diff --git a/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch b/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch index 2424fb0d13..41870a8282 100644 --- a/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch +++ b/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch @@ -5,6 +5,7 @@ Subject: [PATCH] liblzma: mt dec: Fix a comment Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/831b55b971cf579ee16a854f177c36b20d3c6999 Signed-off-by: Julien Olivain --- diff --git a/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch b/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch index 7845380a8c..14985ebc8f 100644 --- a/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch +++ b/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch @@ -12,6 +12,7 @@ called (reinitializing the decoder always calls threads_end()). Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/c0c835964dfaeb2513a3c0bdb642105152fe9f34 Signed-off-by: Julien Olivain --- diff --git a/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch b/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch index 9915e6b275..d370d8b613 100644 --- a/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch +++ b/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch @@ -26,6 +26,7 @@ Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.") Reported-by: Harri K. Koskinen Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480 Signed-off-by: Julien Olivain --- diff --git a/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch b/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch index 1a914e08db..b3fd11b29d 100644 --- a/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch +++ b/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch @@ -21,6 +21,7 @@ Block before the worker thread is activated. Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.") Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/8188048854e8d11071b8a50d093c74f4c030acc9 Signed-off-by: Julien Olivain ---