Details: https://nvd.nist.gov/vuln/detail/CVE-2026-27596
Backport the commits referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <[email protected]> --- .../exiv2/exiv2/CVE-2026-27596-1.patch | 58 +++++++++++++++++++ .../exiv2/exiv2/CVE-2026-27596-2.patch | 24 ++++++++ meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb | 2 + 3 files changed, 84 insertions(+) create mode 100644 meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch create mode 100644 meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch new file mode 100644 index 0000000000..67757947d3 --- /dev/null +++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-1.patch @@ -0,0 +1,58 @@ +From 05d3cc42c6f56678ae62697d60af01af8876eada Mon Sep 17 00:00:00 2001 +From: Kevin Backhouse <[email protected]> +Date: Thu, 26 Feb 2026 20:44:18 +0000 +Subject: [PATCH] Regression test for + https://github.com/Exiv2/exiv2/issues/3511 + +CVE: CVE-2026-27596 +Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/fe0d0154ab2886feb503e6cfd38c3b6d5722921f] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + test/data/issue_3511_poc.eps | 13 +++++++++++++ + tests/bugfixes/github/test_issue_3511.py | 17 +++++++++++++++++ + 2 files changed, 30 insertions(+) + create mode 100644 test/data/issue_3511_poc.eps + create mode 100644 tests/bugfixes/github/test_issue_3511.py + +diff --git a/test/data/issue_3511_poc.eps b/test/data/issue_3511_poc.eps +new file mode 100644 +index 0000000..4d403cc +--- /dev/null ++++ b/test/data/issue_3511_poc.eps +@@ -0,0 +1,13 @@ ++%!PS-Adobe-3.0 EPSF-3.0 ++%%BoundingBox: 0 0 100 100 ++%%EndComments ++%%BeginProlog ++%%EndProlog ++%%Page: 1 1 ++%%BeginPageSetup ++%%EndPageSetup ++%BeginPhotoshop: 16 ++3842494D040C00000000000441424344 ++%EndPhotoshop ++%%PageTrailer ++%%EOF +diff --git a/tests/bugfixes/github/test_issue_3511.py b/tests/bugfixes/github/test_issue_3511.py +new file mode 100644 +index 0000000..1825550 +--- /dev/null ++++ b/tests/bugfixes/github/test_issue_3511.py +@@ -0,0 +1,17 @@ ++# -*- coding: utf-8 -*- ++ ++import system_tests ++ ++ ++class test_issue_3511_sigma_LoaderNative_getData(metaclass=system_tests.CaseMeta): ++ url = "https://github.com/Exiv2/exiv2/issues/3511"; ++ ++ filename = "$data_path/issue_3511_poc.eps" ++ commands = ["$exiv2 -pp $filename"] ++ retval = [1] ++ stderr = [ ++ """$exiv2_exception_message $filename: ++$kerCorruptedMetadata ++""" ++ ] ++ stdout = [""] diff --git a/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch new file mode 100644 index 0000000000..addc01bfd0 --- /dev/null +++ b/meta-oe/recipes-support/exiv2/exiv2/CVE-2026-27596-2.patch @@ -0,0 +1,24 @@ +From 6b65696b4af2f0a6b6756ba693aebf83889bafa3 Mon Sep 17 00:00:00 2001 +From: Kevin Backhouse <[email protected]> +Date: Thu, 26 Feb 2026 20:44:54 +0000 +Subject: [PATCH] Check for integer overflow. + +CVE: CVE-2026-27596 +Upstream-Status: Backport [https://github.com/Exiv2/exiv2/commit/2cb728a850b4aa048a683711906d716c5f9a32ac] +Signed-off-by: Gyorgy Sarvari <[email protected]> +--- + src/preview.cpp | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/src/preview.cpp b/src/preview.cpp +index d99a03a..aefb323 100644 +--- a/src/preview.cpp ++++ b/src/preview.cpp +@@ -492,6 +492,7 @@ namespace { + #endif + return DataBuf(); + } ++ enforce(sizeData >= 28, Exiv2::kerCorruptedMetadata); + return DataBuf(record + sizeHdr + 28, sizeData - 28); + } else { + throw Error(kerErrorMessage, "Invalid native preview filter: " + nativePreview_.filter_); diff --git a/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb b/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb index 602ef3910f..2bf9c88b3e 100644 --- a/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb +++ b/meta-oe/recipes-support/exiv2/exiv2_0.27.3.bb @@ -33,6 +33,8 @@ SRC_URI = "https://github.com/Exiv2/${BPN}/releases/download/v${PV}/${BP}-Source file://CVE-2021-37622-1.patch \ file://CVE-2021-37622-2.patch \ file://CVE-2026-25884.patch \ + file://CVE-2026-27596-1.patch \ + file://CVE-2026-27596-2.patch \ " SRC_URI[sha256sum] = "a79f5613812aa21755d578a297874fb59a85101e793edc64ec2c6bd994e3e778"
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#125083): https://lists.openembedded.org/g/openembedded-devel/message/125083 Mute This Topic: https://lists.openembedded.org/mt/118258174/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
