From: Thomas Perale via buildroot <buildroot@buildroot.org>
To: Bernd Kuhls <bernd@kuhls.net>
Cc: Thomas Perale <thomas.perale@mind.be>, buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH 1/1] package/xz: security bump version to 5.8.4
Date: Fri, 18 Sep 2026 15:09:31 +0200 [thread overview]
Message-ID: <20260918130931.163480-1-thomas.perale@mind.be> (raw)
In-Reply-To: <20260910201105.2543208-1-bernd@kuhls.net>
In reply of:
> https://github.com/tukaani-project/xz/releases/tag/v5.8.4
>
> - lzma_alone_decoder(), lzma_lzip_decoder(),
> lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
> invalid memory access after memory allocation has failed and
> the application reinitializes the existing decoder to decode
> a different file. This bug could at least result in a crash.
> This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
> (Also in v5.2, v5.4, and v5.6.)
>
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Applied to 2026.08.x. Thanks
> ---
> Gitlab pipelines passed:
> https://gitlab.com/bkuhls/buildroot/-/commits/d8ad85198932bc421166413ecf9cc821917c56a9
>
> package/xz/xz.hash | 4 ++--
> package/xz/xz.mk | 2 +-
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/package/xz/xz.hash b/package/xz/xz.hash
> index 488a3d55dc..270ac748db 100644
> --- a/package/xz/xz.hash
> +++ b/package/xz/xz.hash
> @@ -1,5 +1,5 @@
> -# From https://github.com/tukaani-project/xz/releases/tag/v5.8.3
> -sha256 33bf69c0d6c698e83a68f77e6c1f465778e418ca0b3d59860d3ab446f4ac99a6 xz-5.8.3.tar.bz2
> +# From https://github.com/tukaani-project/xz/releases/tag/v5.8.4
> +sha256 3340ae48f88665abc78d71dc43446fb3f7e70b48fd59844ac0e14958cef6e00b xz-5.8.4.tar.bz2
>
> # Hash for license files
> sha256 616a3ad264ce29b8f1cb97e53037b139d406899ca8d1f799651e17bfa09830b8 COPYING
> diff --git a/package/xz/xz.mk b/package/xz/xz.mk
> index 056c168057..c3232966ee 100644
> --- a/package/xz/xz.mk
> +++ b/package/xz/xz.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -XZ_VERSION = 5.8.3
> +XZ_VERSION = 5.8.4
> XZ_SOURCE = xz-$(XZ_VERSION).tar.bz2
> XZ_SITE = https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)
> XZ_INSTALL_STAGING = YES
> --
> 2.47.3
>
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
prev parent reply other threads:[~2026-09-18 13:09 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-10 20:11 [Buildroot] [PATCH 1/1] package/xz: security bump version to 5.8.4 Bernd Kuhls
2026-09-12 7:39 ` Peter Korsgaard
2026-09-18 13:09 ` Thomas Perale via buildroot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260918130931.163480-1-thomas.perale@mind.be \
--to=buildroot@buildroot.org \
--cc=bernd@kuhls.net \
--cc=thomas.perale@mind.be \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.