mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-10 08:14:09 -09:00
94013c3a95
Fixes the following vulnerabilities: CVE-2026-68546: Heap out-of-bounds write in RemoteIo when reading from a malicious remote server (WebReady/Curl builds) https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52 CVE-2026-68547: Heap out-of-bounds read in RemoteIo when reading block-aligned remote CRW files https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649 Out-of-bounds write in RemoteIo::mmap https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q Out of bounds write in http.cpp https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2 Infinite loop in QuickTimeVideo::userDataDecoder https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp For more details, see the announcement: https://www.openwall.com/lists/oss-security/2026/08/30/1 Notice: the RemoteIo-related vulnerabilities are not applicable for Buildroot as exiv2 is not built with libcurl support. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Julien Olivain <ju.o@free.fr>
4 lines
197 B
Plaintext
4 lines
197 B
Plaintext
# Locally calculated
|
|
sha256 700b76b97695b2fab4ef8c79619c68ae57d09e0c130724791cafbd39e0eb4aef exiv2-0.28.9.tar.gz
|
|
sha256 a7ba75cb966aca374711e2af49e5f3aea6a4443a803440f5d93e73a5a1222f66 COPYING
|