Hi Yoann, thank you for your feedback. > I disagree: 3.5.18 is a maintenance/cleanup release with major code > removal (even if obsolete) and I think this is not compatible with our > stable policy. > > To fix CVE-2026-4367, you should backport the fix to scarthgap instead.
Understood. I will submit a new patch to backport the fix from upstream libxpm to scarthgap. Thanks, Enoch Ng Wind River Linux ________________________________ From: Yoann Congal <[email protected]> Sent: Monday, July 20, 2026 3:08 AM To: Ng, Enoch <[email protected]>; [email protected] <[email protected]> Subject: Re: [OE-core][scarthgap][PATCH] libxpm: upgrade 3.5.17 -> 3.5.19 CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. Hello, On Thu Jul 16, 2026 at 4:25 PM CEST, Enoch Ng via lists.openembedded.org wrote: > From: Wang Mingyu <[email protected]> > > Squashed backport of two upgrades: > 1fc25a668e libxpm: upgrade 3.5.18 -> 3.5.19 > 767f686226 libxpm: upgrade 3.5.17 -> 3.5.18 Wang did not author this squashed commit. You can reference their commits but if you majorly modify them (like here), you should be author. > > A vulnerability in the `xpmNextWord()` function could cause an > internal pointer to read beyond the file's end due to improper > validation of file boundaries. This issue was fixed in libXpm 3.5.19. > > The changes between 3.5.17 and 3.5.19 contain the fix to > CVE-2026-4367 along with other changes that should be safe to > backport as shown here: > > $ git log --oneline libXpm-3.5.17..libXpm-3.5.19 > 9a05472 (HEAD -> master, tag: libXpm-3.5.19, origin/master, > origin/HEAD) libXpm 3.5.19 > 5448e1b Fix CVE-2026-4367: Out-of-bounds read in xpmNextWord() > 5b7e903 (tag: libXpm-3.5.18) libXpm 3.5.18 > a5549ac gitlab CI: drop the ci-fairy check-mr job > 10070a4 Strip trailing whitespace from source files > 5679dd6 tests: poll for stable compressed output > 7ce3959 man pages: adjust line breaks in source files > 60ee362 man pages: remove .PP after .SH or .SS lines > 3ba5d81 man pages: ensure .BR macro has multiple arguments > 3aa8a1e man pages: make indentation arguments to .IP be numeric > 854c23a XpmCreateBuffer.3: editorial changes for this man page > [Debian bug #1102886] > b7309b4 Fix build with current Windows headers > 2803929 Use _stricmp() instead of strcasecmp() on Windows > bdb6c75 Remove xpmstrdup fallback for strdup > 73b69d7 Remove xpmstrcasecmp fallback for strcasecmp > b30fd09 Remove ancient port to 16-bit Windows without X11 libraries > 0224b43 Remove ancient Amiga support > b72af4e unifdef VAX11C > 02702c2 unifdef sequent > b4e2177 Remove outdated ifdef checks for including stdint.h I disagree: 3.5.18 is a maintenance/cleanup release with major code removal (even if obsolete) and I think this is not compatible with our stable policy. To fix CVE-2026-4367, you should backport the fix to scarthgap instead. > > Signed-off-by: Wang Mingyu <[email protected]> > Signed-off-by: Mathieu Dubois-Briand <[email protected]> > Signed-off-by: Ross Burton <[email protected]> > Signed-off-by: Richard Purdie <[email protected]> > Signed-off-by: Enoch Ng <[email protected]> > --- > .../xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb} | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > rename meta/recipes-graphics/xorg-lib/{libxpm_3.5.17.bb => libxpm_3.5.19.bb} > (88%) Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#241492): https://lists.openembedded.org/g/openembedded-core/message/241492 Mute This Topic: https://lists.openembedded.org/mt/120299432/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
