From 9989e25158ead53cd28350ef325feecd08895c95 Mon Sep 17 00:00:00 2001 From: Peter Korsgaard Date: Wed, 6 May 2026 21:02:37 +0200 Subject: [PATCH] package/xlib_libXpm: security bump to version 3.5.19 Fixes the following vulnerability: CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord() libXpm uses a number of internal helper functions to parse the XPM file format. One of these internal functions, xpmNextString(), checks for the NULL terminator when looking for the end of the current string but not when looking for the beginning of the next string. A small XPM file with a malformed color table definition may cause the function xpmNextWord(), called from xpmParseColors() following a call to xpmNextString(), to start past the actual end of the file, causing an out-of-bound read. Advisory: https://lists.x.org/archives/xorg-announce/2026-April/003690.html Signed-off-by: Peter Korsgaard Signed-off-by: Julien Olivain (cherry picked from commit 3aa75c99c13caf0816c69f57245c2950d40f3895) Signed-off-by: Thomas Perale --- package/x11r7/xlib_libXpm/xlib_libXpm.hash | 6 +++--- package/x11r7/xlib_libXpm/xlib_libXpm.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/x11r7/xlib_libXpm/xlib_libXpm.hash b/package/x11r7/xlib_libXpm/xlib_libXpm.hash index 3582169891..72a330f1ad 100644 --- a/package/x11r7/xlib_libXpm/xlib_libXpm.hash +++ b/package/x11r7/xlib_libXpm/xlib_libXpm.hash @@ -1,6 +1,6 @@ -# From https://lists.x.org/archives/xorg-announce/2023-October/003425.html -sha256 64b31f81019e7d388c822b0b28af8d51c4622b83f1f0cb6fa3fc95e271226e43 libXpm-3.5.17.tar.xz -sha512 52f9d2664a47a26c1a6ad65d18867de870b66947b0b0d99cca3512756a0aaa6ce2a245c0b49f20b70c3ce48bf04c47c333e8119a147465c277bca727f6ab017e libXpm-3.5.17.tar.xz +# From https://lists.x.org/archives/xorg-announce/2026-April/003691.html +sha256 ad3576d689221a39dc728f0e0dc02ca7bb6a0d724c9a77fd1bfa1e9af83be900 libXpm-3.5.19.tar.xz +sha512 dd95a70af0ac2fb0f5876e69ad19b38128c5add94b00238ee41a22634aa4dc56b22c1b47c4baa6a1ab549308d11b302c250b405322da8a64ea24441a065fbada libXpm-3.5.19.tar.xz # Locally calculated sha256 a80d706759624a04aa90fd62bc644a360fc3d72e08dcbfb129f167c11ca285de COPYING sha256 cbe4ced0abc8a32bea471204ae01038c202758ce4e772d3d329a341ffa761e71 COPYRIGHT diff --git a/package/x11r7/xlib_libXpm/xlib_libXpm.mk b/package/x11r7/xlib_libXpm/xlib_libXpm.mk index 1239ba0d4d..a2a652df17 100644 --- a/package/x11r7/xlib_libXpm/xlib_libXpm.mk +++ b/package/x11r7/xlib_libXpm/xlib_libXpm.mk @@ -4,7 +4,7 @@ # ################################################################################ -XLIB_LIBXPM_VERSION = 3.5.17 +XLIB_LIBXPM_VERSION = 3.5.19 XLIB_LIBXPM_SOURCE = libXpm-$(XLIB_LIBXPM_VERSION).tar.xz XLIB_LIBXPM_SITE = https://xorg.freedesktop.org/archive/individual/lib XLIB_LIBXPM_LICENSE = MIT