From patchwork Fri Oct 2 11:23:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10300 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hx5yF123pz3wrK for ; Fri, 02 Oct 2026 11:23:49 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [172.28.1.201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hx5yC34J9z87T for ; Fri, 02 Oct 2026 11:23:47 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hx5y80KLbz37Jf for ; Fri, 02 Oct 2026 11:23:44 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hx5y05fPRz37DB for ; Fri, 02 Oct 2026 11:23:36 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hx5y047nMz1mh; Fri, 02 Oct 2026 11:23:36 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1790940216; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xrvqCNP3J48TbtfKCSmgYazygj6fSrFnndD1fH5ceUg=; b=K/SALu62GKkKgn/6FTtRA2v3Lix4DY50teGaF2gF7/SGldOES5JF0FDViE37LyXZo4lrtU dL5CnZH+jHLyo2DQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1790940216; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xrvqCNP3J48TbtfKCSmgYazygj6fSrFnndD1fH5ceUg=; b=O/o9IxuNLvy1LGQzPkizy2X6Mrt2DnqloZn3ovJ+AYiI4jSevEgH1yQ27vmPCLuxSQVqEx H656dG17uuaXW9PR4/bLcIVJY01WAbA5iPq5fSMICeZuT/Z8TeX40NW/M6+DLwHkTCim0C fFauWyiWM/VnoQ3zzCN5JujB3X3bMqlAVD9DIrrcWOjOVjCouQrzkgJ11Y9b3cbct3Tlee 7RF6l7WkhQGdOcBLn/bBhkIf32Y15whyz5OwL3jY51Q0Rn2vICeLwAMwTlZsZJ6XQ1UVPp 198nMS2HTuPP9nVGlcxYb9QaYPKVhAXhx2Y+WpuJzX6RQmvpdY/hjU0fwrL/bw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] libpng: Update to version 1.6.59 Date: Fri, 2 Oct 2026 13:23:25 +0200 Message-ID: <20261002112330.3568361-8-adolf.belka@ipfire.org> In-Reply-To: <20261002112330.3568361-1-adolf.belka@ipfire.org> References: <20261002112330.3568361-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - Update from version 1.6.58 to 1.6.59 - Update of rootfile - 1 CVE fix - Changelog 1.6.59 Fixed CVE-2026-46675 (medium severity): Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression. (Reported independently by Ze Sheng and .) Fixed a regression introduced in version 1.6.47 that caused libpng to reject hIST chunks in their correct position, after PLTE. (Contributed by Yuki Sekiguchi.) Prevented a double free of `png_struct` members after an allocation failure. (Contributed by Anthony Hurtado.) Applied fixes and updates to the CMake build. Adopted the REUSE Specification for licensing the CI files. Signed-off-by: Adolf Belka --- config/rootfiles/common/libpng | 2 +- lfs/libpng | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config/rootfiles/common/libpng b/config/rootfiles/common/libpng index ef7d888f3..5c7cf4867 100644 --- a/config/rootfiles/common/libpng +++ b/config/rootfiles/common/libpng @@ -16,7 +16,7 @@ usr/lib/libpng.so #usr/lib/libpng16.la usr/lib/libpng16.so usr/lib/libpng16.so.16 -usr/lib/libpng16.so.16.58.0 +usr/lib/libpng16.so.16.59.0 #usr/lib/pkgconfig/libpng.pc #usr/lib/pkgconfig/libpng16.pc #usr/share/man/man3/libpng.3 diff --git a/lfs/libpng b/lfs/libpng index 6aa7fbee9..2375432b0 100644 --- a/lfs/libpng +++ b/lfs/libpng @@ -24,7 +24,7 @@ include Config -VER = 1.6.58 +VER = 1.6.59 THISAPP = libpng-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 51042e8f2b56d469b516db9cbde6d4b6813a62d1b7117898ba32a9a5ac5cd73832c627d7377745e5d5154aade6ec6928fc6b9cd9b96885f64b7ca7df19ca40ec +$(DL_FILE)_BLAKE2 = f2656b0d9a3865faf957e8600a7617516d9139d15c6d7581c06b4829b4c9338ec5f747e4ccfcc49b6b9f5a96f0476121eda99457469c8e1cfecd8ecc3b1697ed install : $(TARGET)