mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-26 03:50:44 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libpng: security bump to version 1.6.56

Browse Source 
Fixes the following security vulnerabilities:

CVE-2026-33416 (high):
Use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`.

CVE-2026-33636 (high):
Out-of-bounds read/write in the palette expansion on ARM Neon.

For more details, see the advisories:
https://github.com/pnggroup/libpng/security/advisories/GHSA-m4pc-p4q3-4c7j
https://github.com/pnggroup/libpng/security/advisories/GHSA-wjr5-c57x-95m2

Release notes:
https://github.com/pnggroup/libpng/blob/v1.6.56/ANNOUNCE

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22e4440eae)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Bernd Kuhls
2026-03-27 18:57:43 +01:00
committed by Thomas Perale
parent f6a408fd8f
commit 6e84b56f4d
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
package/libpng/libpng.hash
View File

@@ -1,5 +1,5 @@
# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.55/
sha1 13f7bedf27009e59961f823cc779a5f9f5341a91 libpng-1.6.55.tar.xz
# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.56/
sha1 71eb3636e60b6ea66f2f670cdf1f7160b7a1fa8b libpng-1.6.56.tar.xz
# Locally computed:
sha256 d925722864837ad5ae2a82070d4b2e0603dc72af44bd457c3962298258b8e82d libpng-1.6.55.tar.xz
sha256 f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18 libpng-1.6.56.tar.xz
sha256 bdb0a645ea18c60507d0368379b1ac5474b92255fcc2d115e07486a7672ba526 LICENSE

2
package/libpng/libpng.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
LIBPNG_VERSION = 1.6.55
LIBPNG_VERSION = 1.6.56
LIBPNG_SERIES = 16
LIBPNG_SOURCE = libpng-$(LIBPNG_VERSION).tar.xz
LIBPNG_SITE = http://downloads.sourceforge.net/project/libpng/libpng$(LIBPNG_SERIES)/$(LIBPNG_VERSION)