mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 08:30:47 -09:00
63c2dd2d40
Fixes the following security issue: CVE-2023-46361: Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. https://www.cve.org/CVERecord?id=CVE-2023-46361 Note that jbig2dec version 0.19 (used in Buildroot 2024.02.11) is not officially listed as affected, but it actually has the same bug. Also note that this CVE is about a crash in the CLI tool only. Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be> [Julien: add JBIG2DEC_IGNORE_CVES] Signed-off-by: Julien Olivain <ju.o@free.fr>
19 lines
565 B
Makefile
19 lines
565 B
Makefile
################################################################################
|
|
#
|
|
# jbig2dec
|
|
#
|
|
################################################################################
|
|
|
|
JBIG2DEC_VERSION = 0.20
|
|
JBIG2DEC_SITE = \
|
|
https://github.com/ArtifexSoftware/jbig2dec/releases/download/$(JBIG2DEC_VERSION)
|
|
JBIG2DEC_LICENSE = AGPL-3.0+
|
|
JBIG2DEC_LICENSE_FILES = LICENSE
|
|
JBIG2DEC_CPE_ID_VENDOR = artifex
|
|
JBIG2DEC_INSTALL_STAGING = YES
|
|
|
|
# 0001-Bug-705041-jbig2dec-Avoid-uninitialized-allocator-in.patch
|
|
JBIG2DEC_IGNORE_CVES += CVE-2023-46361
|
|
|
|
$(eval $(autotools-package))
|