* [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48
@ 2026-09-10 7:37 Bernd Kuhls
2026-09-10 18:46 ` Julien Olivain via buildroot
2026-09-18 13:08 ` Thomas Perale via buildroot
0 siblings, 2 replies; 3+ messages in thread
From: Bernd Kuhls @ 2026-09-10 7:37 UTC (permalink / raw)
To: buildroot
https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
Fixes the following security issues:
(Security fix for specific API usage, GHSA-2p8c-ff85-vh9x)
If pcre2_jit_compile() is called with options for some match modes, and
then pcre2_match() is used to perform a match for a different match
mode, an out-of-bounds read can occur if the match is attempted against
invalid UTF input.
(Security fix for pattern conversion, GHSA-q8g2-wprr-34m9)
If pcre2_convert() is called on untrusted input on platforms with
32-bit size_t, an out-of-bounds heap write can occur.
(Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
matching when using a heap limit; also fixed possible integer overflows
which could cause under-allocation of the workspace.
(Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several
integer overflows while compiling patterns on 32-bit CPUs, which could
cause under-allocation followed by out-of-bounds writes.
(Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to
prevent two out-of-bounds reads while scanning backwards through
invalid UTF data with PCRE2_MATCH_INVALID_UTF.
(Security fix for specific API usage, #937) Fixed a leak and later
invalid free when calling the fast-path pcre2_jit_match() function with
a match data object previously used with pcre2_match() and
PCRE2_COPY_MATCHED_SUBJECT.
(Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
uninitialised bytes from malloc() via pcre2_serialize_encode().
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/a621579b98b143ec2e87173d63a45f475ccbce08
package/pcre2/pcre2.hash | 4 ++--
package/pcre2/pcre2.mk | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/package/pcre2/pcre2.hash b/package/pcre2/pcre2.hash
index 17f15c0fdc..90991322a2 100644
--- a/package/pcre2/pcre2.hash
+++ b/package/pcre2/pcre2.hash
@@ -1,6 +1,6 @@
# Locally calculated after checking pgp signature:
-# https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2.sig
-sha256 47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7 pcre2-10.47.tar.bz2
+# https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.48/pcre2-10.48.tar.bz2.sig
+sha256 b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed pcre2-10.48.tar.bz2
# Locally computed
sha256 197d8a73ffee0d6b09adba2f9c677b5f5aede24edf89258a68e48248d010d811 LICENCE.md
sha256 5f216505c0f6ea3273caec89e766eef93cdeb7bbb0c429f9360116d7c938feeb deps/sljit/LICENSE
diff --git a/package/pcre2/pcre2.mk b/package/pcre2/pcre2.mk
index f2b5608150..ea841f482e 100644
--- a/package/pcre2/pcre2.mk
+++ b/package/pcre2/pcre2.mk
@@ -4,7 +4,7 @@
#
################################################################################
-PCRE2_VERSION = 10.47
+PCRE2_VERSION = 10.48
PCRE2_SITE = https://github.com/PCRE2Project/pcre2/releases/download/pcre2-$(PCRE2_VERSION)
PCRE2_SOURCE = pcre2-$(PCRE2_VERSION).tar.bz2
PCRE2_LICENSE = BSD-3-Clause
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48
2026-09-10 7:37 [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48 Bernd Kuhls
@ 2026-09-10 18:46 ` Julien Olivain via buildroot
2026-09-18 13:08 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Julien Olivain via buildroot @ 2026-09-10 18:46 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: buildroot
On 10/09/2026 09:37, Bernd Kuhls wrote:
> https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
>
> Fixes the following security issues:
>
> (Security fix for specific API usage, GHSA-2p8c-ff85-vh9x)
> If pcre2_jit_compile() is called with options for some match modes,
> and
> then pcre2_match() is used to perform a match for a different match
> mode, an out-of-bounds read can occur if the match is attempted
> against
> invalid UTF input.
>
> (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9)
> If pcre2_convert() is called on untrusted input on platforms with
> 32-bit size_t, an out-of-bounds heap write can occur.
>
> (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
> matching when using a heap limit; also fixed possible integer
> overflows
> which could cause under-allocation of the workspace.
>
> (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several
> integer overflows while compiling patterns on 32-bit CPUs, which could
> cause under-allocation followed by out-of-bounds writes.
>
> (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to
> prevent two out-of-bounds reads while scanning backwards through
> invalid UTF data with PCRE2_MATCH_INVALID_UTF.
>
> (Security fix for specific API usage, #937) Fixed a leak and later
> invalid free when calling the fast-path pcre2_jit_match() function
> with
> a match data object previously used with pcre2_match() and
> PCRE2_COPY_MATCHED_SUBJECT.
>
> (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
> uninitialised bytes from malloc() via pcre2_serialize_encode().
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48
2026-09-10 7:37 [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48 Bernd Kuhls
2026-09-10 18:46 ` Julien Olivain via buildroot
@ 2026-09-18 13:08 ` Thomas Perale via buildroot
1 sibling, 0 replies; 3+ messages in thread
From: Thomas Perale via buildroot @ 2026-09-18 13:08 UTC (permalink / raw)
To: Bernd Kuhls; +Cc: Thomas Perale, buildroot
In reply of:
> https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
>
> Fixes the following security issues:
>
> (Security fix for specific API usage, GHSA-2p8c-ff85-vh9x)
> If pcre2_jit_compile() is called with options for some match modes, and
> then pcre2_match() is used to perform a match for a different match
> mode, an out-of-bounds read can occur if the match is attempted against
> invalid UTF input.
>
> (Security fix for pattern conversion, GHSA-q8g2-wprr-34m9)
> If pcre2_convert() is called on untrusted input on platforms with
> 32-bit size_t, an out-of-bounds heap write can occur.
>
> (Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
> matching when using a heap limit; also fixed possible integer overflows
> which could cause under-allocation of the workspace.
>
> (Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several
> integer overflows while compiling patterns on 32-bit CPUs, which could
> cause under-allocation followed by out-of-bounds writes.
>
> (Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to
> prevent two out-of-bounds reads while scanning backwards through
> invalid UTF data with PCRE2_MATCH_INVALID_UTF.
>
> (Security fix for specific API usage, #937) Fixed a leak and later
> invalid free when calling the fast-path pcre2_jit_match() function with
> a match data object previously used with pcre2_match() and
> PCRE2_COPY_MATCHED_SUBJECT.
>
> (Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
> uninitialised bytes from malloc() via pcre2_serialize_encode().
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to 2025.02.x & 2026.08.x. Thanks
> ---
> Gitlab pipelines passed:
> https://gitlab.com/bkuhls/buildroot/-/commits/a621579b98b143ec2e87173d63a45f475ccbce08
>
> package/pcre2/pcre2.hash | 4 ++--
> package/pcre2/pcre2.mk | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/package/pcre2/pcre2.hash b/package/pcre2/pcre2.hash
> index 17f15c0fdc..90991322a2 100644
> --- a/package/pcre2/pcre2.hash
> +++ b/package/pcre2/pcre2.hash
> @@ -1,6 +1,6 @@
> # Locally calculated after checking pgp signature:
> -# https://github.com/PhilipHazel/pcre2/releases/download/pcre2-10.47/pcre2-10.47.tar.bz2.sig
> -sha256 47fe8c99461250d42f89e6e8fdaeba9da057855d06eb7fc08d9ca03fd08d7bc7 pcre2-10.47.tar.bz2
> +# https://github.com/PCRE2Project/pcre2/releases/download/pcre2-10.48/pcre2-10.48.tar.bz2.sig
> +sha256 b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed pcre2-10.48.tar.bz2
> # Locally computed
> sha256 197d8a73ffee0d6b09adba2f9c677b5f5aede24edf89258a68e48248d010d811 LICENCE.md
> sha256 5f216505c0f6ea3273caec89e766eef93cdeb7bbb0c429f9360116d7c938feeb deps/sljit/LICENSE
> diff --git a/package/pcre2/pcre2.mk b/package/pcre2/pcre2.mk
> index f2b5608150..ea841f482e 100644
> --- a/package/pcre2/pcre2.mk
> +++ b/package/pcre2/pcre2.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -PCRE2_VERSION = 10.47
> +PCRE2_VERSION = 10.48
> PCRE2_SITE = https://github.com/PCRE2Project/pcre2/releases/download/pcre2-$(PCRE2_VERSION)
> PCRE2_SOURCE = pcre2-$(PCRE2_VERSION).tar.bz2
> PCRE2_LICENSE = BSD-3-Clause
> --
> 2.47.3
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-18 13:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-10 7:37 [Buildroot] [PATCH 1/1] package/pcre2: security bump to version 10.48 Bernd Kuhls
2026-09-10 18:46 ` Julien Olivain via buildroot
2026-09-18 13:08 ` Thomas Perale via buildroot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.