm64-buildd.buildinfo
 a020c7ef36fdc8397364f8fed70cdb2f 163616 utils optional unzip_6.0-29+deb13u1_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEYxmcRLDHP0tCCM0oScpU3dYulLgFAmp69wYACgkQScpU3dYu
lLgo+RAAsI2pJ/3tIHl+7m++A0di+DWhzWntA7Xc6IPzkQKWpHlNCacF3djL5WS3
OXr/YFaKuN5gzXUaNYK2KpnG5+68pXyB8UYI4AGe3R8635ZlzeDo9Z1gZ6d1oKAu
ybBfL9qqa/7PwRsNG13P1FbIh+usgQ6PLCdPrcTTDfDwc3YtEvnRANbcxc18M2Wf
W9k036RlIM6dJgyVbPV1TjQYcfHogYLxqfkOiP+OwdhDziuSmJrXvx6Ry5fF+SxC
ypFWttXbpM/+5t3T4yzVFSKSz7NHqXeEBBmG+K+vVVf1vSWTkTiDpWXkFo68HLZ/
6ThTZwJm1KKwn15JznkE7IO09xQD5VnACZ5Ew8D6RJTEZP8FP22rzt0HfPT+bLWb
UmM3uOj0qdUy/FK4v5AEQQvq+uMAFy8MZvtLCoAZ+mI5bvTFcmrWSVCR+dj2EmmN
Hgekj1lVjfWsCZcMtJuNRnjWzXjA+/oY6DOhHmnShYqrxp0332cgkh1dyyNa47Yt
K9lq6ivlAOhE5h9ZaHK4xARewmdg5wzI9tc5awK6OhLxx7yojVpt81H8UXi+MWwv
8Io507TVj1kicVhdu4SDuum440N1cjDnhgaDDwZsL5D74AQ8/slY+bH8xsVAwp3E
EpodbEc2Mgmw7xHzeh3Tgw8u3zBM0fNCYq84JEkb0KkNWl4FLxg=
=j2Em
-----END PGP SIGNATURE-----