All of lore.kernel.org
 help / color / mirror / Atom feed
From: Peter Korsgaard <peter@korsgaard.com>
To: buildroot@buildroot.org
Subject: [Buildroot] [PATCH] package/exiv2: security bump to version 0.28.9
Date: Tue,  1 Sep 2026 21:41:55 +0200	[thread overview]
Message-ID: <20260901194156.1045810-1-peter@korsgaard.com> (raw)

Fixes the following vulnerabilities:

CVE-2026-68546: Heap out-of-bounds write in RemoteIo when reading from a
malicious remote server (WebReady/Curl builds)
https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52

CVE-2026-68547: Heap out-of-bounds read in RemoteIo when reading
block-aligned remote CRW files
https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j

CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic
https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649

Out-of-bounds write in RemoteIo::mmap
https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q

Out of bounds write in http.cpp
https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2

Infinite loop in QuickTimeVideo::userDataDecoder
https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp

For more details, see the announcement:
https://www.openwall.com/lists/oss-security/2026/08/30/1

Notice: the RemoteIo-related vulnerabilities are not applicable for
Buildroot as exiv2 is not built with libcurl support.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
---
 package/exiv2/exiv2.hash | 2 +-
 package/exiv2/exiv2.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/exiv2/exiv2.hash b/package/exiv2/exiv2.hash
index 7c497cf0eb..ff8e82333a 100644
--- a/package/exiv2/exiv2.hash
+++ b/package/exiv2/exiv2.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  ea51b0609f58a9afa063b60daa1539948b62247721e154f4fff0ad3aec9f9756  exiv2-0.28.8.tar.gz
+sha256  700b76b97695b2fab4ef8c79619c68ae57d09e0c130724791cafbd39e0eb4aef  exiv2-0.28.9.tar.gz
 sha256  a7ba75cb966aca374711e2af49e5f3aea6a4443a803440f5d93e73a5a1222f66  COPYING
diff --git a/package/exiv2/exiv2.mk b/package/exiv2/exiv2.mk
index d45acae34e..7c9ac5c6cc 100644
--- a/package/exiv2/exiv2.mk
+++ b/package/exiv2/exiv2.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-EXIV2_VERSION = 0.28.8
+EXIV2_VERSION = 0.28.9
 EXIV2_SITE = $(call github,Exiv2,exiv2,v$(EXIV2_VERSION))
 EXIV2_INSTALL_STAGING = YES
 EXIV2_LICENSE = GPL-2.0+
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

             reply	other threads:[~2026-09-01 19:42 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-01 19:41 Peter Korsgaard [this message]
2026-09-02 19:14 ` [Buildroot] [PATCH] package/exiv2: security bump to version 0.28.9 Julien Olivain via buildroot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260901194156.1045810-1-peter@korsgaard.com \
    --to=peter@korsgaard.com \
    --cc=buildroot@buildroot.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.