From 94013c3a95a849b6a8d8db5321f9bfea4c389b10 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Tue, 1 Sep 2026 21:41:55 +0200 Subject: [PATCH] package/exiv2: security bump to version 0.28.9 Fixes the following vulnerabilities: CVE-2026-68546: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds) https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52 CVE-2026-68547: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649 Out-of-bounds write in RemoteIo::mmap https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q Out of bounds write in http.cpp https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2 Infinite loop in QuickTimeVideo::userDataDecoder https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp For more details, see the announcement: https://www.openwall.com/lists/oss-security/2026/08/30/1 Notice: the RemoteIo-related vulnerabilities are not applicable for Buildroot as exiv2 is not built with libcurl support. Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain --- package/exiv2/exiv2.hash | 2 +- package/exiv2/exiv2.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/exiv2/exiv2.hash b/package/exiv2/exiv2.hash index 7c497cf0eb..ff8e82333a 100644 --- a/package/exiv2/exiv2.hash +++ b/package/exiv2/exiv2.hash @@ -1,3 +1,3 @@ # Locally calculated -sha256 ea51b0609f58a9afa063b60daa1539948b62247721e154f4fff0ad3aec9f9756 exiv2-0.28.8.tar.gz +sha256 700b76b97695b2fab4ef8c79619c68ae57d09e0c130724791cafbd39e0eb4aef exiv2-0.28.9.tar.gz sha256 a7ba75cb966aca374711e2af49e5f3aea6a4443a803440f5d93e73a5a1222f66 COPYING diff --git a/package/exiv2/exiv2.mk b/package/exiv2/exiv2.mk index d45acae34e..7c9ac5c6cc 100644 --- a/package/exiv2/exiv2.mk +++ b/package/exiv2/exiv2.mk @@ -4,7 +4,7 @@ # ################################################################################ -EXIV2_VERSION = 0.28.8 +EXIV2_VERSION = 0.28.9 EXIV2_SITE = $(call github,Exiv2,exiv2,v$(EXIV2_VERSION)) EXIV2_INSTALL_STAGING = YES EXIV2_LICENSE = GPL-2.0+