From 92acdeea7e66ec31ec6f30f377384d95e4ec2929 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 29 Jun 2025 22:59:47 +0200 Subject: [PATCH] package/libavif: security bump to v1.3.0 Fixes the following security issues: - CVE-2025-48174: makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream->offset+size. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-48174 - https://github.com/AOMediaCodec/libavif/pull/2768/commits - CVE-2025-48175: avifImageRGBToYUV in reformat.c has integer overflows in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and vRowBytes. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-48175 - https://github.com/AOMediaCodec/libavif/commit/64d956ed5a602f78cebf29da023280944ee92efd For more details on the version bump, see: - https://github.com/AOMediaCodec/libavif/releases/tag/v1.3.0 - https://github.com/AOMediaCodec/libavif/releases/tag/v1.2.1 - https://github.com/AOMediaCodec/libavif/releases/tag/v1.2.0 Signed-off-by: Thomas Perale Signed-off-by: Julien Olivain (cherry picked from commit 0c1fa0bce14b2a75e7ede0d6bf6be52d7807684e) Signed-off-by: Thomas Perale --- package/libavif/libavif.hash | 2 +- package/libavif/libavif.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libavif/libavif.hash b/package/libavif/libavif.hash index b26e678abf..c53e0c9f50 100644 --- a/package/libavif/libavif.hash +++ b/package/libavif/libavif.hash @@ -1,3 +1,3 @@ -sha256 914662e16245e062ed73f90112fbb4548241300843a7772d8d441bb6859de45b libavif-1.1.1.tar.gz +sha256 0a545e953cc049bf5bcf4ee467306a2f113a75110edf59e61248873101cd26c1 libavif-1.3.0.tar.gz sha256 165abf92cc04b39e80d29cadea7a6a7e8fddf59407d4ad2616507a7ebe8216f9 LICENSE diff --git a/package/libavif/libavif.mk b/package/libavif/libavif.mk index 0c2a8e4dae..4357566ed1 100644 --- a/package/libavif/libavif.mk +++ b/package/libavif/libavif.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBAVIF_VERSION = 1.1.1 +LIBAVIF_VERSION = 1.3.0 LIBAVIF_SITE = $(call github,AOMediaCodec,libavif,v$(LIBAVIF_VERSION)) LIBAVIF_LICENSE = BSD-2-Clause, IJG, Apache-2.0 LIBAVIF_LICENSE_FILES = LICENSE