From ff8dd4cc898d0796e2350a30e8246668a8891dca Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 15 Jan 2026 22:02:46 +0100 Subject: [PATCH] package/libpng: security bump version to 1.6.54 Release notes: https://raw.githubusercontent.com/pnggroup/libpng/v1.6.54/ANNOUNCE * Fixed CVE-2026-22695 (medium severity): Heap buffer over-read in `png_image_read_direct_scaled. (Reported and fixed by Petr Simecek.) * Fixed CVE-2026-22801 (medium severity): Integer truncation causing heap buffer over-read in `png_image_write_*` Updated license hash due to copyright year bump: https://github.com/pnggroup/libpng/commit/9e4e247afbe809bac24bf70f531b23427e3f20ec Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain (cherry picked from commit 85fa070335cd536793255d8c90fe915e11c3bee8) Signed-off-by: Thomas Perale --- package/libpng/libpng.hash | 8 ++++---- package/libpng/libpng.mk | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/package/libpng/libpng.hash b/package/libpng/libpng.hash index 1e57e1dc33..4cf8718cc6 100644 --- a/package/libpng/libpng.hash +++ b/package/libpng/libpng.hash @@ -1,5 +1,5 @@ -# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.53/ -sha1 90672f16e545e4931abd50d372edef50596a1d46 libpng-1.6.53.tar.xz +# From https://sourceforge.net/projects/libpng/files/libpng16/1.6.54/ +sha1 3dcffaeb58daa7b754bebe93cb008342964d9f39 libpng-1.6.54.tar.xz # Locally computed: -sha256 1d3fb8ccc2932d04aa3663e22ef5ef490244370f4e568d7850165068778d98d4 libpng-1.6.53.tar.xz -sha256 16d9daaafbf63a31a5bdc91d4600972548fef5aaa1244202393288dbd079c49a LICENSE +sha256 01c9d8a303c941ec2c511c14312a3b1d36cedb41e2f5168ccdaa85d53b887805 libpng-1.6.54.tar.xz +sha256 bdb0a645ea18c60507d0368379b1ac5474b92255fcc2d115e07486a7672ba526 LICENSE diff --git a/package/libpng/libpng.mk b/package/libpng/libpng.mk index 6fc3744963..bde2c8e9fc 100644 --- a/package/libpng/libpng.mk +++ b/package/libpng/libpng.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBPNG_VERSION = 1.6.53 +LIBPNG_VERSION = 1.6.54 LIBPNG_SERIES = 16 LIBPNG_SOURCE = libpng-$(LIBPNG_VERSION).tar.xz LIBPNG_SITE = http://downloads.sourceforge.net/project/libpng/libpng$(LIBPNG_SERIES)/$(LIBPNG_VERSION)