linux/meta-openembedded.git/meta-oe/recipes-support, branch scarthgap

nss: Fix CVE-2026-2781

2026-05-21T04:26:15+00:00

Pick patch from [1] as 3.9X upstream mirror backport of [2] mentioned in Debian report in [3]. [1] https://github.com/nss-dev/nss/commit/870d3b013e6b39540d14e67b3db89da5a96381bf [2] https://hg-edge.mozilla.org/projects/nss/rev/245385e16fa6 [3] https://security-tracker.debian.org/tracker/CVE-2026-2781 Signed-off-by: Hugo SIMELIERE (Schneider Electric) Reviewed-by: Bruno VERNAY Signed-off-by: Anuj Mittal

libssh: set status for CVE-2025-14821

2026-05-21T03:27:48+00:00

The vulnerability is Windows-specific and depends on loading configuration from C:\etc, which does not apply to Linux/Yocto builds Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-14821 https://github.com/advisories/GHSA-5jf9-8f86-jhvw https://www.libssh.org/security/advisories/CVE-2025-14821.txt Signed-off-by: Sudhir Dumbhare Signed-off-by: Anuj Mittal

lcms: patch CVE-2026-42798

2026-05-21T03:27:46+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-42798 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

lcms: patch CVE-2026-41254

2026-05-21T03:27:46+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2026-41254 Backport the patches referenced by the NVD advisory. Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

onig: Add CVE_PRODUCT to support product name

2026-05-21T03:27:43+00:00

- Set CVE_PRODUCT to align with the NVD CPE and ensure correct CVE reporting. Signed-off-by: Het Patel Signed-off-by: Khem Raj (cherry picked from commit 7bc5268662f1428bdbca08e14d223aa6b62e87f3) Signed-off-by: Himanshu Jadon Signed-off-by: Anuj Mittal

onig: fix gcc 15 build

2026-04-29T07:26:07+00:00

With backport from upstream 6.9.10. Signed-off-by: Mikko Rapeli Signed-off-by: Anuj Mittal

libssh: Fix CVE-2026-0965

2026-04-29T04:44:29+00:00

Backport the patch [1] as mentioned in [2] [1] https://git.libssh.org/projects/libssh.git/commit/?id=bf390a042623e02abc8f421c4c5fadc0429a8a76 [2] https://security-tracker.debian.org/tracker/CVE-2026-0965 Ptests passed: root@qemux86:~# ptest-runner libssh START: ptest-runner 2026-04-28T04:44 BEGIN: /usr/lib/libssh/ptest ... ... DURATION: 269 END: /usr/lib/libssh/ptest 2026-04-28T04:49 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libssh: patch CVE-2026-0967

2026-04-29T04:44:29+00:00

Backport patch [1] as mentioned in [2] [1] https://git.libssh.org/projects/libssh.git/commit/?id=6d74aa6138895b3662bade9bd578338b0c4f8a15 [2] https://security-tracker.debian.org/tracker/CVE-2026-0967 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

libssh: patch CVE-2026-0968

2026-04-29T04:44:29+00:00

Backport patches [1] and [2] as mentioned in [3] [1] https://git.libssh.org/projects/libssh.git/commit/?id=796d85f786dff62bd4bcc4408d9b7bbc855841e9 [2] https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03 [3] https://security-tracker.debian.org/tracker/CVE-2026-0968 Certain functions from sftp.c were moved to a new file sftp_common.c in version 0.11.0 by following commit: https://git.libssh.org/projects/libssh.git/commit/src/sftp_common.c?id=c3e03ab4651e4f3382e3a51c0273ade894f0c48a This is the backport of the changes using the original file sftp.c Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal

opensc: patch CVE-2025-66215

2026-04-29T04:44:29+00:00

Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66215 Backport the patches referenced by the PR[1] mentioned in the nvd. Dropped the formatting commit from the backport. [1] https://github.com/OpenSC/OpenSC/pull/3436 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal