mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-06-13 17:39:57 +00:00
Code Issues Projects Releases Wiki Activity

exiv2: patch CVE-2026-27596

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27596

Backport the commits referenced by the NVD advisory.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This commit is contained in:
Gyorgy Sarvari
2026-03-11 12:11:54 +01:00
parent ac5e0e2ba0
commit 8add1e4e12
3 changed files with 84 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch
+58
View File
@@ -0,0 +1,58 @@
From 05d3cc42c6f56678ae62697d60af01af8876eada Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 26 Feb 2026 20:44:18 +0000
Subject: [PATCH] Regression test for
https://github.com/Exiv2/exiv2/issues/3511
CVE: CVE-2026-27596
Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/fe0d0154ab2886feb503e6cfd38c3b6d5722921f]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
test/data/issue_3511_poc.eps | 13 +++++++++++++
tests/bugfixes/github/test_issue_3511.py | 17 +++++++++++++++++
2 files changed, 30 insertions(+)
create mode 100644 test/data/issue_3511_poc.eps
create mode 100644 tests/bugfixes/github/test_issue_3511.py
diff --git a/test/data/issue_3511_poc.eps b/test/data/issue_3511_poc.eps
new file mode 100644
index 0000000..4d403cc
--- /dev/null
+++ b/test/data/issue_3511_poc.eps
@@ -0,0 +1,13 @@
+%!PS-Adobe-3.0 EPSF-3.0
+%%BoundingBox: 0 0 100 100
+%%EndComments
+%%BeginProlog
+%%EndProlog
+%%Page: 1 1
+%%BeginPageSetup
+%%EndPageSetup
+%BeginPhotoshop: 16
+3842494D040C00000000000441424344
+%EndPhotoshop
+%%PageTrailer
+%%EOF
diff --git a/tests/bugfixes/github/test_issue_3511.py b/tests/bugfixes/github/test_issue_3511.py
new file mode 100644
index 0000000..1825550
--- /dev/null
+++ b/tests/bugfixes/github/test_issue_3511.py
@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+
+import system_tests
+
+
+class test_issue_3511_sigma_LoaderNative_getData(metaclass=system_tests.CaseMeta):
+ url = "https://github.com/Exiv2/exiv2/issues/3511"
+
+ filename = "$data_path/issue_3511_poc.eps"
+ commands = ["$exiv2 -pp $filename"]
+ retval = [1]
+ stderr = [
+ """$exiv2_exception_message $filename:
+$kerCorruptedMetadata
+"""
+ ]
+ stdout = [""]
meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch
+24
View File
@@ -0,0 +1,24 @@
From 6b65696b4af2f0a6b6756ba693aebf83889bafa3 Mon Sep 17 00:00:00 2001
From: Kevin Backhouse <kevinbackhouse@github.com>
Date: Thu, 26 Feb 2026 20:44:54 +0000
Subject: [PATCH] Check for integer overflow.
CVE: CVE-2026-27596
Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/2cb728a850b4aa048a683711906d716c5f9a32ac]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/preview.cpp | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/preview.cpp b/src/preview.cpp
index d99a03a..aefb323 100644
--- a/src/preview.cpp
+++ b/src/preview.cpp
@@ -492,6 +492,7 @@ namespace {
#endif
return DataBuf();
}
+ enforce(sizeData >= 28, Exiv2::kerCorruptedMetadata);
return DataBuf(record + sizeHdr + 28, sizeData - 28);
} else {
throw Error(kerErrorMessage, "Invalid native preview filter: " + nativePreview_.filter_);
meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb
+2
View File
@@ -33,6 +33,8 @@ SRC_URI = "https://github.com/Exiv2/${BPN}/releases/download/v${PV}/${BP}-Source
file://CVE-2021-37622-1.patch \
file://CVE-2021-37622-2.patch \
file://CVE-2026-25884.patch \
file://CVE-2026-27596-1.patch \
file://CVE-2026-27596-2.patch \
"
SRC_URI[sha256sum] = "a79f5613812aa21755d578a297874fb59a85101e793edc64ec2c6bd994e3e778"