summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* systemd: add libpcre2 as RRECOMMENDS if pcre2 is enabledAlexis Cellier2025-03-081-1/+1
| | | | | | | | | | | | | | | | The libpcre2 is now dlopen'ed, so it is not automatically added to the RDEPENDS anymore. Add it to the RRECOMMENDS list (and not RDEPENDS as systemd tags the library as "suggested"). This issue is not on master, the systemd v257 recipe uses a tool that systemd provides to get this kind of dependencies. But this cannot be backported to scarthgap as systemd v255 does not have this tool yet. Cc: Yoann Congal <yoann.congal@smile.fr> (From OE-Core rev: 45fc7048c511c433ecc23840fe6fdd61f6366a47) Signed-off-by: Alexis Cellier <alexis.cellier@smile.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-0840Deepesh Varatharajan2025-03-082-0/+54
| | | | | | | | | | | | PR32560 stack-buffer-overflow at objdump disassemble_bytes Backport a patch from upstream to fix CVE-2025-0840 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=baac6c221e9d69335bf41366a1c7d87d8ab2f893] (From OE-Core rev: 338a2a95eb9a99c8e56dfb1f6336497ddd654372) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: Correct the CVE ID to fix CVE-2025-22919Archana Polampalli2025-03-082-2/+2
| | | | | | | | | | A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file. (From OE-Core rev: bf0ad79c46d8a01aafc91620ddf415749aa8849a) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-0518Archana Polampalli2025-03-082-0/+35
| | | | | | | | | | | | | | | Unchecked Return Value, Out-of-bounds Read vulnerability in FFmpeg allows Read Sensitive Constants Within an Executable. This vulnerability is associated with program files https://github.Com/FFmpeg/FFmpeg/blob/master/libavfilter/af_pan.C This issue affects FFmpeg: 7.1. Issue was fixed: https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a https://github.com/FFmpeg/FFmpeg/commit/b5b6391d64807578ab872dc58fb8aa621dcfc38a This issue was discovered by: Simcha Kosma (From OE-Core rev: 75ad6e004de95ff6208820ccf2c0af01d9363749) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-22921Archana Polampalli2025-03-082-0/+35
| | | | | | | | | | FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c. (From OE-Core rev: bc9cdf3701b937d40964903a3489898a69525d17) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-25471Archana Polampalli2025-03-082-0/+40
| | | | | | | | | | FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: a8331b11d5d7aa8f1997eaa189b74aaab7cc44da) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-25473Archana Polampalli2025-03-082-0/+37
| | | | | | | | | | FFmpeg git master before commit c08d30 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. (From OE-Core rev: abc6b3180b87c665ff04204b7163d1f074d99747) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26601Vijay Anusuri2025-03-085-0/+344
| | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d & https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f & https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989 (From OE-Core rev: 165032003e3f7fb5fde7322c5ad64c26f286228a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26600Vijay Anusuri2025-03-082-0/+69
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b (From OE-Core rev: f84fd297131deda3e13377f0b3555a71e67f1d74) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26599Vijay Anusuri2025-03-083-0/+197
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be & https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8 (From OE-Core rev: aea55eb6eb5610ef6e7d37fadcbb7e760bf80d7d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26598Vijay Anusuri2025-03-082-0/+121
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a (From OE-Core rev: b58fe3b82168502e29f500e42ca8d140934f5b1a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26597Vijay Anusuri2025-03-082-0/+47
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949 (From OE-Core rev: 6e19f26f4f152316badf3668b74cfc50d8d12528) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26596Vijay Anusuri2025-03-082-0/+50
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01 (From OE-Core rev: ea9aac48ff4bc25e79b17c63b425a705c97f078d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26595Vijay Anusuri2025-03-082-0/+66
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87 (From OE-Core rev: f801e34c07472af8384e69da27271584ee6a8d1c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2025-26594Vijay Anusuri2025-03-083-0/+107
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6 (From OE-Core rev: f6af10075bc8bf7e8ffb9054500529608d3bb8ba) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: Fix CVE-2024-9632Vijay Anusuri2025-03-082-1/+62
| | | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-9632 Upstream patch: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ba1d14f8eff2a123bd7ff4d48c02e1d5131358e0 (From OE-Core rev: 634a10db7da46688413d26f3fc9d5510f239b40b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: ignore CVE-2025-0725Poonam Jadhav2025-03-081-0/+2
| | | | | | | | | | | | CVE-2025-0725 can only trigger for curl when using a runtime zlib version 1.2.0.3 or older and scarthgap supports zlib 1.3.1 version, hence ignore cve for scarthgap https://curl.se/docs/CVE-2025-0725.html (From OE-Core rev: 8c3b4a604b40260e7ca9575715dd8017e17d35c0) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: Fix CVE-2025-26466Vijay Anusuri2025-03-082-0/+39
| | | | | | | | | | | | | | sshd(8) in OpenSSH versions 9.5p1 to 9.9p1 (inclusive) is vulnerable to a memory/CPU denial-of-service related to the handling of SSH2_MSG_PING packets. This condition may be mitigated using the existing PerSourcePenalties feature. Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2] (From OE-Core rev: 7360f3998939e202f9611644a8bed0c3fe0c782a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: data_smart.py: clear expand_cache in _setvar_update_overridevarsChen Qi2025-03-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At the end of this function, self.overrides is cleared, which means we'll construct a new self.overrides after this call. And a new self.overrides will give out different expand_cache, so the old expand_cache should also be cleared to avoid any wrong value. Currently, there's a problem revealed by recent recipe specific virtual provider patch. If we enable multilib and set "OVERRIDES:prepend" in local.conf, things don't work. Here's the error message: ERROR: Nothing PROVIDES 'lib32-gcc-cross-x86_64' Below are reproduce steps: 1. Add in local.conf the following lines: MACHINE ?= "qemux86-64" require conf/multilib.conf MULTILIBS ?= "multilib:lib32" DEFAULTTUNE:virtclass-multilib-lib32 ?= "core2-32" OVERRIDES:prepend = "some-override:" (Note that using :append and :remove also reproduces the issue.) 2. bitbake -n lib32-sysstat (bitbake -n core-image-minimal also reproduces the issue) The expandWithRefs calls getVar, which fills expand_cache. So when setting OVERRIDES:prepend, this will fill the expand_cache. When overridevars are updated, if we don't clear expand_cache, we'll retrieve wrong values. Previously, things happened to work because there's a call to expand PREFERRED_PROVIDER_virtual/${TARGET_PREFIX}gcc, which in turn expands TARGET_VENDOR. Now what we expand is PREFERRED_PROVIDER_ virtual/cross-cc, so the problem is revealed. (Bitbake rev: 7375d32e8c1af20c51abec4eb3b072b4ca58b239) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: data_smart.py: simple clean upChen Qi2025-03-081-4/+1
| | | | | | | | | | | | | When var matches __setvar_regexp__, which has the value as below, __setvar_regexp__ = re.compile(r'(?P<base>.*?)(?P<keyword>:append|:prepend|:remove)(:(?P<add>[^A-Z]*))?$') the keyword will not be __doc__ or __module__ and var will always contain ":". (Bitbake rev: 9cac695951d0fd587063b250bfc8ef0f87acad18) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: data_smart.py: remove unnecessary ? from __expand_var_regexp__Chen Qi2025-03-081-1/+1
| | | | | | | | | | | The non-greedy modifier suffix ? is not necessary here because } is not in the character set [a-zA-Z0-9\-_+./~:]. (Bitbake rev: aae570b7f051fc5deee7a1712a02ed92498a4461) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: bitbake-diffsigs: fix handling when finding only a single sigfileEnrico Jörns2025-03-081-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the following error when calling 'bitbake-dumpsig' or 'bitbake-diffsigs' when having only a single sigfile available: | Traceback (most recent call last): | File "[..]/poky/bitbake/bin/bitbake-dumpsig", line 171, in <module> | files = find_siginfo_task(tinfoil, options.taskargs[0], options.taskargs[1]) | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ | File "[..]/poky/bitbake/bin/bitbake-dumpsig", line 83, in find_siginfo_task | sig2 = latestsigs[1] | ~~~~~~~~~~^^^ | IndexError: list index out of range Handle this by adding (and returning) the path for the second sigfile only if one is found. This way it will work for both diffsigs and dumpsig use case. The calling argparse code already deals with find_siginfo_task() returning only a single file. For 'bitbake-dumpsig' it will just dump the single sigfile, for 'bitbake-diffsigs' it will emit a proper error message again: | ERROR: Only one matching sigdata file found for the specified task (systemd configure) (cherry picked from commit 25057d33e9131f3214a06bbb316c916c744f8f03) (Bitbake rev: 4e443aeab9096b41c9e5ba41cd21027ecaa20285) Signed-off-by: Enrico Jörns <ejo@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Patrick Vogelaar <patrick.vogelaar@belden.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ccache.conf: Add include_file_ctime to sloppinessFabio Berton2025-03-051-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When multiple recipes are built in parallel, Ccache sometimes refuses to lookup some objects in cache, leading to undesired cache misses. The root cause of this is an interaction between the way how bitbake constructs a recipe sysroot and Ccache's `include_file_ctime` check. Whenever bitbake creates a recipe's sysroot it hardlinks the files provided by a recipes dependencies. Adding a hardlink to a file changes it's ctime which in turn leads Ccache to believe that the file was modified thus aborting the cache lookup. To avoid this situation, add `include_file_ctime` to the list of checks that should be ignored using the Ccache sloppiness configuration option [1]. Example of a log entry that Ccache ignores a file: / |recipe-sysroot/usr/include/bits/pthread_stack_min.h had status change |near or after invocation (ctime 1739822508.107677255, invocation time |1739822507.970071107) \ 1 - https://ccache.dev/manual/4.10.2.html#config_sloppiness (From OE-Core rev: c74a6d6afc52606825e583cae1162e13a5369498) Signed-off-by: Fabio Berton <fabio.berton@criticaltechworks.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4899698297c7783e02aba5388e0469cc83bd2f70) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* meta: Enable '-o pipefail' for the SDK installerMoritz Haase2025-03-051-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When testing a Yocto SDK installer on Alpine 3.21, we recently ended up with a broken SDK. One of the commands the relocation script calls in a piped multi-command chain failed (see [0]), but the installer did not realize that - since it doesn't use 'set -o pipefail'. Thus, the error was never reported to the user and the installer claimed to have set up the SDK correctly - which wasn't the case. Given that the SDK installer is a POSIX-compliant shell script and that the 'pipefail' option used to be missing from the standard, it's not surprising that it isn't used. Thankfully however, in June of 2024, a new version of POSIX (POSIX.1-2024) was released - and that one finally includes the 'pipefail' option (see [1]). A number of shells already support it, so let's enable it if available to make the SDK installer more robust. The change has been tested locally using SDK installers for internal projects, based on both Kirkstone and Scarthgap. [0]: https://gitlab.alpinelinux.org/alpine/aports/-/issues/16797 [1]: https://pubs.opengroup.org/onlinepubs/9799919799.2024edition/utilities/V3_chap02.html#set (From OE-Core rev: 1cb4b41c7faf77fcc347b1276d86d4288968c926) (From OE-Core rev: 940159f060e9a851cc9ff5a9e1c590ed8de4b38e) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 10dce263f0230f94a44a017b5614811e696c5ce9) Signed-off-by: Akash Hadke <akash.hadke27@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: kernel-fitimage: Restore FIT_SIGN_INDIVIDUAL="1" behaviorMarek Vasut2025-03-051-9/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | OE FIT_SIGN_INDIVIDUAL is implemented in an unusual manner, where the resulting signed fitImage contains both signed images and signed configurations, possibly using different keys. This kind of signing of images is redundant, but so is the behavior of FIT_SIGN_INDIVIDUAL="1" and that is here to stay. Adjust the process of public key insertion into u-boot.dtb such that if FIT_SIGN_INDIVIDUAL==1, the image signing key is inserted into u-boot.dtb first, and in any case the configuration signing key is inserted into u-boot.dtb last. The verification of the keys inserted into u-boot.dtb against unused.itb is performed only for FIT_SIGN_INDIVIDUAL!=1 due to mkimage limitation, which does not allow mkimage -f auto-conf to update the generated unused.itb, and instead rewrites it. Fixes: 259bfa86f384 ("u-boot: kernel-fitimage: Fix dependency loop if UBOOT_SIGN_ENABLE and UBOOT_ENV enabled") (From OE-Core rev: 699822a163a4efa32735f75d21fde4ffa195c0e0) Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0106e5efab99c8016836a2ab71e2327ce58a9a9d) Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix multiple CVEsHitendra Prajapati2025-03-054-0/+357
| | | | | | | | | | | | | Backport fixes for: * CVE-2025-1352 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=2636426a091bd6c6f7f02e49ab20d4cdc6bfc753 * CVE-2025-1365 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=5e5c0394d82c53e97750fe7b18023e6f84157b81 * CVE-2025-1372 - Upstream-Status: Backport from https://sourceware.org/git/?p=elfutils.git;a=commit;h=73db9d2021cab9e23fd734b0a76a612d52a6f1db (From OE-Core rev: 938676089fb5da383b7daf6c5e6348079ecf5674) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vulnerabilities/classes: remove references to cve-check text formatMarta Rybczynska2025-02-282-29/+69
| | | | | | | | | | | | | The text format has been removed, so also remove references and examples using this format. Replace with examples with the JSON format. (From yocto-docs rev: 3757ace0581e6279aa7c065b21cee56edfe985dd) Signed-off-by: Marta Rybczynska <marta.rybczynska@ygreky.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit a52cd7bcadccc53e982f90d6e170d00798322597) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: Add missing variable IMAGE_ROOTFS_MAXSIZEWeisser, Pascal2025-02-281-0/+6
| | | | | | | | | | | | | | This patch adds the missing documentation of variable IMAGE_ROOTFS_MAXSIZE to the reference manual. (From yocto-docs rev: c3c18c5f3d8f1ac8781dbc3fdbfdb53c94095f62) Signed-off-by: Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 1dcc8cf7c49da449b324a7bd6bb22effe1d53d70) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-setuptools-scm: respect GIT_CEILING_DIRECTORIESEtienne Cordonnier2025-02-282-0/+37
| | | | | | | | | | | | | | | | | | | | | | | | | Fixes https://bugzilla.yoctoproject.org/show_bug.cgi?id=15740 python3-setuptools-scm was ignoring GIT_CEILING_DIRECTORIES which is set by poky, and it was thus finding a wrong value of "toplevel" in ./src/setuptools_scm/_file_finders/git.py The code is supposed to generate the list of files contained in python3-setuptools-scm, but it was instead running "git archive" on whatever git repository was above the build directory, because the tarball containing the sources of python3-setuptools-scm does not contain a .git directory. This is barely noticeable when building as a subdirectory of poky which is only 48MB, but this was causing serious slowdowns of python3-setuptools-scm:do_compile when building inside a big git repository with files tracked using git-lfs (50 minutes in my use-case). Reported upstream as https://github.com/pypa/setuptools-scm/issues/1103 (From OE-Core rev: 4ebe72477484cf68165b6f736ce10373e97d0e6d) (From OE-Core rev: 369eebad4f38c3641be73dbc0490c87636e0912d) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bind: Upgrade 9.18.28 -> 9.18.33Vijay Anusuri2025-02-281-1/+1
| | | | | | | | | | | | | | | | | Includes security fixes for CVE-2024-12705 CVE-2024-11187 and other bug fixes Release Notes: https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-32 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-31 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-30 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-29 (From OE-Core rev: 37f07393c6977e7765ebfd948a017dab9be6a367) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: upgrade 2.12.9 -> 2.12.10Peter Marko2025-02-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.12.10 Security * [CVE-2025-24928] Fix stack-buffer-overflow in xmlSnprintfElements * [CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd * pattern: Fix compilation of explicit child axis Regressions * parser: Fix detection of duplicate attributes Bug fixes * xpath: Fix parsing of non-ASCII names Portability * python: Declare init func with PyMODINIT_FUNC * tests: Fix sanitizer version check on old Apple clang Build * autotools: Set AC_CONFIG_AUX_DIR * cmake: Always build Python module as shared library * cmake: Fix compatibility in package version file (From OE-Core rev: 4540dd4bb71e00b7f8c1a3f5a9e10d482e0b2abd) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libcap: fix CVE-2025-1390Hitendra Prajapati2025-02-282-0/+37
| | | | | | | | | Upstream-Status: Backport from https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878 (From OE-Core rev: b975db55f6e0d551e69c870620292b58425f9aab) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: fix CVE-2024-57259Hongxu Jia2025-02-282-0/+42
| | | | | | | | | | | | | sqfs_search_dir in Das U-Boot before 2025.01-rc1 exhibits an off-by-one error and resultant heap memory corruption for squashfs directory listing because the path separator is not considered in a size calculation. https://nvd.nist.gov/vuln/detail/CVE-2024-57259 (From OE-Core rev: 8fad176e6258a44d1ba1eed224cd27745b6a57cf) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: fix CVE-2024-57258Hongxu Jia2025-02-284-0/+133
| | | | | | | | | | | | | Integer overflows in memory allocation in Das U-Boot before 2025.01-rc1 occur for a crafted squashfs filesystem via sbrk, via request2size, or because ptrdiff_t is mishandled on x86_64. https://nvd.nist.gov/vuln/detail/CVE-2024-57258 (From OE-Core rev: 12e1d55ae2427b6aaca6a1f7d8f947f0d6bbd28d) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: fix CVE-2024-57257Hongxu Jia2025-02-282-0/+228
| | | | | | | | | | | | A stack consumption issue in sqfs_size in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with deep symlink nesting. https://nvd.nist.gov/vuln/detail/CVE-2024-57257 (From OE-Core rev: 890597539246c0f2b427d60965d5665cf7f4731c) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: fix CVE-2024-57256Hongxu Jia2025-02-282-0/+52
| | | | | | | | | | | | | | An integer overflow in ext4fs_read_symlink in Das U-Boot before 2025.01-rc1 occurs for zalloc (adding one to an le32 variable) via a crafted ext4 filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite. https://nvd.nist.gov/vuln/detail/CVE-2024-57256 (From OE-Core rev: 21e6ac6e53112b9dddc5a84f27be5851469b9c46) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: fix CVE-2024-57255Hongxu Jia2025-02-282-0/+54
| | | | | | | | | | | | | An integer overflow in sqfs_resolve_symlink in Das U-Boot before 2025.01-rc1 occurs via a crafted squashfs filesystem with an inode size of 0xffffffff, resulting in a malloc of zero and resultant memory overwrite. https://nvd.nist.gov/vuln/detail/CVE-2024-57255 (From OE-Core rev: c3784c108f003c6663ca969585414e4a90f06606) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* u-boot: fix CVE-2024-57254Hongxu Jia2025-02-282-1/+50
| | | | | | | | | | | | | An integer overflow in sqfs_inode_size in Das U-Boot before 2025.01-rc1 occurs in the symlink size calculation via a crafted squashfs filesystem. https://nvd.nist.gov/vuln/detail/CVE-2024-57254 (From OE-Core rev: eea9fee59bc7576bef94f0da466887e4daff0356) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* migration-guides: add release notes for 5.0.7Lee Chee Yang2025-02-212-0/+333
| | | | | | | | | | (From yocto-docs rev: fb677d4289bb00b7807f512a1e3b7c89d3e3d92e) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 9f1f9f1a3a2a541ed70df72d4fe391b5b7fd3733) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Add favicon for the documentation htmlAntonin Godard2025-02-212-0/+1
| | | | | | | | | | | | | Import the favicon from https://www.yoctoproject.org/, convert it to 16x16 (as per the Sphinx documentation) to make a 1291B image of the Yocto logo. (From yocto-docs rev: 14de49a1ec6d725764e2a968edd3386252e826fe) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit e3ee43e6d70685a2404aae2d60557a42879b0bb1) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* contributor-guide/submit-changes: add policy on AI generated codeAntonin Godard2025-02-211-0/+49
| | | | | | | | | | | | | | Based on message by Richard Purdie on the yocto-docs list: https://lists.yoctoproject.org/g/docs/message/6300 Re-formatted for the Yocto Project documentation syntax. (From yocto-docs rev: da3aa5ba9387ca5bb7ddd75fe6f7962d0629ea90) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit a72dd13e6841b621c9e8f904dfaa440c186d2959) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sdk-manual: extensible.rst: update devtool ide-sdkAdrian Freihofer2025-02-211-3/+4
| | | | | | | | | | | | | | | | | | | | Replace devtool ide-sdk --debug-build-config by devtool modify --debug-build This change was introduced with commit https://git.yoctoproject.org/poky/commit/?id=1f7eb26c947dde14698ae6e2ab88f0637027f4cb (From yocto-docs rev: 04b8b94a2fa892c3580a2a506dc5b40d6a176a41) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit e2b6a4c6c633e79d0e4975ba2e1a27a8c1b8c1c5) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* icu: remove host references in nativesdk to fix reproducibilityOleksandr Hnatiuk2025-02-211-9/+24
| | | | | | | | | | | | | | | | | Fix is only done for target. Use same code for nativesdk. Backport from poky master: https://git.yoctoproject.org/poky/commit/?id=c63b8f28ac52047fad689b78d605aa792baf1ad8 (From OE-Core rev: dc6306883cc2c7d4d98d595442e5bf4037a160c5) (From OE-Core rev: fc46705cc629a151f85717a57f7d789de8fd9b64) Signed-off-by: Oleksiy Obitotskyy <oobitots@cisco.com> Signed-off-by: Oleksandr Hnatiuk <ohnatiuk@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c63b8f28ac52047fad689b78d605aa792baf1ad8) Signed-off-by: Bhabu Bindu <bindu.bhabu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ppp: Revert lock path to /var/lockJohannes Schneider2025-02-212-0/+64
| | | | | | | | | | | | | | | | | | ppp version 2.5.0 fails to run properly if an expected /run/pppd/lock directory does not exist, which is not usually created in a yocto built OS. Backport the patch from upstream version 2.5.1 that fixes the issue by reverting back to /var/lock. The related github issue upstream was: "lock directory moved in ppp-2.5.0 #419" [1] Link: https://github.com/ppp-project/ppp/issues/419 (From OE-Core rev: 0869eb50e39c567cc1d50db4eb287f02866196cf) Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* scripts/install-buildtools: Update to 5.0.7Aleksandar Nikolic2025-02-211-2/+2
| | | | | | | | | Update to the 5.0.7 release of the 5.0 series for buildtools. (From OE-Core rev: 793d3203db41efa4df1d615db832a771015b7b50) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.0764 -> 9.1.1043Divya Chellam2025-02-211-2/+2
| | | | | | | | | | | | | This includes CVE-fix for CVE-2025-22134 and CVE-2025-24014 Changes between 9.1.0764 -> 9.1.1043 ==================================== https://github.com/vim/vim/compare/v9.1.0764...v9.1.1043 (From OE-Core rev: 00b97ae6e1aa2c1cad2ff23e4eedab1d55af6f4f) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: upgrade 3.2.3 -> 3.2.4Peter Marko2025-02-216-354/+24
| | | | | | | | | | | | | | Release information: https://github.com/openssl/openssl/blob/openssl-3.2/NEWS.md#major-changes-between-openssl-323-and-openssl-324-11-feb-2025 Handles CVE-2024-12797 in addition to already patched CVEs. Refresh patches and remove CVE patches included in the new version. (From OE-Core rev: b051c16980f67541866253f0d7eb2dc39847fb83) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2024-12243Peter Marko2025-02-212-0/+1150
| | | | | | | | | | Backport following patch to address this CVE: https://gitlab.com/gnutls/gnutls/-/commit/4760bc63531e3f5039e70ede91a20e1194410892 (From OE-Core rev: e5316a9019e6b9ad5a66b6070ea863705a26c633) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* subversion: ignore CVE-2024-45720Peter Marko2025-02-211-0/+2
| | | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-45720 This CVE is relevant only for subversion running on Windows. (From OE-Core rev: 6a22c704c5236c7b893135dca53cc5d2b6f78e03) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Reviewed-by: Sofiane Hamam <sofiane.hamam@smile.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: bblayers/query: Fix using "removeprefix" string methodJoerg Schmidt2025-02-211-1/+2
| | | | | | | | | | | | | | | | | | The minimum Python version required for Yocto 5.0 is 3.8 which causes failure in poky/bitbake/lib/bblayers/query.py when listing layers by using command "bitbake-layers show-recipes -f --bare --mc MC" for the given multiconfig MC. The reason for that failure is the use of "removeprefix" string method which got introduced in Python 3.9. This patch replaces the "removeprefix" method with an equivalent solution supported by Python 3.8. (Bitbake rev: f6635b32ab553e812fe7c05998ef05834fccd0f3) Signed-off-by: Joerg Schmidt <joerg.schmidt@garmin.com> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-04 18:03:31 +0000