-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 11 Aug 2026 00:10:00 +0200
Source: unzip
Binary: unzip unzip-dbgsym
Architecture: armhf
Version: 6.0-29+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: armhf Build Daemon (arm-ubc-02) <buildd_arm64-arm-ubc-02@buildd.debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Description:
 unzip      - De-archiver for .zip files
Closes: 1142904 1142905 1142906
Changes:
 unzip (6.0-29+deb13u1) trixie-security; urgency=high
 .
   * Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
     (heap out-of-bounds read in EF_IZUNIX3 extra field handler)
   * Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
     (stack out-of-bounds NUL write in EF_SMARTZIP handler)
   * Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
     (heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
 e4b64da88b55e0a7e360f046cc312bdf64228aff 270076 unzip-dbgsym_6.0-29+deb13u1_armhf.deb
 d498a2b2800780d3700d616956f2c7b799dd1ec5 5799 unzip_6.0-29+deb13u1_armhf-buildd.buildinfo
 d2bed239befb1ba45ea948dc50f8e290d54c188b 159212 unzip_6.0-29+deb13u1_armhf.deb
Checksums-Sha256:
 1f434d1062226c30ebad5573bfa82a28a95cd8021314b55290d35b99bbd7df98 270076 unzip-dbgsym_6.0-29+deb13u1_armhf.deb
 47231ea1c28ae90038b906edbaae298af578077a975b9b2831c048c0d8485832 5799 unzip_6.0-29+deb13u1_armhf-buildd.buildinfo
 3026330a3d54c754beeb17606d8e22738d8365aecc8870f66845d624ca8d1b23 159212 unzip_6.0-29+deb13u1_armhf.deb
Files:
 0bf060fe869b10ffb7e822d3887ac031 270076 debug optional unzip-dbgsym_6.0-29+deb13u1_armhf.deb
 d5f6ce4611562428dd401f3a6c5a40aa 5799 utils optional unzip_6.0-29+deb13u1_armhf-buildd.buildinfo
 0e8e7dce9c16f348b6efc1556e0f03dd 159212 utils optional unzip_6.0-29+deb13u1_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJkN0BnKzGWWW6tS+G5VHrWJmwgcFAmp69uoACgkQG5VHrWJm
wgcM2hAAiWOK/ZpyDDW842ZELIcdyPFqwdtHp8I51C+BUniXoDGCANQKAB1A0coQ
pVu1mdJZ2xZ+eURycRi4KpfCvznWjkqDW+17EKOv/benXquevQGRy1pNEkwujCdq
OTnDGSA+G3krh7MQMyqtJG5AgE9id6Y8bmeQHwpk653gz1fQn0DFRw/whaC0Kqtc
wXpn3vW7QJdZaXNMiMO1nDWl59EVr28sERU5l0qIWHAiHDy0VTfCiwbS5ikSiU11
mpZNPJ4v4fLbX0ld+tbVRxsTl9YKAKhDSyXDfCnrwzNWaePPYF5WohUbicpqMTyM
WGOcXTC/EFanGwNAAl7af2DdERAyr740qmAz7+l8GxDTw1YWmLrzMMJPExYOhgA6
sJ84SZgpu47W5ULuiQdvMcGBW6ifkKlbDnJ5932Igy+icSr0SlgQkRDDkq8c8FV0
kOcfbYewgOZQEESxkhoihCIU+HHSDyLhFuAb/fPN6jC4XwHcuuH3ZzRNbcV1dPuh
REPB4OW1Zrz/qB3bXQACyGKGyFMnUPJvoMsD+00kXPvEPXZmGfiNj/H3M6xrzsfX
j47gQO6t8eO4hu9aaV1FHqCxGKwU90CYey8pUALOMQJpZr3nhwCCsPnbWIllb79A
SNj2nrs7GH4zESkwaxeIknXBXyzhQh1dLJBx8FYVrNvGNknMEm8=
=MzKj
-----END PGP SIGNATURE-----