linux/meta-openembedded.git/meta-oe/recipes-multimedia, branch scarthgap

libjxl: mark CVE-2025-12474 and CVE-2026-1837 patched

2026-03-24T03:22:15+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-12474 https://nvd.nist.gov/vuln/detail/CVE-2026-1837 Both vulnerabilities have been fixed in 0.10.5. Relevant commits: CVE-2025-12474: https://github.com/libjxl/libjxl/commit/5ce68976a5abfaea7b3086036ab9f6543ab5b29e CVE-2026-1837: https://github.com/libjxl/libjxl/commit/36b0cecaa12f643d03c16bd32e5f83775c912b07 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

libjxl: upgrade 0.10.2 -> 0.10.5

2026-03-24T03:22:02+00:00

Bug fix release, mostly CVE fixes. Drop patches that are included. Changelog: 0.10.5: fix tile dimension in low memory rendering pipeline (CVE-2025-12474) fix number of channels for gray-to-gray color transform (CVE-2026-1837) djxl: reject decoding JXL files if "packed" representation size overflows size_t 0.10.4: Huffman lookup table size fix (CVE-2024-11403) Check height limit in modular trees (CVE-2024-11498) 0.10.3: fixed decoding of some special images Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

libmad: ignore CVE-2017-11552 and CVE-2018-7263

2026-01-26T04:34:48+00:00

These CVEs are for mpg321, not libmad. See Debian assessment: * https://security-tracker.debian.org/tracker/CVE-2017-11552 * https://security-tracker.debian.org/tracker/CVE-2018-7263 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit fee86a312fbcaef7aaad66fe2f6756bd7e57d585) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

id3lib: mark CVE-2007-4460 as fixed

2026-01-12T02:42:26+00:00

This is fixed in id3lib3.8.3_3.8.3-16.2.debian.tar.xz patch included in SRC_URI. Version 3.8.3-7 contains patch for this CVE, we use 3.8.3-16.2. This can be verified by checking the debian/changelog within this patch or diffing [1] and [2] and verifying that this can be reverse-applied. [1] https://snapshot.debian.org/archive/debian/20070819T000000Z/pool/main/i/id3lib3.8.3/id3lib3.8.3_3.8.3-6.diff.gz [2] https://snapshot.debian.org/archive/debian/20070819T000000Z/pool/main/i/id3lib3.8.3/id3lib3.8.3_3.8.3-7.diff.gz Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 9fff0040f1694b09c6c68cf59615f42d801d62f5) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libvpx: upgrade 1.14.0 -> 1.14.1

2026-01-12T02:42:25+00:00

libvpx-configure-support-blank-prefix.patch refreshed for 1.14.1 Changelog: ============ - Improved the detection of compiler support for AArch64 extensions, particularly SVE. - Added vpx_codec_get_global_headers() support for VP9. - Added buffer bounds checks to vpx_writer and vpx_write_bit_buffer. - Fix to GetSegmentationData() crash in aq_mode=0 for RTC rate control. - Fix to alloc for row_base_thresh_freq_fac. - Free row mt memory before freeing cpi->tile_data. - Fix to buffer alloc for vp9_bitstream_worker_data. - Fix to VP8 race issue for multi-thread with pnsr_calc. - Fix to uv width/height in vp9_scale_and_extend_frame_ssse3. - Fix to integer division by zero and overflow in calc_pframe_target_size(). - Fix to integer overflow in vpx_img_alloc() & vpx_img_wrap()(CVE-2024-5197). - Fix to UBSan error in vp9_rc_update_framerate(). - Fix to UBSan errors in vp8_new_framerate(). - Fix to integer overflow in vp8 encodeframe.c. - Handle EINTR from sem_wait(). Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj (cherry picked from commit 911023b521bebcd7e4ee4bcb2eb97745c2349752) Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

audiofile: mark CVE-2020-18781 as patched

2025-11-17T04:46:55+00:00

Per [1] this CVE is already patched by commit [2]. This can be also verified with yocto build. Running without this patch: root@qemux86-64:~# sfconvert poc.wav output format wave malloc(): corrupted top size Aborted Running with it: root@qemux86-64:~# sfconvert poc.wav output format wave Audio File Library: Bad number of coefficients [error 62] Could not open file 'poc.wav' for reading. [1] https://github.com/mpruett/audiofile/issues/56 [2] https://github.com/antlarr/audiofile/commit/c48e4c6503f7dabd41f11d4c9c7b7f8960e7f2c0 Signed-off-by: Peter Marko Signed-off-by: Khem Raj (cherry picked from commit 68f55c158e15a5d35702ae5c730586001e487f86) Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

audiofile: patch CVE-2018-13440 and CVE-2018-17059

2025-11-17T04:46:55+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2018-13440 https://nvd.nist.gov/vuln/detail/CVE-2018-17059 The patches have been backported from Debian - upstream has been inactive for almost a decade by now. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit e16a7d11d1dc0c577cb17652085b0c183c791883) Signed-off-by: Anuj Mittal

audiofile: patch CVE-2019-13147 and CVE-2022-24599

2025-11-17T04:46:55+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2019-13147 https://nvd.nist.gov/vuln/detail/CVE-2022-24599 These patches are used by opensuse to mitigate the corresponding vulnerabulities. Signed-off-by: Gyorgy Sarvari Signed-off-by: Khem Raj (cherry picked from commit 8ef997336aec6f51318f1a7fa55d57e3990914e8) Signed-off-by: Anuj Mittal

id3lib: update remote patch SRC_URI

2025-11-12T06:02:41+00:00

The URL of the patch archive from Debian got out of date - update it. Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

libjxl: fix CVE-2024-11403 & CVE-2024-11498

2025-10-30T07:11:00+00:00

* CVE-2024-11403 - Upstream-Status: Backport from https://github.com/libjxl/libjxl/commit/9cc451b91b74ba470fd72bd48c121e9f33d24c99 * CVE-2024-11498 - Upstream-Status: Backport from https://github.com/libjxl/libjxl/commit/bf4781a2eed2eef664790170977d1d3d8347efb9 Signed-off-by: Hitendra Prajapati Signed-off-by: Anuj Mittal