[Buildroot] [PATCH 1/1] package/xz: security bump version to 5.8.4
From: Bernd Kuhls <hidden>
Date: 2026-09-10 20:11:15
Subsystem:
the rest · Maintainer:
Linus Torvalds
https://github.com/tukaani-project/xz/releases/tag/v5.8.4 - lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an invalid memory access after memory allocation has failed and the application reinitializes the existing decoder to decode a different file. This bug could at least result in a crash. This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending. (Also in v5.2, v5.4, and v5.6.) Signed-off-by: Bernd Kuhls <redacted> --- Gitlab pipelines passed: https://gitlab.com/bkuhls/buildroot/-/commits/d8ad85198932bc421166413ecf9cc821917c56a9 package/xz/xz.hash | 4 ++-- package/xz/xz.mk | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/package/xz/xz.hash b/package/xz/xz.hash
index 488a3d55dc..270ac748db 100644
--- a/package/xz/xz.hash
+++ b/package/xz/xz.hash@@ -1,5 +1,5 @@ -# From https://github.com/tukaani-project/xz/releases/tag/v5.8.3 -sha256 33bf69c0d6c698e83a68f77e6c1f465778e418ca0b3d59860d3ab446f4ac99a6 xz-5.8.3.tar.bz2 +# From https://github.com/tukaani-project/xz/releases/tag/v5.8.4 +sha256 3340ae48f88665abc78d71dc43446fb3f7e70b48fd59844ac0e14958cef6e00b xz-5.8.4.tar.bz2 # Hash for license files sha256 616a3ad264ce29b8f1cb97e53037b139d406899ca8d1f799651e17bfa09830b8 COPYING
diff --git a/package/xz/xz.mk b/package/xz/xz.mk
index 056c168057..c3232966ee 100644
--- a/package/xz/xz.mk
+++ b/package/xz/xz.mk@@ -4,7 +4,7 @@ # ################################################################################ -XZ_VERSION = 5.8.3 +XZ_VERSION = 5.8.4 XZ_SOURCE = xz-$(XZ_VERSION).tar.bz2 XZ_SITE = https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION) XZ_INSTALL_STAGING = YES
--
2.47.3
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot