linux/meta-openembedded.git/meta-oe, branch walnascar-next

mariadb: upgrade 11.4.5 -> 11.4.6

2025-07-27T18:35:10+00:00

This upgrade includes fix for CVE-2023-52971 Changelog: https://mariadb.com/kb/en/mariadb-11-4-6-changelog/ refresh 0001-Add-missing-includes-cstdint-and-cstdio.patch Droped 3871.patch and mm_malloc.patch as these are available in 11.4.6 Signed-off-by: Yogita Urade Signed-off-by: Khem Raj Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

syslog-ng: upgrade 4.8.1 -> 4.8.2

2025-07-27T18:35:10+00:00

Includes fix for CVE-2024-47619 Release notes: https://github.com/syslog-ng/syslog-ng/releases/tag/syslog-ng-4.8.2 Signed-off-by: Praveen Kumar Signed-off-by: Armin Kuster

poco: patch CVE-2025-6375

2025-07-27T18:35:10+00:00

Pick commit mentioned in [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-6375 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

minifi-cpp: patch spdlog CVE-2025-6140

2025-07-27T18:35:10+00:00

Same patch as in spdlog recipe. Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

spdlog: patch CVE-2025-6140

2025-07-27T18:35:10+00:00

Pick commit [1] mentioned in [2] as listed in [3]. [1] https://github.com/gabime/spdlog/commit/10320184df1eb4638e253a34b1eb44ce78954094 [2] https://github.com/gabime/spdlog/issues/3360 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-6140 Signed-off-by: Peter Marko Signed-off-by: Armin Kuster

poppler: upgrade 25.04.0 -> 25.06.0

2025-07-27T18:35:10+00:00

Includes fix for CVE-2025-52886 poppler 25.06.0 changelog: ========================== core: * Fix writing dates back to file * Internal code improvements * Fix crashes in malformed documents glib: * Add the ink annotation type * Add missing autopointers definitions utils: * pdfsig: Add assert-signer feature * pdfsig: Return error code on error poppler 25.05.0 changelog: ========================== core: * Fix re-fetching after xref reconstruction. Issue #1584 * Fix compilation with ENABLE_ZLIB_UNCOMPRESS=ON * Various annotation improvements. Issues #642, #1558, #1055 * CairoFontEngine: invalidate broken embedded fonts. Issue #1453 * Splash: Performance improvements * Internal code improvements glib: * Small signature improvements Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

xmlsec1: fix build with gnutls or openssl PACKAGECONFIG not enabled

2025-07-27T18:35:10+00:00

the .pc files might not be installed based on the PACKAGECONFIG value fixes: https://git.openembedded.org/meta-openembedded/commit/?id=cce20b5124e28ee55adf03fe062084f38d065580 Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

udisks2: Hardening measure of CVE-2025-6019

2025-07-06T23:23:22+00:00

Refer [1], CVE-2025-6019 is strongly related to udisk daemon, and this is a hardening measure related to this. [1] https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt [2] https://security-tracker.debian.org/tracker/CVE-2025-6019 [3] https://ubuntu.com/blog/udisks-libblockdev-lpe-vulnerability-fixes-available Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

libblockdev: fix CVE-2025-6019

2025-07-06T23:23:22+00:00

CVE-2025-6019: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. Refer: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

xmlsec1: avoid hardcoded ${RECIPE_SYSROOT} in xmlsec1-gnutls.pc

2025-07-06T23:23:22+00:00

Fix do_package_qa error by removing ${RECIPE_SYSROOT} from the installed xmlsec1-gnutls.pc file. This ensures the generated .pc file does not leak build-time paths, complying with QA checks. Fixes QA error: ERROR: xmlsec1-1.3.7-r0.wr2500 do_package_qa: QA Issue: File /usr/lib/pkgconfig/xmlsec1-gnutls.pc in package xmlsec1-dev contains reference to TMPDIR [buildpaths] Signed-off-by: Jiaying Song Signed-off-by: Armin Kuster