Re: [Buildroot] [PATCH 1/2] package/opensc: security bump version to 0.27.1

["Alexis Lothoré via buildroot" <buildroot@buildroot.org>]

On Wed Apr 22, 2026 at 9:00 AM CEST, Alexis Lothoré wrote:
> On Tue Apr 21, 2026 at 8:48 PM CEST, Bernd Kuhls wrote:
>> https://github.com/OpenSC/OpenSC/blob/0.27.1/NEWS
>>
>> Switched to sha256 tarball hash provided by upstream.
>>
>> Removed patch which is included in this release.
>>
>> Fixes the following CVEs:
>> * CVE-2025-13763: Several uses of potentially uninitialized memory
>>                   detected by fuzzers
>> * CVE-2025-49010: Possible write beyond buffer bounds during processing
>>                   of GET RESPONSE APDU
>> * CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver
>> * CVE-2025-66038: Possible read beyond buffer bounds when parsing
>>                   historical bytes in PIV driver
>> * CVE-2025-66037: Possible buffer overrun while parsing SPKI
>>
>> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
>
> I suspect the CC on my address to be a mistake, as my name can be found
> for the openscAP package.

Ah, nevermind, I missed the openscap related patch in the same series

>
> LGTM though ;)
>
> Thanks,
>
> Alexis




-- 
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot