From 7c4e482b15359b186e697678de5ee1f280d78450 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Sat, 15 Feb 2025 21:25:12 +0100 Subject: [PATCH] package/assimp: security bump to version 5.4.3 Fixes the following security vulnerability: CVE-2024-40724: Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a specially crafted file into the product. https://github.com/assimp/assimp/pull/5651 Fixes: https://nvd.nist.gov/vuln/detail/cve-2024-40724 Signed-off-by: Peter Korsgaard [Julien: add link to cve] Signed-off-by: Julien Olivain (cherry picked from commit 30da391756dfba96f078a6e04707c6e8a63a4162) Signed-off-by: Peter Korsgaard --- package/assimp/assimp.hash | 2 +- package/assimp/assimp.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/assimp/assimp.hash b/package/assimp/assimp.hash index 79415706f9..bdcab695fc 100644 --- a/package/assimp/assimp.hash +++ b/package/assimp/assimp.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 a07666be71afe1ad4bc008c2336b7c688aca391271188eb9108d0c6db1be53f1 assimp-5.3.1.tar.gz +sha256 66dfbaee288f2bc43172440a55d0235dfc7bf885dda6435c038e8000e79582cb assimp-5.4.3.tar.gz sha256 147874443d242b4e2bae97036e26ec9d6b37f706174c1bd5ecfcc8c1294cef51 LICENSE diff --git a/package/assimp/assimp.mk b/package/assimp/assimp.mk index 2765cc7171..ba0d506033 100644 --- a/package/assimp/assimp.mk +++ b/package/assimp/assimp.mk @@ -4,7 +4,7 @@ # ################################################################################ -ASSIMP_VERSION = 5.3.1 +ASSIMP_VERSION = 5.4.3 ASSIMP_SITE = $(call github,assimp,assimp,v$(ASSIMP_VERSION)) ASSIMP_LICENSE = BSD-3-Clause ASSIMP_LICENSE_FILES = LICENSE