summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* gupnp-igd: add ptest supportkirkstoneGyorgy Sarvari2025-12-062-1/+23
| | | | | | Execution takes around 10 seconds. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* gupnp-av: add ptest supportGyorgy Sarvari2025-12-062-2/+31
| | | | | | | | | | | | It takes around a second to execute the suite. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 65c2f6de55fa662bce0281046ed3f291c414ff82) Adapted to Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* gupnp: add ptest supportGyorgy Sarvari2025-12-062-1/+25
| | | | | | | | | | | It takes almost 50 seconds on my machine to execute. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e7878d69abd4d1cfaad3f5e5ba9cf7ad00f136bd) Adapted to Kirkstone Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* gssdp: add ptest supportGyorgy Sarvari2025-12-062-1/+20
| | | | | | | | | | | It is quick, it finished under 20 seconds on my machine. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 27865a96d576160a0e3a0fda6b7e604f19edbc6c) Adapted to Kirkstone Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: add ptest supportGyorgy Sarvari2025-12-062-2/+46
| | | | | | | | | | | | | | It takes under 10 seconds to run the suite. Executed succesfully on x86-64, with musl and glibc. The recipe requires pam DISTRO_FEATURE to be present. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 54ca51b6c6c90ad464a488e1ee271d3fff708955) Adapted to Kirkstone Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23493Gyorgy Sarvari2025-12-062-0/+34
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23493 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23484Gyorgy Sarvari2025-12-062-0/+32
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23484 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23483Gyorgy Sarvari2025-12-062-0/+66
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23483 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23481Gyorgy Sarvari2025-12-062-0/+47
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23481 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23480Gyorgy Sarvari2025-12-063-0/+412
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23480 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23479Gyorgy Sarvari2025-12-062-0/+84
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23479 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23478Gyorgy Sarvari2025-12-062-0/+86
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23478 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23477Gyorgy Sarvari2025-12-062-0/+39
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23477 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: patch CVE-2022-23468Gyorgy Sarvari2025-12-062-0/+35
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23468 Pick the patch that mentions this vulnerability explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xrdp: upgrade 0.9.18 -> 0.9.18.1Gyorgy Sarvari2025-12-061-1/+1
| | | | | | | | Contains fix for CVE-2022-23613 Changelog: https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.18.1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2025-32873Saravanan2025-12-054-0/+219
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32873 Upstream-patch: https://github.com/django/django/commit/9cd8028f3e38dca8e51c1388f474eecbe7d6ca3c/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-53907Saravanan2025-12-052-0/+125
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-53907 Upstream-patch: https://github.com/django/django/commit/790eb058b0716c536a2f2e8d1c6d5079d776c22b/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-41991Saravanan2025-12-052-0/+144
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41991 Upstream-patch: https://github.com/django/django/commit/efea1ef7e2190e3f77ca0651b5458297bc0f6a9f/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* scsirastools: Fix build with usrmergeKhem Raj2025-12-021-1/+1
| | | | | | Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 4448cd9ee7e62de0a2787110256c8c0cabb941ee) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* gradm: fix installation with usrmerge enabledGyorgy Sarvari2025-12-022-0/+71
| | | | | | | | | | | | | In case usrmerge DISTRO_FEATURE is enabled, the recipe installs its binaries into /sbin folder, which however supposed to be a symlink to /usr/sbin folder, thus ultimately failing the installation. To avoid this problem, backport a patch from master branch that allows specifying the installation location. This is a partial backport of 682657248c654c54ac87edc9bf0a95fb59ff0b1e Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* babeld: fix installation with usrmergeGyorgy Sarvari2025-12-021-1/+1
| | | | | | | | | | | | In case usrmerge DISTRO_FEATURE is enabled, the recipe installed the application to /bin folder, which is however a symlink to /usr/bin, so the installation ultimately failed. To fix this, set the correct prefix for the installation. This is a partial backport of f91983f1f3e897d25ab477fdfb5baed89ccc0daf Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fontforge: patch CVE-2024-25081 and CVE-2024-25082Gyorgy Sarvari2025-11-302-0/+182
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-25081 https://nvd.nist.gov/vuln/detail/CVE-2024-25082 The same patch fixes both vulnerabilities. Take the patch from the pull request that is referenced by the nv report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fontforge: patch CVE-2020-5395, CVE-2020-25690 and CVE-2020-5496Gyorgy Sarvari2025-11-303-1/+116
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-5395 https://nvd.nist.gov/vuln/detail/CVE-2020-25690 https://nvd.nist.gov/vuln/detail/CVE-2020-5496 The same patch fixes all three. The patch for CVE-2020-25690 is mentioned in the RedHat bug, which is referenced in the nvd report. The patch for CVE-2020-5395 is mentioned in the Github issue that is referenced in the nvd report. The patch for CVE-2020-5496 is mentioned in the comments of the issue that is linked in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fontforge: ignore CVE-2019-15785Gyorgy Sarvari2025-11-301-0/+3
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2019-15785 The vulnerability is not present in the currently used version, so ignore it. Current version: 20190801 First vulnerable version: 20190813 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* yasm: patch CVE-2021-33456Gyorgy Sarvari2025-11-302-0/+36
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33465 The patch was taken from Debian: https://sources.debian.org/patches/yasm/1.3.0-8/1020-hash-null-CVE-2021-33456.patch/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1e2731fce05d15020fddf3dca5d8ee42ec3c04e1)
* yasm: patch CVE-2021-33464Gyorgy Sarvari2025-11-302-0/+35
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33464 The patch was taken from Debian: https://sources.debian.org/patches/yasm/1.3.0-8/1010-nasm-pp-no-env-CVE-2021-33464.patch/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 66a0b01b52e5d1cd2af4c41ae0b67541464874e6)
* yasm: patch CVE-2023-29579Gyorgy Sarvari2025-11-302-1/+41
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-29579 The patch was taken from Debian: https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cc30757a7fd0af5f60b9a6408b3eb94c0810acda)
* yasm: add alternative CVE_PRODUCTGyorgy Sarvari2025-11-301-0/+2
| | | | | | | | | | | | | | There are multiple vendors for yasm: $ sqlite3 ./nvdcve_2-2.db "select distinct vendor, product from products where product = 'yasm';" tortall|yasm yasm_project|yasm Both products refer to the same application Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 93f85e4fd2fb124cb047f6b378cf0052a1f102aa)
* python3-django: fix CVE-2024-39330Saravanan2025-11-304-0/+367
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39330 Upstream-patch: https://github.com/django/django/commit/2b00edc0151a660d1eb86da4059904a0fc4e095e Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-39329Saravanan2025-11-304-0/+227
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-39329 Upstream-patch: https://github.com/django/django/commit/156d3186c96e3ec2ca73b8b25dc2ef366e38df14 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2025-57833Saravanan2025-11-304-0/+207
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-57833 Upstream-patch: https://github.com/django/django/commit/31334e6965ad136a5e369993b01721499c5d1a92 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-56374Saravanan2025-11-304-0/+625
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-56374 Upstream-patch: https://github.com/django/django/commit/ad866a1ca3e7d60da888d25d27e46a8adb2ed36e Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2025-26699Saravanan2025-11-304-0/+217
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-26699 Upstream-patch: https://github.com/django/django/commit/e88f7376fe68dbf4ebaf11fad1513ce700b45860 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2024-27351Saravanan2025-11-302-0/+150
| | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-27351 Upstream-patch: https://github.com/django/django/commit/072963e4c4d0b3a7a8c5412bc0c7d27d1a9c3521 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: upgrade 4.2.17 -> 4.2.26Saravanan2025-11-303-14/+22
| | | | | | | | | | | | | | | | | | | | Fixes CVE-2025-64459, CVE-2025-64458, CVE-2025-59682, CVE-2025-59681, CVE-2025-57833, CVE-2025-48432, CVE-2025-32873, CVE-2025-26699, CVE-2024-56374 and other bug fixes. Release notes: https://docs.djangoproject.com/en/dev/releases/4.2.18/ https://docs.djangoproject.com/en/dev/releases/4.2.19/ https://docs.djangoproject.com/en/dev/releases/4.2.20/ https://docs.djangoproject.com/en/dev/releases/4.2.21/ https://docs.djangoproject.com/en/dev/releases/4.2.22/ https://docs.djangoproject.com/en/dev/releases/4.2.23/ https://docs.djangoproject.com/en/dev/releases/4.2.24/ https://docs.djangoproject.com/en/dev/releases/4.2.25/ https://docs.djangoproject.com/en/dev/releases/4.2.26/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: upgrade 3.2.23 -> 3.2.25Saravanan2025-11-301-2/+2
| | | | | | | | | | | Fixes CVE-2024-27351, CVE-2024-24680 and other bugfixes. Release notes: https://docs.djangoproject.com/en/dev/releases/3.2.24/ https://docs.djangoproject.com/en/dev/releases/3.2.25/ Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: patch CVE-2025-43964Gyorgy Sarvari2025-11-302-0/+26
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-43964 Pick the patch that is referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: patch CVE-2025-43963Gyorgy Sarvari2025-11-302-0/+37
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-43963 Pick the patch that is referenced in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: patch CVE-2025-43961 and CVE-2025-43962Gyorgy Sarvari2025-11-302-0/+105
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-43961 https://nvd.nist.gov/vuln/detail/CVE-2025-43962 Pick the patch that is mentioned by the nvd reports - the same patch fixes both vulnerabilities. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: patch CVE-2023-1729Gyorgy Sarvari2025-11-302-1/+28
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1729 Pick the patch that is mentioned to solve the issue in the issue linked from the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: ignore CVE-2020-35535Gyorgy Sarvari2025-11-301-0/+1
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35535 The fix is already included in the used revision. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: ignore CVE-2020-35534Gyorgy Sarvari2025-11-301-0/+1
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35534 The fix is already included in the currently used revision. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: ignore CVE-2020-35533Gyorgy Sarvari2025-11-301-1/+6
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35533 The fix is already included in the currently used revision. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: ignore CVE-2020-35532Gyorgy Sarvari2025-11-301-1/+1
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35532 The fix is already included in the currently used revision. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: ignore CVE-2020-35531Gyorgy Sarvari2025-11-301-2/+2
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35531 The fix is already included in the currently used revision. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libraw: ignore CVE-2020-35530Gyorgy Sarvari2025-11-301-0/+3
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35530 The fix is already included in the currently used revision. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tigervnc: ignore CVE-2014-8241Gyorgy Sarvari2025-11-301-0/+3
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2014-8241 The vulnerability is about a potential null-pointer dereference, because of a malloc result is not verified[1]. The vulnerable code has been refactored since completely[2], and the code isn't present anymore in the codebase. [1]: https://github.com/TigerVNC/tigervnc/issues/993#issuecomment-612874972 - attachment [2]: https://github.com/TigerVNC/tigervnc/commit/b8a24f055f1a29886d8b18bb3f0902144dc5bd14 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libao: ignore CVE-2017-11548Gyorgy Sarvari2025-11-301-0/+3
| | | | | | | | | | | | | | | | | Both Suse[1] and Debian[2] disputes that this is a vulnerability in libao. Based on their investigation while an issue exists, it is not in libao, however higher in the audio-toolchain, most likely in libmad or mpg321. There seem to be nothing to be fixed about this in libao - ignore this CVE due to this. [1]: https://bugzilla.suse.com/show_bug.cgi?id=1081767 [2]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870608 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a993eb8b93f16e3a16c9a1ab2eb0939cb2331593) Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cockpit: set correct CVE_PRODUCTGyorgy Sarvari2025-11-301-0/+2
| | | | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit af4df551eec582844a8b56154117915ace1596cd)
* libde265: patch CVE-2022-1253Gyorgy Sarvari2025-11-302-1/+37
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-1253 Pick the patch from the nvd report. The patch is only partially backported, because part of the vulnerable code was introuced only in a later version. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-28 16:51:28 +0000