From 385c25f4b0badc277b6f2fe8a2ea108098a49360 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Sat, 3 Oct 2026 09:12:37 +0200 Subject: [PATCH] package/{glibc, localedef}: security bump version to 2.44-57-g34106fee6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes CVE-2026-97399: https://gitlab.com/gnutools/glibc/-/commit/34106fee698c83eb0af71d4d0381e66b399be746 Signed-off-by: Bernd Kuhls Signed-off-by: Thomas Petazzoni (cherry picked from commit a205fa58d2261a33479cf64ad6bcc96b374ae948) Signed-off-by: Raphaël Mélotte --- package/glibc/glibc.hash | 2 +- package/glibc/glibc.mk | 5 ++++- package/localedef/localedef.mk | 2 +- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash index 439fe1f140..51e29673c3 100644 --- a/package/glibc/glibc.hash +++ b/package/glibc/glibc.hash @@ -1,5 +1,5 @@ # Locally calculated (fetched from git) -sha256 2ba6ee9ed5177a792fcce4da13225800f0cb3a2413a459e7864b8843eb5cb790 glibc-2.44-55-gc90398e00571476711792baacb6d92bd2a7b6891-git4.tar.gz +sha256 902d628994c2f3b30af4a7f507835079852cc8ed21d8a7f340e45dc5dae148bf glibc-2.44-57-g34106fee698c83eb0af71d4d0381e66b399be746-git4.tar.gz # Hashes for license files sha256 edaef632cbb643e4e7a221717a6c441a4c1a7c918e6e4d56debc3d8739b233f6 COPYINGv2 diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk index a838ac1a81..435a97361b 100644 --- a/package/glibc/glibc.mk +++ b/package/glibc/glibc.mk @@ -7,7 +7,7 @@ # Generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- # When updating the version, please also update localedef -GLIBC_VERSION = 2.44-55-gc90398e00571476711792baacb6d92bd2a7b6891 +GLIBC_VERSION = 2.44-57-g34106fee698c83eb0af71d4d0381e66b399be746 GLIBC_SITE = https://gitlab.com/gnutools/glibc.git GLIBC_SITE_METHOD = git @@ -46,6 +46,9 @@ GLIBC_IGNORE_CVES += CVE-2026-8674 # Fixed by 2.44-55-gc90398e00571476711792baacb6d92bd2a7b6891 GLIBC_IGNORE_CVES += CVE-2026-89092 +# Fixed by 2.44-57-g34106fee698c83eb0af71d4d0381e66b399be746 +GLIBC_IGNORE_CVES += CVE-2026-97399 + # This CVE is considered as not being security issues by # upstream glibc: # https://security-tracker.debian.org/tracker/CVE-2010-4756 diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk index e4bfce1a3a..becbdfae7f 100644 --- a/package/localedef/localedef.mk +++ b/package/localedef/localedef.mk @@ -7,7 +7,7 @@ # Use the same VERSION, SITE, and LICENSE as target glibc # As in glibc.mk, generate version string using: # git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2- -LOCALEDEF_VERSION = 2.44-55-gc90398e00571476711792baacb6d92bd2a7b6891 +LOCALEDEF_VERSION = 2.44-57-g34106fee698c83eb0af71d4d0381e66b399be746 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION)$(BR_FMT_VERSION_git).tar.gz LOCALEDEF_SITE = https://gitlab.com/gnutools/glibc.git LOCALEDEF_SITE_METHOD = git