linux/meta-openembedded.git, branch walnascar-next

][PATCH] ufs-utils: fix crash for ufs-utils list_bsg

2025-07-27T18:35:10+00:00

The full_path buffer in find_bsg_device function consists of: path + '/' + files->d_name + '\0' So the buffer size should be: strlen(path) + strlen(files->d_name) + 2, not: strlen(path) + strlen(files->d_name) + 1. Backport a patch to fix crash when running 32-bit binary on 64-bit system: $ ufs-utils list_bsg malloc(): invalid next size (unsorted) Aborted (core dumped) Signed-off-by: Yi Zhao Signed-off-by: Armin Kuster

mariadb: upgrade 11.4.5 -> 11.4.6

2025-07-27T18:35:10+00:00

This upgrade includes fix for CVE-2023-52971 Changelog: https://mariadb.com/kb/en/mariadb-11-4-6-changelog/ refresh 0001-Add-missing-includes-cstdint-and-cstdio.patch Droped 3871.patch and mm_malloc.patch as these are available in 11.4.6 Signed-off-by: Yogita Urade Signed-off-by: Khem Raj Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

mbedtls: upgrade 3.6.3.1 -> 3.6.4

2025-07-27T18:35:10+00:00

Fixes several security vulnerabilities: CVE-2025-49601, CVE-2025-49600, CVE-2025-52496, CVE-2025-47917, CVE-2025-48965, CVE-2025-52497, and CVE-2025-49087 The framework directory has been changed into a git submodule.[1][2] The recipe now uses Git Submodule Fetcher (gitsm) Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.4 [1] https://github.com/Mbed-TLS/mbedtls/commit/8cf5666a174237998a7965e284d7ba8c1655d16d [2] https://github.com/Mbed-TLS/mbedtls/commit/c90c6d8ff787ab8787d9373b0e662a95ed1f4dae Signed-off-by: Guðni Már Gilbert Signed-off-by: Khem Raj Signed-off-by: Armin Kuster

mbedtls: upgrade 3.6.3 -> 3.6.3.1

2025-07-27T18:35:10+00:00

Signed-off-by: Wang Mingyu Signed-off-by: Khem Raj Signed-off-by: Armin Kuster

python3-aiohttp: fix CVE-2025-53643

2025-07-27T18:35:10+00:00

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of aiohttp is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. Version 3.12.14 contains a patch for this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-53643 Signed-off-by: Jiaying Song Signed-off-by: Armin Kuster

python3-tornado: upgrade 6.4.2 -> 6.5

2025-07-27T18:35:10+00:00

Changelog: https://github.com/tornadoweb/tornado/releases/tag/v6.5.0 Signed-off-by: Praveen Kumar Signed-off-by: Armin Kuster

syslog-ng: upgrade 4.8.1 -> 4.8.2

2025-07-27T18:35:10+00:00

Includes fix for CVE-2024-47619 Release notes: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.2 Signed-off-by: Praveen Kumar Signed-off-by: Armin Kuster

poco: patch CVE-2025-6375

2025-07-27T18:35:10+00:00

Pick commit mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-6375 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

minifi-cpp: patch spdlog CVE-2025-6140

2025-07-27T18:35:10+00:00

Same patch as in spdlog recipe. Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

spdlog: patch CVE-2025-6140

2025-07-27T18:35:10+00:00

Pick commit [1] mentioned in [2] as listed in [3]. [1] https://github.com/gabime/spdlog/commit/10320184df1eb4638e253a34b1eb44ce78954094 [2] https://github.com/gabime/spdlog/issues/3360 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-6140 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster