[Buildroot] [PATCH 1/1] package/xz: security bump version to 5.8.4

[Buildroot] [PATCH 1/1] package/xz: security bump version to 5.8.4

[Bernd Kuhls]

https://github.com/tukaani-project/xz/releases/tag/v5.8.4

- lzma_alone_decoder(), lzma_lzip_decoder(),
  lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
  invalid memory access after memory allocation has failed and
  the application reinitializes the existing decoder to decode
  a different file. This bug could at least result in a crash.
  This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
  (Also in v5.2, v5.4, and v5.6.)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
---
Gitlab pipelines passed:
https://gitlab.com/bkuhls/buildroot/-/commits/d8ad85198932bc421166413ecf9cc821917c56a9

 package/xz/xz.hash | 4 ++--
 package/xz/xz.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/xz/xz.hash b/package/xz/xz.hash
index 488a3d55dc..270ac748db 100644
--- a/package/xz/xz.hash
+++ b/package/xz/xz.hash
@@ -1,5 +1,5 @@
-# From https://github.com/tukaani-project/xz/releases/tag/v5.8.3
-sha256  33bf69c0d6c698e83a68f77e6c1f465778e418ca0b3d59860d3ab446f4ac99a6  xz-5.8.3.tar.bz2
+# From https://github.com/tukaani-project/xz/releases/tag/v5.8.4
+sha256  3340ae48f88665abc78d71dc43446fb3f7e70b48fd59844ac0e14958cef6e00b  xz-5.8.4.tar.bz2
 
 # Hash for license files
 sha256  616a3ad264ce29b8f1cb97e53037b139d406899ca8d1f799651e17bfa09830b8  COPYING
diff --git a/package/xz/xz.mk b/package/xz/xz.mk
index 056c168057..c3232966ee 100644
--- a/package/xz/xz.mk
+++ b/package/xz/xz.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-XZ_VERSION = 5.8.3
+XZ_VERSION = 5.8.4
 XZ_SOURCE = xz-$(XZ_VERSION).tar.bz2
 XZ_SITE = https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)
 XZ_INSTALL_STAGING = YES
-- 
2.47.3

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/xz: security bump version to 5.8.4

[Peter Korsgaard]

>>>>> "Bernd" == Bernd Kuhls <bernd@kuhls.net> writes:

 > https://github.com/tukaani-project/xz/releases/tag/v5.8.4
 > - lzma_alone_decoder(), lzma_lzip_decoder(),
 >   lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
 >   invalid memory access after memory allocation has failed and
 >   the application reinitializes the existing decoder to decode
 >   a different file. This bug could at least result in a crash.
 >   This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
 >   (Also in v5.2, v5.4, and v5.6.)

 > Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Committed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/xz: security bump version to 5.8.4

[Thomas Perale via buildroot]

In reply of:
> https://github.com/tukaani-project/xz/releases/tag/v5.8.4
> 
> - lzma_alone_decoder(), lzma_lzip_decoder(),
>   lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
>   invalid memory access after memory allocation has failed and
>   the application reinitializes the existing decoder to decode
>   a different file. This bug could at least result in a crash.
>   This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
>   (Also in v5.2, v5.4, and v5.6.)
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

Applied to 2026.08.x. Thanks

> ---
> Gitlab pipelines passed:
> https://gitlab.com/bkuhls/buildroot/-/commits/d8ad85198932bc421166413ecf9cc821917c56a9
> 
>  package/xz/xz.hash | 4 ++--
>  package/xz/xz.mk   | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/package/xz/xz.hash b/package/xz/xz.hash
> index 488a3d55dc..270ac748db 100644
> --- a/package/xz/xz.hash
> +++ b/package/xz/xz.hash
> @@ -1,5 +1,5 @@
> -# From https://github.com/tukaani-project/xz/releases/tag/v5.8.3
> -sha256  33bf69c0d6c698e83a68f77e6c1f465778e418ca0b3d59860d3ab446f4ac99a6  xz-5.8.3.tar.bz2
> +# From https://github.com/tukaani-project/xz/releases/tag/v5.8.4
> +sha256  3340ae48f88665abc78d71dc43446fb3f7e70b48fd59844ac0e14958cef6e00b  xz-5.8.4.tar.bz2
>  
>  # Hash for license files
>  sha256  616a3ad264ce29b8f1cb97e53037b139d406899ca8d1f799651e17bfa09830b8  COPYING
> diff --git a/package/xz/xz.mk b/package/xz/xz.mk
> index 056c168057..c3232966ee 100644
> --- a/package/xz/xz.mk
> +++ b/package/xz/xz.mk
> @@ -4,7 +4,7 @@
>  #
>  ################################################################################
>  
> -XZ_VERSION = 5.8.3
> +XZ_VERSION = 5.8.4
>  XZ_SOURCE = xz-$(XZ_VERSION).tar.bz2
>  XZ_SITE = https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)
>  XZ_INSTALL_STAGING = YES
> -- 
> 2.47.3
> 
> _______________________________________________
> buildroot mailing list
> buildroot@buildroot.org
> https://lists.buildroot.org/mailman/listinfo/buildroot
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot