mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-28 21:11:41 -09:00
d15dddfc5f
Fixes the following vulnerability:
- CVE-2025-8837:
A vulnerability was identified in JasPer up to 4.2.5. This affects the
function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the
component JPEG2000 File Handler. The manipulation leads to use after
free. An attack has to be approached locally. The exploit has been
disclosed to the public and may be used.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-8837
- 8308060d3f
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
50 lines
1.2 KiB
Makefile
50 lines
1.2 KiB
Makefile
################################################################################
|
|
#
|
|
# jasper
|
|
#
|
|
################################################################################
|
|
|
|
JASPER_VERSION = 2.0.33
|
|
JASPER_SITE = https://github.com/jasper-software/jasper/releases/download/version-$(JASPER_VERSION)
|
|
JASPER_INSTALL_STAGING = YES
|
|
JASPER_LICENSE = JasPer-2.0
|
|
JASPER_LICENSE_FILES = LICENSE
|
|
JASPER_CPE_ID_VALID = YES
|
|
JASPER_SUPPORTS_IN_SOURCE_BUILD = NO
|
|
JASPER_CONF_OPTS = \
|
|
-DJAS_ENABLE_DOC=OFF \
|
|
-DJAS_ENABLE_PROGRAMS=OFF
|
|
|
|
# 0001-Fixes-367.patch
|
|
JASPER_IGNORE_CVES += CVE-2023-51257
|
|
|
|
# 0002-Fixes-400.patch
|
|
JASPER_IGNORE_CVES += CVE-2025-8835
|
|
|
|
# 0003-Fixes-401.patch
|
|
JASPER_IGNORE_CVES += CVE-2025-8836
|
|
|
|
# 0004-Fixes-402-403.patch
|
|
JASPER_IGNORE_CVES += CVE-2025-8837
|
|
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
JASPER_CONF_OPTS += -DJAS_ENABLE_SHARED=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_JPEG),y)
|
|
JASPER_CONF_OPTS += -DJAS_ENABLE_LIBJPEG=ON
|
|
JASPER_DEPENDENCIES += jpeg
|
|
else
|
|
JASPER_CONF_OPTS += -DJAS_ENABLE_LIBJPEG=OFF
|
|
endif
|
|
|
|
JASPER_CFLAGS = $(TARGET_CFLAGS)
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_GCC_BUG_85180),y)
|
|
JASPER_CFLAGS += -O0
|
|
endif
|
|
|
|
JASPER_CONF_OPTS += -DCMAKE_C_FLAGS="$(JASPER_CFLAGS)"
|
|
|
|
$(eval $(cmake-package))
|