Skip to content

Commit 8002534

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Wed Aug 26 06:04:16 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent 12e78cc commit 8002534

6 files changed

Lines changed: 70 additions & 23 deletions

File tree

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
{
22
"vcs_url": "https://github.com/github/advisory-database",
33
"vulnerabilities": {
4+
"GHSA-P2PH-7G93-HW3M": {
5+
"7d09b1d73cfc6e7461c0117c84d99aefa0ba4141": "Publish GHSA-p2ph-7g93-hw3m",
6+
"8030799f750a5f730375ecc326e73fb74ed88bca": "Merge pull request #8177 from github/G-Rath-GHSA-p2ph-7g93-hw3m",
7+
"5eaa5a029255ff4720d98baf2e9a4cdae729c360": "Improve GHSA-p2ph-7g93-hw3m",
8+
"e558598d1f7e56d15354bd0be9f93d4b6c2065b6": "Publish Advisories\n\nGHSA-3w9f-2pph-j5vc\nGHSA-6qvp-39mm-95v8\nGHSA-jr5f-v2jv-69x6\nGHSA-p2ph-7g93-hw3m",
9+
"817bd4a546cbff5ade9339ffe460b320b19edaff": "Publish GHSA-p2ph-7g93-hw3m"
10+
},
411
"GHSA-CV84-9P8J-FJ68": {
512
"2bd2ede461277836aaae3a9bdc8bca48495979d8": "Publish Advisories\n\nGHSA-cv84-9p8j-fj68\nGHSA-p43p-whwx-q52h"
613
},
@@ -15892,11 +15899,6 @@
1589215899
"GHSA-XPV9-P7VG-QHRC": {
1589315900
"9c495a76cd670dd1fcddf0224eb11422112f10d8": "Publish Advisories\n\nGHSA-34qm-63x6-fcm3\nGHSA-576m-xh9m-c774\nGHSA-5hpf-pc4x-3jcf\nGHSA-69q5-vhm6-656f\nGHSA-6q89-vxvr-wgv2\nGHSA-843r-rrmh-xf43\nGHSA-89v8-3927-wfcg\nGHSA-9c3c-227q-3j67\nGHSA-c9q2-5c67-xg9p\nGHSA-gq94-hf88-g4wv\nGHSA-h4jr-6mf9-63fq\nGHSA-p894-8wv9-373j\nGHSA-pwj4-f48q-v2h2\nGHSA-q3px-vrjj-4f97\nGHSA-r937-wjx7-w2jp\nGHSA-r98j-g9p3-fcgm\nGHSA-w3gw-f9wr-g6qx\nGHSA-xpf5-wwvx-w945\nGHSA-xpv9-p7vg-qhrc"
1589415901
},
15895-
"GHSA-P2PH-7G93-HW3M": {
15896-
"5eaa5a029255ff4720d98baf2e9a4cdae729c360": "Improve GHSA-p2ph-7g93-hw3m",
15897-
"e558598d1f7e56d15354bd0be9f93d4b6c2065b6": "Publish Advisories\n\nGHSA-3w9f-2pph-j5vc\nGHSA-6qvp-39mm-95v8\nGHSA-jr5f-v2jv-69x6\nGHSA-p2ph-7g93-hw3m",
15898-
"817bd4a546cbff5ade9339ffe460b320b19edaff": "Publish GHSA-p2ph-7g93-hw3m"
15899-
},
1590015902
"GHSA-7MQ5-J49H-8P29": {
1590115903
"98a0012dffbf9c9600454e1d5a4abe1aa073d342": "Publish Advisories\n\nGHSA-7mq5-j49h-8p29\nGHSA-94qr-xmg5-q7cw\nGHSA-p6vp-4f63-q49c\nGHSA-qpch-gjf6-c9gf"
1590215904
},

‎data/fix-commits/aom-e111beb2.json‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,13 @@
11
{
22
"vcs_url": "https://aomedia.googlesource.com/aom",
33
"vulnerabilities": {
4+
"CVE-2026-56209": {
5+
"441c439b9916474cac15d2822af47a9ad70674a8": "Merge tag 'v3.15.0' into main branch\n\nRelease v3.15.0 Quibble Pants\n\n2026-08-25 v3.15.0\n This release is ABI compatible with the last release.\n\n This release includes the fixes for all the security issues found by\n AI tools recently.\n\n Important build system change: The cmake option ENABLE_APPS was added\n to build aomdec and aomenc without building the example programs. The\n cmake option ENABLE_EXAMPLES was redefined to build only the example\n programs.\n\n - New Features\n * Test only: New codec control AV1E_SET_MODE_REF_DELTA_ENABLED for\n the encoder to toggle loopfilter mode_ref_delta_enabled.\n * New codec option \u201cforce-max-q\u201d for the encoder to force the use\n of max Q in VBR mode.\n * Completed low-complexity decode mode development for VOD video,\n and supported HDres (i.e. 720p to 1080p) encoding.\n * IntraBC for RTC screen: improvements to allow and speed up this\n tool for realtime mode.\n\n - Compression Efficiency Improvements\n * Improved the rate allocation among hierarchical layers and luma\n and chroma planes.\n\n - Perceptual Quality Improvements\n * Improved VMAF metric while maintaining PSNR performance.\n\n - Speedups\n * Continued the speed 0 to 3 encoder speed optimizations.\n * Improvements to Arm optimizations for convolve and variance\n functions.\n\n - Bug Fixes\n * Bug 541725398: aom_img_flip: fix chroma height calculation\n * Bug 437872594: CONFIG_SHARED=1 produces an .a(rchive) file for\n static linking\n * Bug 503326506: SEGV in encoder_destroy via failed encoder\n initialization\n * Bug 538651949: Bounds-check bypass in AV1E_SET_SVC_LAYER_ID:\n ppi/svc layer-count desync re-enables OOB layer_context[]\n read/write (incomplete fix for issue 503993985 / CVE-2026-56209)\n * Bug 525452409: The math and Threads::Threads library dependencies\n should not be part of the link interface of the aom shared library\n * Bug 524353636: AOM_EXTRA_C_FLAGS/-DSANITIZE= flags not propagated\n w/CMAKE_BUILD_TYPE=Debug\n * Bug 513342555: Potential heap double-free in libaom AV1 MT\n encoding via aliased macroblock data\n * Bug 520656240: Copy on write: libaom AV1 wedge/interintra mask\n buffers could be precomputed\n * Bug 514696186: aomdec fails with \"Failed to decode tile data\" on\n stream encoded by aomenc\n * Bug 382465458: Chessboard pattern on flat gray video encoded with\n libaom AV1\n * oss-fuzz:514006304: Increase ctx->cx_data_sz to 2.5x uncomp frame\n size\n * Bug 514816767: aomenc fails assertion check mi->bsize == bsize\n * Bug 504613867: Potential heap OOB read in\n av1_int_pro_motion_estimation due to stale stride (CVE-2026-13906)\n * Bug 503810640: Undefined behavior: NaN-to-int conversion in\n aom_noise_model_get_grain_parameters\n * Bug 503171639: Heap-buffer-overflow in\n av1_update_and_record_txb_context via SVC encoding with mismatched\n TXB buffer size\n * Bug 505976409: SIGFPE (integer divide-by-zero) in libaom AV1 SVC\n encoder\n\nBug: 549271249\nChange-Id: I4a10986ae5323fa5e593217a81803aaa0552cd4c"
6+
},
7+
"CVE-2026-13906": {
8+
"441c439b9916474cac15d2822af47a9ad70674a8": "Merge tag 'v3.15.0' into main branch\n\nRelease v3.15.0 Quibble Pants\n\n2026-08-25 v3.15.0\n This release is ABI compatible with the last release.\n\n This release includes the fixes for all the security issues found by\n AI tools recently.\n\n Important build system change: The cmake option ENABLE_APPS was added\n to build aomdec and aomenc without building the example programs. The\n cmake option ENABLE_EXAMPLES was redefined to build only the example\n programs.\n\n - New Features\n * Test only: New codec control AV1E_SET_MODE_REF_DELTA_ENABLED for\n the encoder to toggle loopfilter mode_ref_delta_enabled.\n * New codec option \u201cforce-max-q\u201d for the encoder to force the use\n of max Q in VBR mode.\n * Completed low-complexity decode mode development for VOD video,\n and supported HDres (i.e. 720p to 1080p) encoding.\n * IntraBC for RTC screen: improvements to allow and speed up this\n tool for realtime mode.\n\n - Compression Efficiency Improvements\n * Improved the rate allocation among hierarchical layers and luma\n and chroma planes.\n\n - Perceptual Quality Improvements\n * Improved VMAF metric while maintaining PSNR performance.\n\n - Speedups\n * Continued the speed 0 to 3 encoder speed optimizations.\n * Improvements to Arm optimizations for convolve and variance\n functions.\n\n - Bug Fixes\n * Bug 541725398: aom_img_flip: fix chroma height calculation\n * Bug 437872594: CONFIG_SHARED=1 produces an .a(rchive) file for\n static linking\n * Bug 503326506: SEGV in encoder_destroy via failed encoder\n initialization\n * Bug 538651949: Bounds-check bypass in AV1E_SET_SVC_LAYER_ID:\n ppi/svc layer-count desync re-enables OOB layer_context[]\n read/write (incomplete fix for issue 503993985 / CVE-2026-56209)\n * Bug 525452409: The math and Threads::Threads library dependencies\n should not be part of the link interface of the aom shared library\n * Bug 524353636: AOM_EXTRA_C_FLAGS/-DSANITIZE= flags not propagated\n w/CMAKE_BUILD_TYPE=Debug\n * Bug 513342555: Potential heap double-free in libaom AV1 MT\n encoding via aliased macroblock data\n * Bug 520656240: Copy on write: libaom AV1 wedge/interintra mask\n buffers could be precomputed\n * Bug 514696186: aomdec fails with \"Failed to decode tile data\" on\n stream encoded by aomenc\n * Bug 382465458: Chessboard pattern on flat gray video encoded with\n libaom AV1\n * oss-fuzz:514006304: Increase ctx->cx_data_sz to 2.5x uncomp frame\n size\n * Bug 514816767: aomenc fails assertion check mi->bsize == bsize\n * Bug 504613867: Potential heap OOB read in\n av1_int_pro_motion_estimation due to stale stride (CVE-2026-13906)\n * Bug 503810640: Undefined behavior: NaN-to-int conversion in\n aom_noise_model_get_grain_parameters\n * Bug 503171639: Heap-buffer-overflow in\n av1_update_and_record_txb_context via SVC encoding with mismatched\n TXB buffer size\n * Bug 505976409: SIGFPE (integer divide-by-zero) in libaom AV1 SVC\n encoder\n\nBug: 549271249\nChange-Id: I4a10986ae5323fa5e593217a81803aaa0552cd4c",
9+
"de4c1d1edc49723a78954d30a83690aa1937422f": "Add CVE-2026-13906 to bug 504613867 in CHANGELOG\n\nBug: 549271249\nChange-Id: I03e82992d681c4f2a46e8585e451b104853a38b7"
10+
},
411
"CVE-2024-5493": {
512
"a9eef2ee8f0a1efdaf4158321c14c83eab5cab04": "Merge tag 'v3.8.3' into main branch\n\nlibaom v3.8.3 release\n\n2024-06-07 v3.8.3\n This release includes several bug fixes. This release is ABI\n compatible with the last release. See\n https://aomedia.googlesource.com/aom/+log/v3.8.2..v3.8.3 for all the\n commits in this release.\n\n - Bug Fixes\n * aomedia:2754, aomedia:3567: Ensure thread stack size is at least\n 256 KB\n * aomedia:3382, chromium:339877165: update codec config after\n svc/scale controls (CVE-2024-5493)\n * aomedia:3561: libaom-3.8.2 armv7 Android build failed\n * aomedia:3580: Allow g_timebase.num to be greater than\n g_timebase.den\n * Arm SVE build fixes.\n * av1_block_error_lp_neon: fix block_size param type\n\nBug: aomedia:3581\nChange-Id: I5c09e52e1e847452fd30a64504617e69924f89d4",
613
"89ca86204d3605c2967aa4e24b332d7636f7ac19": "Merge tag 'v3.9.1' into main branch\n\nlibaom v3.9.1 release\n\n2024-06-05 v3.9.1\n This release includes several bug fixes. This release is ABI\n compatible with the last release. See\n https://aomedia.googlesource.com/aom/+log/v3.9.0..v3.9.1 for all the\n commits in this release.\n\n - Bug Fixes\n * aomedia:2754, aomedia:3567: Ensure thread stack size is at least\n 256 KB\n * b:330639949, oss-fuzz:68195: Increase scaling in linsolve_wiener\n * Fix high target data rate overflow.\n * aomedia:3509: Fix two UBSan errors in av1_rc_update_framerate()\n * aomedia:3382, chromium:339877165: update codec config after\n svc/scale controls (CVE-2024-5493)\n * aomedia:3561: libaom-3.8.2 armv7 Android build failed\n * aomedia:3571: {,highbd_}intrapred_neon.c: Avoid over-reads in z1\n and z3 preds\n * aomedia:3578: libaom-3.9.0 undefined reference to\n `aom_sub_pixel_variance16xh_ssse3'\n * aomedia:3579: Use round for RC calculations in cyclic_refresh\n * aomedia:3580: Allow g_timebase.num to be greater than\n g_timebase.den\n * oss-fuzz:68774: libaom:av1_dec_fuzzer: Segv on unknown address in\n od_ec_dec_init\n * Arm SVE build fixes.\n * av1_block_error_lp_neon: fix block_size param type\n * av1_block_error_lp_sve: fix block_size param type\n\nBug: aomedia:3577\nChange-Id: I2e68f863a8171b3ca09ff5151c3fb9a0aa6af1bd"

0 commit comments

Comments
 (0)