mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-09 16:01:54 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/xz: add patch trailer

Browse Source 
Commit [1] introduced a set of patches to fix CVE-2025-31115.
Since [2] the security patches neeed to reference the vulnerability with
the `CVE: ` trailer in the patch header.

This set of patch is no longer present on master branch with xz bump [3]
but hasn't been cherry picked to 2025.02.x branch.

[1] 06c6c49fe8 package/xz: add security patches fixing CVE-2025-31115
[2] 1167d0ff3d docs/manual: mention CVE trailer
[3] aaa50b0e61 package/xz: bump to version 5.8.1

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2026-04-17 14:06:40 +02:00
parent 97203c48f9
commit 136f41d0e9
4 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch
View File

@@ -5,6 +5,7 @@ Subject: [PATCH] liblzma: mt dec: Fix a comment
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
CVE: CVE-2025-31115
Upstream: https://github.com/tukaani-project/xz/commit/831b55b971cf579ee16a854f177c36b20d3c6999
Signed-off-by: Julien Olivain <ju.o@free.fr>
---

1
package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch
View File

@@ -12,6 +12,7 @@ called (reinitializing the decoder always calls threads_end()).
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
CVE: CVE-2025-31115
Upstream: https://github.com/tukaani-project/xz/commit/c0c835964dfaeb2513a3c0bdb642105152fe9f34
Signed-off-by: Julien Olivain <ju.o@free.fr>
---

1
package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch
View File

@@ -26,6 +26,7 @@ Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.")
Reported-by: Harri K. Koskinen <x64nop@nannu.org>
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
CVE: CVE-2025-31115
Upstream: https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480
Signed-off-by: Julien Olivain <ju.o@free.fr>
---

1
package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch
View File

@@ -21,6 +21,7 @@ Block before the worker thread is activated.
Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.")
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
CVE: CVE-2025-31115
Upstream: https://github.com/tukaani-project/xz/commit/8188048854e8d11071b8a50d093c74f4c030acc9
Signed-off-by: Julien Olivain <ju.o@free.fr>
---