summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* postgresql: upgrade 16.12 -> 16.14scarthgapAnkur Tyagi2026-05-257-35/+17
| | | | | | | | | | | Also refreshed patches to resolve patch fuzz QA issue. Bug fix releases https://www.postgresql.org/docs/release/16.13/ https://www.postgresql.org/docs/release/16.14/ Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-backports-zstd: add recipeJérémie Dautheribes (Schneider Electric )2026-05-253-0/+90
| | | | | | | | | | | | This recipe was previously part of the master branch but was removed because the zstd module was integrated into the Python standard library starting from Python 3.14. Since Scarthgap uses Python 3.12, restore and update this recipe for users on this branch. Signed-off-by: Jérémie Dautheribes (Schneider Electric) <jeremie.dautheribes@bootlin.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: patch CVE-2026-42946Theo Gaige (Schneider Electric)2026-05-213-0/+139
| | | | | | | | | | | | | | Backport patches [1] and [2] mentioned in [3]. [1] https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e [2] https://github.com/nginx/nginx/commit/39d7d0ba0799fcff6baee52b6525f45739593cfd [3] https://security-tracker.debian.org/tracker/CVE-2026-42946 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: patch CVE-2026-42945Theo Gaige (Schneider Electric)2026-05-212-0/+47
| | | | | | | | | | | | Backport patch [1] mentioned in [2]. [1] https://github.com/nginx/nginx/commit/524977e7c534e87e5b55739fa74601c9f1102686 [2] https://security-tracker.debian.org/tracker/CVE-2026-42945 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: patch CVE-2026-42934Theo Gaige (Schneider Electric)2026-05-212-0/+80
| | | | | | | | | | | | Backport patch [1] mentioned in [2]. [1] https://github.com/nginx/nginx/commit/54b7945961b2eaafc480d6b85d9635d0db1c126a [2] https://security-tracker.debian.org/tracker/CVE-2026-42934 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: patch CVE-2026-40701Theo Gaige (Schneider Electric)2026-05-212-0/+74
| | | | | | | | | | | | Backport patch [1] mentioned in [2]. [1] https://github.com/nginx/nginx/commit/d2b8d47741820c9fb134c6731ecb40b21f3085b1 [2] https://security-tracker.debian.org/tracker/CVE-2026-40701 Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dnsmasq: Fix CVE-2026-5172Hugo SIMELIERE (Schneider Electric)2026-05-212-0/+40
| | | | | | | | | | Pick patch from [1] dnsmasq 2.90 debian bookworm pacthes. [1] https://sources.debian.org/src/dnsmasq/2.90-4~deb12u2/debian/patches/CVE-2026-5172.patch Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dnsmasq: Fix CVE-2026-4893Hugo SIMELIERE (Schneider Electric)2026-05-212-0/+39
| | | | | | | | | | Pick patch from [1] dnsmasq 2.90 debian bookworm pacthes. [1] https://sources.debian.org/src/dnsmasq/2.90-4~deb12u2/debian/patches/CVE-2026-4893.patch Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dnsmasq: Fix CVE-2026-4892Hugo SIMELIERE (Schneider Electric)2026-05-212-0/+42
| | | | | | | | | | Pick patch from [1] dnsmasq 2.90 debian bookworm pacthes. [1] https://sources.debian.org/src/dnsmasq/2.90-4~deb12u2/debian/patches/CVE-2026-4892.patch Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dnsmasq: Fix CVE-2026-4891Hugo SIMELIERE (Schneider Electric)2026-05-212-0/+45
| | | | | | | | | | Pick patch from [1] dnsmasq 2.90 debian bookworm pacthes. [1] https://sources.debian.org/src/dnsmasq/2.90-4~deb12u2/debian/patches/CVE-2026-4891.patch Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nss: Fix CVE-2026-2781Hugo SIMELIERE (Schneider Electric)2026-05-212-0/+37
| | | | | | | | | | | | Pick patch from [1] as 3.9X upstream mirror backport of [2] mentioned in Debian report in [3]. [1] https://github.com/nss-dev/nss/commit/870d3b013e6b39540d14e67b3db89da5a96381bf [2] https://hg-edge.mozilla.org/projects/nss/rev/245385e16fa6 [3] https://security-tracker.debian.org/tracker/CVE-2026-2781 Signed-off-by: Hugo SIMELIERE (Schneider Electric) <hsimeliere.opensource@witekio.com> Reviewed-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* dash: fix CVE-2026-31323Theo Gaige2026-05-212-1/+47
| | | | | | | | | | Backport upstream fix for CVE-2026-31323 [1]. [1] https://git.kernel.org/pub/scm/utils/dash/dash.git/commit/?id=0034bfe185d3d875cebace8cb3ca5c9dabf9e0f3 Signed-off-by: Theo Gaige <tgaige.opensource@witekio.com> Reviewed-by: Bruno Vernay <bruno.vernay@se.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* strongswan: fix for CVE-2026-35334Hitendra Prajapati2026-05-212-0/+256
| | | | | | | | | | | Pick patch according to [1] [1] https://download.strongswan.org/security/CVE-2026-35334 [2] https://www.strongswan.org/blog/2026/04/22/strongswan-vulnerability-(cve-2026-35334).html [3] https://security-tracker.debian.org/tracker/CVE-2026-35334 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libssh: set status for CVE-2025-14821Sudhir Dumbhare2026-05-211-0/+2
| | | | | | | | | | | | | The vulnerability is Windows-specific and depends on loading configuration from C:\etc, which does not apply to Linux/Yocto builds Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-14821 https://github.com/advisories/GHSA-5jf9-8f86-jhvw https://www.libssh.org/security/advisories/CVE-2025-14821.txt Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nanomsg: upgrade 1.2.1 -> 1.2.2Ankur Tyagi2026-05-211-1/+1
| | | | | | | | Changelog: https://github.com/nanomsg/nanomsg/releases/tag/1.2.2 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* postfix: upgrade 3.8.12 -> 3.8.16Ankur Tyagi2026-05-211-1/+1
| | | | | | | | | | | | | | | | | 3.8.13 http://www.postfix.org/announcements/postfix-3.10.6.html 3.8.14 http://www.postfix.org/announcements/postfix-3.10.7.html 3.8.15 http://www.postfix.org/announcements/postfix-3.10.8.html 3.8.16 http://www.postfix.org/announcements/postfix-3.11.2.html Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* lcms: patch CVE-2026-42798Ankur Tyagi2026-05-212-0/+39
| | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-42798 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* lcms: patch CVE-2026-41254Ankur Tyagi2026-05-213-1/+70
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-41254 Backport the patches referenced by the NVD advisory. Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* frr: patch CVE-2026-28532Ankur Tyagi2026-05-212-0/+310
| | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-28532 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* firewalld: upgrade 1.3.2 -> 1.3.4Ankur Tyagi2026-05-211-1/+1
| | | | | | | | https://github.com/firewalld/firewalld/releases/tag/v1.3.3 https://github.com/firewalld/firewalld/releases/tag/v1.3.4 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* apache2: upgrade 2.4.66 -> 2.4.67Liyin Zhang2026-05-211-1/+1
| | | | | | | | | | | | | | | | | | | | | Security fixes: - CVE-2026-34059 - CVE-2026-34032 - CVE-2026-33857 - CVE-2026-33523 - CVE-2026-33007 - CVE-2026-33006 - CVE-2026-29169 - CVE-2026-29168 - CVE-2026-28780 - CVE-2026-24072 - CVE-2026-23918 See: https://archive.apache.org/dist/httpd/CHANGES_2.4.67 Signed-off-by: Liyin Zhang <liyin.zhang.cn@windriver.com> Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* exiftool: ignore CVE-2026-7580Ankur Tyagi2026-05-211-0/+1
| | | | | | | | | | | The impacted function mentioned in the nvd[1] was introduced in v12.82[2], hence we can ignore this CVE. [1]https://nvd.nist.gov/vuln/detail/CVE-2026-7580 [2]https://github.com/exiftool/exiftool/commit/280a7f0db71b5887be492d57723723cb196ad2f9 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* php: upgrade 8.2.30 -> 8.2.31Jason Schonberg2026-05-211-1/+1
| | | | | | | | | This is a security release. Changelog: https://www.php.net/ChangeLog-8.php#8.2.31 Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* open-vm-tools: Add entry to CVE_PRODUCT to support the product nameHet Patel2026-05-211-1/+1
| | | | | | | | | | | - Added 'vmware:open_vm_tools' to CVE_PRODUCT to align with the NVD CPE and ensure accurate CVE reporting. Signed-off-by: Het Patel <hetpat@cisco.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9b69587ecb92b3acb7b3092217357de9c1be14e6) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* onig: Add CVE_PRODUCT to support product nameHet Patel2026-05-211-0/+3
| | | | | | | | | | | - Set CVE_PRODUCT to align with the NVD CPE and ensure correct CVE reporting. Signed-off-by: Het Patel <hetpat@cisco.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7bc5268662f1428bdbca08e14d223aa6b62e87f3) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* abseil-cpp: Add CVE_PRODUCT to support product nameHet Patel2026-05-211-0/+3
| | | | | | | | | | | - Set CVE_PRODUCT to align with the NVD CPE and ensure correct CVE reporting. Signed-off-by: Het Patel <hetpat@cisco.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a428ea90c08fc93ce5e39612974323aad26d1ef3) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-ecdsa: set CVE_PRODUCTGyorgy Sarvari2026-05-211-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Set the correct CVE_PRODUCT value, the default python: ecdsa doesn't match relevant entries. The correct values were taken from the CVE db, by checking which CVEs are relevant. See CVE db query: sqlite> select * from products where product like '%ecdsa%'; CVE-2019-14853|python-ecdsa_project|python-ecdsa|||0.13.3|< CVE-2019-14859|python-ecdsa_project|python-ecdsa|||0.13.3|< CVE-2020-12607|antonkueltz|fastecdsa|||2.1.2|< CVE-2021-43568|starkbank|elixir_ecdsa|1.0.0|=|| CVE-2021-43569|starkbank|ecdsa-dotnet|1.3.2|=|| CVE-2021-43570|starkbank|ecdsa-java|1.0.0|=|| CVE-2021-43571|starkbank|ecdsa-node|1.1.2|=|| CVE-2021-43572|starkbank|ecdsa-python|||2.0.1|< CVE-2022-24884|ecdsautils_project|ecdsautils|||0.4.1|< CVE-2024-21502|antonkueltz|fastecdsa|||2.3.2|< CVE-2024-23342|tlsfuzzer|ecdsa|||0.18.0|<= Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7f962ef1557a291545646470c03fd9c4a23eb7d9) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python-grpcio(-tools): add grpc:grpc to cve productPeter Marko2026-05-212-0/+4
| | | | | | | | | | | | | | | | | | | | | | These grpc python modules contain parts of grpc core. Each CVE needs to be assessed if the patch applies also to core parts included in each module. Note that so far there was never a CVE specific for python module, only for grpc:grpc and many of those needed to be fixed at leasts in grpcio: sqlite> select vendor, product, count(*) from products where product like '%grpc%' group by vendor, product; grpc|grpc|21 grpck|grpck|1 linuxfoundation|grpc_swift|9 microsoft|grpconv|1 opentelemetry|configgrpc|1 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f993cb2ecb62193bcce8d3d0e06e180a7fef44b8) Signed-off-by: Himanshu Jadon <hjadon@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* wireshark: fix for CVE-2025-13946Hitendra Prajapati2026-05-212-0/+52
| | | | | | | | | | | Pick patch from [1] also mentioned at NVD report in [2] [1] https://gitlab.com/wireshark/wireshark/-/issues/20884 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-13946 [3] https://security-tracker.debian.org/tracker/CVE-2025-13946 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: Stick to C17 until next releaseKhem Raj2026-05-051-0/+3
| | | | | | | | | | | | | Patches are sprinkled in master branch of jq but the backports regresses tests, so its better to keep it at C17 for now. Backport: changed from += to :append to apply to all target, native and nativesdk builds. Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* onig: fix gcc 15 buildMikko Rapeli2026-04-292-0/+139
| | | | | | | With backport from upstream 6.9.10. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-39979Ankur Tyagi2026-04-292-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-39979 Ptests passed: root@qemux86:~# ptest-runner jq START: ptest-runner 2026-04-26T11:09 BEGIN: /usr/lib/jq/ptest PASS: optionaltest PASS: mantest PASS: jqtest PASS: onigtest PASS: shtest PASS: utf8test PASS: base64test === Test Summary === TOTAL: 7 PASSED: 7 FAILED: 0 SKIPPED: 0 DURATION: 44 END: /usr/lib/jq/ptest 2026-04-26T11:10 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-33948Ankur Tyagi2026-04-292-0/+52
| | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33948 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-33947Ankur Tyagi2026-04-292-0/+108
| | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-33947 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: patch CVE-2026-32316Ankur Tyagi2026-04-292-0/+56
| | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-32316 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* python3-pillow: fix CVE-2026-40192Hitendra Prajapati2026-04-292-0/+51
| | | | | | | | | | | Backport commit[1] which fixes this vulnerability as mentioned NVD report in [2]. [1] https://github.com/python-pillow/Pillow/commit/3cb854e8b2bab43f40e342e665f9340d861aa628 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-40192 [3] https://security-tracker.debian.org/tracker/CVE-2026-40192 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libssh: Fix CVE-2026-0965Ankur Tyagi2026-04-292-0/+285
| | | | | | | | | | | | | | | | | | | | | | | Backport the patch [1] as mentioned in [2] [1] https://git.libssh.org/projects/libssh.git/commit/?id=bf390a042623e02abc8f421c4c5fadc0429a8a76 [2] https://security-tracker.debian.org/tracker/CVE-2026-0965 Ptests passed: root@qemux86:~# ptest-runner libssh START: ptest-runner 2026-04-28T04:44 BEGIN: /usr/lib/libssh/ptest ... ... DURATION: 269 END: /usr/lib/libssh/ptest 2026-04-28T04:49 STOP: ptest-runner TOTAL: 1 FAIL: 0 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libssh: patch CVE-2026-0967Ankur Tyagi2026-04-292-0/+361
| | | | | | | | | | Backport patch [1] as mentioned in [2] [1] https://git.libssh.org/projects/libssh.git/commit/?id=6d74aa6138895b3662bade9bd578338b0c4f8a15 [2] https://security-tracker.debian.org/tracker/CVE-2026-0967 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* libssh: patch CVE-2026-0968Ankur Tyagi2026-04-293-0/+202
| | | | | | | | | | | | | | | | | Backport patches [1] and [2] as mentioned in [3] [1] https://git.libssh.org/projects/libssh.git/commit/?id=796d85f786dff62bd4bcc4408d9b7bbc855841e9 [2] https://git.libssh.org/projects/libssh.git/commit/?id=212121971fb26e1e00b72bd5402c0454a4d84c03 [3] https://security-tracker.debian.org/tracker/CVE-2026-0968 Certain functions from sftp.c were moved to a new file sftp_common.c in version 0.11.0 by following commit: https://git.libssh.org/projects/libssh.git/commit/src/sftp_common.c?id=c3e03ab4651e4f3382e3a51c0273ade894f0c48a This is the backport of the changes using the original file sftp.c Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* corosync: patch CVE-2026-35092Gyorgy Sarvari2026-04-292-0/+58
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-35092 Pick the patch that mentions the CVE ID explicitly (the same commit was identified by Debian also[1]) [1]: https://security-tracker.debian.org/tracker/CVE-2026-35092 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit af73e716bc7150ae8d912d8af00f6995e25f2031) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* corosync: patch CVE-2026-35091Gyorgy Sarvari2026-04-292-0/+48
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-35091 Pick the patch that mentions the CVE ID explicitly (it was identified by Debian also as the fix[1]) [1]: https://security-tracker.debian.org/tracker/CVE-2026-35091 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 701b22fda35648efc333d6e6e7abd8e70aa49870) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* opensc: patch CVE-2025-66215Ankur Tyagi2026-04-295-0/+177
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66215 Backport the patches referenced by the PR[1] mentioned in the nvd. Dropped the formatting commit from the backport. [1] https://github.com/OpenSC/OpenSC/pull/3436 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* opensc: patch CVE-2025-66038Ankur Tyagi2026-04-292-0/+42
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66038 Backport the patch referenced by the wiki[1] mentioned in the nvd. [1] https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66038 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* opensc: patch CVE-2025-66037Ankur Tyagi2026-04-292-0/+36
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-66037 Backport the patch referenced by the wiki[1] mentioned in the nvd. [1] https://github.com/OpenSC/OpenSC/wiki/CVE-2025-66037 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* opensc: patch CVE-2025-49010Ankur Tyagi2026-04-292-0/+73
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49010 Backport the patch referenced by the wiki[1] mentioned in the nvd. [1] https://github.com/OpenSC/OpenSC/wiki/CVE-2025-49010 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* openjpeg: patch CVE-2026-6192Gyorgy Sarvari2026-04-292-0/+36
| | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-6192 Backport the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> (cherry picked from commit 09050325e6e0736beccc40d125e56430054b7cb8) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* jq: fix CVE-2026-40164Daniel Turull2026-04-292-0/+93
| | | | | | | Backport patch to fix CVE-2026-40164. Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* nginx: fix CVE-2026-32647Hitendra Prajapati2026-04-292-0/+79
| | | | | | | | | | | | As per the advisory[1] mentioned in NVD[2], version 1.28.3 contains the fix. Backport the commit[3] from 1.28.3 changelog matching the description. [1] https://my.f5.com/manage/s/article/K000160366 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-32647 [3] https://github.com/nginx/nginx/commit/a172c880cb51f882a5dc999437e8b3a4f87630cc Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* krb5: Backport additional fixes to build on clangKhem Raj2026-04-293-0/+1243
| | | | | | | | | | | | Enabling additional warning tightens the function prototype checks and clang goes a step ahead to flag void foo() as well it should be void foo(void) Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Martin Jansa <martin.jansa@gmail.com> (cherry picked from commit 37cc472e44ef5b2b8c0ae8b5bcebf875fa9dd5be) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
* kernel-hardening-checker: update 0.6.10.2 -> 0.6.17.1Michael Opdenacker2026-04-291-1/+1
| | | | | | | | | | Following the update on master. This version reports more hardening issues: 128 "failures" instead of 113 on the same kernel. Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-20 04:26:02 +0000