-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Tue, 11 Aug 2026 00:10:00 +0200
Source: unzip
Binary: unzip unzip-dbgsym
Architecture: s390x
Version: 6.0-29+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: s390x Build Daemon (zandonai) <buildd_s390x-zandonai@buildd.debian.org>
Changed-By: Santiago Vila <sanvila@debian.org>
Description:
 unzip      - De-archiver for .zip files
Closes: 1142904 1142905 1142906
Changes:
 unzip (6.0-29+deb13u1) trixie-security; urgency=high
 .
   * Apply upstream fix for CAN-2026-2034440. Closes: #1142904.
     (heap out-of-bounds read in EF_IZUNIX3 extra field handler)
   * Apply upstream fix for CAN-2026-2034443. Closes: #1142905.
     (stack out-of-bounds NUL write in EF_SMARTZIP handler)
   * Apply upstream fix for CAN-2026-2034442. Closes: #1142906.
     (heap buffer overflow WRITE in memextract() STORED path)
Checksums-Sha1:
 9d7f41d7692bf7d0e13498994a5d204b51a0836c 274332 unzip-dbgsym_6.0-29+deb13u1_s390x.deb
 4ec05ef0419de4f887966f31bbf9385e39ac2126 5795 unzip_6.0-29+deb13u1_s390x-buildd.buildinfo
 62fdb6f695b2671bd003eb2408ca9991eac6cd73 172708 unzip_6.0-29+deb13u1_s390x.deb
Checksums-Sha256:
 1547465ba0b4587e1760e955cc66c6fc80f4674d1ccefed8445093c5a5738b02 274332 unzip-dbgsym_6.0-29+deb13u1_s390x.deb
 2406721fbaf5dd1fb495f489be78f2a28de5b24d9d3af139c772c73ebb2aa171 5795 unzip_6.0-29+deb13u1_s390x-buildd.buildinfo
 778e2ceb3fea0c42955d3aab3cc9ca0b4ed94b7ee67260d05c5333b0974813ff 172708 unzip_6.0-29+deb13u1_s390x.deb
Files:
 929c115e92894d82a9ad73dbf32e217b 274332 debug optional unzip-dbgsym_6.0-29+deb13u1_s390x.deb
 9ed0eed008988fddf6de075878cf0b6b 5795 utils optional unzip_6.0-29+deb13u1_s390x-buildd.buildinfo
 b83c09c4a1ca7e3e4f0d76eb3e39ced7 172708 utils optional unzip_6.0-29+deb13u1_s390x.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEENly2ANlpa4eeqnluvVOPI7pYNpgFAmp6+jUACgkQvVOPI7pY
NphQEg/7BYaVOCl8yQNoYhQaNjjKRHfoeiCYkyKFLHRV0bHHa3uKy76VyFpw/OIP
5XRsXwJBiJUqMkcncZ7raq8SPWlJTSYQwD8IMdxIkXBvPGFcpmKl2qJcTGkUbthm
4tv+uQyEUpC2H6mUusmzQxnQuEclloALEfDUSgBAd6BOhxd05QS9F1C1yJGVbnpo
PGPO/iL5knG0fZSOlRDYYmQCszQW+q67fgVc8SgwOxr5ZpkD/sWVDBAiZgSGGEmT
zKIBo6+EUra0+TUk1eI+rpTvTcCDkiTirOWttGpp6nFVq2A8rvfw40J3sYIIutIY
BWXuhYUV4f6Ax3UByi7o5m+g/B3TdBOjBcvDOIt98t+HIgQJ4kAdY2puPhstrg2q
sQLR3BwOXiNeSH8xzKQ6DxJAO1SiFs77SwfVvWkj6oCht57wmfiAikEjp134iXP+
wjGII79xMqcWfzTGUmveqmkj01aWFh3wpEKAJ1l6QApdJLCTvkgULHEEyh7fvdrS
iIEXMW/24Oy8cwQfBkM4FHbDml3xjKNSOKuY6pGwwO28Vmwlvqvu47fK6KrnrA3W
waPVmTCn9/XYvqeJQRHVDkO4zHnm4RpTgxKGN6wwsn/Wy/hCekqFAyYoUdr0Yp1g
RY7YRW2aQy46brA7BstefqVL484xsvFyqyEU5CB6teNX4ODeqWA=
=DcKf
-----END PGP SIGNATURE-----