From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 23 Jan 2026 16:03:21 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vjIgz-004W2F-1a for lore@lore.pengutronix.de; Fri, 23 Jan 2026 16:03:21 +0100 Received: from localhost ([127.0.0.1] helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1vjIgy-0003ng-S7; Fri, 23 Jan 2026 16:03:20 +0100 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1vjIfp-000191-8H; Fri, 23 Jan 2026 16:02:09 +0100 Received: from dude05.red.stw.pengutronix.de ([2a0a:edc0:0:1101:1d::54]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1vjIfp-0026yA-2M; Fri, 23 Jan 2026 16:02:09 +0100 Received: from mol by dude05.red.stw.pengutronix.de with local (Exim 4.98.2) (envelope-from ) id 1vjIfo-00000006b64-4BF2; Fri, 23 Jan 2026 16:02:08 +0100 From: Michael Olbrich To: ptxdist@pengutronix.de Date: Fri, 23 Jan 2026 16:02:08 +0100 Message-ID: <20260123150208.1572491-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260115201203.1824095-1-christian.melki@t2data.com> References: <20260115201203.1824095-1-christian.melki@t2data.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: Re: [ptxdist] [APPLIED] libpng: Version bump. 1.6.53 -> 1.6.54 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Christian Melki Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 94c0f1589817c397dc57e6bcaa097c0766d20ad8. Michael [sent from post-receive hook] On Fri, 23 Jan 2026 16:02:08 +0100, Christian Melki wrote: > Security fixes. > https://sourceforge.net/p/libpng/code/ci/libpng16/tree/CHANGES > > Plugs CVEs: > CVE-2026-22695: Heap buffer over-read in png_image_read_direct_scaled. > CVE-2026-22801: Integer truncation causing heap buffer over-read in png_image_write_* > > * License hash changed, copyright year updates. > > Signed-off-by: Christian Melki > Message-Id: <20260115201203.1824095-1-christian.melki@t2data.com> > Signed-off-by: Michael Olbrich > > diff --git a/rules/libpng.make b/rules/libpng.make > index 7bd6d2376c1b..f69de3e081f5 100644 > --- a/rules/libpng.make > +++ b/rules/libpng.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_LIBPNG) += libpng > # > # Paths and names > # > -LIBPNG_VERSION := 1.6.53 > -LIBPNG_MD5 := 0d95e8af31991e976811bbf55f693d2d > +LIBPNG_VERSION := 1.6.54 > +LIBPNG_MD5 := ba9e86853c794d111398b66a42bfa0dc > LIBPNG := libpng-$(LIBPNG_VERSION) > LIBPNG_SUFFIX := tar.xz > LIBPNG_URL := $(call ptx/mirror, SF, libpng/$(LIBPNG).$(LIBPNG_SUFFIX)) > @@ -25,7 +25,7 @@ LIBPNG_SOURCE := $(SRCDIR)/$(LIBPNG).$(LIBPNG_SUFFIX) > LIBPNG_DIR := $(BUILDDIR)/$(LIBPNG) > LIBPNG_LICENSE := libpng-2.0 > LIBPNG_LICENSE_FILES := \ > - file://LICENSE;md5=5516d77a3cf75f55a0d37254e3e65a20 > + file://LICENSE;md5=9dc350edbbbee660c7d9af79487168f2 > > # ---------------------------------------------------------------------------- > # Prepare