From d71f65ff4303d78e69a5be3bf9b8a7a681497944 Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Sun, 28 Dec 2025 19:56:34 +0100 Subject: [PATCH] package/musl: add CVE trailer in patch Since Buildroot commit [1] the patches that fixes a security vulnerability needs to reference the fixed vulnerability. This patch adds the relevant information to the patch header. [1] 1167d0ff3d docs/manual: mention CVE trailer Signed-off-by: Thomas Perale Signed-off-by: Thomas Petazzoni (cherry picked from commit c0921c6b38fd494de8b3490b965614d3f2089399) Signed-off-by: Thomas Perale --- ...04-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch | 1 + ...05-iconv-harden-UTF-8-output-code-path-against-input-de.patch | 1 + 2 files changed, 2 insertions(+) diff --git a/package/musl/0004-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch b/package/musl/0004-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch index dbfd87db76..a0418e1df8 100644 --- a/package/musl/0004-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch +++ b/package/musl/0004-iconv-fix-erroneous-input-validation-in-EUC-KR-decod.patch @@ -17,6 +17,7 @@ buffer. bug report was submitted in private by Nick Wellnhofer on account of potential security implications. +CVE: CVE-2025-26519 Upstream: https://git.musl-libc.org/cgit/musl/commit/?id=e5adcd97b5196e29991b524237381a0202a60659 Signed-off-by: Peter Korsgaard --- diff --git a/package/musl/0005-iconv-harden-UTF-8-output-code-path-against-input-de.patch b/package/musl/0005-iconv-harden-UTF-8-output-code-path-against-input-de.patch index a14041364a..8250790d4f 100644 --- a/package/musl/0005-iconv-harden-UTF-8-output-code-path-against-input-de.patch +++ b/package/musl/0005-iconv-harden-UTF-8-output-code-path-against-input-de.patch @@ -14,6 +14,7 @@ output byte count overflow, moving the output position backwards, potentially past the beginning of the buffer, without storing any bytes. +CVE: CVE-2025-26519 Upstream: https://git.musl-libc.org/cgit/musl/commit/?id=c47ad25ea3b484e10326f933e927c0bc8cded3da Signed-off-by: Peter Korsgaard ---