Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=styhead 2025-02-25T13:45:21+00:00 2025-02-25T13:45:21+00:00 Peter Kjellerstedt peter.kjellerstedt@axis.com 2025-02-11T00:09:54+00:00 urn:sha1:ce59141da8a891706d55d580fe0ace42b8d4c07b Rewrite ebtables-legacy-save to avoid using bashisms. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> 2025-01-16T14:17:32+00:00 Peter Marko peter.marko@siemens.com 2024-12-20T15:36:28+00:00 urn:sha1:528404955f09b85fbebbcab1e900f8190c14531f Solves CVE-2024-9781 Release notes: https://www.wireshark.org/docs/relnotes/wireshark-4.2.7.html https://www.wireshark.org/docs/relnotes/wireshark-4.2.8.html Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 2d3988f7b611f0ccf0ea4dff8fb7bd15b4dc8860) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2025-01-16T14:17:32+00:00 Peter Marko peter.marko@siemens.com 2024-12-19T20:49:00+00:00 urn:sha1:89723804873935d11bd7892794a494edd8750060 Per [1] this is a problem of applications using memcached inproperly. This should not be a CVE against php-memcached, but for whatever software the issue was actually found in. php-memcached and libmemcached provide a VERIFY_KEY flag if they're too lazy to filter untrusted user input. [1] https://github.com/php-memcached-dev/php-memcached/issues/519 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 889ccce6848276fa68b3736b345552a533bc6bd2) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2025-01-16T14:17:32+00:00 Peter Marko peter.marko@siemens.com 2024-12-19T20:48:57+00:00 urn:sha1:2c4308f0d81b596d93de5575aa2e82da73dd7f7a It is fixed by [1] since 0.15.3. NVD tracks this CVE as version-less. [1] https://cgit.freedesktop.org/spice/spice-gtk/commit/?id=efbf867bb88845d5edf839550b54494b1bb752b9 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7e17f8cec02d20813fb8368ccc1c5ae27b291383) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2025-01-16T14:17:32+00:00 Peter Marko peter.marko@siemens.com 2024-12-19T20:48:53+00:00 urn:sha1:3bca579274f5ff8fce35dffb686502ef08f4973b NVD tracks this as version-less CVE for spice. It was fixed by [1] and [2] included in 0.13.2. [1] https://gitlab.freedesktop.org/spice/spice/-/commit/6b32af3e1746988bb5a5123263bcf61b65e5be7e [2] https://gitlab.freedesktop.org/spice/spice/-/commit/359ac42a7ac02dcd1013757559292006647cd5c4 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 073e8452748132a93103e5db32dc9980c84d201c) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2025-01-16T14:17:32+00:00 Benjamin Bouvier benjamin.bouvier@ekinops.com 2024-12-13T07:47:32+00:00 urn:sha1:a6aa620c1acd41184da2c4dcb975268ce4eb0f49 Add exact CPE name (from NVD database) in CVE_PRODUCT in order to ensure CVE filtering and not be disturb by futur potential false-positive CVEs. Signed-off-by: Benjamin Bouvier <benjamin.bouvier@ekinops.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d03002f19cc56a7386db5a88217c59ea71fded05) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2025-01-16T14:17:32+00:00 Ghislain Mangé ghislain.mange@smile.fr 2024-12-02T10:58:47+00:00 urn:sha1:df6844bc84e8ce3cf39ad4d548a099867c11b0ee Conditionnal inherit may be missed when PACKAGECONFIG qt5 is activated after this inherit, eg in .bbappend. see patch [0] [0]: https://lists.openembedded.org/g/bitbake-devel/message/16815 Reviewed-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Ghislain Mangé <ghislain.mange@smile.fr> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 97318e27ebf9f528acf77fb0759c332bd83adb4b) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2025-01-16T14:17:32+00:00 Peter Marko peter.marko@siemens.com 2024-12-10T18:52:23+00:00 urn:sha1:7070f90c863f478388cd58390bd3e5225523da52 This ancient CVE [1] is unversioned ("*") in NVD DB. "mod_sqlpw module in ProFTPD does not reset a cached password..." Looking at history and changelog, the module was removed [2] around the time when this CVE was published, likely as reaction to this CVE. "mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the distribution. They are currently unmaintained and have numerous bugs." Note: It was later re-introduced as mod_sql when it got fixed under new maintainer. [1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027 [2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 03a1b56bc7ce88a3b0ad6790606b0498899cc1e3) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2024-11-19T21:13:29+00:00 Jeroen Knoops jeroen.knoops@philips.com 2024-10-17T10:53:45+00:00 urn:sha1:826a94028262fdebb60566c95fae7b546057b08d Default branch is renamed from `master` to `main`. Commitshas are the same. Signed-off-by: Jeroen Knoops <jeroen.knoops@philips.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 58679b6a515b51d28c480836ad598fca6f0cc655) Signed-off-by: Armin Kuster <akuster808@gmail.com> 2024-11-19T21:13:29+00:00 Jiaying Song jiaying.song.cn@windriver.com 2024-10-18T06:59:47+00:00 urn:sha1:c857fa458f5f4ce155fdb84bbc70953ac804f93b Change the SRC_URI to the correct value due to the following error: WARNING: wireguard-tools-1.0.20210914-r0 do_fetch: Failed to fetch URL git://git.zx2c4.com/wireguard-tools;branch=master, attempting MIRRORS if available Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bc29ed7b10795773fccef2839cfbfc23cd2e115d) Signed-off-by: Armin Kuster <akuster808@gmail.com>