summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* xserver-xf86-config: add a configuration fragment to disable screen blankingRoss Burton2025-03-152-0/+13
| | | | | | | | | | | | Add a configuration fragment that disables screen blanking, and add it to all qemu machines. (From OE-Core rev: bb16526a4a0c39b6c156edbf68c7377bfdfa0bd1) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 780a5ccaa51d5aed18200883a686387e70847e4b) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: upgrade 21.1.14 -> 21.1.15Wang Mingyu2025-03-151-1/+1
| | | | | | | | | | (From OE-Core rev: 1fdd0a6824f34ce18c4adac8f0014935896b3e21) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ba94110d70ebfb1b4798ecf05389f7ea602b1f55) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.1043 -> 9.1.1115Divya Chellam2025-03-151-2/+2
| | | | | | | | | | | | | This includes CVE-fix for CVE-2025-26603 and CVE-2025-1215 Changes between 9.1.1043 -> 9.1.1115 ==================================== https://github.com/vim/vim/compare/v9.1.1043...v9.1.1115 (From OE-Core rev: f390badfe5b3a1a8cc70051075a5e641ff5abf2c) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2025-0678 and CVE-2025-1125Peter Marko2025-03-152-0/+88
| | | | | | | | | Cherry-pick patch mentioning these CVEs. (From OE-Core rev: d96bf8ec82ed07c006167e15f7aa0d5e81440977) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2025-0677, CVE-2025-0684, CVE-2025-0685, CVE-2025-0686 and ↵Peter Marko2025-03-152-0/+378
| | | | | | | | | | | CVE-2025-0689 Cherry-pick patch mentioning these CVEs. (From OE-Core rev: f25e1296b8265414061b0b8f12110c6ee22bc7be) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45778 and CVE-2024-45779Peter Marko2025-03-152-0/+56
| | | | | | | | | Cherry-pick patch mentioning these CVEs. (From OE-Core rev: eb9811ef2a38f1dcd4074eef6f809fd63e98454f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2025-1118Peter Marko2025-03-152-0/+38
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: 77abb78b5d4dd0e54b656170c03ac68b919b8784) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2025-0690Peter Marko2025-03-152-0/+74
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: d9fb00f71380ad39ea5b61e60c4f458371460862) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45777Peter Marko2025-03-152-0/+58
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: 2ec4bcda16b92cabf7cf5cb7c68cbe45da269364) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45776Peter Marko2025-03-152-0/+40
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: e1e13086f38b021a8aabfe8d044b5755d62ee846) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2025-0622Peter Marko2025-03-154-0/+117
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: d9d99bd5baddcb0438e0c28ab6e302ee9fa0c327) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45775Peter Marko2025-03-152-0/+39
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: 4e01993bf71d3b8e2375ab43857b671738953507) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45774Peter Marko2025-03-152-0/+38
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: f24f2dc0b7504508357cbe5d5f7a577639a6548e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2025-0624Peter Marko2025-03-152-0/+85
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: 0c860bf1765b49a7540ae3cb206ce09cf25f30a7) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45783Peter Marko2025-03-152-0/+40
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: 70a15bc790025e3241274d3e92674928c41537b6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45780Peter Marko2025-03-152-0/+94
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: f3a14813ed012904e64fd9897ea4ddaf622059dd) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: patch CVE-2024-45782 and CVE-2024-56737Peter Marko2025-03-152-0/+37
| | | | | | | | | Cherry-pick patch mentioning these CVEs. (From OE-Core rev: 61268080ba160a4965873ba5aad6ebbfd1ee2fe1) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grup: patch CVE-2024-45781Peter Marko2025-03-152-0/+36
| | | | | | | | | Cherry-pick patch mentioning this CVE. (From OE-Core rev: 120d8cc7b91654557a3101a5f8fda44fb703e5b2) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: backport strlcpy functionPeter Marko2025-03-152-0/+69
| | | | | | | | | It is used to fix multiple CVEs. (From OE-Core rev: c12baf254a37ff4921c2be0e4d3f626a91980d1a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: drop obsolete CVE statusesPeter Marko2025-03-151-3/+0
| | | | | | | | | | CVE-2021-46705 was needed only with 2.06 CVE-2023-4692 and CVE-2023-4693 were fixed in NVD DB meanwhile (From OE-Core rev: fab492f32a8630a353d307119dd4109dac81ad45) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check.bbclass: Mitigate symlink related errorNiko Mauno2025-03-151-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to Yocto reference manual, in description of the IMAGE_LINK_NAME variable, it is said that It is possible to set this to "" to disable symlink creation, however, you also need to set :term:`IMAGE_NAME` to still have a reasonable value e.g.:: IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" However, when using following additions in local.conf file: INHERIT += "cve-check" IMAGE_LINK_NAME = "" IMAGE_NAME = "${IMAGE_BASENAME}${IMAGE_MACHINE_SUFFIX}${IMAGE_VERSION_SUFFIX}" the implicit symlink creation in cve_check_write_rootfs_manifest leads to following build failure $ bitbake core-image-minimal core-image-base ... ERROR: core-image-base-1.0-r0 do_image_complete: Recipe core-image-base is trying to install files into a shared area when those files already exist. The files and the manifests listing them are: /home/poky/build/tmp/deploy/images/qemux86-64/.json (matched in manifest-qemux86_64-core-image-minimal.image_complete) Please adjust the recipes so only one recipe provides a given file. Mitigate the issue by creating the symlink only in case IMAGE_LINK_NAME has not been set to empty string. (From OE-Core rev: 64bfec359bd909761ce0a6a716286d938ed162d1) (From OE-Core rev: 35e210e3ebe21f1f4466760076b7140618af536e) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* puzzles: ignore three new CVEs for a different puzzlesRoss Burton2025-03-151-0/+3
| | | | | | | | | | | | | | As we just match on product by default, ignore three CVEs which are for the "Puzzles" WordPress theme by ThemeREX (CPE themerex:puzzles). (From OE-Core rev: 87326573c82ac1e8dc335319442236ef2341501e) (From OE-Core rev: 9543945bb935e9a3e2bfbf731412188fc52ad2c9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: Fix CVE-2025-27219Ashish Sharma2025-03-152-0/+32
| | | | | | | | | Upstream-Status: Backport from [https://github.com/ruby/cgi/commit/9907b76dad0777ee300de236dad4b559e07596ab] (From OE-Core rev: 7e0a96b5c0b7a5ca593df83861086d0980ea72e9) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: fix CVE-2025-26465Archana Polampalli2025-03-152-0/+170
| | | | | | | | | | | | | | A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. (From OE-Core rev: 60b5df194a5bea491489fdae2f32e33ffd21c9c7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: event/utils: Avoid deadlock from lock_timeout() and recursive eventsRichard Purdie2025-03-152-1/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We've been seeing intermittent failures on Ubuntu 22.04 in oe-selftest which were problematic to debug. The failure was inside lock_timeout and once that was identified and the backtrace obtained, the problem becomes clearer: File "X/bitbake/lib/bb/server/process.py", line 466, in idle_thread_internal retval = function(self, data, False) File "X/bitbake/lib/bb/command.py", line 123, in runAsyncCommand self.cooker.updateCache() File "X/bitbake/lib/bb/cooker.py", line 1629, in updateCache self.parser = CookerParser(self, mcfilelist, total_masked) File "X/bitbake/lib/bb/cooker.py", line 2141, in __init__ self.bb_caches = bb.cache.MulticonfigCache(self.cfgbuilder, self.cfghash, cooker.caches_array) File "X/bitbake/lib/bb/cache.py", line 772, in __init__ loaded += c.prepare_cache(progress) File "X/bitbake/lib/bb/cache.py", line 435, in prepare_cache loaded = self.load_cachefile(progress) File "X/bitbake/lib/bb/cache.py", line 516, in load_cachefile progress(cachefile.tell() + previous_progress) File "X/bitbake/lib/bb/cache.py", line 751, in progress bb.event.fire(bb.event.CacheLoadProgress(current_progress, cachesize), File "X/bitbake/lib/bb/event.py", line 234, in fire fire_ui_handlers(event, d) File "X/bitbake/lib/bb/event.py", line 210, in fire_ui_handlers _ui_handlers[h].event.send(event) File "X/bitbake/lib/bb/cooker.py", line 117, in send str_event = codecs.encode(pickle.dumps(event), \'base64\').decode(\'utf-8\') File "/usr/lib/python3.10/asyncio/sslproto.py", line 320, in __del__ _warn(f"unclosed transport {self!r}", ResourceWarning, source=self) File "/usr/lib/python3.10/warnings.py", line 109, in _showwarnmsg sw(msg.message, msg.category, msg.filename, msg.lineno, File "X/bitbake/lib/bb/main.py", line 113, in _showwarning warnlog.warning(s) File "/usr/lib/python3.10/logging/__init__.py", line 1489, in warning self._log(WARNING, msg, args, **kwargs) File "/usr/lib/python3.10/logging/__init__.py", line 1624, in _log self.handle(record) File "/usr/lib/python3.10/logging/__init__.py", line 1634, in handle self.callHandlers(record) File "/usr/lib/python3.10/logging/__init__.py", line 1696, in callHandlers hdlr.handle(record) File "/usr/lib/python3.10/logging/__init__.py", line 968, in handle self.emit(record) File "X/bitbake/lib/bb/event.py", line 778, in emit fire(record, None) File "X/bitbake/lib/bb/event.py", line 234, in fire fire_ui_handlers(event, d) File "X/bitbake/lib/bb/event.py", line 197, in fire_ui_handlers with bb.utils.lock_timeout(_thread_lock): File "/usr/lib/python3.10/contextlib.py", line 135, in __enter__ return next(self.gen) File "X/bitbake/lib/bb/utils.py", line 1888, in lock_timeout bb.server.process.serverlog("Couldn\'t get the lock for 5 mins, timed out, exiting. %s" % traceback.format_stack()) or put in simpler terms, whilst sending an event(), an unrelated warning message happens to be triggered from asyncio: /usr/lib/python3.10/asyncio/sslproto.py:320: ResourceWarning: unclosed transport <asyncio.sslproto._SSLProtocolTransport object at 0x7f0e797d3100> which triggers a second event() which can't be sent as we're already in the critcal section and already hold the lock. That warning is due to the version of asyncio used on Ubuntu 22.04 with python 3.10 and that comined with timing issues explains why we don't see it on other python versions or distros. We can't handle the second event as the lock is there to serialise the events. Instead, we queue the event and then process the queue later. Add a new version of lock_timeout which allows us to handle the situation more gracefully. (Bitbake rev: 696c2c1ef095f8b11c7d2eff36fae50f58c62e5e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2c590ff1aff89d23b25ce808650f200013a1e6af) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: utils: Add signal blocking for lock_timeoutRichard Purdie2025-03-151-0/+2
| | | | | | | | | | | | We never want to exit whilst holding these locks as it deadlocks all python threads. Add signal blocking around the lock critical part so a signal shouldn't cause such an exit. (Bitbake rev: 5cc1dde1ffd9382b3a9e4cc182be067defba16a7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a097755c671e2b530dea6200a94b39fa9dca246c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: utils: Tweak lock_timeout logicRichard Purdie2025-03-151-1/+1
| | | | | | | | | | | | We should really try and take the lock in the try/finally block so that in some rare cases such as badly timed interrupt/signal, we always release the lock. (Bitbake rev: 5dbbca616a71047fc3573a2be49846d5c9cdd15a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a9eb8bf7174b6962b5ba07192fe95b8c7112d9d2) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: utils: Print information about lock issue before exitingRichard Purdie2025-03-151-0/+1
| | | | | | | | (Bitbake rev: d41fad7fadde59dd63647bbbeb074604314bf310) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cdf6c51a064f8f335c3262b7f102618996f1a229) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to scarthgap head revisionyocto-5.0.8scarthgap-5.0.8Steve Sakoman2025-03-101-1/+1
| | | | | | (From OE-Core rev: cd2b6080a4c0f2ed2c9939ec0b87763aef595048) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 5.0.8Steve Sakoman2025-03-101-1/+1
| | | | | | (From meta-yocto rev: afa9ec665d1197d9289a86d30389be0cc037d739) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: add ubuntu2404 to SANITY_TESTED_DISTROSSteve Sakoman2025-03-101-0/+1
| | | | | | (From meta-yocto rev: 74e211b936f8c2897d2b6e6b554cc419e352f267) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libtasn1: upgrade 4.19.0 -> 4.20.0Vijay Anusuri2025-03-101-4/+3
| | | | | | | | | | | | | | | | * Noteworthy changes in release 4.20.0 (2025-02-01) [stable] - The release tarball is now reproducible. - We publish a minimal source-only tarball generated by 'git archive'. - Update gnulib files and various build/maintenance fixes. - Fix CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET OF elements License-Update: file COPYING.LESSER renamed to COPYING.LESSERv2 & Copyright year updated to 2025 (From OE-Core rev: fc5814dfa49c67157def00b323656f15e8bc457b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzcode-native: Fix compiler setting from 2023d versionAlessio Cascone2025-03-101-1/+1
| | | | | | | | | | | | | | Starting from 2023d version, tzcode makefile does not use anymore "cc" variable for C compiler, due to Makefile refactoring. Replacing "cc" with "CC" fixes the issue. (From OE-Core rev: c297d2cd8d28463adca5158c9895f1492754d569) Signed-off-by: Alessio Cascone <alessio.cascone@vimar.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b3cdfca5ef84ed2054faef9abddef3aeed930e17) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata/tzcode-native: upgrade 2024b -> 2025aPriyal Doshi2025-03-101-3/+3
| | | | | | | | | | (From OE-Core rev: 34b0f99ffd9beab4d400b05f259fc26f3da0386b) Signed-off-by: Priyal Doshi <pdoshi@mvista.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a15c4e6793c55c8084a61298ef3695e1db2f60cd) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: remove OE_IMPORTSRoss Burton2025-03-081-8/+0
| | | | | | | | | | | | | | | | oe-core no longer supports OE_IMPORTS[1], so remove the documentation. [1] oe-core 1f56155e ("base: Switch to use addpylib directive and BB_GLOBAL_PYMODULES") (From yocto-docs rev: 7d3cce5b962ca9f73b29affceb7ebc6710627739) Signed-off-by: Ross Burton <ross.burton@arm.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit d03dad11974ada7a99b4406e2350b9f5f0acc746) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: don't refer to poky-lsbRoss Burton2025-03-081-1/+1
| | | | | | | | | | | | | This was removed in 2019, so swap it for poky-altcfg. (From yocto-docs rev: f0348f44008b6f89ed1119497fe2dcd230691625) Signed-off-by: Ross Burton <ross.burton@arm.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 7f7f6570befdda280c174a5f9776b20f53f3ea0d) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Remove all mention of core-image-lsbRoss Burton2025-03-083-36/+13
| | | | | | | | | | | | | | | | core-image-lsb was removed in 2019[1], so remove all of the incredibly obsolete references in the documentation. [1] oe-core fb064356af615d67d85b65942103bf943d84d290 (From yocto-docs rev: 05029257d0c5f090d5c0a96c6244bfaf40615178) Signed-off-by: Ross Burton <ross.burton@arm.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 062445a49919eff117b5478c1fb18d125c1f895c) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 4.0.25Lee Chee Yang2025-03-082-0/+168
| | | | | | | | | | (From yocto-docs rev: 0bf41c5366c4ca7982336e433f69f88c7ea98fa6) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 4649514cdfae496f43711d6b830a0a835c3a1534) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: add libpcre2 as RRECOMMENDS if pcre2 is enabledAlexis Cellier2025-03-081-1/+1
| | | | | | | | | | | | | | | | The libpcre2 is now dlopen'ed, so it is not automatically added to the RDEPENDS anymore. Add it to the RRECOMMENDS list (and not RDEPENDS as systemd tags the library as "suggested"). This issue is not on master, the systemd v257 recipe uses a tool that systemd provides to get this kind of dependencies. But this cannot be backported to scarthgap as systemd v255 does not have this tool yet. Cc: Yoann Congal <yoann.congal@smile.fr> (From OE-Core rev: 45fc7048c511c433ecc23840fe6fdd61f6366a47) Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-0840Deepesh Varatharajan2025-03-082-0/+54
| | | | | | | | | | | | PR32560 stack-buffer-overflow at objdump disassemble_bytes Backport a patch from upstream to fix CVE-2025-0840 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893] (From OE-Core rev: 338a2a95eb9a99c8e56dfb1f6336497ddd654372) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: Correct the CVE ID to fix CVE-2025-22919Archana Polampalli2025-03-082-2/+2
| | | | | | | | | | A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file. (From OE-Core rev: bf0ad79c46d8a01aafc91620ddf415749aa8849a) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-0518Archana Polampalli2025-03-082-0/+35
| | | | | | | | | | | | | | | Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C This issue affects FFmpeg: 7.1. Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosma (From OE-Core rev: 75ad6e004de95ff6208820ccf2c0af01d9363749) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-22921Archana Polampalli2025-03-082-0/+35
| | | | | | | | | | FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. (From OE-Core rev: bc9cdf3701b937d40964903a3489898a69525d17) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-25471Archana Polampalli2025-03-082-0/+40
| | | | | | | | | | FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: a8331b11d5d7aa8f1997eaa189b74aaab7cc44da) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-25473Archana Polampalli2025-03-082-0/+37
| | | | | | | | | | FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: abc6b3180b87c665ff04204b7163d1f074d99747) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26601Vijay Anusuri2025-03-085-0/+344
| | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d & https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f & https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989 (From OE-Core rev: 165032003e3f7fb5fde7322c5ad64c26f286228a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26600Vijay Anusuri2025-03-082-0/+69
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b (From OE-Core rev: f84fd297131deda3e13377f0b3555a71e67f1d74) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26599Vijay Anusuri2025-03-083-0/+197
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be & https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8 (From OE-Core rev: aea55eb6eb5610ef6e7d37fadcbb7e760bf80d7d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26598Vijay Anusuri2025-03-082-0/+121
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a (From OE-Core rev: b58fe3b82168502e29f500e42ca8d140934f5b1a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26597Vijay Anusuri2025-03-082-0/+47
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949 (From OE-Core rev: 6e19f26f4f152316badf3668b74cfc50d8d12528) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 18:49:01 +0000