From: Julien Olivain via buildroot <buildroot@buildroot.org>
To: Peter Korsgaard <peter@korsgaard.com>
Cc: buildroot@buildroot.org
Subject: Re: [Buildroot] [PATCH] package/exiv2: security bump to version 0.28.9
Date: Wed, 02 Sep 2026 21:14:09 +0200 [thread overview]
Message-ID: <d601e74b42e33fce26b89012bafb7904@free.fr> (raw)
In-Reply-To: <20260901194156.1045810-1-peter@korsgaard.com>
On 01/09/2026 21:41, Peter Korsgaard wrote:
> Fixes the following vulnerabilities:
>
> CVE-2026-68546: Heap out-of-bounds write in RemoteIo when reading from
> a
> malicious remote server (WebReady/Curl builds)
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
>
> CVE-2026-68547: Heap out-of-bounds read in RemoteIo when reading
> block-aligned remote CRW files
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
>
> CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
>
> Out-of-bounds write in RemoteIo::mmap
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
>
> Out of bounds write in http.cpp
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
>
> Infinite loop in QuickTimeVideo::userDataDecoder
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
>
> For more details, see the announcement:
> https://www.openwall.com/lists/oss-security/2026/08/30/1
>
> Notice: the RemoteIo-related vulnerabilities are not applicable for
> Buildroot as exiv2 is not built with libcurl support.
>
> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
prev parent reply other threads:[~2026-09-02 19:14 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-01 19:41 [Buildroot] [PATCH] package/exiv2: security bump to version 0.28.9 Peter Korsgaard
2026-09-02 19:14 ` Julien Olivain via buildroot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d601e74b42e33fce26b89012bafb7904@free.fr \
--to=buildroot@buildroot.org \
--cc=ju.o@free.fr \
--cc=peter@korsgaard.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox