summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* go-helloworld: fix licenseQuentin Schulz2025-08-201-2/+2
| | | | | | | | | | | | | | | | | The example repo doesn't seem to have ever been under MIT to begin with but rather Apache-2.0. It was then changed to the license used by the goland projectm that is BSD-3-Clause, 2 years ago in commit 00c7068f9d83 ("all: update to Go license"). The license file exists in the sources, so use that one instead of taking it from the OE-Core license directory. License-Update: Incorrect license is now proper (From OE-Core rev: fa45d6d5bec8fe503ff6b9166a3b4af31ea95369) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Add PACKAGECONFIG option for debugger supportNikhil R2025-08-201-1/+3
| | | | | | | | | | | | | | | | | Starting from CMake version 2.27 support for interactive debugging of CMake scripts and configurations was added. However, by default the `nativesdk-cmake` is compiled with debugger support turned off. This change adds debugger support for cmake (From OE-Core rev: 8acfca456c3502f0d097ba01a2d08f83fb75ab60) (From OE-Core rev: 776846eb8aa2f5f8c1ec8842cdbaff6b6bcdfa65) Signed-off-by: Nikhil R <nikhilr5@kpit.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: re-add missing libgen includeMartin Jansa2025-08-201-2/+2
| | | | | | | | | | | | | | | | | | It was added by original commit for CVE-2025-6020-01.patch https://github.com/linux-pam/linux-pam/commit/475bd60c552b98c7eddb3270b0b4196847c0072e#diff-05f443e6acbe32a148a45648148739bf6f02f13acc5c20c6037bf933223d4d77 but removed here in the rebase, causing: ../../../Linux-PAM-1.5.3/modules/pam_namespace/pam_namespace.c:326:11: error: call to undeclared function 'dirname'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 326 | parent = dirname(buf); | ^ ../../../Linux-PAM-1.5.3/modules/pam_namespace/pam_namespace.c:326:9: error: incompatible integer to pointer conversion assigning to 'char*' from 'int' [-Wint-conversion] 326 | parent = dirname(buf); | ^ ~~~~~~~~~~~~ (From OE-Core rev: 6d88a28ac7b6ff61808eb46e5c85dabd17c77f2e) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: fix multiple CVEsHitendra Prajapati2025-08-204-0/+274
| | | | | | | | | | * CVE-2025-47183 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c4d0f4bbd9a8e97f119a4528b9f4662a6b80922c && https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d76cae74dad89994bfcdad83da6ef1ad69074332 * CVE-2025-47219 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b80803943388050cb870c95934fc52feeffb94ac (From OE-Core rev: 3e82483c777d0a59a9d93e7c41f8fe88a9d75b22) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: fix CVE-2025-47806Hitendra Prajapati2025-08-202-0/+51
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/da4380c4df0e00f8d0bad569927bfc7ea35ec37d (From OE-Core rev: fbe8dd2aa6160530b84d3a174f3f8fc14f9fbab5) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: fix CVE-2025-47808Hitendra Prajapati2025-08-202-0/+37
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6b19f117518a765a25c99d1c4b09f2838a8ed0c9 (From OE-Core rev: 2611a16cad53d2bf0cda2946678e7d31e3ffa007) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2025-0913Peter Marko2025-08-201-0/+2
| | | | | | | | | | | | | | | | | | This is problem on Windows platform only. Per NVD report [1], CPE has "and" clause Running on/with cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Also linked patch [2] changes Windows files only (and tests). [1] https://nvd.nist.gov/vuln/detail/CVE-2025-0913 [2] https://go-review.googlesource.com/c/go/+/672396 (From OE-Core rev: ec1c6ab989b298773e8df8a6a4532f88b93617ff) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: patch CVE-2025-8194Peter Marko2025-08-202-4/+224
| | | | | | | | | | Pick commit from 3.12 branch mentioned in NVD report. https://nvd.nist.gov/vuln/detail/CVE-2025-8194 (From OE-Core rev: 34f1b4877a0601d2057453c159c76a54754f229a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* avahi: fix CVE-2024-52615Zhang Peng2025-08-202-0/+229
| | | | | | | | | | | | | | | | | | CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: ec22ec26b3f40ed5e0d84d60c29d8c315cf72e23) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* variables.rst: remove references to obsolete tar packagingRobert P. J. Day2025-08-041-10/+4
| | | | | | | | | | | | | The tar packaging format was removed some time ago. Also, add some minor grammatical tweaking. (From yocto-docs rev: 0c154c1f431be918c4c9ce3047c12099925a9c53) Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 8e9fd1ca232f3c1e8be51cb881a68b4745ee548a) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/start.rst: added missing command in Optimize your VHDX file using ↵Marco Cavallini2025-08-041-0/+1
| | | | | | | | | | | | | | | | | | | | | DiskPart After compact vsdisk you have to detach it before exiting otherwise the vdisk remains attached. DISKPART> select vdisk file="<path_to_VHDX_file>" DISKPART> attach vdisk readonly DISKPART> compact vdisk DISKPART> detach <------------ new missing command DISKPART> exit (From yocto-docs rev: a1dc91850e0353866dc9b461fce8c08724e49dae) Signed-off-by: Marco Cavallini <m.cavallini@koansoftware.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 1cc65ddf1a074f61fe5a63d222f3079b7fcb4c1e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 5.0.11Lee Chee Yang2025-08-042-0/+220
| | | | | | | | | | (From yocto-docs rev: 736b0b06d8fb48cbf72386464df919745bcce90e) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit b5f6113cd95107132aac74b8f0e6e4895b7b0e90) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-libc-headers: Fix invalid conversion in cn_proc.hFabio Berton2025-08-042-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | Backport 'connector: Fix invalid conversion in cn_proc.h' commit to fix error: / |/usr/include/linux/cn_proc.h: In function 'proc_cn_event | valid_event(proc_cn_event)': |/usr/include/linux/cn_proc.h:72:17: error: invalid conversion from | 'unsigned int' to 'proc_cn_event' [-fpermissive] | 72 | ev_type &= PROC_EVENT_ALL; | | ^ | | | | | unsigned int \ Change is already merged in kernel branch linux-6.6.y [1]. 1 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.6.y&id=06e785aeb9ea8a43d0a3967c1ba6e69d758e82d4 (From OE-Core rev: f023779af6c0e5c838bdacbd6d9765d1c6740575) Signed-off-by: Fabio Berton <fbberton@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* scripts/install-buildtools: Update to 5.0.11Aleksandar Nikolic2025-08-041-2/+2
| | | | | | | | | Update to the 5.0.11 release of the 5.0 series for buildtools (From OE-Core rev: 3b3a672ae6c024096cc263a669b1131e3f653b79) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: fix CVE-2025-8058Peter Marko2025-08-042-2/+2
| | | | | | | | | | | | | | This is a single commit bump containing only CVE fix $ git log --oneline cff1042cceec3502269947e96cf7023451af22f3..b027d5b145f1b2908f370bdb96dfe40180d0fcb6 b027d5b145 posix: Fix double-free after allocation failure in regcomp (bug 33185) Test results didn't change except newly added test succeeding. (tst-regcomp-bracket-free) (From OE-Core rev: c2b63f171719e2b1c12ba049cbe776adf9e0244b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2025-6170Peter Marko2025-08-042-0/+104
| | | | | | | | | Pick commit referencing this CVE from 2.13 branch. (From OE-Core rev: 061610dfca8a72b71e1baca3ad4aa2c9fb64449b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ncurses: patch CVE-2025-6141Peter Marko2025-08-042-0/+26
| | | | | | | | | | | | | | | Pick relevant part of snapshot commit 20250329, see [1]. That has: add a buffer-limit check in postprocess_termcap (report/testcase by Yifan Zhang). [1] https://invisible-island.net/ncurses/NEWS.html#index-t20250329 (From OE-Core rev: 79b080eb93918431c97edbbc80de5f70a2b09a4a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-6395Peter Marko2025-08-042-0/+300
| | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 14fbbdc51f7d02bc10b8078c0ba1de17f1563d73) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-32990Peter Marko2025-08-042-0/+2110
| | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 823cdb5574c15a595dfeab413421304007899aa2) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-32988Peter Marko2025-08-042-0/+59
| | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 2838dae57a1236d4f6eb97e32eb500892ba67184) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch reject zero-length version in certificate requestPeter Marko2025-08-043-1/+41
| | | | | | | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. The MR contains referece to undiscoled issue, so any security relevant patch should be picked. Binary test file was added as separate file as binary diffs are not supported. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: d1aaef9bbaa240c83cc7d485b55570449203da0b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch read buffer overrun in the "pre_shared_key" extensionPeter Marko2025-08-043-1/+38
| | | | | | | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. The ME contains referece to undiscoled issue, so any security relevant patch should be picked. Binary test file was added as separate file as binary diffs are not supported. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 8f825e7f4ca36d7ac62062e452cea256f3c058aa) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-32989Peter Marko2025-08-043-0/+56
| | | | | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. Binary test file was added as separate file as binary diffs are not supported. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 9d9ce14e2edceb211c3193cef88715d9c67fd3e0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: utils: Optimise signal/sigmask performanceRichard Purdie2025-08-041-4/+13
| | | | | | | | | | | | | | | | Running "time bitbake -pP idle" with a valid cache shows around 800,000 calls to enum creation from python's signal.py. We don't care about this overhead and it adversely affects cache load time quite badly. Try and use _signal directly, falling back to signal, which avoids this overhead we don't need and makes cache loading much faster. (Bitbake rev: 982645110a19ebb94d519926a4e14c8a2a205cfd) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee5fce67ce35b025c68aa61e2e758903269ee346) Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: bitbake: runqueue: Verify mcdepends are validMark Hatle2025-08-044-1/+14
| | | | | | | | | | | | | | | | | In order to avoid a potentially confusing backtrace, check that the mcdepend is valid when we add it. Add a test case to ensure invalid configurations are caught and trigger an error. [RP: Reworked test case to simplify and improve code] (Bitbake rev: 9f6f049870e0ec829e171fe91ec8f7a092ddd2ab) Signed-off-by: Mark Hatle <mark.hatle@amd.com> Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Chris Laplante <chris.laplante@agilent.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mtools: upgrade 4.0.48 -> 4.0.49Jinfeng Wang2025-07-291-1/+1
| | | | | | | | | | | | | | | | New version includes check for overlong file names, see [1]. [1] https://lists.gnu.org/archive/html/info-mtools/2025-06/msg00005.html (From OE-Core rev: c374e6cfcdd2c8ba17d82ffcfdeb97d21144e2bf) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (From OE-Core rev: 044c2bceefcc12262cb2421e8f1da5f6c2ed9f72) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mtools: upgrade 4.0.47 -> 4.0.48Wang Mingyu2025-07-293-7/+7
| | | | | | | | | | | | | | | | | clang_UNUSED.patch disable-hardcoded-configs.patch refreshed for 4.0.48 (From OE-Core rev: d2c56de7c9d403c3432213bc20e04c2ed5f1db16) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (From OE-Core rev: 1d5aee7e67cd614073a15b47b832375428865260) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mtools: upgrade 4.0.46 -> 4.0.47Richard Purdie2025-07-294-7/+7
| | | | | | | | | | | (From OE-Core rev: cf705382534d8f5af6880511221f701a733d84d7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (From OE-Core rev: 14ef270cc003646e6ca97ff3405507f2b9e92736) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mtools: upgrade 4.0.45 -> 4.0.46Wang Mingyu2025-07-293-12/+12
| | | | | | | | | | | | | | | | | | | | | | | | | clang_UNUSED.patch mtools-makeinfo.patch refreshed for 4.0.46 Changelog: ============= - iconv buffer overflow fixes - removed references to mread and mwrite (obsolete subcommands from mcopy) - documented mdoctorfat, and addressed 2 bugs/oversights - removed references to obsolete mread and mwrite - portability fixes (dietlibc and MacOS X) & simplification (From OE-Core rev: daab05bc863611c83223a383dd83ff2134cae6f8) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (From OE-Core rev: f5a5b2372669d8be4ae3f19ed6892264ea3999d0) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mtools: upgrade 4.0.44 -> 4.0.45Wang Mingyu2025-07-291-1/+1
| | | | | | | | | | | | | | | | | Changelog: ============ - Fixed iconv descriptor leak - Fixed size of error message buffer (From OE-Core rev: 77340d2bb1f31e305394df5d589fc0d3a0c5cd9a) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (From OE-Core rev: cc1975888ffdc58655e80d3d14450cf68ee0f719) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mtools: upgrade 4.0.43 -> 4.0.44Alexander Kanavin2025-07-294-17/+22
| | | | | | | | | | | | (From OE-Core rev: b09b06ed6351685e5351f8bf80a88d2f42093ca4) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (From OE-Core rev: dd8c333576d7ebb8abab3a62b3451439519a0caa) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: upgrade 21.1.6 -> 21.1.18Vijay Anusuri2025-07-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | xorg-server 21.1.17 This release contains the fixes for the issues reported in today's security advisory: https://lists.x.org/archives/xorg/2025-June/062055.html * CVE-2025-49175 * CVE-2025-49176 * CVE-2025-49177 * CVE-2025-49178 * CVE-2025-49179 * CVE-2025-49180 Additionally, this release includes a fix for CVE-2022-49737 which was issued after the fix was merged back in 2022 and several other various fixes. Ref: https://lists.x.org/archives/xorg-announce/2025-June/003609.html xorg-server 21.1.18 This release contains an additional fix for CVE-2025-49176 from June 17 security advisory: https://lists.x.org/archives/xorg/2025-June/062055.html Ref: https://lists.x.org/archives/xorg-announce/2025-June/003612.html (From OE-Core rev: 2ab7c45631f78ac8f6d19889fa8526d062329992) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a59b385184fb3a548dc27310fd04d64351d8dfba) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.39 branch updatesDeepesh Varatharajan2025-07-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | $ git log --oneline 06a70769fd0b2e1f2a3085ad50ab620282bd77b3..cff1042cceec3502269947e96cf7023451af22f3 cff1042cce Fix error reporting (false negatives) in SGID tests 1924d341c0 support: Pick group in support_capture_subprogram_self_sgid if UID == 0 Testing Results: Before After Diff PASS 5074 5082 +8 XPASS 4 4 0 FAIL 121 116 -5 XFAIL 16 16 0 UNSUPPORTED 157 154 -3 cff1042cce Fix error reporting (false negatives) in SGID tests Improved SGID test handling by unifying error reporting and using secure temporary directories. Replaced non-standard exit codes and fixed premature exits to avoid masking failures. These changes reduced false negatives, increasing overall test pass rates UNSUPPORTED tests changes -UNSUPPORTED: stdlib/tst-secure-getenv -UNSUPPORTED: elf/tst-env-setuid-static -UNSUPPORTED: elf/tst-env-setuid-tunables FAILed tests changes -FAIL: malloc/tst-aligned-alloc-random-thread-cross-malloc-check -FAIL: malloc/tst-aligned-alloc-random-thread-malloc-check -FAIL: malloc/tst-dynarray -FAIL: malloc/tst-dynarray-mem -FAIL: resolv/tst-resolv-aliases PASSed tests changes +PASS: stdlib/tst-secure-getenv +PASS: elf/tst-env-setuid-static +PASS: elf/tst-env-setuid-tunables +PASS: malloc/tst-aligned-alloc-random-thread-cross-malloc-check +PASS: malloc/tst-aligned-alloc-random-thread-malloc-check +PASS: malloc/tst-dynarray +PASS: malloc/tst-dynarray-mem +PASS: resolv/tst-resolv-aliases (From OE-Core rev: c40b9c33061c4019ed7790ccb799bb3491998b3d) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: fix CVE-2025-6020Hitendra Prajapati2025-07-296-0/+2206
| | | | | | | | | Upstream-Status: Backport from https://github.com/linux-pam/linux-pam/commit/475bd60c552b98c7eddb3270b0b4196847c0072e && https://github.com/linux-pam/linux-pam/commit/592d84e1265d04c3104acee815a503856db503a1 && https://github.com/linux-pam/linux-pam/commit/976c20079358d133514568fc7fd95c02df8b5773 (From OE-Core rev: dd5bbac75b1d8f7ebd83d5c9945bd860e397ba07) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: patch CVE-2025-27587Peter Marko2025-07-293-0/+2049
| | | | | | | | | | | | Pick commits for Minerva fix between 3.2.4 and 3.2.5 release. Update to 3.2.5 is blocked due to problem with python ptest errors, so use patch instead of upgrade for now. (From OE-Core rev: 57c04a32997c1b045121aff045f3ffaa7bb0b5f5) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: CVE-2024-41996Peter Marko2025-07-292-0/+45
| | | | | | | | | | | | | As discussed in [1], this commit fixes CVE-2024-41996. Although openssl project does not consider this a vulnerability, it got CVE number assigned so it deserves attention. [1] https://github.com/openssl/openssl/pull/25088 (From OE-Core rev: cb49b9e49b4561ccea4c231cac591af557b9749c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* orc: set CVE_PRODUCTPeter Marko2025-07-291-0/+3
| | | | | | | | | | | | | | | There are new CVEs reported for this recipe which are not for this componene, but for a component with same name from apache. sqlite> select vendor, product, id, count(*) from products where product like 'orc' group by vendor, product, id; apache|orc|CVE-2018-8015|1 apache|orc|CVE-2025-47436|4 gstreamer|orc|CVE-2024-40897|1 (From OE-Core rev: f5e320c0ea57ce1813ed09da703fe2b33f4976e6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: fix CVE-2025-6965Roland Kovacs2025-07-292-0/+113
| | | | | | | | | | | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. (From OE-Core rev: 52499a5ea3b4ba145914aca873844ab718953289) Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-7545Deepesh Varatharajan2025-07-292-0/+40
| | | | | | | | | | | | | | objcopy: Don't extend the output section size Since the output section contents are copied from the input, don't extend the output section size beyond the input section size. Backport a patch from upstream to fix CVE-2025-7545 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944] (From OE-Core rev: 128e40c39d8eafdd32fea71b902b38801afec202) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-7546Yash Shinde2025-07-292-0/+59
| | | | | | | | | | | | | Report corrupted group section instead of trying to recover. CVE: CVE-2025-7546 Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b] PR 33050 [https://sourceware.org/bugzilla/show_bug.cgi?id=33050] (From OE-Core rev: 3a54f11b9462905e103e13161a77ef681f14dc92) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: fix CVE-2025-49795Roland Kovacs2025-07-292-0/+93
| | | | | | | | | | | A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service. (From OE-Core rev: b144c3ef3ba1797d925ea44d9450a6ec0fe32047) Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: test/fetch: Switch u-boot based test to use our own mirrorRichard Purdie2025-07-291-1/+1
| | | | | | | | | | The upstream servers are having issues so switch to our own shadow copy of the repo. (Bitbake rev: 86e7a58c0e9904c33b1b94dddc3d683c2da22d1a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oe-debuginfod: add option for data storageJoe Slater2025-07-211-1/+16
| | | | | | | | | | | | | | | Storing the data files under $HOME can be unreliable if debuginfod is used for several projects, especially if $HOME is shared between machines. We provide an option to save files under the project directory. The default behavior is unchanged. (From OE-Core rev: e1e0cf82f559077e2a51447baf137086202c0c4a) (From OE-Core rev: 24c0ab18045920bb5c1e965c0ea6d176fd6de234) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* timedated: wait for jobs before SetNTP responseMichal Seben2025-07-212-0/+98
| | | | | | | | | | Backport a fix to address the dbus SetNTP response timing issue. Fix is already available since systemd v256-rc1. (From OE-Core rev: 4db0483cfd14e31c3e7cc87d538d73275fd51bbf) Signed-off-by: Michal Seben <michal.seben@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kea: set correct permissions for /var/run/keaYi Zhao2025-07-213-0/+3
| | | | | | | | | | | | | | | | | | | Set the permissions of /var/run/kea to 750 to fix kea server startup error: ERROR [kea-dhcp4.dhcp4/445.140718820303936] DHCP4_INIT_FAIL failed to initialize Kea server: configuration error using file '/etc/kea/kea-dhcp4.conf': 'socket-name' is invalid: socket path:/var/run/kea does not exist or does not have permssions = 750 This permission check was introduced by commit[1] in kea 2.4.2. [1] https://gitlab.isc.org/isc-projects/kea/-/commit/f7061c4e9711f395fbc940b0cf0ddbde87e0fc13 (From OE-Core rev: 5b709e2c165bf46f4f35e1783ab7ec54fabd2ec3) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: stable 2.42 branch updatesDeepesh Varatharajan2025-07-211-1/+1
| | | | | | | | | | | | | | | | | | | | Below commit on binutils-2.42 stable branch are updated. x86: Check MODRM for call and jmp in binutils older than 2.45 Test Results: Before After Diff No. of expected passes 302 302 0 No. of unexpected failures 2 2 0 No. of untested testcases 1 1 0 No. of unsupported tests 7 7 0 Testing was done and there were no regressions found (From OE-Core rev: 412def8923a89f3c385eae25901bed0c07859029) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: upgrade 1.9.15p5 -> 1.9.17p1Praveen Kumar2025-07-213-6/+57
| | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== * Fixed CVE-2025-32462. Sudo's -h (--host) option could be specified when running a command or editing a file. This could enable a local privilege escalation attack if the sudoers file allows the user to run commands on a different host. * Fixed CVE-2025-32463. An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. The chroot support has been deprecated an will be removed entirely in a future release. License-Update: Copyright updated to 2025 0001-sudo.conf.in-fix-conflict-with-multilib.patch refreshed for 1.9.17 (From OE-Core rev: b04af6db102c97f3d4338dbcfdcab927b5194a69) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "sudo: Fix CVE-2025-32462"Steve Sakoman2025-07-212-43/+0
| | | | | | | | This CVE is fixed in the following version bump This reverts commit d01f888a5ec43fdc8e7bd496ae9317c0fa28da9b. Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: Upgrade 2.44.3 -> 2.44.4Vijay Anusuri2025-07-211-1/+1
| | | | | | | | | | | | | Addresses the security issues - CVE-2025-27613, CVE-2025-27614, CVE-2025-46334, CVE-2025-46835, CVE-2025-48384, CVE-2025-48385, and CVE-2025-48386. Release Notes: https://github.com/git/git/blob/v2.44.4/Documentation/RelNotes/2.44.4.txt (From OE-Core rev: 3a9fdcb2ea0dd2744f59a62f2722bfa276302324) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdk-pixbuf: fix CVE-2025-7345Archana Polampalli2025-07-212-0/+56
| | | | | | | | | | | | | A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, allowing out-of-bounds reads from heap memory, potentially causing application crashes or arbitrary code execution. (From OE-Core rev: 78a52a7feb995b4ab4f4df6b16feaac60f6ad59b) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-09-09 10:53:03 +0000