[Buildroot] [PATCH 1/1] package/libde265: security bump to version 1.0.14

[Buildroot] [PATCH 1/1] package/libde265: security bump to version 1.0.14

[Fabrice Fontaine]

Fix CVE-2023-43887: Libde265 v1.0.12 was discovered to contain multiple
buffer overflows via the num_tile_columns and num_tile_row parameters in
the function pic_parameter_set::dump.

Fix CVE-2023-47471: Buffer Overflow vulnerability in strukturag libde265
v1.10.12 allows a local attacker to cause a denial of service via the
slice_segment_header function in the slice.cc component.

https://github.com/strukturag/libde265/releases/tag/v1.0.14
https://github.com/strukturag/libde265/releases/tag/v1.0.13

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/libde265/libde265.hash | 2 +-
 package/libde265/libde265.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/libde265/libde265.hash b/package/libde265/libde265.hash
index 168b5db395..9bb3f20a71 100644
--- a/package/libde265/libde265.hash
+++ b/package/libde265/libde265.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  62185ea2182e68cf68bba20cc6eb4c287407b509cf0a827d7ddb75614db77b5c  libde265-1.0.12.tar.gz
+sha256  99f46ef77a438be639aa3c5d9632c0670541c5ed5d386524d4199da2d30df28f  libde265-1.0.14.tar.gz
 sha256  02cc1585a20677992e0ba578fa692635dc193735f2691dc81de924b51c4e8020  COPYING
diff --git a/package/libde265/libde265.mk b/package/libde265/libde265.mk
index 208fa24e27..8624d2f949 100644
--- a/package/libde265/libde265.mk
+++ b/package/libde265/libde265.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBDE265_VERSION = 1.0.12
+LIBDE265_VERSION = 1.0.14
 LIBDE265_SITE = https://github.com/strukturag/libde265/releases/download/v$(LIBDE265_VERSION)
 LIBDE265_LICENSE = LGPL-3.0+
 LIBDE265_LICENSE_FILES = COPYING
-- 
2.42.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/libde265: security bump to version 1.0.14

[Peter Korsgaard]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Fix CVE-2023-43887: Libde265 v1.0.12 was discovered to contain multiple
 > buffer overflows via the num_tile_columns and num_tile_row parameters in
 > the function pic_parameter_set::dump.

 > Fix CVE-2023-47471: Buffer Overflow vulnerability in strukturag libde265
 > v1.10.12 allows a local attacker to cause a denial of service via the
 > slice_segment_header function in the slice.cc component.

 > https://github.com/strukturag/libde265/releases/tag/v1.0.14
 > https://github.com/strukturag/libde265/releases/tag/v1.0.13

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/libde265: security bump to version 1.0.14

[Peter Korsgaard]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Fix CVE-2023-43887: Libde265 v1.0.12 was discovered to contain multiple
 > buffer overflows via the num_tile_columns and num_tile_row parameters in
 > the function pic_parameter_set::dump.

 > Fix CVE-2023-47471: Buffer Overflow vulnerability in strukturag libde265
 > v1.10.12 allows a local attacker to cause a denial of service via the
 > slice_segment_header function in the slice.cc component.

 > https://github.com/strukturag/libde265/releases/tag/v1.0.14
 > https://github.com/strukturag/libde265/releases/tag/v1.0.13

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2023.08.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot