From: Peter Marko <[email protected]> Pick patch referencing this CVE from 3.41 branch (oldest release still receiving security updates).
Signed-off-by: Peter Marko <[email protected]> --- .../glibc/glibc/0037-CVE-2026-77117.patch | 32 +++++++++++++++++++ meta/recipes-core/glibc/glibc_2.39.bb | 1 + 2 files changed, 33 insertions(+) create mode 100644 meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch diff --git a/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch new file mode 100644 index 00000000000..fa42a548c34 --- /dev/null +++ b/meta/recipes-core/glibc/glibc/0037-CVE-2026-77117.patch @@ -0,0 +1,32 @@ +From e43e46f94398b3de446fec11da1e7633ea5202ec Mon Sep 17 00:00:00 2001 +From: Florian Weimer <[email protected]> +Date: Fri, 28 Aug 2026 10:26:07 +0200 +Subject: [PATCH] iconvdata: SHIFT_JISX0213 decoding lacks pending character + reset (CVE-2026-77117) + +This fixes bug 34556. + +Reviewed-by: Carlos O'Donell <[email protected]> +(cherry picked from commit 68d94bbe50b7577d48998107d632ef3a0df050e3) + +CVE: CVE-2026-77117 +Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=e43e46f94398b3de446fec11da1e7633ea5202ec] +Signed-off-by: Peter Marko <[email protected]> +--- + iconvdata/shift_jisx0213.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/iconvdata/shift_jisx0213.c b/iconvdata/shift_jisx0213.c +index 364298dcff..834fa81322 100644 +--- a/iconvdata/shift_jisx0213.c ++++ b/iconvdata/shift_jisx0213.c +@@ -226,6 +226,9 @@ + STANDARD_FROM_LOOP_ERR_HANDLER (1); \ + } \ + } \ ++ else \ ++ /* There was a pending character. Clear it. */ \ ++ *statep = 0; \ + \ + put32 (outptr, ch); \ + outptr += 4; \ diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb index 567d53dd6f6..3090b9cd277 100644 --- a/meta/recipes-core/glibc/glibc_2.39.bb +++ b/meta/recipes-core/glibc/glibc_2.39.bb @@ -69,6 +69,7 @@ SRC_URI = "${GLIBC_GIT_URI};branch=${SRCBRANCH};name=glibc \ file://0034-CVE-2026-6368.patch \ file://0035-CVE-2026-19542.patch \ file://0036-CVE-2026-19499.patch \ + file://0037-CVE-2026-77117.patch \ " S = "${WORKDIR}/git" B = "${WORKDIR}/build-${TARGET_SYS}"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#248463): https://lists.openembedded.org/g/openembedded-core/message/248463 Mute This Topic: https://lists.openembedded.org/mt/121892952/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
