On Wed Jun 10, 2026 at 3:39 PM CEST, Jérémy Rosen via lists.openembedded.org wrote: > Hello Bindu > > The hunk you removed from archive_read_support_format_iso9660.c is the > actual CVE fix, so what is left is the test only... but that's kinda > normal > > As you mentionned, the fix is already included in CVE-2026-4426.patch > > upstream fixed both CVE with the same code in two separate, parllel but > identical > commits then merged them. Thus complicating backports > > please rename CVE-2026-4426.patch to CVE-2026-442_CVE-2026-5121.patch > > and add the new CVE tag and related test there > > > please respin and send a version where both CVE are fixed in the same > file > > > thanks a lot for looking into this > Jeremy
Hello, Gentle ping for the above Regards, > > On Fri May 22, 2026 at 12:18 PM CEST, BINDU via lists.openembedded.org wrote: >> Fixes CVE-2026-5121, adds regression test for >> zisofs 32-bit heap overflow >> >> Signed-off-by: Sana Kazi <[email protected]> >> --- >> .../libarchive/libarchive/CVE-2026-5121.patch | 1271 +++++++++++++++++ >> .../libarchive/libarchive_3.7.9.bb | 1 + >> 2 files changed, 1272 insertions(+) >> create mode 100644 >> meta/recipes-extended/libarchive/libarchive/CVE-2026-5121.patch >> -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241293): https://lists.openembedded.org/g/openembedded-core/message/241293 Mute This Topic: https://lists.openembedded.org/mt/119437633/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
