From: Peter Marko <[email protected]>
Release notes [1]:
Version 1.6.59 [September 28, 2026]
Fixed CVE-2026-46675 (medium severity):
Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt
or iCCP decompression.
(Reported independently by Ze Sheng and
<[email protected]>.)
Fixed a regression introduced in version 1.6.47 that caused libpng to reject
hIST chunks in their correct position, after PLTE.
(Contributed by Yuki Sekiguchi.)
Prevented a double free of `png_struct` members after an allocation failure.
(Contributed by Anthony Hurtado.)
Applied fixes and updates to the CMake build.
Adopted the REUSE Specification for licensing the CI files.
[1] https://github.com/pnggroup/libpng/blob/v1.6.59/CHANGES#L6388
Signed-off-by: Peter Marko <[email protected]>
---
.../files/0001-tests-stream-per-test-results-to-stdout.patch | 2 +-
.../libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb} | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-multimedia/libpng/{libpng_1.6.58.bb => libpng_1.6.59.bb}
(97%)
diff --git
a/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
b/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
index 139495d211..2bedb607f6 100644
---
a/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
+++
b/meta/recipes-multimedia/libpng/files/0001-tests-stream-per-test-results-to-stdout.patch
@@ -50,7 +50,7 @@ index eb7078158..a2e64fbe6 100644
endif
# man pages
-@@ -165,7 +171,7 @@ pkgconfig_DATA = libpng@PNGLIB_MAJOR@@[email protected]
+@@ -216,7 +222,7 @@ pkgconfig_DATA = libpng@PNGLIB_MAJOR@@[email protected]
# not done in the source directory!
EXTRA_DIST= \
ANNOUNCE AUTHORS CHANGES INSTALL LICENSE README TODO TRADEMARK \
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb
similarity index 97%
rename from meta/recipes-multimedia/libpng/libpng_1.6.58.bb
rename to meta/recipes-multimedia/libpng/libpng_1.6.59.bb
index 928b010c9c..4dbd769cf7 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.58.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.59.bb
@@ -15,7 +15,7 @@ SRC_URI =
"${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \
file://0001-tests-stream-per-test-results-to-stdout.patch \
"
-SRC_URI[sha256sum] =
"28eb403f51f0f7405249132cecfe82ea5c0ef97f1b32c5a65828814ae0d34775"
+SRC_URI[sha256sum] =
"d80dd2a38a37f803cb9b6ac7b14bd6e74ddc3b654780a8380bdf93523fdb4389"
MIRRORS += "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/
${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/older-releases/"
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#247152):
https://lists.openembedded.org/g/openembedded-core/message/247152
Mute This Topic: https://lists.openembedded.org/mt/121560676/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
