linux/meta-openembedded.git/meta-oe/recipes-support, branch scarthgap-next

poco: patch CVE-2025-6375

2025-08-02T17:37:04+00:00

Pick commit mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-6375 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

poco: ignore additional failing tests

2025-08-02T17:37:04+00:00

These tests are failing and thus preventing verification of new patches. Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

spdlog: patch CVE-2025-6140

2025-08-02T17:37:04+00:00

Pick commit [1] mentioned in [2] as listed in [3]. [1] https://github.com/gabime/spdlog/commit/10320184df1eb4638e253a34b1eb44ce78954094 [2] https://github.com/gabime/spdlog/issues/3360 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-6140 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

poppler: fix CVE-2025-52886

2025-08-02T17:37:04+00:00

Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-52886 https://security-tracker.debian.org/tracker/CVE-2025-52886 Upstream patches: https://gitlab.freedesktop.org/poppler/poppler/-/commit/3449a16d3b1389870eb3e20795e802c6ae8bc04f https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

libssh: fix CVE-2025-5351 & CVE-2025-5372

2025-08-02T17:37:04+00:00

* CVE-2025-5351 - Upstream-Status: Backport from https://git.libssh.org/projects/libssh.git/commit/?id=6ddb730a27338983851248af59b128b995aad256 * CVE-2025-5372 - Upstream-Status: Backport from https://git.libssh.org/projects/libssh.git/commit/?id=a9d8a3d44829cf9182b252bc951f35fb0d573972 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster

udisks2: Hardening measure of CVE-2025-6019

2025-07-06T23:47:17+00:00

Refer [1], CVE-2025-6019 is strongly related to udisk daemon, and this is a hardening measure related to this. [1] https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt [2] https://security-tracker.debian.org/tracker/CVE-2025-6019 [3] https://ubuntu.com/blog/udisks-libblockdev-lpe-vulnerability-fixes-available Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

libssh: fix CVE-2025-5318

2025-07-06T23:46:54+00:00

Upstream-Status: Backport from https://git.libssh.org/projects/libssh.git/commit/?id=5f4ffda88770f95482fd0e66aa44106614dbf466 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster

imagemagick: guard sed operations in do_install for optional files

2025-06-23T21:03:24+00:00

When PACKAGECONFIG options like 'cxx' 'webp' and 'xml' are disabled, certain files such as Magick++-config.im7, configure.xml, or delegates.xml are not installed. Unconditionally running sed on these files results in errors during do_install Error: sed: can't read .../image/usr/bin/Magick++-config.im7: No such file or directory Signed-off-by: Nikhil R Signed-off-by: Sana Kazi Signed-off-by: Armin Kuster

syslog-ng: fix CVE-2024-47619

2025-05-21T13:17:17+00:00

syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-47619 Upstream patch: https://github.com/syslog-ng/syslog-ng/commit/12a0624e4c275f14cee9a6b4f36e714d2ced8544 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

poppler: fix CVE-2025-43903

2025-05-17T18:20:48+00:00

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. CVE-2025-43903-0001 is the dependent commit and CVE-2025-43903-0002 is the actual CVE fix. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-43903 Upstream patches: https://gitlab.freedesktop.org/poppler/poppler/-/commit/33672ca1b6670f7378e24f6d475438f7f5d86b05 https://gitlab.freedesktop.org/poppler/poppler/-/commit/f1b9c830f145a0042e853d6462b2f9ca4016c669 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster