diff mbox series

[v2,for,2026.05.x] package/{glibc, localedef}: security bump to v2.43-61

Message ID 20260902123905.192515-1-titouan.christophe@mind.be
State New
Headers show
Series [v2,for,2026.05.x] package/{glibc, localedef}: security bump to v2.43-61 | expand

Commit Message

Titouan Christophe Sept. 2, 2026, 12:39 p.m. UTC 
This fixes the following known vulnerabilities:
- CVE-2026-19499
- CVE-2026-77117
- CVE-2026-80489

(alternative to commit be382f6061216ca82a735d0992894c4e6fe5173a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
Changes v1-v2:
    - Also bump version in localedef (forgotten in v1)
---
 package/glibc/glibc.hash       |  2 +-
 package/glibc/glibc.mk         | 11 ++++++++++-
 package/localedef/localedef.mk |  2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/package/glibc/glibc.hash b/package/glibc/glibc.hash
index 237b56ee48..cff188ab52 100644
--- a/package/glibc/glibc.hash
+++ b/package/glibc/glibc.hash
@@ -1,5 +1,5 @@ 
 # Locally calculated (fetched from git)
-sha256  6c6ec86c66f0484c6916e849e20433ebc67869649c72a772cdf1bb6ca408d516  glibc-2.43-49-g8017bcfc4d9bd16083cb7f3d8eda7d07b4593b09-git4.tar.gz
+sha256  221a59fb35cad9435481bf7e79cbc4edd0ded70fb0ccf7e57d5478fb169dcdf6  glibc-2.43-61-g8dad0ee453a9bd9d24e55daba85e70915b29e19d-git4.tar.gz
 
 # Hashes for license files
 sha256  edaef632cbb643e4e7a221717a6c441a4c1a7c918e6e4d56debc3d8739b233f6  COPYINGv2
diff --git a/package/glibc/glibc.mk b/package/glibc/glibc.mk
index 29b0639cb1..bdf26a0f95 100644
--- a/package/glibc/glibc.mk
+++ b/package/glibc/glibc.mk
@@ -7,7 +7,7 @@ 
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
 # When updating the version, please also update localedef
-GLIBC_VERSION = 2.43-49-g8017bcfc4d9bd16083cb7f3d8eda7d07b4593b09
+GLIBC_VERSION = 2.43-61-g8dad0ee453a9bd9d24e55daba85e70915b29e19d
 GLIBC_SITE = https://gitlab.com/gnutools/glibc.git
 GLIBC_SITE_METHOD = git
 
@@ -61,6 +61,15 @@  GLIBC_IGNORE_CVES += CVE-2026-6238
 # Fixed by glibc-2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
 GLIBC_IGNORE_CVES += CVE-2026-6791
 
+# Fixed in glibc-2.43-54-713998bf001027c2507cb56f9d1c73e46a6bad0b
+GLIBC_IGNORE_CVES += CVE-2026-19499
+
+# Fixed in glibc-2.43-55-138c43f0180945b014e284a87b332d4d8237f537
+GLIBC_IGNORE_CVES += CVE-2026-77117
+
+# Fixed in glibc-2.43-56-3ad1bbd8f94a207efb108a38d434695eab8a1831
+GLIBC_IGNORE_CVES += CVE-2026-80489
+
 # This CVE is considered as not being security issues by
 # upstream glibc:
 #  https://security-tracker.debian.org/tracker/CVE-2010-4756
diff --git a/package/localedef/localedef.mk b/package/localedef/localedef.mk
index 026146bb09..ad7b809578 100644
--- a/package/localedef/localedef.mk
+++ b/package/localedef/localedef.mk
@@ -7,7 +7,7 @@ 
 # Use the same VERSION, SITE, and LICENSE as target glibc
 # As in glibc.mk, generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
-LOCALEDEF_VERSION = 2.43-49-g8017bcfc4d9bd16083cb7f3d8eda7d07b4593b09
+LOCALEDEF_VERSION = 2.43-61-g8dad0ee453a9bd9d24e55daba85e70915b29e19d
 LOCALEDEF_SOURCE = glibc-$(LOCALEDEF_VERSION)$(BR_FMT_VERSION_git).tar.gz
 LOCALEDEF_SITE = https://gitlab.com/gnutools/glibc.git
 LOCALEDEF_SITE_METHOD = git