Re: [Buildroot] [PATCH 1/2] package/tiff: add patch to fix CVE-2025-8176

[Peter Korsgaard <peter@korsgaard.com>]

>>>>> "Thomas" == Thomas Perale via buildroot <buildroot@buildroot.org> writes:

 > Fix the following vulnerability:
 > - CVE-2025-8176

 >     A vulnerability was found in LibTIFF up to 4.7.0. It has been declared
 >     as critical. This vulnerability affects the function get_histogram of
 >     the file tools/tiffmedian.c. The manipulation leads to use after free.
 >     The attack needs to be approached locally. The exploit has been
 >     disclosed to the public and may be used. The patch is identified as
 >     fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a
 >     patch to fix this issue.

 > For more information, see:
 >   - https://www.cve.org/CVERecord?id=CVE-2025-8176
 >   - https://gitlab.com/libtiff/libtiff/-/merge_requests/727

 > Signed-off-by: Thomas Perale <thomas.perale@mind.be>
 > ---
 >  ...ip-the-first-line-of-the-input-image.patch | 116 ++++++++++++++++++
 >  package/tiff/tiff.mk                          |   3 +
 >  2 files changed, 119 insertions(+)
 >  create mode 100644 package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch

 > diff --git a/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch b/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch
 > new file mode 100644
 > index 0000000000..3bc0f26772
 > --- /dev/null
 > +++ b/package/tiff/0001-don-t-skip-the-first-line-of-the-input-image.patch
 > @@ -0,0 +1,116 @@
 > +From 3994cf3b3bc6b54c32f240ca5a412cffa11633fa Mon Sep 17 00:00:00 2001
..
 > +From ce46f002eca4148497363f80fab33f9396bcbeda Mon Sep 17 00:00:00 2001

While it probably works to concatenate 3 commits into a single patch,
that is not how we normally do it here. I would prefer to see the 3
upstream commits as 3 separate patches.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot