[Buildroot] [PATCH] package/libopenh264: security bump to version 2.5.1

[Peter Korsgaard]

>>>>> "Arnout" == Arnout Vandecappelle <arnout at rnout.be> writes:

 > On 28/03/2025 17:25, Peter Korsgaard wrote:
 >> Fixes the following security issue:
 >> 
 >> CVE-2025-27091: OpenH264 Decoding Functions Heap Overflow Vulnerability
 >> 
 >> A vulnerability in the decoding functions of OpenH264 codec library could
 >> allow a remote, unauthenticated attacker to trigger a heap overflow.
 >> 
 >> This vulnerability is due to a race condition between a Sequence Parameter
 >> Set (SPS) memory allocation and a subsequent non Instantaneous Decoder
 >> Refresh (non-IDR) Network Abstraction Layer (NAL) unit memory usage.  An
 >> attacker could exploit this vulnerability by crafting a malicious bitstream
 >> and tricking a victim user into processing an arbitrary video containing the
 >> malicious bitstream.  An exploit could allow the attacker to cause an
 >> unexpected crash in the victim's user decoding client and, possibly, perform
 >> arbitrary commands on the victim's host by abusing the heap overflow.
 >> 
 >> https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x
 >> https://github.com/cisco/openh264/releases/tag/2.5.1
 >> 
 >> The upstream tag now has no 'v' prefix, so drop it from _SITE.
 >> 
 >> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>

 >  Applied to 2025.02.x, thanks.

Shouldn't this go to 2024.02.x / 2024.11.x as well?

-- 
Bye, Peter Korsgaard