summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* libxml2: patch CVE-2025-32414Peter Marko2025-05-022-0/+75
| | | | | | | | | Pick commit which has been backported to 2.12 release branch. (From OE-Core rev: 187052ce4ddd43b46b8335cc955a63ca19ee6994) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ppp: patch CVE-2024-58250Peter Marko2025-05-022-1/+195
| | | | | | | | | | | | | | | | Backport patch to remove vulnerable component. This is a breaking change, but there will be no other fix for this CVE as upstream did the deletion without providing a fix first. If someone really needs this feature, which the commit message describes as deprecated, bbappend with patch removal is possible. License-Update: passprompt plugin removed (From OE-Core rev: 5350ef531ded14f0b4c32c211aaf993354be1ec9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: Update fix for CVE-2024-10041Shubham Kulkarni2025-05-023-1/+79
| | | | | | | | | | | | | | | Initially, PAM community fixed CVE-2024-10041 in the version v1.6.0 via commit b3020da. But not all cases were covered with this fix and issues were reported after the release. In the v1.6.1 release, PAM community fixed these issues via commit b7b9636. Backport this commit b7b9636, which Fixes: b3020da ("pam_unix/passverify: always run the helper to obtain shadow password file entries") Backport from https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620 (From OE-Core rev: 78a04ce17e7d828c0cf8cae2164882683d46275e) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Fix dead links that use the DISTRO macroAntonin Godard2025-04-289-12/+12
| | | | | | | | | | | | | | | | | | | | After introducing the DISTRO_LATEST_TAG and DISTRO_REL_LATEST_TAG macros, use them in links that currently use DISTRO/DISTRO_REL_TAG. When building for the tip of a branch, this will replace the current A.B.999 in links to the latest existing tag. The links were found across the documentation by running 'grep -r "http.*5\.2\.999"' inside the _build/html output after building the docs. [YOCTO #14802] (From yocto-docs rev: d1f3616b373334a5aa75ad7874f05ee4b0e6591f) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 29be069ebbf2c55d72fc51d99ed5a558af37c05e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.yaml: introduce DISTRO_LATEST_TAGAntonin Godard2025-04-282-2/+25
| | | | | | | | | | | | | | | | | | | | | | | | | Introduce the DISTRO_LATEST_TAG macro, which should always point to the latest existing tag in the documentation, unlike DISTRO which may point to A.B.999 to represent the tip of a branch. This variable is needed to fix dead links in the documentation that currently use the DISTRO macro. Also, make DISTRO_REL_TAG use the DISTRO macro directly, to avoid repetition, and add a DISTRO_REL_LATEST_TAG macro that has the same role as DISTRO_LATEST_TAG but with "yocto-" prepended to it. In set_versions.py, run the "git describe --abbrev=0 --tags --match='yocto-*'" command to get the latest existing tag on the currently checked out commit. Fallback to ourversion in case we didn't find any. (From yocto-docs rev: 4195f52117b8132b46dd562acaf40e6e4480be33) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit a85b0e500c94921f77fa7b7dbb877e4945f96d1e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* manuals: remove repeated wordAndrew Kreimer2025-04-281-1/+1
| | | | | | | | | | The word "modern" appears twice, remove the extra one. (From yocto-docs rev: 6d2715b74d43c39fcee3ad7631d93b5396ce84bf) Signed-off-by: Andrew Kreimer <algonell@gmail.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: improve the PKGV documentationAntonin Godard2025-04-281-0/+17
| | | | | | | | | | It may be confusing for users that source control information is not present in the BitBake environment. Document it as a warning block. (From yocto-docs rev: 990b3708d7131ccfb4e435e8a53e987195de3e06) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: HOST_CC_ARCH: fix wrong SDK referenceAntonin Godard2025-04-281-2/+1
| | | | | | | | | | | | | When building for nativesdk recipes, HOST_CC_ARCH equals SDK_CC_ARCH, not BUILDSDK_CC_ARCH which doesn't exist. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: ba030d9d65702889b089bd3c9cb6a719a7e0a413) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 08fc3446cb13b5bd8781874d2d996899ce12b082) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document HOST_*_ARCH variablesAntonin Godard2025-04-281-0/+27
| | | | | | | | | | | | | These variables control the flags for the assembler, compiler and linker, but depend on the context. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: 1520ba47f66c6d51f710005cdd4f4b880eccd5b0) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit f8eb33569a5e8cadc036855e2d95eee77e627cb4) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document missing SDK_*_ARCH variablesAntonin Godard2025-04-281-0/+15
| | | | | | | | | | | | | These variables control the flags for the assembler, compiler and linker when building for nativesdk recipes. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: 95f4aabe48a6e06f8391e032c6a7038bf0e10332) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit c08f6d3c8aee86264c069b7c30850cb02de76076) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: add missing documentation for BUILD_* variablesAntonin Godard2025-04-281-20/+230
| | | | | | | | | | | | | | | | | | | | These toolchain variables are used in a native context. Some of the BUILD_* variables missed documentation. Also, some of the base commands were also not there so document them. Some of existing BUILD_* variable documentation were missing the note about their usage in a native context, so add it too so that all BUILD_* variables are documented the same way. [YOCTO #15719] Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: e692a7553ccf7496288f2eb7df71766cb5261eb4) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 87103afa1cb6690e9aaa87ca1f23e45eaaa359ac) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: add manpage links for toolchain variablesAntonin Godard2025-04-281-9/+11
| | | | | | | | | | | | Use the :manpage: role to provide links to common toolchain utilities. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: adfb1a4a768f53a0404b65297f7fa9ed12b77088) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 7023e5f176efde05a6798476712c8a4e006a6b0d) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* documentation/conf.py: define a manpage urlAntonin Godard2025-04-284-4/+6
| | | | | | | | | | | | | | | | By defining the manpages_url we can use the :manpage: role in the documentation for providing links to manpages. See: https://www.sphinx-doc.org/en/master/usage/configuration.html#confval-manpages_url Replace existing manpages links to use this role. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: 73faf4a4fdd3d536e8af92b49bf067746cd9fa05) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 4e63cd74cd1a330ea5e96bb04243a90f607b2857) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document autotools class related variablesAntonin Godard2025-04-281-0/+17
| | | | | | | | | Document the AUTOTOOLS_SCRIPT_PATH and the CONFIGURE_SCRIPT variables. (From yocto-docs rev: b63d665549e14e1a468ffbf07c8494a491833770) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: WATCHDOG_TIMEOUT: fix recipe nameAntonin Godard2025-04-281-2/+2
| | | | | | | | | | | | This variable affects the watchdog-config recipe, not the watchdog recipe. (From yocto-docs rev: b3676b26b02e6e3861dd1d7dcf05dfcf6836bcd5) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit d3350c38910c47c76ed17f24579120013589ca1f) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 5.0.8Lee Chee Yang2025-04-282-1/+227
| | | | | | | | | | (From yocto-docs rev: 0fad3824f060805c9c3e974c8db830bb03520d20) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 7494df521ed9c70e877dbdef1adfe38ad717682f) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bluez5: add missing tools to noinst-tools packageGuðni Már Gilbert2025-04-281-1/+7
| | | | | | | | | | | | | | | | | | This change will prevent these tools from being installed if the image doesn't install bluez5-noinst-tools package. BlueZ 5.66: tools/mesh-tester BlueZ 5.66: tools/ioctl-tester BlueZ 5.65: tools/iso-tester BlueZ 5.56: tools/btpclientctl BlueZ 5.51: tools/bcmfw BlueZ 5.49: tools/rtlfw BlueZ 5.47: tools/btconfig (not a new tool, but it was moved from bin_PROGRAMS to noinst_PROGRAMS) (From OE-Core rev: 87cadf62ba0d6b0fc3dc0151a5d320919b7eb1ab) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: upgrade 3.1.4 -> 3.1.6Soumya Sambu2025-04-281-1/+4
| | | | | | | | | | | | | Includes fix for - CVE-2024-56326, CVE-2025-27516, CVE-2024-56201 Changelog: https://github.com/pallets/jinja/blob/3.1.6/CHANGES.rst https://github.com/pallets/jinja/blob/3.1.5/CHANGES.rst (From OE-Core rev: a935ef8f205c9510ebc5539c133960bc72504902) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: upgrade 255.17 -> 255.18Guðni Már Gilbert2025-04-2828-34/+34
| | | | | | | | | | | | | The update includes 82 commits. Full list of changes can be found on Github [1] All patches were refreshed with devtool. [1] systemd/systemd-stable@v255.17...v255.18 (From OE-Core rev: 121e1fb42c4c909115bc550585b2ebcb3a13e0a5) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wic: bootimg-efi: Support + symbol in filenamesIgor Opaniuk2025-04-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Allow the '+' symbol as a valid character in filenames listed in the IMAGE_EFI_BOOT_FILES variable. The '+' symbol might be used to support boot counting for boot entries, as described in the UAPI Boot Loader Specification [1]: The boot counting data is stored in the name of the boot loader entry. A boot loader entry file name may contain a plus (+) followed by a number. This may optionally be followed by a minus (-) followed by a second number. The dot (.) and file name suffix (conf or efi) must immediately follow. Boot counting is enabled for entries which match this pattern. Example: IMAGE_EFI_BOOT_FILES:append = " entry.conf;loader/entries/entry+3.conf" [1] https://uapi-group.org/specifications/specs/boot_loader_specification/#boot-counting (From OE-Core rev: 081fa0ebb33dbbfd0f6e8239690261c0a9dcdb2c) Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3f25822281eb9423ff86105eaebb0bed48663648) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: fix CVE-2025-0167Yogita Urade2025-04-282-0/+179
| | | | | | | | | | | | | | | | | | | | | | When asked to use a `.netrc` file for credentials *and* to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-0167 Upstream patch: https://github.com/curl/curl/commit/0e120c5b925e8ca75d5319e (From OE-Core rev: b74dba43f2d6896245232373f2a9fdf07086a237) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: fix CVE-2024-11053Yogita Urade2025-04-284-0/+1214
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password. CVE-2024-11053-0001 is the dependent commit, CVE-2024-11053-0002 is actual CVE fix and the actual fix caused a regression that was fixed by CVE-2024-11053-0003. Reference: https://curl.se/docs/CVE-2024-11053.html https://git.launchpad.net/ubuntu/+source/curl/commit/?h=applied/ubuntu/noble-devel&id=9ea469c352a313104f750dea93e78df8d868c435 Upstream patches: https://github.com/curl/curl/commit/9bee39bfed2c413b4cc4eb306a57ac92a1854907 https://github.com/curl/curl/commit/e9b9bbac22c26cf67316fa8e6c6b9e831af3194 https://github.com/curl/curl/commit/9fce2c55d4b0273ac99b59bd8cb982a6d96b88cf (From OE-Core rev: 084d8ca3b47b47333edba87f6aa427a12ee574f2) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: patch CVE-2025-29088Peter Marko2025-04-282-0/+180
| | | | | | | | | | | | Pick commit [1] mentioned in [2]. [1] https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-29088 (From OE-Core rev: 6a65833a53487571b1ed0831dcc0b1fb04946557) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: patch CVE-2025-3277Peter Marko2025-04-282-1/+31
| | | | | | | | | | | | Pick commit [1] mentioned in [2]. [1] https://sqlite.org/src/info/498e3f1cf57f164f [2] https://nvd.nist.gov/vuln/detail/CVE-2025-3277 (From OE-Core rev: 2f800295919ac337f038e1678f4c0abb2a6e7f95) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-1182Ashish Sharma2025-04-282-0/+34
| | | | | | | | | Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=b425859021d17adf62f06fb904797cf8642986ad] (From OE-Core rev: d27416eb05643afcd80435dd7ed27d6cd3d85650) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32906Vijay Anusuri2025-04-283-0/+146
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/1f509f31b6f8420a3661c3f990424ab7b9164931 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/af5b9a4a3945c52b940d5ac181ef51bb12011f1f (From OE-Core rev: c3ba6b665a907b8f8340aedcbf51bef79f1048b8) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32912Vijay Anusuri2025-04-283-0/+73
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/cd077513f267e43ce4b659eb18a1734d8a369992 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/910ebdcd3dd82386717a201c13c834f3a63eed7f (From OE-Core rev: f18f762edd7ffa02ead1f382856066d2157015ed) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32911 & CVE-2025-32913Vijay Anusuri2025-04-283-0/+118
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/7b4ef0e004ece3a308ccfaa714c284f4c96ade34 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/f4a761fb66512fff59798765e8ac5b9e57dceef0 (From OE-Core rev: c1bf4fca316c67b9ce1134c7e5bdc9c0ac9ab878) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32909Vijay Anusuri2025-04-282-0/+37
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm it/ba4c3a6f988beff59e45801ab36067293d24ce92 (From OE-Core rev: 9eba43f18664a20d7f5dc8942eb39cfbd83c066e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32910Vijay Anusuri2025-04-284-0/+277
| | | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/e40df6d48a1cbab56f5d15016cc861a503423cfe & https://gitlab.gnome.org/GNOME/libsoup/-/commit/405a8a34597a44bd58c4759e7d5e23f02c3b556a & https://gitlab.gnome.org/GNOME/libsoup/-/commit/ea16eeacb052e423eb5c3b0b705e5eab34b13832 (From OE-Core rev: c9c6c8c5be4df8cb2c44f1e6fe0954c9ee666e5a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to scarthgap head revisionyocto-5.0.9scarthgap-5.0.9Steve Sakoman2025-04-191-1/+1
| | | | | | (From OE-Core rev: 04038ecd1edd6592b826665a2b787387bb7074fa) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 5.0.9Steve Sakoman2025-04-191-1/+1
| | | | | | (From meta-yocto rev: 7f1be5a930554ea5036d2c806aa752ae0b2de826) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: rewrite ptest installationVishwas Udupa2025-04-192-40/+46
| | | | | | | | | | | | | | | | | | | | | | | | | | Rewrite (again) the openssl test suite installation. Depend on and reuse already installed libraries and modules instead of installing them twice. Be more selective when installing from the build tree so we don't install intermediate .c .d .o files. This further reduces the size of openssl-dbg from ~120MB to ~18MB. (From OE-Core rev: 8baa0ce7eae65026cb3a784adaf3a4fc724ce9c9) Upstream-Status: Backport[https://git.yoctoproject.org/poky/commit/?id=76212866402edb947f745f837e3c3b98b3056e58] (From OE-Core rev: b3cd05f123625c4c301fee925cdbb9641bc73412) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 76212866402edb947f745f837e3c3b98b3056e58) Signed-off-by: Vishwas Udupa <quic_vudupa@quicinc.com> Change-Id: Ifc0e3a019c2abe5142d0f1e359ae5aa33dae1608 Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: upgrade 3.7.4 -> 3.7.9Peter Marko2025-04-196-285/+5
| | | | | | | | | | | | | | | | | | These is update with only bug and security releases. On top of previous CVE patches, also CVE-2024-48615 is handled. Also many security fixes without CVE assigment are included. Note that upgrade to 3.7.5 on master required fix of test in python3-libarchive-c, however that recipe does not yet have ptest in scarthgap and the fix was in test only, not in productive code, so it is not necessary in scarthgap. Also remove CVE_STATUS which was obsolete already before this upgrade. (From OE-Core rev: f20516a3ed8a39d7e4deddf11dd2acd871894048) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-1181Ashish Sharma2025-04-193-0/+498
| | | | | | | | | | | | | | Import patches from ubuntu: Upstream-Status: Backport [ https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181-pre.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 && https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 Upstream commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 ] (From OE-Core rev: abb575f6ac1f5badae2825f1cb6152379a6658ee) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-1178 & CVE-2024-57360Ashish Sharma2025-04-193-0/+115
| | | | | | | | | | | | | Backport Fixes for: *CVE-2025-1178 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0] *CVE-2024-57360 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=5f8987d3999edb26e757115fe87be55787d510b9] (From OE-Core rev: 15a7f68ce14f635acf9b988fc1958ee625de4e11) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-1176Ashish Sharma2025-04-192-0/+157
| | | | | | | | | | Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1176.patch?h=applied/ubuntu/jammy-security Upstream commit https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814] (From OE-Core rev: 8d02a680b415f3145f4a4ef71842f336d8e3513b) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* patch.py: set commituser and commitemail for addNoteChangqing Li2025-04-161-6/+8
| | | | | | | | | | | | | | | | | | When PATCHTOOL is set to 'git', and user don't setup user.name and user.email for git, do_patch fail with the following error, fix by passing -c options. CmdError("git notes --ref refs/notes/devtool append -m 'original patch: 0001-PATCH-increase-to-cpp17-version.patch' HEAD", 0, 'stdout: stderr: Author identity unknown *** Please tell me who you are. Run git config --global user.email "you@example.com" git config --global user.name "Your Name" (From OE-Core rev: 9de38ac99c2b19f549c00ea5277faf621c6f4e65) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: upgrade 10.04.0 -> 10.05.0Archana Polampalli2025-04-161-1/+1
| | | | | | | | | | | | | | | | This upgrade addresses CVEs: CVE-2025-27835 CVE-2025-27832 CVE-2025-27831 CVE-2025-27836 CVE-2025-27830 CVE-2025-27833 CVE-2025-27833 CVE-2025-27834 Changelog: https://ghostscript.readthedocs.io/en/gs10.05.0/News.html (From OE-Core rev: 2c851f74fa72c30d447d59d450eb9bc036404f55) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-22871Hitendra Prajapati2025-04-162-0/+173
| | | | | | | | | Upstream-Status: Backport from https://github.com/golang/go/commit/15e01a2e43ecb8c7e15ff7e9d62fe3f10dcac931 (From OE-Core rev: b343da566856ad17b5dc03d42d9241bcb44cad1b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xz: patch CVE-2025-31115Peter Marko2025-04-165-0/+339
| | | | | | | | | | | | Cherry-pick commits from [1] linked from [2] from branch v5.4 [1] https://tukaani.org/xz/xz-cve-2025-31115.patch [2] https://tukaani.org/xz/threaded-decoder-early-free.html (From OE-Core rev: 952ea12f08a4e42f787a21fb98adaf4b17d0aee1) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xz: upgrade 5.4.6 -> 5.4.7Peter Marko2025-04-161-2/+2
| | | | | | | | | | | License-Update: homepage update in [1] [1] https://github.com/tukaani-project/xz/commit/c5c091332c6953a0ce940cb355ea9e99491429fc (From OE-Core rev: e6565ca37da4821f8e3924fe6bc6a6f4eeedd9a9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: add workaround for json5 style listPeter Marko2025-04-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NVD responses changed to an invalid json between: * April 5, 2025 at 3:03:44 AM GMT+2 * April 5, 2025 at 4:19:48 AM GMT+2 The last response is since then in format { "resultsPerPage": 625, "startIndex": 288000, "totalResults": 288625, "format": "NVD_CVE", "version": "2.0", "timestamp": "2025-04-07T07:17:17.534", "vulnerabilities": [ {...}, ... {...}, ] } Json does not allow trailing , in responses, that is json5 format. So cve-update-nvd2-native do_Fetch task fails with log backtrace ending: ... File: '/builds/ccp/meta-siemens/projects/ccp/../../poky/meta/recipes-core/meta/cve-update-nvd2-native.bb', lineno: 234, function: update_db_file 0230: if raw_data is None: 0231: # We haven't managed to download data 0232: return False 0233: *** 0234: data = json.loads(raw_data) 0235: 0236: index = data["startIndex"] 0237: total = data["totalResults"] 0238: per_page = data["resultsPerPage"] ... File: '/usr/lib/python3.11/json/decoder.py', lineno: 355, function: raw_decode 0351: """ 0352: try: 0353: obj, end = self.scan_once(s, idx) 0354: except StopIteration as err: *** 0355: raise JSONDecodeError("Expecting value", s, err.value) from None 0356: return obj, end Exception: json.decoder.JSONDecodeError: Expecting value: line 1 column 1442633 (char 1442632) ... There was no announcement about json format of API v2.0 by nvd. Also this happens only if whole database is queried (database update is fine, even when multiple pages as queried). And lastly it's only the cve list, all other lists inside are fine. So this looks like a bug in NVD 2.0 introduced with some update. Patch this with simple character deletion for now and let's monitor the situation and possibly switch to json5 in the future. Note that there is no native json5 support in python, we'd have to use one of external libraries for it. (From OE-Core rev: 4358fdfdd7a8908df98f7c4def2c8c1a6efb7256) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6e526327f5c9e739ac7981e4a43a4ce53a908945) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-22870Archana Polampalli2025-04-162-0/+81
| | | | | | | | | | | | Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. (From OE-Core rev: 88e79f915137edc5a37a110abdc79f5800404e45) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: patch CVE-2024-7537Peter Marko2025-04-162-0/+60
| | | | | | | | | | Pick commit https://web.git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=e6d8d526d5077c0b6ab459efeb6b882c28e0fdeb (From OE-Core rev: 54ce53f7c2daf4f9d536e4e1f721035064c57b30) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* mc: set ac_cv_path_ZIP to avoid buildpaths QA issuesMartin Jansa2025-04-071-0/+1
| | | | | | | | | | | | | | | | | | * in builds with zip in HOSTTOOLS mc fails with: ERROR: mc-4.8.31-r0 do_package_qa: QA Issue: File /usr/libexec/mc/extfs.d/uzip in package mc-helpers-perl contains reference to TMPDIR [buildpaths] and it's because of the path to zip: mc/4.8.31/package $ grep -R styhead . ./usr/libexec/mc/extfs.d/uzip:my $app_zip = "TMPDIR/hosttools/zip"; * don't use /usr/bin/env as in other cases, because app_zip is then used e.g. with: my $cmd_addlink = "$app_zip -g -y"; (From OE-Core rev: 4003b5faa1e5acfa025e1d0df4e021e06cf8724c) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* yocto-uninative: Update to 4.7 for glibc 2.41Michael Halstead2025-04-071-5/+5
| | | | | | | | | (From OE-Core rev: 7626067432743657e9c536ca16a2dac513ba4929) Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-cross-canadian: Set CVE_STATUS ignore for CVE-2024-43402Virendra Thakur2025-04-071-0/+4
| | | | | | | | | | | | | | | | This CVE was created because fix for CVE-2024-24576 was incomplete. Ignore the new CVE in the same way as the old one. See https://nvd.nist.gov/vuln/detail/CVE-2024-43402 As per NVD, this CVE only affects to Windows platform Reference: https://git.yoctoproject.org/meta-lts-mixins/commit/?h=scarthgap/rust&id=13f045acf6388d1e320fd4c0f3ca19ca7a75ef44 (From OE-Core rev: ef2ba1f04f6f21530dc4efe5c4f61cbb0c76c032) Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* freetype: follow-up patch for CVE-2025-27363Peter Marko2025-04-072-1/+36
| | | | | | | | | | | | | | | Per [1] there are two patches needed - [2] which is already included in 3.13.1 and [3] which is only in 2.13.3. Backport the second patch. [1] https://gitlab.freedesktop.org/freetype/freetype/-/issues/1322 [2] https://gitlab.freedesktop.org/freetype/freetype/-/commit/ef636696524b081f1b8819eb0c6a0b932d35757d [3] https://gitlab.freedesktop.org/freetype/freetype/-/commit/73720c7c9958e87b3d134a7574d1720ad2d24442 (From OE-Core rev: 41f855ea5a2018d08e0e9457d710032e96fe669b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* expat: patch CVE-2024-8176Peter Marko2025-04-074-0/+1831
| | | | | | | | | | | | | | | | | | | Backport https://github.com/libexpat/libexpat/pull/973 Patch created by: git diff 2fc36833334340ff7ddca374d86daa8744c1dfa3..99529768b4a722f46c69b04b874c1d45b3eb819c Additional backport (containing changes in tests only) was needed to apply it cleanly. Additional backport https://github.com/libexpat/libexpat/pull/989 which has fixed regression of the first fix. Patch created by: git diff 91ca72e913af94ed44ef2a80a9dd542be3e5766c..308c31ed647f2c6aebe33ca3a4fa9e1436f461e2 (From OE-Core rev: 3ece58813faaf4e5f66c7b52f736e84615ccfef6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-09-14 09:39:54 +0000