From a4249a20243bb620d095a36e78d3722aa29f8da7 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Wed, 14 May 2025 23:04:30 +0200 Subject: [PATCH] package/libraw: security bump to version 0.21.4 Fixes the following security issues: - CVE-2025-43961: metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-43961 - https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2 - CVE-2025-43962: phase_one_correct in decoders/load_mfbacks.cpp has out-of-bounds reads for tag 0x412 processing For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-43962 - https://github.com/LibRaw/LibRaw/commit/66fe663e02a4dd610b4e832f5d9af326709336c2 - CVE-2025-43963: phase_one_correct in decoders/load_mfbacks.cpp allows out-of-buffer access For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-43963 - https://github.com/LibRaw/LibRaw/commit/be26e7639ecf8beb55f124ce780e99842de2e964 - CVE-2025-43964: tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp does not enforce minimum w0 and w1 values. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-43964 - https://github.com/LibRaw/LibRaw/commit/a50dc3f1127d2e37a9b39f57ad9bb2ebb60f18c0 For more details on the version bump, see the release notes: - https://github.com/LibRaw/LibRaw/releases/tag/0.21.4 - https://github.com/LibRaw/LibRaw/releases/tag/0.21.3 - https://github.com/LibRaw/LibRaw/compare/0.21.2...0.21.4 Signed-off-by: Thomas Perale Signed-off-by: Peter Korsgaard --- package/libraw/libraw.hash | 2 +- package/libraw/libraw.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libraw/libraw.hash b/package/libraw/libraw.hash index 838c598d78..36d9d31948 100644 --- a/package/libraw/libraw.hash +++ b/package/libraw/libraw.hash @@ -1,5 +1,5 @@ # Locally calculated -sha256 fe7288013206854baf6e4417d0fb63ba4ed7227bf36fff021992671c2dd34b03 LibRaw-0.21.2.tar.gz +sha256 6be43f19397e43214ff56aab056bf3ff4925ca14012ce5a1538a172406a09e63 LibRaw-0.21.4.tar.gz sha256 eea173a556abac0370461e57e12aab266894ea6be3874c2be05fd87871f75449 LICENSE.LGPL sha256 0e3098d2d54a12434715f6679ea408d57da5e8d613c385c58ecc6fe5d30cc81f LICENSE.CDDL sha256 7d6650cef6cf892abe95e55a6bda1e1c42f221fd411b807deb2fc0b805b868d4 README.md diff --git a/package/libraw/libraw.mk b/package/libraw/libraw.mk index 211b67f935..e320b2d835 100644 --- a/package/libraw/libraw.mk +++ b/package/libraw/libraw.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBRAW_VERSION = 0.21.2 +LIBRAW_VERSION = 0.21.4 LIBRAW_SOURCE = LibRaw-$(LIBRAW_VERSION).tar.gz LIBRAW_SITE = http://www.libraw.org/data LIBRAW_INSTALL_STAGING = YES