summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
* wpa-supplicant: fix CVE-2022-37660kirkstoneDivya Chellam7 days6-0/+1679
| | | | | | | | | | | | | | | | | | | | | | | | | | | In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association. CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004 are dependent commits while CVE-2022-37660-0005 is actual CVE fix. Reference: https://security-tracker.debian.org/tracker/CVE-2022-37660 Upstream-patches: https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62 https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534 https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865 https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4 (From OE-Core rev: 3dd917c52ace30607800f0b70a52a52662dda731) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: fix typo in CVE-2024-0151.patchGyorgy Sarvari7 days1-5/+8
| | | | | | | | | | | | | | | | | During backporting the patch, accidentally a variable was removed. In case the recipe is compiled for 32-bit Arm target, compilation fails with the following error: 3.0.1-r0/git/llvm/lib/Target/ARM/ARMISelLowering.cpp:4481:13: error: 'RegVT' was not declared in this scope | 4481 | if (RegVT == MVT::f16 || RegVT == MVT::bf16) | | ^~~~~ This patch corrects the patch, and adds back the removed RegVT variable. (From OE-Core rev: 77f29f8fea58de40459186952d25279877ce4994) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-1594Archana Polampalli7 days2-0/+105
| | | | | | | | | | | | | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. (From OE-Core rev: 5a922eb95da7d373ee2bc3018065448fa128e69a) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix multiple CVEsArchana Polampalli7 days4-0/+269
| | | | | | | | | | | | | | | | | | | | CVE-2023-6605: A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs. CVE-2023-6604: A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation. CVE-2023-6602: flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists. (From OE-Core rev: aa68992ddc5744bb4fdbb3a3cd0636b303449be2) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-7700Archana Polampalli7 days2-0/+53
| | | | | | | | | NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec.c) (From OE-Core rev: a8344e051e4c705df69f4787726a9eca5c780eff) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio: Add audio group explicitlyKyungjik Min11 days1-1/+1
| | | | | | | | | | | | | | | | | | | Since pulseaudio-server requires the audio group, we explicitly add it. When use useradd-staticids or do not use the default group in base-passwd, an error will occur because the audio group is not defined. NOTE: pulseaudio: Performing useradd with [--root TOPDIR/tmp/work/cortexa72-poky-linux/pulseaudio/17.0/recipe-sysroot --home-dir /var/run/pulse --gid 998 --groups audio,pulse --no-create-home --system --shell /bin/false --uid 998 pulse] useradd: group 'audio' does not exist ERROR: pulseaudio: useradd command did not succeed. (From OE-Core rev: 71ed9d8394f7e625270ee66f9c2816bba4aa2016) Signed-off-by: Kyungjik Min <dpmin7@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issueDeepak Rathore11 days2-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default CONNECTIVITY_CHECK_URIS uses "https://yoctoproject.org/connectivity.html" which redirect to "https://www.yoctoproject.org/connectivity.html". Some network configurations with proxies or restricted internet access don't handle HTTP redirects properly during the sanity check phase, causing build failures with: ERROR: OE-core's config sanity checker detected a potential misconfiguration. Either fix the cause of this error or at your own risk disable the checker (see sanity.conf). Following is the list of potential problems / advisories: Fetcher failure for URL: 'https://yoctoproject.org/connectivity.html'. URL doesn't work. Updated the default URL to use the final destination directly to avoid redirect-related connectivity check failures. Also updated SDK test cases in https.py to use the corrected URL for consistency. (From OE-Core rev: aceb2920fbdef43db7b0b698865358e288901610) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 60cdf960a3560f391babd559737f1afb31fb2c5c) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: remove devtool FIXME commentPeter Marko11 days1-52/+0
| | | | | | | | | | This comment should not have been merged. It shows that the license did not change. (From OE-Core rev: 652986a4c67fc5d1c69cd3c2cb0d7f197b960be6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1198 -> 9.1.1652Peter Marko11 days4-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Handles CVE-2025-53905, CVE-2025-53906, CVE-2025-55157, CVE-2025-55158. Changes between 9.1.1198 -> 9.1.1652 ==================================== https://github.com/vim/vim/compare/v9.1.1198...v9.1.1652 Refresh patches. Disable newly introduced wayland support (in patch version 1485). To this belongs also adding recursion in delete command for dir auto which was newly failing as there is wayland directory inside now. If someone is interested, this can be probably enabled, but without additional work it results in compilation error due to function redefinition conflicts. (From OE-Core rev: e87d427d928234ef0441f9ce1fe8631fbe471094) (From OE-Core rev: bd2dc808baec7e940a09f80afa2c2997efe7cbfe) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: not adjust script pathnames for native scripts eitherMingli Yu11 days1-14/+21
| | | | | | | | | | | | | | | | | | | After the below commit introduced, the shebang size of native scripts is also checked, so rework the patch to fix the gap. 377fe11bc0 insane.bbclass: Make do_qa_staging check shebangs Fixes: ERROR: QA Issue: : /work/x86_64-linux/vim-native/9.0.0005-r0/sysroot-destdir/work/x86_64-linux/vim-native/9.0.0005-r0/recipe-sysroot-native/usr/share/vim/vim90/tools/mve.awk maximum shebang size exceeded, the maximum size is 128. [shebang-size] ERROR: QA Issue: : /work/x86_64-linux/vim-native/9.0.0005-r0/sysroot-destdir/work/x86_64-linux/vim-native/9.0.0005-r0/recipe-sysroot-native/usr/share/vim/vim90/tools/efm_perl.pl maximum shebang size exceeded, the maximum size is 128. [shebang-size] (From OE-Core rev: 79232458b9cdc741a2049d83839af73f58a5554c) (From OE-Core rev: 671f8cec8ef463d75e9393c5fc03cf913ef9edf6) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2025-48384Praveen Kumar11 days2-0/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-48384 Upstream-patch: https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89 (From OE-Core rev: 34cb9674a5ce337a75af0dc415706d0323c427a6) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2025-8851Yogita Urade11 days2-0/+72
| | | | | | | | | | | | | | | | | | | | | A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8851 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/8a7a48d7a645992ca83062b3a1873c951661e2b3 (From OE-Core rev: 1ced84bbd4ab15f0f16176e367744b496a0ea97c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2025-8534Yogita Urade11 days2-0/+61
| | | | | | | | | | | | | | | | | | | | | | | | | | A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used." Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8534 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736ecc8b (From OE-Core rev: c897368cd363d3e50372ab1fc95bc31f1a883dc4) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2024-13978Yogita Urade11 days2-0/+48
| | | | | | | | | | | | | | | | | | | | | | A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as problematic. Affected by this vulnerability is the function t2p_read_tiff_init of the file tools/tiff2pdf.c of the component fax2ps. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The patch is named 2ebfffb0e8836bfb1cd7d85c059cd285c59761a4. It is recommended to apply a patch to fix this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-13978 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4 (From OE-Core rev: f6ff692be6b08290845b6c6c27eaf5d676476464) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "sqlite3: patch CVE-2025-7458"Steve Sakoman2025-09-013-125/+0
| | | | | | | | | We have found that since this patch SELECT queries with COUNT(DISTINCT(column)) seem to cause sqlite to segfault This reverts commit 4d5093e5103016c08b3a32fd83b1ec9edd87cd5a. Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch regression of patch for CVE-2025-5918Peter Marko2025-08-293-1/+53
| | | | | | | | | | | Picked commit per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-5918 (From OE-Core rev: c947e01b3c27e9f08dc55ee4939d5537318f12e3) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dpkg: patch CVE-2025-6297Peter Marko2025-08-292-0/+126
| | | | | | | | | | | Pick commit per [1] from 1.22.x branch. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-6297 (From OE-Core rev: aaf58c4ad69203a6437362ef130e8ed3ce267e81) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: patch CVE-2025-7039Peter Marko2025-08-293-0/+85
| | | | | | | | | | | | Pick commit per [1]. Also pick commit which changed the same code before to apply it cleanly. [1] https://security-tracker.debian.org/tracker/CVE-2025-7039 (From OE-Core rev: 79355004da104587b2fb40dcb76053431c6a6182) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: ignore CVE-2024-7730Peter Marko2025-08-291-0/+3
| | | | | | | | | | This CVE is for virtio-snd which was introduced in 8.2.0. Therefore ignore this CVE for version 6.2.0. (From OE-Core rev: 93545ef00c4930dd297649934bee0e95c520ee16) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: fix CVE-2025-47807Hitendra Prajapati2025-08-292-0/+50
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/9e2238adc1cad1fba5aad23bc8c2a6c2a65794d2 (From OE-Core rev: 8452fbdee00d27f2390dafa9d2ef14e7458baa70) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Fix for CVE-2025-49180Vijay Anusuri2025-08-293-0/+98
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/3c3a4b767b16174d3213055947ea7f4f88e10ec6 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/0235121c6a7a6eb247e2addb3b41ed6ef566853d (From OE-Core rev: 88abe8ec73f822b461670557539a7df0875325cc) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Fix for CVE-2025-49179Vijay Anusuri2025-08-292-0/+68
| | | | | | | | | | | | | import patch from debian to fix CVE-2025-49179 Upstream-Status: Backport [import from debian xorg-server_21.1.7-3+deb12u10.diff.gz Upstream commit https://gitlab.freedesktop.org/xorg/xserver/-/commit/2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4] (From OE-Core rev: da1b72e407190a81ac3bcc74a0ea51b4160cb5a9) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Fix for CVE-2025-49178Vijay Anusuri2025-08-292-0/+50
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2 (From OE-Core rev: 8d29231af51de235b99be0eeb71dfab41d67589d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: fix CVE-2023-50781Jiaying Song2025-08-297-1/+1806
| | | | | | | | | | | | | | | | | | | | | | | | A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. The CVE-2023-50781 in M2Crypto is addressed by modifying OpenSSL because M2Crypto relies on OpenSSL for its cryptographic operations.The issue stems from OpenSSL’s RSA PKCS#1 v1.5 padding verification being vulnerable to Bleichenbacher-type attacks.To mitigate this, OpenSSL introduced an implicit rejection mechanism in the RSA PKCS#1 v1.5 padding.Therefore, resolving the vulnerability requires changes within OpenSSL itself to ensure M2Crypto’s security. References: https://nvd.nist.gov/vuln/detail/CVE-2023-50781 https://github.com/openssl/openssl/pull/13817/commits https://todo.sr.ht/~mcepl/m2crypto/342?__goaway_challenge=meta-refresh&__goaway_id=45a03d6accb7b343867110db1f7fb334 (From OE-Core rev: d24c4923d6f7a25bdc3ec5d4ac6bee32bb0bae88) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libubootenv: backport patch to fix unknown type name 'size_t'Youngseok Jeong2025-08-222-1/+32
| | | | | | | | | | | | | | | | Fix: ../recipe-sysroot/usr/include/libuboot.h:29:2: error: unknown type name 'size_t' size_t envsize; ^ This error can be avoided by using CXXFLAGS:append = " -include cstddef" but this way would be needed in all recipes that use libuboot.h. Therefore, Backport the patch to include <cstddef> in C++ builds. (From OE-Core rev: e401a16d8e26d25cec95fcea98d6530036cffca1) Signed-off-by: Youngseok Jeong <youngseok1.jeong@lge.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: ignore CVE-2025-4056Peter Marko2025-08-221-0/+3
| | | | | | | | | | | | | | | | | | | | NVD report [1] says: A flaw was found in GLib. A denial of service on **Windows platforms** may occur if an application attempts to spawn a program using long command lines. The fix [3] (linked from [2]) also changes only files glib/gspawn-win32-helper.c glib/gspawn-win32.c [1] https://nvd.nist.gov/vuln/detail/CVE-2025-4056 [2] https://gitlab.gnome.org/GNOME/glib/-/issues/3668 [3] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4570 (From OE-Core rev: 8c69793deb78cf9718801825477938c22e229eca) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2025-27614-CVE-2025-27613-CVE-2025-46334-CVE-2025-46835Hitendra Prajapati2025-08-222-0/+2501
| | | | | | | | | Upstream-Status: Backport from from https://github.com/git/git/commit/d61cfed2c23705fbeb9c0d08f59e75ee08738950 (From OE-Core rev: a24e44f92114f995e034923a62b96947dc99d6e8) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Fix for CVE-2025-49177Vijay Anusuri2025-08-222-0/+55
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab02fb96b1c701c3bb47617d965522c34befa6af (From OE-Core rev: b876a8c8dc9ffe288a41b18a61b4758ec52a115e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Fix for CVE-2025-49176Vijay Anusuri2025-08-223-0/+131
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/03731b326a80b582e48d939fe62cb1e2b10400d9 & https://gitlab.freedesktop.org/xorg/xserver/-/commit/4fc4d76b2c7aaed61ed2653f997783a3714c4fe1 (From OE-Core rev: d1b634ce77b5d47b086a2c757acf50e6e002494b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Fix for CVE-2025-49175Vijay Anusuri2025-08-222-0/+92
| | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/0885e0b26225c90534642fe911632ec0779eebee (From OE-Core rev: 23c1a62bced088cbc5eb31937bbc1e5d864213ab) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: fix CVE-2025-47183 & CVE-2025-47219Hitendra Prajapati2025-08-224-0/+274
| | | | | | | | | | * CVE-2025-47183 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/c4d0f4bbd9a8e97f119a4528b9f4662a6b80922c && https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/d76cae74dad89994bfcdad83da6ef1ad69074332 * CVE-2025-47219 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/b80803943388050cb870c95934fc52feeffb94ac (From OE-Core rev: 0d923b416717d91142cced53961d853007a09daa) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: fix CVE-2025-47806 & CVE-2025-47808Hitendra Prajapati2025-08-223-0/+88
| | | | | | | | | | | | Backport fixes for: * CVE-2025-47806 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/da4380c4df0e00f8d0bad569927bfc7ea35ec37d * CVE-2025-47808 - Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6b19f117518a765a25c99d1c4b09f2838a8ed0c9 (From OE-Core rev: 974670b83970f78edcb9f7d09ba34ec3a327320a) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: Fix manpage build after CVE-2025-4598Dan McGregor2025-08-221-4/+3
| | | | | | | | | | | | The previous fix missed another cherry-pick that fixed building manpages after the coredump patch. The version-info.xml file doesn't exist in 250. It was introduced later, so remove the reference to it. (From OE-Core rev: 0a383ef579ffe5f5c4ef2c78040540f1332e4ea6) Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-helloworld: fix licenseQuentin Schulz2025-08-181-2/+2
| | | | | | | | | | | | | | | The example repo doesn't seem to have ever been under MIT to begin with but rather Apache-2.0. The license file exists in the sources, so use that one instead of taking it from the OE-Core license directory. License-Update: Incorrect license is now proper (From OE-Core rev: 3d1c037a7cb7858a4e3c33a94f5d343a81aac5f7) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnupg: disable tests to avoid running target binaries at build timeGuocai He2025-08-181-0/+1
| | | | | | | | | | | | | | | | | | | | By default, the tests are built and run at do_compile and we can see errors like below in log.do_compile: gnupg-2.3.7/tests/cms/inittests: line 99: ../../sm/gpgsm: cannot execute binary file: Exec format error Note that the do_compile process still succeeds. However, we'd better avoid executing these target binaries at build time. (From OE-Core rev: b02f99a0b82ed55a07c00b32805ad676c04ee4ab) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (master rev: 74d48497470ce209bc6bdf49c2e2cfda67dce6ae) Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: fix CVE-2023-40403Hitendra Prajapati2025-08-186-0/+1044
| | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxslt/-/commit/adebe45f6ef9f9d036acacd8aec7411d4ea84e25 && https://gitlab.gnome.org/GNOME/libxslt/-/commit/1d9820635c271b35f88431f33ea78dc8be349e5b && https://gitlab.gnome.org/GNOME/libxslt/-/commit/ccec6fa31d11ab0a5299f15ea184c7a457e92940 && https://gitlab.gnome.org/GNOME/libxslt/-/commit/82f6cbf8ca61b1f9e00dc04aa3b15d563e7bbc6d && https://gitlab.gnome.org/GNOME/libxslt/-/commit/452fb4ca9b9803448826008b9573987c615912a1 (From OE-Core rev: b77845d6fed5385de5789f8864fc399f82209ea1) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-5918Peter Marko2025-08-184-0/+730
| | | | | | | | | | Pick 2 commits as in scarthgap branch plus one additional precondition to apply those. (From OE-Core rev: e43507dad134c5036be1c79a37f73c34f4fb6292) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2025-0913Peter Marko2025-08-181-1/+1
| | | | | | | | | | | | | | | | | | This is problem on Windows platform only. Per NVD report [1], CPE has "and" clause Running on/with cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Also linked patch [2] changes Windows files only (and tests). [1] https://nvd.nist.gov/vuln/detail/CVE-2025-0913 [2] https://go-review.googlesource.com/c/go/+/672396 (From OE-Core rev: 473da932a8f94b7454e0e13912753a7e7545fc17) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: patch CVE-2025-8194Peter Marko2025-08-182-3/+223
| | | | | | | | | | Pick commit from 3.12 branch mentioned in NVD report. https://nvd.nist.gov/vuln/detail/CVE-2025-8194 (From OE-Core rev: 4ae9daf3d05530952a8b002257dd9afda2e077e4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2025-8177Yogita Urade2025-08-182-0/+36
| | | | | | | | | | | | | | | | | | | | | A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8177 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/e8de4dc1f923576dce9d625caeebd93f9db697e1 (From OE-Core rev: fbf3238630c104c9e17d6e902986358cea5986ff) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2025-8176Yogita Urade2025-08-184-0/+123
| | | | | | | | | | | | | | | | | | | | | | | | A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8176 Upstream patches: https://gitlab.com/libtiff/libtiff/-/commit/3994cf3b3bc6b54c32f240ca5a412cffa11633fa https://gitlab.com/libtiff/libtiff/-/commit/ce46f002eca4148497363f80fab33f9396bcbeda https://gitlab.com/libtiff/libtiff/-/commit/ecc4ddbf1f0fed7957d1e20361e37f01907898e0 (From OE-Core rev: 5dbc4ccce8676b016de8c1393c2f0d0f74eb9337) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.29kirkstone-4.0.29Steve Sakoman2025-08-081-1/+1
| | | | | | (From OE-Core rev: bd620eb14660075fd0f7476bbbb65d5da6293874) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.35 branch updatesPeter Marko2025-08-083-252/+2
| | | | | | | | | | | | | | | | | | | This is a single commit bump containing only CVE fix $ git log --oneline d80401002011f470d9c6eb604bf734715e9b3a8c..a66bc3941ff298e474d5f02d0c3303401951141f a66bc3941f posix: Fix double-free after allocation failure in regcomp (bug 33185) Test results didn't change except newly added test succeeding. (tst-regcomp-bracket-free) Also add CVE-2025-0395 ignore which was already included in previous hash bumps. Also drop an unreferenced patch. (From OE-Core rev: 3921549f6420e44a250d06cdef2c9d423fb6e39f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: ignore CVE-2025-3277Peter Marko2025-08-081-0/+2
| | | | | | | | | | | | | | | The vulnerable code was introduced in 3.44.0 via [1]. (See fix commit [2]) Also Debian says "not vulnerabele yet for 3.40.1 in [3] [1] https://github.com/sqlite/sqlite/commit/e1e67abc5cf67f931aab1e471eda23d73f51d456 [2] https://sqlite.org/src/info/498e3f1cf57f164f [3] https://security-tracker.debian.org/tracker/CVE-2025-3277 (From OE-Core rev: ebacd5cd2827c1a9a45a92353518f9d976597526) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: patch CVE-2025-7458Peter Marko2025-08-083-0/+125
| | | | | | | | | | | | | | Pick patch [1] listed in [2]. Also pick another patch which is precondition to this one introducing variable needed for the check. [1] https://sqlite.org/src/info/12ad822d9b827777 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-7458 (From OE-Core rev: 4d5093e5103016c08b3a32fd83b1ec9edd87cd5a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* avahi: fix CVE-2024-52615Zhang Peng2025-08-082-0/+229
| | | | | | | | | | | | | | | | | | CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: 7bd9fee6d654326ea921b51113de99f793e11545) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: Fix CVE-2025-6965Vijay Anusuri2025-08-042-0/+116
| | | | | | | | | Upstream-Status: Backport from https://github.com/sqlite/sqlite/commit/c52e9d97d485a3eb168e3f8f3674a7bc4b419703 (From OE-Core rev: b4a2f74ba0b40abcdf56c4b58cae5f7ce145d511) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-7545Deepesh Varatharajan2025-08-042-0/+40
| | | | | | | | | | | | | | objcopy: Don't extend the output section size Since the output section contents are copied from the input, don't extend the output section size beyond the input section size. Backport a patch from upstream to fix CVE-2025-7545 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944] (From OE-Core rev: 4f461ed46b7694fc4815c7f0504b9cefe5da8e19) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2025-6170Peter Marko2025-08-042-0/+104
| | | | | | | | | Pick commit referencing this CVE from 2.13 branch. (From OE-Core rev: 9418c88c964dffc21abe6a056db72c3c81e25137) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-6395Peter Marko2025-08-042-0/+300
| | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 3680d0e2021c609f624c2170b061e6696fd8254c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-09-19 13:54:18 +0000