From 1b3642b460a5e2e8768ce9dc1a18e65d71a039b7 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 10 Sep 2026 22:11:05 +0200 Subject: [PATCH] package/xz: security bump version to 5.8.4 https://github.com/tukaani-project/xz/releases/tag/v5.8.4 - lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an invalid memory access after memory allocation has failed and the application reinitializes the existing decoder to decode a different file. This bug could at least result in a crash. This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending. (Also in v5.2, v5.4, and v5.6.) Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard (cherry picked from commit 6f125a653038c9460b515b1f0d4c8c4be37d88c3) Signed-off-by: Thomas Perale --- package/xz/xz.hash | 4 ++-- package/xz/xz.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/xz/xz.hash b/package/xz/xz.hash index 488a3d55dc..270ac748db 100644 --- a/package/xz/xz.hash +++ b/package/xz/xz.hash @@ -1,5 +1,5 @@ -# From https://github.com/tukaani-project/xz/releases/tag/v5.8.3 -sha256 33bf69c0d6c698e83a68f77e6c1f465778e418ca0b3d59860d3ab446f4ac99a6 xz-5.8.3.tar.bz2 +# From https://github.com/tukaani-project/xz/releases/tag/v5.8.4 +sha256 3340ae48f88665abc78d71dc43446fb3f7e70b48fd59844ac0e14958cef6e00b xz-5.8.4.tar.bz2 # Hash for license files sha256 616a3ad264ce29b8f1cb97e53037b139d406899ca8d1f799651e17bfa09830b8 COPYING diff --git a/package/xz/xz.mk b/package/xz/xz.mk index 056c168057..c3232966ee 100644 --- a/package/xz/xz.mk +++ b/package/xz/xz.mk @@ -4,7 +4,7 @@ # ################################################################################ -XZ_VERSION = 5.8.3 +XZ_VERSION = 5.8.4 XZ_SOURCE = xz-$(XZ_VERSION).tar.bz2 XZ_SITE = https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION) XZ_INSTALL_STAGING = YES