From 6f4e61bff84fd601c45a00c72215deec8b513b39 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Tue, 10 Feb 2026 09:11:36 +0100 Subject: [PATCH] package/libpng: security bump to version 1.6.55 Fixes the following security vulnerability: CVE-2026-25646 (High): Heap buffer overflow in png_set_quantize when called with no histogram and a palette larger than twice the requested maximum number of colors. For more details, see the advisory: https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3 Release notes: https://github.com/pnggroup/libpng/blob/v1.6.55/ANNOUNCE Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain --- package/libpng/libpng.hash | 6 +++--- package/libpng/libpng.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/libpng/libpng.hash b/package/libpng/libpng.hash index 4cf8718cc6..7901f82c3a 100644 --- a/package/libpng/libpng.hash +++ b/package/libpng/libpng.hash @@ -1,5 +1,5 @@ -# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.54/ -sha1 3dcffaeb58daa7b754bebe93cb008342964d9f39 libpng-1.6.54.tar.xz +# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.55/ +sha1 13f7bedf27009e59961f823cc779a5f9f5341a91 libpng-1.6.55.tar.xz # Locally computed: -sha256 01c9d8a303c941ec2c511c14312a3b1d36cedb41e2f5168ccdaa85d53b887805 libpng-1.6.54.tar.xz +sha256 d925722864837ad5ae2a82070d4b2e0603dc72af44bd457c3962298258b8e82d libpng-1.6.55.tar.xz sha256 bdb0a645ea18c60507d0368379b1ac5474b92255fcc2d115e07486a7672ba526 LICENSE diff --git a/package/libpng/libpng.mk b/package/libpng/libpng.mk index d052fa7862..01c1cbbec7 100644 --- a/package/libpng/libpng.mk +++ b/package/libpng/libpng.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBPNG_VERSION = 1.6.54 +LIBPNG_VERSION = 1.6.55 LIBPNG_SERIES = 16 LIBPNG_SOURCE = libpng-$(LIBPNG_VERSION).tar.xz LIBPNG_SITE = https://downloads.sourceforge.net/project/libpng/libpng$(LIBPNG_SERIES)/$(LIBPNG_VERSION)