From 3f9bcf42c31bb0d089ae0e70642242cf572ba5b6 Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 16 Apr 2026 09:36:37 +0200 Subject: [PATCH] package/libexif: security bump to version 0.6.26 https://github.com/libexif/libexif/blob/v0.6.26/NEWS * Security issues fixed: * CVE-2026-40386: An unsigned integer underflow in Fuji and Olympus makernote handling * CVE-2026-40385: An unsigned integer overflow on 32bit systems in Nikon makernote handling * CVE-2026-32775: A buffer overwrite via integer underflow in makernote handling Switched to xz tarball and tarball hash provided by upstream. Signed-off-by: Bernd Kuhls Signed-off-by: Julien Olivain --- package/libexif/libexif.hash | 3 ++- package/libexif/libexif.mk | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/package/libexif/libexif.hash b/package/libexif/libexif.hash index 9e95e27f3e..5949bfb36c 100644 --- a/package/libexif/libexif.hash +++ b/package/libexif/libexif.hash @@ -1,3 +1,4 @@ +# From https://github.com/libexif/libexif/releases/tag/v0.6.26 +sha256 4a055ed6575e61ca46c3172be3c753cc16c9becd0f99ec71d58dd0e471476c0c libexif-0.6.26.tar.xz # Locally computed: -sha256 7c9eba99aed3e6594d8c3e85861f1c6aaf450c218621528bc989d3b3e7a26307 libexif-0.6.25.tar.bz2 sha256 36b6d3fa47916943fd5fec313c584784946047ec1337a78b440e5992cb595f89 COPYING diff --git a/package/libexif/libexif.mk b/package/libexif/libexif.mk index 0e50d78fbe..f434f9a922 100644 --- a/package/libexif/libexif.mk +++ b/package/libexif/libexif.mk @@ -4,8 +4,8 @@ # ################################################################################ -LIBEXIF_VERSION = 0.6.25 -LIBEXIF_SOURCE = libexif-$(LIBEXIF_VERSION).tar.bz2 +LIBEXIF_VERSION = 0.6.26 +LIBEXIF_SOURCE = libexif-$(LIBEXIF_VERSION).tar.xz LIBEXIF_SITE = \ https://github.com/libexif/libexif/releases/download/v$(LIBEXIF_VERSION) LIBEXIF_INSTALL_STAGING = YES