mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-23 15:54:21 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/libavif: security bump to v1.3.0

Browse Source 
Fixes the following security issues:

- CVE-2025-48174: makeRoom in stream.c has an integer overflow and
    resultant buffer overflow in stream->offset+size.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48174
  - https://github.com/AOMediaCodec/libavif/pull/2768/commits

- CVE-2025-48175: avifImageRGBToYUV in reformat.c has integer overflows
    in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and
    vRowBytes.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48175
  - 64d956ed5a

For more details on the version bump, see:
  - https://github.com/AOMediaCodec/libavif/releases/tag/v1.3.0
  - https://github.com/AOMediaCodec/libavif/releases/tag/v1.2.1
  - https://github.com/AOMediaCodec/libavif/releases/tag/v1.2.0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0c1fa0bce1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Thomas Perale
2025-06-29 22:59:47 +02:00
parent 288d63bfcd
commit 92acdeea7e
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
package/libavif/libavif.hash
View File

@@ -1,3 +1,3 @@
sha256 914662e16245e062ed73f90112fbb4548241300843a7772d8d441bb6859de45b libavif-1.1.1.tar.gz
sha256 0a545e953cc049bf5bcf4ee467306a2f113a75110edf59e61248873101cd26c1 libavif-1.3.0.tar.gz
sha256 165abf92cc04b39e80d29cadea7a6a7e8fddf59407d4ad2616507a7ebe8216f9 LICENSE

2
package/libavif/libavif.mk
View File

@@ -4,7 +4,7 @@
#
################################################################################
LIBAVIF_VERSION = 1.1.1
LIBAVIF_VERSION = 1.3.0
LIBAVIF_SITE = $(call github,AOMediaCodec,libavif,v$(LIBAVIF_VERSION))
LIBAVIF_LICENSE = BSD-2-Clause, IJG, Apache-2.0
LIBAVIF_LICENSE_FILES = LICENSE