diff mbox series

[scarthgap] libxpm: upgrade 3.5.17 -> 3.5.19

Message ID 20260716142529.2686271-1-enoch.ng@windriver.com
State New
Headers show
Series [scarthgap] libxpm: upgrade 3.5.17 -> 3.5.19 | expand

Commit Message

Enoch Ng July 16, 2026, 2:25 p.m. UTC 
From: Wang Mingyu <wangmy@fujitsu.com>

Squashed backport of two upgrades:
1fc25a668e libxpm: upgrade 3.5.18 -> 3.5.19
767f686226 libxpm: upgrade 3.5.17 -> 3.5.18

A vulnerability in the `xpmNextWord()` function could cause an
internal pointer to read beyond the file's end due to improper
validation of file boundaries. This issue was fixed in libXpm 3.5.19.

The changes between 3.5.17 and 3.5.19 contain the fix to
CVE-2026-4367 along with other changes that should be safe to
backport as shown here:

$ git log --oneline libXpm-3.5.17..libXpm-3.5.19
9a05472 (HEAD -> master, tag: libXpm-3.5.19, origin/master,
        origin/HEAD) libXpm 3.5.19
5448e1b Fix CVE-2026-4367: Out-of-bounds read in xpmNextWord()
5b7e903 (tag: libXpm-3.5.18) libXpm 3.5.18
a5549ac gitlab CI: drop the ci-fairy check-mr job
10070a4 Strip trailing whitespace from source files
5679dd6 tests: poll for stable compressed output
7ce3959 man pages: adjust line breaks in source files
60ee362 man pages: remove .PP after .SH or .SS lines
3ba5d81 man pages: ensure .BR macro has multiple arguments
3aa8a1e man pages: make indentation arguments to .IP be numeric
854c23a XpmCreateBuffer.3: editorial changes for this man page
        [Debian bug #1102886]
b7309b4 Fix build with current Windows headers
2803929 Use _stricmp() instead of strcasecmp() on Windows
bdb6c75 Remove xpmstrdup fallback for strdup
73b69d7 Remove xpmstrcasecmp fallback for strcasecmp
b30fd09 Remove ancient port to 16-bit Windows without X11 libraries
0224b43 Remove ancient Amiga support
b72af4e unifdef VAX11C
02702c2 unifdef sequent
b4e2177 Remove outdated ifdef checks for including stdint.h

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Enoch Ng <enoch.ng@windriver.com>
---
 .../xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb}             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-graphics/xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb} (88%)
diff mbox series

Patch

diff --git a/meta/recipes-graphics/xorg-lib/libxpm_3.5.17.bb b/meta/recipes-graphics/xorg-lib/libxpm_3.5.19.bb
similarity index 88%
rename from meta/recipes-graphics/xorg-lib/libxpm_3.5.17.bb
rename to meta/recipes-graphics/xorg-lib/libxpm_3.5.19.bb
index 8e15ecc0d4..32e052fd42 100644
--- a/meta/recipes-graphics/xorg-lib/libxpm_3.5.17.bb
+++ b/meta/recipes-graphics/xorg-lib/libxpm_3.5.19.bb
@@ -22,6 +22,6 @@  PACKAGES =+ "sxpm cxpm"
 FILES:cxpm = "${bindir}/cxpm"
 FILES:sxpm = "${bindir}/sxpm"
 
-SRC_URI[sha256sum] = "64b31f81019e7d388c822b0b28af8d51c4622b83f1f0cb6fa3fc95e271226e43"
+SRC_URI[sha256sum] = "ad3576d689221a39dc728f0e0dc02ca7bb6a0d724c9a77fd1bfa1e9af83be900"
 
 BBCLASSEXTEND = "native"