mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-08 08:30:47 -09:00
353007cf40
- CVE-2026-6192:
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This
impacts the function opj_pi_initialise_encode in the library
src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The
attack must be carried out locally. The exploit is publicly available
and might be used. The identifier of the patch is
839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a
patch to address this issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-6192
- 839936aa33
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
29 lines
949 B
Makefile
29 lines
949 B
Makefile
################################################################################
|
|
#
|
|
# openjpeg
|
|
#
|
|
################################################################################
|
|
|
|
OPENJPEG_VERSION = 2.5.4
|
|
OPENJPEG_SITE = $(call github,uclouvain,openjpeg,v$(OPENJPEG_VERSION))
|
|
OPENJPEG_LICENSE = BSD-2-Clause
|
|
OPENJPEG_LICENSE_FILES = LICENSE
|
|
OPENJPEG_CPE_ID_VENDOR = uclouvain
|
|
OPENJPEG_INSTALL_STAGING = YES
|
|
|
|
# 0001-opj-pi-initialise-encode-avoid-potential-integer-overflow-leading-to-insufficient-memory-allocation.patch
|
|
OPENJPEG_IGNORE_CVES += CVE-2026-6192
|
|
|
|
OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib)
|
|
OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBPNG),libpng)
|
|
OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_TIFF),tiff)
|
|
OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_LCMS2),lcms2)
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
|
|
OPENJPEG_CONF_OPTS += -DOPJ_USE_THREAD=ON
|
|
else
|
|
OPENJPEG_CONF_OPTS += -DOPJ_USE_THREAD=OFF
|
|
endif
|
|
|
|
$(eval $(cmake-package))
|