diff mbox series

[v2,for,2025.02.x] package/{glibc, localedef}: security bump to v2.41-159

Message ID 20260902123817.192274-1-titouan.christophe@mind.be
State New
Headers show
Series [v2,for,2025.02.x] package/{glibc, localedef}: security bump to v2.41-159 | expand

Commit Message

Titouan Christophe Sept. 2, 2026, 12:38 p.m. UTC 
This fixes the following known vulnerabilities:
- CVE-2026-5435
- CVE-2026-6238
- CVE-2026-6791
- CVE-2026-6368
- CVE-2026-19499
- CVE-2026-77117
- CVE-2026-80489

(alternative to commit be382f6061216ca82a735d0992894c4e6fe5173a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
Changes v1-v2:
    - Also bump version in localedef (forgotten in v1)
---
 package/glibc/glibc.hash       |  2 +-
 package/glibc/glibc.mk         | 24 +++++++++++++++++++++++-
 package/localedef/localedef.mk |  2 +-
 3 files changed, 25 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash
index 03e8722057..87dd8b67ac 100644
--- a/package/glibc/glibc.hash
+++ b/package/glibc/glibc.hash
@@ -1,5 +1,5 @@ 
 # Locally calculated (fetched from git)
-sha256  130d77e16a08f7e52e14b49d8554997877a4fe82ac6b840a0202716146ac8fb5  glibc-2.41-143-gfc7a48bc9e999c0f9a1f9fa1b209eac1d6a93363-git4.tar.gz
+sha256  e3550f6d074325ad8ee75fff96f16a967055e88f69e1455333ace515b8ac2067  glibc-2.41-159-g3d141c23899d90559741b5fe74db97ccf0ef5c29-git4.tar.gz
 
 # Hashes for license files
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index 7c64fea4a2..65a99b4a68 100644
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -7,7 +7,7 @@ 
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
 # When updating the version, please also update localedef
-GLIBC_VERSION = 2.41-143-gfc7a48bc9e999c0f9a1f9fa1b209eac1d6a93363
+GLIBC_VERSION = 2.41-159-g3d141c23899d90559741b5fe74db97ccf0ef5c29
 GLIBC_SITE = https://gitlab.com/gnutools/glibc.git
 GLIBC_SITE_METHOD = git
 
@@ -66,6 +66,28 @@  GLIBC_IGNORE_CVES += CVE-2026-5928
 # Fixed by glibc-2.41-142-g1a74f82eedaf0987eda1f522121e6a48fac502e7
 GLIBC_IGNORE_CVES += CVE-2026-5450
 
+# Fixed by glibc-2.41-149-g0e8c56b386d72ba2ddf15784423f2e894c63a241
+GLIBC_IGNORE_CVES += CVE-2026-5435
+
+# Fixed by glibc-2.41-150-g05e1eaea619072a92ff1f5fefe1ac2dd5758829c
+GLIBC_IGNORE_CVES += CVE-2026-6238
+
+# Fixed by glibc-2.41-152-g965b580070b8184b0dd390800d9194291a600e67
+GLIBC_IGNORE_CVES += CVE-2026-6791
+
+# Fixed by glibc-2.41-153-gdfc8ef388ef7856f318ade7dec501f92ce54f9e3
+GLIBC_IGNORE_CVES += CVE-2026-6368
+
+# Fixed by glibc-2.41-156-g5256941bc811248670eda4636dccd0a390d34dec
+GLIBC_IGNORE_CVES += CVE-2026-19499
+
+# Fixed by glibc-2.41-157-ge43e46f94398b3de446fec11da1e7633ea5202ec
+GLIBC_IGNORE_CVES += CVE-2026-77117
+
+# Fixed by glibc-2.41-158-gec116a0fbedcc860631e525e70b409cf295f27da
+GLIBC_IGNORE_CVES += CVE-2026-80489
+
+
 # glibc is part of the toolchain so disable the toolchain dependency
 GLIBC_ADD_TOOLCHAIN_DEPENDENCY = NO
 
diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk
index 2549aaaf99..9a19ebc4aa 100644
--- a/package/localedef/localedef.mk
+++ b/package/localedef/localedef.mk
@@ -7,7 +7,7 @@ 
 # Use the same VERSION, SITE and LICENSE as target glibc
 # As in glibc.mk, generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
-LOCALEDEF_VERSION = 2.41-143-gfc7a48bc9e999c0f9a1f9fa1b209eac1d6a93363
+LOCALEDEF_VERSION = 2.41-159-g3d141c23899d90559741b5fe74db97ccf0ef5c29
 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION)$(BR_FMT_VERSION_git).tar.gz
 LOCALEDEF_SITE = https://gitlab.com/gnutools/glibc.git
 LOCALEDEF_SITE_METHOD = git