-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 31 Jul 2026 23:59:26 +0200
Source: xen
Binary: xen-doc
Architecture: all
Version: 4.20.3+127-gc42374a105-0+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: all Build Daemon (x86-grnet-02) <buildd_all-x86-grnet-02@buildd.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Description:
 xen-doc    - Xen documentation
Closes: 1129037
Changes:
 xen (4.20.3+127-gc42374a105-0+deb13u1) trixie-security; urgency=medium
 .
   * Update to new upstream version 4.20.3+127-gc42374a105, which also contains
     security fixes for the following issues:
     (Closes: #1129037)
     - Use after free of paging structures in EPT
       XSA-480 CVE-2026-23554
     - Xenstored DoS by unprivileged domain
       XSA-481 CVE-2026-23555
     - oxenstored keeps quota related use counts across domain destruction
       XSA-483 CVE-2026-23556
     - Xenstored DoS via XS_RESET_WATCHES command
       XSA-484 CVE-2026-23557
     - grant table v2 race in status page mapping
       XSA-486 CVE-2026-23558
     - x86: Floating Point Divider State Sampling
       XSA-488 CVE-2025-54505
     - x86: CPU Opcode Cache corruption
       XSA-490 CVE-2025-54518
     - x86 HVM I/O port list traversal
       XSA-491 CVE-2026-42487
     - domctl lock open to abuse
       XSA-492 CVE-2026-42489 CVE-2026-42490
     - Arm: Completion of memory accesses not guaranteed by completion of a TLBI
       XSA-493 CVE-2025-10263
     - x86: mismatched mapcache metadata
       XSA-494 CVE-2026-42488
     - x86 shadow paging is deprecated
       XSA-495 CVE-2026-42493
     - buffer overruns in libfsimage iso9660 handling
       XSA-497 CVE-2026-42494 CVE-2026-42495 CVE-2026-62423 CVE-2026-62424 CVE-2026-62425
     - sysctl and platform-op locks open to abuse
       XSA-499 CVE-2026-62426 CVE-2026-62427
     - grant-table: type confusion in grant-copy
       XSA-500 CVE-2026-62428
     - grant-table: version change racing with other operations
       XSA-501 CVE-2026-62435 CVE-2026-62436
     - vNUMA domain cleanup may race other operations
       XSA-502 CVE-2026-62429
     - x86: Out-of-bounds read in vRTC emulation
       XSA-503 CVE-2026-62430
     - Viridian STIMER division by zero
       XSA-504 CVE-2026-62431
     - evtchn: Race between FIFO expand and reset
       XSA-505 CVE-2026-62432
     - correct buffer checks for DM_OP hypercalls
       XSA-506 CVE-2026-62433
     - PoD: Don't try to reclaim special pages
       XSA-507 CVE-2026-62434
     - pygrub: security-supported only when run de-privileged
       XSA-508
   * Drop the following patches which are now included upstream:
     - ARM: Drop ThumbEE support
     - xen/arm: Set ThumbEE as not present in PFR0
   * Note that the following XSA are not listed, because...
     - XSA-482 has patches for the Linux kernel
     - XSA-485 has patches for the Linux kernel
     - XSA-487 has patches for the Linux kernel
     - XSA-489 applies to XAPI which is not included in Debian
     - XSA-496 only applies to Xen 4.21 and later
     - XSA-498 applies to XAPI which is not included in Debian
Checksums-Sha1:
 a0ced0cfd2bea7752afd1ec1869d625f53152c20 587420 xen-doc_4.20.3+127-gc42374a105-0+deb13u1_all.deb
 97e069f6cf465e516645256d9db1ab08332a9c2d 9644 xen_4.20.3+127-gc42374a105-0+deb13u1_all-buildd.buildinfo
Checksums-Sha256:
 0d19bb06a6b36f866670030d271e2e20ecea392c68ac07fc6d4ecc1996e8568d 587420 xen-doc_4.20.3+127-gc42374a105-0+deb13u1_all.deb
 915dd28b823bee11a5b2a788e301781139f6d8ae8408e74ad22311c2e2604c90 9644 xen_4.20.3+127-gc42374a105-0+deb13u1_all-buildd.buildinfo
Files:
 11aa3fea970f262aee66314b9ed6b874 587420 doc optional xen-doc_4.20.3+127-gc42374a105-0+deb13u1_all.deb
 4844c74558fcef833564ca21d93e5c9f 9644 admin optional xen_4.20.3+127-gc42374a105-0+deb13u1_all-buildd.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE81O8NL+3kjBAqEvLmgPNRvTf/zcFAmp3PqwACgkQmgPNRvTf
/zcA9xAAkJtT2BMqvtyfCo/+2GkyNwnEnkWmIINtTuW6sMScFG1t0bFXLeLwOrIw
6eo0PJ9+zeZAMsbE3Mgy6+o411x0vBUFqa4/PGJ5LKMXHRP+nzaJwTei9T4OzT4Q
WB9z5eTo93xKBw/Q8qRUVSXwdXg8qexSwHgVAdiqsdOGROcm+2gTE8WEC5TSB1oD
ipKghqGTmOoreyRVhe7KynlsFbZcWgiMY+cuUInZOFjZ3kqPfx5uKnoYLdfr8/0j
9fviAaiM7SI7ky3OSKy661HgX0kx+5UQXjL73aX+UCVmQYuUM+geeJey6ItNMjHk
f5mVtQ/HoQu9ESqmnSTRnX6KpGMSlMKQfm9Gp8aZ9WSRsG67ar9H7d8y4I1fI9eo
BAKRugPU/Egp34tb8RQrswDuHnsSWIAshmW4+VVM2GtXTM1sK5R/3H6f/h8xgU1B
pZ9WUd5Hgn+aDrBj5dtLBJTWnoBxXkNb2f0kyOA9wZInmokKovDtWZtwbGpl8DvM
ikzVU+o82oiiRxFI/KaF8svLph9r12z/1ei7hpKbRESQjhPOaLslHZFmF4sLhKfU
Gpj6p2LrjFCLvqQgiSSj06GQCv6HURK6qfaNzx+Ke6gj+tRo1PlRwgtH3L6rUZP0
0Y4p3gF/S31OBTGylmDIgRwWSuCoOxYqS9zta2Yne5VAvv9l8RU=
=tHln
-----END PGP SIGNATURE-----