mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-01 14:31:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/xz: security bump version to 5.8.4

Browse Source 
https://github.com/tukaani-project/xz/releases/tag/v5.8.4

- lzma_alone_decoder(), lzma_lzip_decoder(),
  lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
  invalid memory access after memory allocation has failed and
  the application reinitializes the existing decoder to decode
  a different file. This bug could at least result in a crash.
  This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
  (Also in v5.2, v5.4, and v5.6.)

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f125a6530)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Bernd Kuhls
2026-09-10 22:11:05 +02:00
committed by Thomas Perale
parent bc4357219a
commit 1b3642b460
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/xz/xz.hash
View File

@@ -1,5 +1,5 @@
# From https://github.com/tukaani-project/xz/releases/tag/v5.8.3
sha256 33bf69c0d6c698e83a68f77e6c1f465778e418ca0b3d59860d3ab446f4ac99a6 xz-5.8.3.tar.bz2
# From https://github.com/tukaani-project/xz/releases/tag/v5.8.4
sha256 3340ae48f88665abc78d71dc43446fb3f7e70b48fd59844ac0e14958cef6e00b xz-5.8.4.tar.bz2
# Hash for license files
sha256 616a3ad264ce29b8f1cb97e53037b139d406899ca8d1f799651e17bfa09830b8 COPYING

2
package/xz/xz.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
XZ_VERSION = 5.8.3
XZ_VERSION = 5.8.4
XZ_SOURCE = xz-$(XZ_VERSION).tar.bz2
XZ_SITE = https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)
XZ_INSTALL_STAGING = YES