From 136f41d0e908d2094fe7ad87fdf738a882e8b1a3 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Fri, 17 Apr 2026 14:06:40 +0200 Subject: [PATCH] package/xz: add patch trailer Commit [1] introduced a set of patches to fix CVE-2025-31115. Since [2] the security patches neeed to reference the vulnerability with the `CVE: ` trailer in the patch header. This set of patch is no longer present on master branch with xz bump [3] but hasn't been cherry picked to 2025.02.x branch. [1] 06c6c49fe8 package/xz: add security patches fixing CVE-2025-31115 [2] 1167d0ff3d docs/manual: mention CVE trailer [3] aaa50b0e61 package/xz: bump to version 5.8.1 Signed-off-by: Thomas Perale --- package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch | 1 + ...02-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch | 1 + ...03-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch | 1 + ...04-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch | 1 + 4 files changed, 4 insertions(+) diff --git a/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch b/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch index 2424fb0d13..41870a8282 100644 --- a/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch +++ b/package/xz/0001-liblzma-mt-dec-Fix-a-comment.patch @@ -5,6 +5,7 @@ Subject: [PATCH] liblzma: mt dec: Fix a comment Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/831b55b971cf579ee16a854f177c36b20d3c6999 Signed-off-by: Julien Olivain --- diff --git a/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch b/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch index 7845380a8c..14985ebc8f 100644 --- a/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch +++ b/package/xz/0002-liblzma-mt-dec-Simplify-by-removing-the-THR_STOP-sta.patch @@ -12,6 +12,7 @@ called (reinitializing the decoder always calls threads_end()). Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/c0c835964dfaeb2513a3c0bdb642105152fe9f34 Signed-off-by: Julien Olivain --- diff --git a/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch b/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch index 9915e6b275..d370d8b613 100644 --- a/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch +++ b/package/xz/0003-liblzma-mt-dec-Don-t-free-the-input-buffer-too-early.patch @@ -26,6 +26,7 @@ Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.") Reported-by: Harri K. Koskinen Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480 Signed-off-by: Julien Olivain --- diff --git a/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch b/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch index 1a914e08db..b3fd11b29d 100644 --- a/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch +++ b/package/xz/0004-liblzma-mt-dec-Don-t-modify-thr-in_size-in-the-worke.patch @@ -21,6 +21,7 @@ Block before the worker thread is activated. Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.") Reviewed-by: Sebastian Andrzej Siewior Thanks-to: Sam James +CVE: CVE-2025-31115 Upstream: https://github.com/tukaani-project/xz/commit/8188048854e8d11071b8a50d093c74f4c030acc9 Signed-off-by: Julien Olivain ---