Hi,
[ Reason ]
Request to upload aegisub to Trixie p-u to address CVE-2026-92705.
[ Impact ]
- CVE-2026-92705: Aegisub: Arbitrary code execution when opening a
crafted ASS subtitle file
[ Tests ]
Manually tested to be working: a warning dialog is opened for user
confirmation when an ASS subtitle file references an automation script
to be loaded automatically.
[ Risks ]
Patch contains changes to add input sanitization and open warning when
loading automation scripts. Code changes are local and should not affect
other functions.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
1 patch combining all 3 upstream patches referenced in the CVE, plus
adaptions required for older versions.
There is also a trivial change to debian-branch in d/gbp.conf for
tooling.
Please allow me to upload aegisub/3.2.2+dfsg-7.3+deb13u1 to Trixie p-u.