#1152762 release.debian.org: trixie-pu: package aegisub/3.2.2+dfsg-7.3 (CVE-2026-92705)

#1152762#5
Date:
2026-11-01 09:55:31 UTC
From:
To:
Hi,

[ Reason ]
Request to upload aegisub to Trixie p-u to address CVE-2026-92705.

[ Impact ]
- CVE-2026-92705: Aegisub: Arbitrary code execution when opening a
crafted ASS subtitle file

[ Tests ]
Manually tested to be working: a warning dialog is opened for user
confirmation when an ASS subtitle file references an automation script
to be loaded automatically.

[ Risks ]
Patch contains changes to add input sanitization and open warning when
loading automation scripts. Code changes are local and should not affect
other functions.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
1 patch combining all 3 upstream patches referenced in the CVE, plus
adaptions required for older versions.

There is also a trivial change to debian-branch in d/gbp.conf for
tooling.

Please allow me to upload aegisub/3.2.2+dfsg-7.3+deb13u1 to Trixie p-u.