From: Mathieu Dubois-Briand <[email protected]> Version 10.49 28-September-2026 -------------------------------
This is a security-only release, to address GHSA-r9hj-j2rw-4q3m. Compared to 10.48, this release has only a minimal code change to prevent an out-of-bounds write with arbitrary data. An attacker-controlled regex pattern is required, and applications are only affected if using the pcre2_jit_stack_create() and pcre2_jit_stack_assign() APIs to provide a growable JIT stack, and then matching against a pattern with unusually high JIT stack usage, such as a large number of capturing groups. The implications of an out-of-bounds write could include arbitrary code execution. The issue is not a regression and affects releases 10.48 and earlier. Signed-off-by: Mathieu Dubois-Briand <[email protected]> Signed-off-by: Richard Purdie <[email protected]> (cherry picked from commit fd7f3e10c98a1dc75473efae8ab14ea5bcfb1819) Signed-off-by: Yoann Congal <[email protected]> [YC: See: https://github.com/PCRE2Project/pcre2/compare/pcre2-10.48...pcre2-10.49 ] --- .../libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-support/libpcre/{libpcre2_10.48.bb => libpcre2_10.49.bb} (96%) diff --git a/meta/recipes-support/libpcre/libpcre2_10.48.bb b/meta/recipes-support/libpcre/libpcre2_10.49.bb similarity index 96% rename from meta/recipes-support/libpcre/libpcre2_10.48.bb rename to meta/recipes-support/libpcre/libpcre2_10.49.bb index 56791171c23..5fa7c3db3b4 100644 --- a/meta/recipes-support/libpcre/libpcre2_10.48.bb +++ b/meta/recipes-support/libpcre/libpcre2_10.49.bb @@ -20,7 +20,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/pcre2-${PV}/pcre2-${PV}.tar.bz2 \ GITHUB_BASE_URI = "https://github.com/PCRE2Project/pcre2/releases"; UPSTREAM_CHECK_REGEX = "releases/tag/pcre2-(?P<pver>\d+(\.\d+)+)$" -SRC_URI[sha256sum] = "b6c68fdf6f3ac31388b50aa89ff0fc49c00c987c16e7b5146491d12003f2c8ed" +SRC_URI[sha256sum] = "53c156e1ba416a20da8e65395daa132da0d80e76910424caca3fcdae7831d384" CVE_PRODUCT = "pcre2"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247343): https://lists.openembedded.org/g/openembedded-core/message/247343 Mute This Topic: https://lists.openembedded.org/mt/121617727/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
