[Buildroot] [PATCH] package/exiv2: security bump to version 0.28.9

[Julien Olivain]

On 01/09/2026 21:41, Peter Korsgaard wrote:
> Fixes the following vulnerabilities:
> 
> CVE-2026-68546: Heap out-of-bounds write in RemoteIo when reading from 
> a
> malicious remote server (WebReady/Curl builds)
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-3695-mjv8-3r52
> 
> CVE-2026-68547: Heap out-of-bounds read in RemoteIo when reading
> block-aligned remote CRW files
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-jcgh-p9v3-pw6j
> 
> CVE-2026-49275: Out of bounds read in CrwMap::decodeBasic
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-hxph-pv7w-8649
> 
> Out-of-bounds write in RemoteIo::mmap
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-vg6c-9f6h-4x5q
> 
> Out of bounds write in http.cpp
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-9v3x-mhg4-wwv2
> 
> Infinite loop in QuickTimeVideo::userDataDecoder
> https://github.com/Exiv2/exiv2/security/advisories/GHSA-fgw8-p7pr-37cp
> 
> For more details, see the announcement:
> https://www.openwall.com/lists/oss-security/2026/08/30/1
> 
> Notice: the RemoteIo-related vulnerabilities are not applicable for
> Buildroot as exiv2 is not built with libcurl support.
> 
> Signed-off-by: Peter Korsgaard <peter at korsgaard.com>

Applied to master, thanks.