Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=walnascar 2025-10-13T07:21:31+00:00 2025-10-13T07:21:31+00:00 Gyorgy Sarvari skandigraun@gmail.com 2025-10-08T14:47:57+00:00 urn:sha1:f47fdfd73090c996f4edf9c7921bc07bbdffd908 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-55304 Backport patch mentioned in the details of the vulnerability. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2025-10-13T07:21:31+00:00 Gyorgy Sarvari skandigraun@gmail.com 2025-10-08T14:47:56+00:00 urn:sha1:40036aa47ad24659d20643195525310fc5fce123 Details: https://nvd.nist.gov/vuln/detail/CVE-2025-54080 Backport the patch mentioned in the details. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2025-10-13T07:21:31+00:00 Gyorgy Sarvari skandigraun@gmail.com 2025-10-08T14:47:55+00:00 urn:sha1:7907a3e206fb049e609996df8d09141bfb291fcd Details: https://nvd.nist.gov/vuln/detail/CVE-2025-26623 Apply the first to PRs from the relevant issue. (The second PR adds a test, and the 3rd PR tries to reimplement correctly the feature that introduced the vulnerability: it is switching some raw pointers to smart pointers. It was not picked because the 1. In the original issue it is stated that the first PR itself fixes the vulnerability 2. The patch doesn't apply clean due to the time gap between our and their version 3. The behavior of the application does not change ) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> 2024-07-14T19:06:20+00:00 alperak alperyasinak1@gmail.com 2024-07-12T08:06:41+00:00 urn:sha1:9f4361418d58941d058fb94a3671b9d0904b6300 Release Notes: * https://github.com/Exiv2/exiv2/issues/3008 * https://github.com/Exiv2/exiv2/milestone/14?closed=1 This release also fixes a low-severity security issue in asfvideo.cpp: * [CVE-2024-39695](https://github.com/Exiv2/exiv2/security/advisories/GHSA-38rv-8x93-pvrh): out-of-bounds read in AsfVideo::streamProperties. This vulnerability is in a new feature (ASF video) that was added in version 0.28.0, so earlier versions of Exiv2 are not affected. Signed-off-by: alperak <alperyasinak1@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2024-06-27T16:18:48+00:00 Markus Volk f_l_k@t-online.de 2024-06-24T19:55:53+00:00 urn:sha1:3a9fc5ba68d8c121e70c018d4f4a782693def40b - Remove outdated comment - Switch to git fetcher. Otherwise the official download location leads to: WARNING: exiv2-0.28.2-r0 do_recipe_qa: QA Issue: exiv2: SRC_URI uses unstable GitHub/GitLab archives, convert recipe to use git protocol [src-uri-bad] - Remove reproducibility hack. Theres no buildpath leakage in exiv2Config.cmake anymore. Changes from version 0.28.1 to 0.28.2 ------------------------------------- Release Notes: * https://github.com/Exiv2/exiv2/issues/2914 * https://github.com/Exiv2/exiv2/milestone/13?closed=1 This release also fixes two low-severity security issues in quicktimevideo.cpp: * [CVE-2024-24826](https://github.com/Exiv2/exiv2/security/advisories/GHSA-g9xm-7538-mq8w): out-of-bounds read in QuickTimeVideo::NikonTagsDecoder. * [CVE-2024-25112](https://github.com/Exiv2/exiv2/security/advisories/GHSA-crmj-qh74-2r36): denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder. These vulnerabilities are in a new feature (quicktime video) that was added in version 0.28.0, so earlier versions of Exiv2 are not affected. Changes from version 0.28.0 to 0.28.1 ------------------------------------- Release Notes: https://github.com/Exiv2/exiv2/issues/2813 This release also fixes [CVE-2023-44398](https://github.com/Exiv2/exiv2/security/advisories/GHSA-hrw9-ggg3-3r4r), an out-of-bounds write in `BmffImage::brotliUncompress`. The vulnerability is in new code that was added in version 0.28.0, so earlier versions of Exiv2 are not affected. Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2023-09-23T06:57:50+00:00 Markus Volk f_l_k@t-online.de 2023-09-23T00:10:26+00:00 urn:sha1:26321acb6eca2a9fce2506eb3db02b76ee988ef8 - add required dependencies on brotli and libinih Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2023-01-21T18:02:02+00:00 Khem Raj raj.khem@gmail.com 2023-01-17T19:27:49+00:00 urn:sha1:00a7d4b284c1afccfa26021111384d2184b82e5b Drop backported patches Signed-off-by: Khem Raj <raj.khem@gmail.com> 2022-09-15T06:51:48+00:00 Lei Maohui leimaohui@fujitsu.com 2022-09-15T05:07:52+00:00 urn:sha1:8f05d9c2dbc4da5e458eec354b5b2d9749bbbfc8 Remove the build path from file exiv2Config.cmake. Signed-off-by: Lei Maohui <leimaohui@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> 2022-03-05T01:41:45+00:00 Khem Raj raj.khem@gmail.com 2022-03-04T08:44:20+00:00 urn:sha1:14c7d8a0d7cb843ac8b0d25cc4170fa640ac1295 Signed-off-by: Khem Raj <raj.khem@gmail.com> 2021-05-19T16:17:49+00:00 wangmy wangmy@fujitsu.com 2021-05-18T08:08:00+00:00 urn:sha1:a9aecd2c32fc8f238f62ef70813e032b6b52c2f2 References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29473 The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file. An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2, if they can trick the victim into running Exiv2 on a crafted image file. Upstream-Status: Accepted [https://github.com/Exiv2/exiv2/pull/1587/commits/e6a0982f7cd9282052b6e3485a458d60629ffa0b] CVE: CVE-2021-29473 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com>