From b97e9adb890b52d7b1a5d430e6fb976535bfcc80 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 28 Dec 2025 19:56:31 +0100 Subject: [PATCH] package/graphicsmagick: add CVE trailer in patch Since Buildroot commit [1] the patches that fixes a security vulnerability needs to reference the fixed vulnerability. This patch adds the relevant information to the patch header. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni (cherry picked from commit 04d80d13ec7f84e8074ad4f886da06a8e0ca0e86) Signed-off-by: Thomas Perale --- ...0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch | 1 + ...0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch | 1 + 2 files changed, 2 insertions(+) diff --git a/package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch b/package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch index 275738a71a..56122e466e 100644 --- a/package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch +++ b/package/graphicsmagick/0001-ReadJXLImage-Apply-image-dimension-resource-limits.patch @@ -6,6 +6,7 @@ # Parent db3ff8d00c28c38895e1600a28706ce251dac570 ReadJXLImage(): Apply image dimension resource limits. Addresses oss-fuzz Issue 69728 +CVE: CVE-2025-27795 Upstream: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/9bbae7314e3c3b19b830591010ed90bb136b9c42 Signed-off-by: Peter Korsgaard [Peter: drop ChangeLog/version changes] diff --git a/package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch b/package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch index d1cc795b4c..004594523c 100644 --- a/package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch +++ b/package/graphicsmagick/0002-ReadJXLImage-pixel_format-num_channels-needs-to-be.patch @@ -6,6 +6,7 @@ # Parent 036a1376a2a6dc9504c5148249cbd8feaef72de6 ReadJXLImage(): pixel_format.num_channels needs to be 2 for grayscale matte. +CVE: CVE-2025-32460 Upstream: https://foss.heptapod.net/graphicsmagick/graphicsmagick/-/commit/8e56520435df50f618a03f2721a39a70a515f1cb Signed-off-by: Peter Korsgaard [Peter: drop ChangeLog/version changes]