[Buildroot] [PATCH 1/1] package/expat: security bump to version 2.4.4

[Buildroot] [PATCH 1/1] package/expat: security bump to version 2.4.4

[Fabrice Fontaine]

Expat 2.4.4 has been released yesterday. Besides a memory leak bugfix to
xmlwf and fixes to the build system, this release is about security
fixes. There are 2 CVEs involved, both related to fixed-size integer
math (integer overflow) near memory allocation, not unlike what we had
with 2.4.3 before. Impact is denial of service, or more.

Fix CVE-2022-23852 and CVE-2022-23990

https://blog.hartwork.org/posts/expat-2-4-4-released/
https://github.com/libexpat/libexpat/blob/R_2_4_4/expat/Changes

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/expat/expat.hash | 8 ++++----
 package/expat/expat.mk   | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package/expat/expat.hash b/package/expat/expat.hash
index 0853c3c76d..10e13206d0 100644
--- a/package/expat/expat.hash
+++ b/package/expat/expat.hash
@@ -1,7 +1,7 @@
-# From https://sourceforge.net/projects/expat/files/expat/2.4.3/
-md5  b1137f030590b3f0c41c69c6cd68fa90  expat-2.4.3.tar.xz
-sha1  cfaacc4f929b34cfbde2b8f33b74ec84c0cbb329  expat-2.4.3.tar.xz
+# From https://sourceforge.net/projects/expat/files/expat/2.4.4/
+md5  a712d23b7afb32e7527cf0b3fd8f12ac  expat-2.4.4.tar.xz
+sha1  6028b04d3505fc519c4c7c6bd67e1ad1a08cd7b6  expat-2.4.4.tar.xz
 
 # Locally calculated
-sha256  b1f9f1b1a5ebb0acaa88c9ff79bfa4e145823b78aa5185e5c5d85f060824778a  expat-2.4.3.tar.xz
+sha256  b5d25d6e373351c2ed19b562b4732d01d2589ac8c8e9e7962d8df1207cc311b8  expat-2.4.4.tar.xz
 sha256  8c6b5b6de8fae20b317f4992729abc0e520bfba4c7606cd1e9eeb87418eebdec  COPYING
diff --git a/package/expat/expat.mk b/package/expat/expat.mk
index a7ace66095..250600c25e 100644
--- a/package/expat/expat.mk
+++ b/package/expat/expat.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-EXPAT_VERSION = 2.4.3
+EXPAT_VERSION = 2.4.4
 EXPAT_SITE = http://downloads.sourceforge.net/project/expat/expat/$(EXPAT_VERSION)
 EXPAT_SOURCE = expat-$(EXPAT_VERSION).tar.xz
 EXPAT_INSTALL_STAGING = YES
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/expat: security bump to version 2.4.4

[Peter Korsgaard]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > Expat 2.4.4 has been released yesterday. Besides a memory leak bugfix to
 > xmlwf and fixes to the build system, this release is about security
 > fixes. There are 2 CVEs involved, both related to fixed-size integer
 > math (integer overflow) near memory allocation, not unlike what we had
 > with 2.4.3 before. Impact is denial of service, or more.

 > Fix CVE-2022-23852 and CVE-2022-23990

 > https://blog.hartwork.org/posts/expat-2-4-4-released/
 > https://github.com/libexpat/libexpat/blob/R_2_4_4/expat/Changes

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Sorry, I applied the other patch for the same before noticing this (even
though your commit message is a lot nicer).

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot