From 50abc2e77a249402bdbeef55ed7e64dd3a8641f1 Mon Sep 17 00:00:00 2001 From: Fabrice Fontaine Date: Sun, 3 Dec 2023 15:20:11 +0100 Subject: [PATCH] package/libde265: security bump to version 1.0.14 Fix CVE-2023-43887: Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::dump. Fix CVE-2023-47471: Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_header function in the slice.cc component. https://github.com/strukturag/libde265/releases/tag/v1.0.14 https://github.com/strukturag/libde265/releases/tag/v1.0.13 Signed-off-by: Fabrice Fontaine Signed-off-by: Peter Korsgaard (cherry picked from commit 4cf5d91d8bf1dc48af612e785bde869e47048ec3) Signed-off-by: Peter Korsgaard --- package/libde265/libde265.hash | 2 +- package/libde265/libde265.mk | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/package/libde265/libde265.hash b/package/libde265/libde265.hash index 168b5db39576..9bb3f20a71cf 100644 --- a/package/libde265/libde265.hash +++ b/package/libde265/libde265.hash @@ -1,3 +1,3 @@ # Locally computed -sha256 62185ea2182e68cf68bba20cc6eb4c287407b509cf0a827d7ddb75614db77b5c libde265-1.0.12.tar.gz +sha256 99f46ef77a438be639aa3c5d9632c0670541c5ed5d386524d4199da2d30df28f libde265-1.0.14.tar.gz sha256 02cc1585a20677992e0ba578fa692635dc193735f2691dc81de924b51c4e8020 COPYING diff --git a/package/libde265/libde265.mk b/package/libde265/libde265.mk index 208fa24e270a..8624d2f949c3 100644 --- a/package/libde265/libde265.mk +++ b/package/libde265/libde265.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBDE265_VERSION = 1.0.12 +LIBDE265_VERSION = 1.0.14 LIBDE265_SITE = https://github.com/strukturag/libde265/releases/download/v$(LIBDE265_VERSION) LIBDE265_LICENSE = LGPL-3.0+ LIBDE265_LICENSE_FILES = COPYING