linux/meta-openembedded.git/meta-oe/recipes-connectivity, branch scarthgap

krb5: Backport additional fixes to build on clang

2026-04-29T04:44:29+00:00

Enabling additional warning tightens the function prototype checks and clang goes a step ahead to flag void foo() as well it should be void foo(void) Signed-off-by: Khem Raj Cc: Martin Jansa (cherry picked from commit 37cc472e44ef5b2b8c0ae8b5bcebf875fa9dd5be) Signed-off-by: Deepak Rathore Signed-off-by: Anuj Mittal

krb5: fix build with gcc-15

2026-03-24T10:21:50+00:00

* fixes: http://errors.yoctoproject.org/Errors/Details/848727/ ss_internal.h:88:6: error: conflicting types for 'ss_delete_info_dir'; have 'void(void)' 88 | void ss_delete_info_dir(); | ^~~~~~~~~~~~~~~~~~ ... Signed-off-by: Martin Jansa Signed-off-by: Khem Raj (cherry picked from commit f26536c2f6f0617610fca95e5bb6953e843f9288) Signed-off-by: Anuj Mittal

linuxptp: add missing prefix to CVE ID

2026-01-26T04:34:40+00:00

The ID should be in the CVE-YYYY-NNNNN format, as in the other CVE_STATUS[] settings. Add 'CVE-' to avoid potential parsing errors in tools that provide CVE scaning/analysis. Signed-off-by: João Marcos Costa Signed-off-by: Anuj Mittal

libwebsockets: ignore CVE-2025-1866

2026-01-12T02:42:23+00:00

Only affects Windows and can be ignored. Details: https://nvd.nist.gov/vuln/detail/CVE-2025-1866 Signed-off-by: Anuj Mittal

krb5: ignore CVE-2025-3576

2026-01-12T02:42:22+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-3576 As mentioned[1], vulnerability is fixed since upstream 1.21 [1] https://security-tracker.debian.org/tracker/CVE-2025-3576 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

zabbix: patch CVE-2025-49643

2025-12-30T01:38:15+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49643 The actual patch was identified by checking the file that was modified in the tag 6.0.42, and also by looking at the Jira item referenced by it: the patch references DEV-4466, the same ID that is referenced in the Jira ticket[1] referenced by the NVD report (look in the "All Activity" tab). [1]: https://support.zabbix.com/browse/ZBX-27284 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal

krb5: fix for CVE-2024-3596

2025-12-30T01:38:11+00:00

Upstream-Status: Backport from https://github.com/krb5/krb5/commit/871125fea8ce0370a972bf65f7d1de63f619b06c Signed-off-by: Hitendra Prajapati Signed-off-by: Anuj Mittal

libwebsockets: fix CVE-2025-11678

2025-11-21T05:36:18+00:00

Backport a fix from Debian: https://sources.debian.org/patches/libwebsockets/4.3.5-1+deb13u1/CVE-2025-11678.patch Upstream commit: https://github.com/warmcat/libwebsockets/commit/2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a Signed-off-by: Bruno VERNAY Signed-off-by: Hugo SIMELIERE Signed-off-by: Anuj Mittal

libwebsockets: fix CVE-2025-11677

2025-11-21T05:36:17+00:00

Backport a fix from Debian: https://sources.debian.org/patches/libwebsockets/4.3.5-1+deb13u1/CVE-2025-11677.patch Upstream commit: https://github.com/warmcat/libwebsockets/commit/2f082ec31261f556969160143ba94875d783971a Signed-off-by: Bruno VERNAY Signed-off-by: Hugo SIMELIERE Signed-off-by: Anuj Mittal

linuxptp: ignore CVE-2024-42861

2025-11-17T06:20:20+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2024-42861 The vulnerability report is considered to be bogus and a non-issue (or at least not a security issue) by upstream[1] and by major Linux distros[2][3][4]. [1]: https://lists.nwtime.org/sympa/arc/linuxptp-devel/2024-09/msg00080.html [2]: Ubuntu: https://ubuntu.com/security/CVE-2024-42861 [3]: Debian: https://security-tracker.debian.org/tracker/CVE-2024-42861 [4]: Suse: https://bugzilla.suse.com/show_bug.cgi?id=1230935 Signed-off-by: Gyorgy Sarvari Signed-off-by: Anuj Mittal