From b2800531808e0648ffa5bb5340a761a3c32c811f Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Tue, 26 May 2026 22:06:41 +0200 Subject: [PATCH] package/libde265: security bump version to 1.1.0 https://github.com/strukturag/libde265/releases/tag/v1.1.0 "Security fixes - CVE TBD (GHSA-g2rg-wj66-w594) - Out-of-bounds write in process_reference_picture_set via predicted short-term RPS - CVE TBD (GHSA-vv8h-932h-7r86) - Heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow - CVE TBD (GHSA-g5hj-rf9f-7vxm) - Unbounded memory accumulation via orphaned slice headers in read_slice_NAL - (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL parser (remove_stuffing_bytes, resize) Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard --- package/libde265/libde265.hash | 4 ++-- package/libde265/libde265.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/package/libde265/libde265.hash b/package/libde265/libde265.hash index 0412936d42..71a0221089 100644 --- a/package/libde265/libde265.hash +++ b/package/libde265/libde265.hash @@ -1,4 +1,4 @@ -# From https://github.com/strukturag/libde265/releases/tag/v1.0.19 -sha256 bb19a0b485d2643e0eeb7e91f3ab32d1ad617e7c487dbedc91214ca3dbd8d7eb libde265-1.0.19.tar.gz +# From https://github.com/strukturag/libde265/releases/tag/v1.1.0 +sha256 afc19dd28e2fc523de5952bba5224ee1d28e286c72436d2843df126cca1181fd libde265-1.1.0.tar.gz # Locally computed sha256 02cc1585a20677992e0ba578fa692635dc193735f2691dc81de924b51c4e8020 COPYING diff --git a/package/libde265/libde265.mk b/package/libde265/libde265.mk index b559a9f607..2a10dce6d0 100644 --- a/package/libde265/libde265.mk +++ b/package/libde265/libde265.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBDE265_VERSION = 1.0.19 +LIBDE265_VERSION = 1.1.0 LIBDE265_SITE = https://github.com/strukturag/libde265/releases/download/v$(LIBDE265_VERSION) LIBDE265_LICENSE = LGPL-3.0+ LIBDE265_LICENSE_FILES = COPYING