Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27596
Backport the commits referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <[email protected]> --- .../exiv2/exiv2/CVE-2026-27596-1.patch | 71 +++++++++++++++++++ .../exiv2/exiv2/CVE-2026-27596-2.patch | 24 +++++++ meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb | 2 + 3 files changed, 97 insertions(+) create mode 100644 meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch create mode 100644 meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch new file mode 100644 index 0000000000..c2baf1a54b --- /dev/null +++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch @@ -0,0 +1,71 @@ +From eb658ca4af5c81e790b5c85810ef19481655157f Mon Sep 17 00:00:00 2001 +From: Kevin Backhouse <[email protected]> +Date: Thu, 26 Feb 2026 20:44:18 +0000 +Subject: [PATCH] Regression test for + https://github.com/Exiv2/exiv2/issues/3511 + +CVE: CVE-2026-27596 +Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/fe0d0154ab2886feb503e6cfd38c3b6d5722921f] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + test/data/issue_3511_poc.eps | 13 +++++++++++++ + tests/bugfixes/github/test_issue_3511.py | 17 +++++++++++++++++ + .../test_regression_allfiles.py | 1 + + 3 files changed, 31 insertions(+) + create mode 100644 test/data/issue_3511_poc.eps + create mode 100644 tests/bugfixes/github/test_issue_3511.py + +diff --git a/test/data/issue_3511_poc.eps b/test/data/issue_3511_poc.eps +new file mode 100644 +index 000000000..4d403cc51 +--- /dev/null ++++ b/test/data/issue_3511_poc.eps +@@ -0,0 +1,13 @@ ++%!PS-Adobe-3.0 EPSF-3.0 ++%%BoundingBox: 0 0 100 100 ++%%EndComments ++%%BeginProlog ++%%EndProlog ++%%Page: 1 1 ++%%BeginPageSetup ++%%EndPageSetup ++%BeginPhotoshop: 16 ++3842494D040C00000000000441424344 ++%EndPhotoshop ++%%PageTrailer ++%%EOF +diff --git a/tests/bugfixes/github/test_issue_3511.py b/tests/bugfixes/github/test_issue_3511.py +new file mode 100644 +index 000000000..1825550a1 +--- /dev/null ++++ b/tests/bugfixes/github/test_issue_3511.py +@@ -0,0 +1,17 @@ ++# -*- coding: utf-8 -*- ++ ++import system_tests ++ ++ ++class test_issue_3511_sigma_LoaderNative_getData(metaclass=system_tests.CaseMeta): ++ url = "https://github.com/Exiv2/exiv2/issues/3511"; ++ ++ filename = "$data_path/issue_3511_poc.eps" ++ commands = ["$exiv2 -pp $filename"] ++ retval = [1] ++ stderr = [ ++ """$exiv2_exception_message $filename: ++$kerCorruptedMetadata ++""" ++ ] ++ stdout = [""] +diff --git a/tests/regression_tests/test_regression_allfiles.py b/tests/regression_tests/test_regression_allfiles.py +index 09a218e18..34bea3b03 100644 +--- a/tests/regression_tests/test_regression_allfiles.py ++++ b/tests/regression_tests/test_regression_allfiles.py +@@ -124,6 +124,7 @@ def get_valid_files(data_dir): + "pocIssue283.jpg", + "poc_1522.jp2", + "xmpsdk.xmp", ++ "issue_3511_poc.eps", + # large file that creates 11Mb of output so let's exclude it + "ReaganLargeTiff.tiff", + # files that don't create any output diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch new file mode 100644 index 0000000000..b3a5a7cf2f --- /dev/null +++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch @@ -0,0 +1,24 @@ +From b05f12b6c94e946648a681c39c4581b2fe81afc3 Mon Sep 17 00:00:00 2001 +From: Kevin Backhouse <[email protected]> +Date: Thu, 26 Feb 2026 20:44:54 +0000 +Subject: [PATCH] Check for integer overflow. + +CVE: CVE-2026-27596 +Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/2cb728a850b4aa048a683711906d716c5f9a32ac] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + src/preview.cpp | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/preview.cpp b/src/preview.cpp +index 993c3b749..90f60146f 100644 +--- a/src/preview.cpp ++++ b/src/preview.cpp +@@ -422,6 +422,7 @@ DataBuf LoaderNative::getData() const { + #endif + return {}; + } ++ Internal::enforce(sizeData >= 28, ErrorCode::kerCorruptedMetadata); + return {record + sizeHdr + 28, sizeData - 28}; + } + throw Error(ErrorCode::kerErrorMessage, "Invalid native preview filter: " + nativePreview_.filter_); diff --git a/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb b/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb index cea5455354..9ec2f48a77 100644 --- a/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb +++ b/meta-oe/recipes-support/exiv2/exiv2_0.28.3.bb @@ -10,6 +10,8 @@ SRC_URI = "git://github.com/Exiv2/exiv2.git;protocol=https;branch=0.28.x \ file://0001-Add-new-method-appendIccProfile-to-fix-quadratic-per.patch \ file://CVE-2026-25884-1.patch \ file://CVE-2026-25884-2.patch \ + file://CVE-2026-27596-1.patch \ + file://CVE-2026-27596-2.patch \ " SRCREV = "a6a79ef064f131ffd03c110acce2d3edb84ffa2e" S = "${WORKDIR}/git"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#125079): https://lists.openembedded.org/g/openembedded-devel/message/125079 Mute This Topic: https://lists.openembedded.org/mt/118257439/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
