Files
buildroot/package
Thomas Perale 9c9c531d0b package/libmad: add patch for CVE-2017-837{2, 3, 4}
The commit [1] introduced fixes for the following CVEs:

- CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD
  libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause
  a denial of service (assertion failure and application exit) via a
  crafted audio file.
- CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD
  libmad 0.15.1b allows remote attackers to cause a denial of service
  (heap-based buffer overflow and application crash) or possibly have
  unspecified other impact via a crafted audio file.
- CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD
  libmad 0.15.1b allows remote attackers to cause a denial of service
  (heap-based buffer over-read and application crash) via a crafted
  audio file.

In commit [2], the patches ended up not being applied anymore because
the APPLY_PATCHES step was called before the patch content exists.

This commit import the fixes in Buildroot.

[1] 858df3643f package/libmad: switch to debian to fix CVEs
[2] b21184a877 package/libmad: update the patches to be applied with fuzz 0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-05-29 11:15:32 +02:00
..
2026-05-20 21:41:31 +02:00
2026-05-03 19:59:36 +02:00
2026-05-29 10:32:34 +02:00
2026-05-11 21:32:28 +02:00
2026-05-03 18:10:32 +02:00
2026-05-18 22:18:14 +02:00
2026-05-24 19:42:11 +02:00
2026-05-03 18:19:12 +02:00
2026-05-06 23:02:07 +02:00
2026-05-03 18:14:03 +02:00
2026-05-05 20:44:48 +02:00
2026-05-04 19:11:52 +02:00
2026-05-18 20:18:14 +02:00
2026-05-18 20:17:43 +02:00
2026-05-08 12:34:12 +02:00
2026-05-29 10:35:27 +02:00