Public bug reported:
A new release of librsvg is available for merging from Debian.
Ubuntu: 2.62.1+dfsg-1ubuntu1
Debian Unstable: 2.63.2+dfsg-1
### New Debian Changes ###
librsvg (2.63.2+dfsg-1) unstable; urgency=medium
* New upstream release
- SECURITY UPDATE: Fix use-after-free when processing SVG with Xincludes
- CVE-2026-96889 (Closes: #1148902)
* Create a vendor rule in debian/rules instead of a list of commands
to run in debian/README.source
* debian/rules: Update test .a file handling
* Update vendored rust crates
* Update debian/source/include-binaries
* Remove obsolete pango workaround patch
* Update minimum pango
* Update debhelper compat to 14
* Run wrap-and-sort -ast
-- Jeremy Bícha <[email protected]> Sat, 03 Oct 2026 13:22:08 +0200
### Old Ubuntu Delta ###
librsvg (2.62.1+dfsg-1ubuntu1) stonking; urgency=medium
* SECURITY UPDATE: Fix use-after-free
- debian/patches/CVE-2026-96889.patch: (#1241): Fix use-after-free with
duplicate XML entities in rsvg/src/xml/mod.rs, rsvg/src/xml/xml2_load.rs.
- CVE-2026-96889
-- Isabel Garcia Contreras <[email protected]> Mon, 05 Oct
2026 13:21:03 -0400
** Affects: librsvg (Ubuntu)
Importance: Wishlist
Status: New
** Tags: dcr-merge
** Changed in: librsvg (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: librsvg (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171230
Title:
Merge librsvg 2.63.2+dfsg-1 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/librsvg/+bug/2171230/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
