summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* nodejs: ignore CVE-2023-30583, CVE-2023-30584 and CVE-2023-30587Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-30583 https://nvd.nist.gov/vuln/detail/CVE-2023-30584 https://nvd.nist.gov/vuln/detail/CVE-2023-30587 None of these vulnerabilities are present in the recipe version. CVE-2023-30583: While the main feature (blob) was intruced in v16, the vulnerable code (load blobs from file) was introduced in v20[1], and as such, the vulnerability is not present in the recipe version. CVE-2023-30584, CVE-2023-30587: The whole vulnerable feature (permission model) was introduced[2] in v20. Ignore these CVE IDs. [1]: https://github.com/nodejs/node/commit/950cec4c2642c15e2913f35babadda56c1d8a723 [2]: https://github.com/nodejs/node/commit/00c222593e49d817281bc88a322f41f8dca95885 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fio: ignore CVE-2025-10824Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-10824 The upstream maintainer wasn't able to reproduce the issue[1], and the related bug is closed without further action. [1]: https://github.com/axboe/fio/issues/1981 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a275078cbeaa0fafcfa4eb60ca69f05a8fe3df99) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_STATUS) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: ignore CVE-2024-22199Gyorgy Sarvari2026-01-081-0/+2
| | | | | | | | | This CVE is not for python-django, but for some go project which shares the same name. Ignore this CVE due to this. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* proftpd: set status of CVE-2001-0027Peter Marko2026-01-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | This ancient CVE [1] is unversioned ("*") in NVD DB. "mod_sqlpw module in ProFTPD does not reset a cached password..." Looking at history and changelog, the module was removed [2] around the time when this CVE was published, likely as reaction to this CVE. "mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the distribution. They are currently unmaintained and have numerous bugs." Note: It was later re-introduced as mod_sql when it got fixed under new maintainer. [1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027 [2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 03a1b56bc7ce88a3b0ad6790606b0498899cc1e3) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* civetweb: patch CVE-2025-9648Ankur Tyagi2026-01-082-0/+235
| | | | | | | | | | | | Details https://nvd.nist.gov/vuln/detail/CVE-2025-9648 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit eb338ebb606f22363be5b4114e25a10b494b4f55) Rebased patch on Kirkstone's civetweb. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* atop: patch CVE-2025-31160Gyorgy Sarvari2026-01-082-0/+608
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-31160 Backport the patch that's subject references the CVE id explicitly. I was able to verify the patch with a reproducer[1] (which is mentioned in a reference[2] in the nvd report). Without the patch atop crashed, with the patch it worked fine (both with and without -k/-K flags). [1]: https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug [2]: https://gist.github.com/kallsyms/3acdf857ccc5c9fbaae7ed823be0365e Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* php: upgrade 8.1.33 -> 8.1.34Gyorgy Sarvari2026-01-081-1/+1
| | | | | | | | | | | | | | | Comes with fixes for CVE-2025-14177, CVE-2025-14178 and CVE-2025-14180 Changelog: - Curl: Fix curl build and test failures with version 8.16. - Opcache: Reset global pointers to prevent use-after-free in zend_jit_status(). - PDO: Fixed: PDO quoting result null deref. (CVE-2025-14180) - Standard: * Fixed: Null byte termination in dns_get_record(). * Fixed: Heap buffer overflow in array_merge(). (CVE-2025-14178) * Fixed: Information Leak of Memory in getimagesize. (CVE-2025-14177) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nbdkit: remove unused patchGyorgy Sarvari2026-01-081-39/+0
| | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nbdkit: patch CVE-2025-47712Gyorgy Sarvari2026-01-082-0/+163
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47712 Pick the patch from the project's repository which explicitly mentions this vulnerability ID. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nbdkit: patch CVE-2025-47711Gyorgy Sarvari2026-01-082-1/+170
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47711 Pick the patch from the repository which explicitly mentions this CVE ID. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xmlsec1: update SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | The tarball was moved to a subfolder. Adapt the SRC_URI. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* softhsm: correct SRC_URI branchGyorgy Sarvari2026-01-081-1/+1
| | | | | | The develop branch doesn't exist anymore. The fetched commit is on the main branch. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* thrift: fix SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | | The tarball was moved to an archive server, so the link stopped working. Update it to the new location. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* srecord: fix SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | | | The tarball was moved to a new folder in the SourceForge project, and the original convenience link stopped working. Use the direct link instead. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* pcp: switch SRC_URI to gitGyorgy Sarvari2026-01-081-2/+4
| | | | | | | | | | | The original link stopped working. I have compared the original tarball's content with this revision: the contents are bit-identical to each other. The only difference is that the original tarball came with an extra "debian/control" file which is not present in the git repository, but it not using for compiling. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tcsh: update SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | The tarball was moved to a new subfolder, making do_fetch fall back to a mirror. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* hunspell: patch CVE-2019-16707Gyorgy Sarvari2026-01-082-1/+28
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2019-16707 Pick the patch that resolves the Github issue[1] that tracked this vulnerability. [1]: https://github.com/hunspell/hunspell/issues/624 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: patch CVE-2023-28447Gyorgy Sarvari2026-01-082-0/+75
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-28447 Pick the patch that is referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: update CVE_PRODUCTAnkur Tyagi2026-01-081-0/+2
| | | | | | | Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ceadb83fcf18134b40b36cddcacbc8192ea68f82) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: patch CVE-2018-25047Gyorgy Sarvari2026-01-082-1/+143
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2018-25047 Pick the patch that resolved the issue referenced in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* snappy: add CVE_PRODUCTEmil Kronborg Andersen2025-12-251-0/+2
| | | | | | | | | | If CVE_PRODUCT is not explicitly set to google:snappy, CVEs are found for https://github.com/KnpLabs/snappy instead. Signed-off-by: Emil Kronborg Andersen <emkan@prevas.dk> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b888130e957eb4fe9d69fd70f3b3778ba980b728) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dbus-broker: patch CVE-2022-31212Gyorgy Sarvari2025-12-252-1/+73
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-31212 A detailed writeup[1] is referenced by the nvd report, which describes that the vulnerability itself is not in the application, rather in a dependency of it, in c-shutil, which is pulled in as a submodule. Pick the patch from this submodule that fixes a stack overflow, and adds a test explictly verifying the described vulnerability. [1]: https://sec-consult.com/vulnerability-lab/advisory/memory-corruption-vulnerabilities-dbus-broker/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cups-filters: patch CVE-2023-24805Gyorgy Sarvari2025-12-252-0/+214
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-24805 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cups-filters: patch CVE-2025-64524Gyorgy Sarvari2025-12-252-0/+82
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64524 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cups-filters: patch CVE-2025-57812Gyorgy Sarvari2025-12-252-1/+130
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57812 Backport the patch that is referenced by te nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* redis: ignore CVE-2025-46686Gyorgy Sarvari2025-12-252-0/+4
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46686 Upstream disputes that it is a security violation, and says that implementing a mitigation for this would negatively affect the rest of the application, so they elected to ignore it. See Github advisory about the same vulnerability: https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nanopb: patch CVE-2024-53984Gyorgy Sarvari2025-12-252-1/+39
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-53984 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* mpd: Update status for CVE-2020-7465 and CVE-2020-7466Ninette Adhikari2025-12-251-0/+3
| | | | | | | | | | | | | | | The recipe used in the `meta-openembedded` is a different mpd package compared to the one which has the CVE issue. Package used in `meta-embedded`: http://www.musicpd.org Package with CVE issue: https://sourceforge.net/projects/mpd/ No action required. Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3e3c25698124dd82163d966fa9d7e7e807cfecbe) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* mtr: patch CVE-2025-49809Gyorgy Sarvari2025-12-252-1/+41
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49809 Pick the patch mentioned in the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* vlc: upgrade 3.0.17-1 -> 3.0.17.4Gyorgy Sarvari2025-12-251-2/+2
| | | | | | | | | | | | | | | | | | | | This update contains minor bugfixes. Changelog: 3.0.17.4: Service Discovery: Fix UPnP regression on Windows 3.0.17.3: Demux: Fix a regression causing a lack of audio in adaptive streaming 3.0.17.2: Interface: Qt: Fix right click support on video Misc: Update YouTube script This commit has been detached from all branches. The version format change does not cause version-going-backwards issues. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* vorbis-tools: upgrade 1.4.2 -> 1.4.3Gyorgy Sarvari2025-12-254-104/+29
| | | | | | | | | | | | | | | | | | Refreshed gettext.patch Dropped 0001-ogginfo-Include-utf8.h-for-missing-utf8_decode.patch & CVE-2023-43361.patch Dropped patches fixed in newer version Dropped md5sum Changelog: https://gitlab.xiph.org/xiph/vorbis-tools/-/blob/release-1.4.3/CHANGES Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 37a17c25cc38e8207db96b106c0de88dd3977df7) Adapted to Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libmediaart-2.0: upgrade 1.9.6 -> 1.9.7Gyorgy Sarvari2025-12-251-1/+1
| | | | | | | | | | This is a bugfix release, fixing some memory leaks and compiler warning (and it also has a couple of commits related to the project's own CI system, which doesn't affect the application) Changelog: https://gitlab.gnome.org/GNOME/libmediaart/-/blob/master/NEWS Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* zabbix: patch CVE-2025-49643Gyorgy Sarvari2025-12-252-0/+39
| | | | | | | | | | | The actual patch was identified by checking the file that was modified in the tag 6.0.42, and also by looking at the Jira item referenced by it: the patch references DEV-4466, the same ID that is referenced in the Jira ticket[1] referenced by the NVD report (look in the "All Activity" tab). [1]: https://support.zabbix.com/browse/ZBX-27284 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: patch CVE-2025-62171Gyorgy Sarvari2025-12-252-0/+27
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-62171 Pick the patch that's mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: patch CVE-2025-65955Gyorgy Sarvari2025-12-252-0/+26
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-65955 Pick the patch referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: patch CVE-2022-1115Gyorgy Sarvari2025-12-252-0/+26
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-1115 Pick the patch referenced in the NVD report. Tested successfully against the PoC described in the related Github issue[1]. [1]: https://github.com/ImageMagick/ImageMagick/issues/4974 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* krb5: fix for CVE-2024-3596Hitendra Prajapati2025-12-252-0/+629
| | | | | | | Upstream-Status: Backport from https://github.com/krb5/krb5/commit/871125fea8ce0370a972bf65f7d1de63f619b06c Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: fix CVE_PRODUCTGyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | The CVE_PRODUCT is set with a weak default assignment in the cve-check.bbclass, which means that when the recipe uses +=, it overrides the original weak adefault value instead of appending to it. Set all applicable values in CVE_PRODUCT variable explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xdebug: upgrade 3.1.1 -> 3.1.5Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This update contains many bugfixes. Changelog: https://xdebug.org/updates#x_3_1_5 3.1.5: - Install documentation gives wrong arch for installation on M1 Macs - phpize --clean removes required clocks.m4 file - Constant defined with an enum case produce double "facet" attribute in context_get response - Crash when used with source guardian encoded files - Segfault in __callStatic() after FFI initialization 3.1.4: - Removing second call breakpoint with same function name - XDebug breaks the Symfony "PhpFilesAdapter" cache adapter - Possible use after free with GC Stats - Can't inspect ArrayObject storage elements - Segmentation fault in symfony cache - Debug session can be started with "XDEBUG_SESSION_START=anything" when xdebug.trigger_value is set - Warn when profiler_append is used together with zlib compression - Code coverage misses static array assignment lines 3.1.3: - evaling broken code (still) causes unhandled exception in PHP 7.4 - Memory leak when a trace file can't be opened because xdebug.trace_output_name is invalid - Slowdown when calling a function with long string parameters - Debugger creates XML with double facet attribute 3.1.2: - Segfault on fiber switch in finally block in garbage collected fiber - Crash when profile file can not be created - __debugInfo is not used for var_dump output - Segault on xdebug_get_function_stack inside a Fiber Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* phpmyadmin: upgrade 5.1.3 -> 5.1.4Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Last bugfix release of the 5.1.x series. Changelog: - Fixed sorting the database list with "statistics" enabled on "Data" column creates a PHP type error - Fix for invalid cache when losing access to config storage after it being cached - Fix session cookie not respecting the CookieSameSite configuration directive in PHP 7.2 - Fix create index form accepting too many columns - Disable editing to system schemas - Add better error handling when IndexedDB is not working - Fixed incorrect escaping of special MySQL characters on some pages - Fix GIS visualization with an edited query - Remove the use of the deprecated `strftime` function in OpenDocument exports - Enable tabindex recompute on preview button while insert new rows - Fix invalid SQL generated when PRIMARY/UNIQUE key contains a POINT column - Fix setup's CSS not loading when the URL doesn't have a trailing slash - Remove jQuery SVG JavaScript dependency - Fix column visibility dropdown when the column name is too long - Fix issue when exporting using Firefox or Safari on PHP 8.1.4 - Update JavaScript dependencies - Fix case where errors were thrown when browsing a table - Fix UI issue when user accounts page has the initials navigation bar Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* hiawatha: set a working SRC_URIGyorgy Sarvari2025-12-221-1/+1
| | | | | | The project has moved to a new site, old SRC_URI stopped working. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cherokee: patch CVE-2020-12845Gyorgy Sarvari2025-12-222-0/+196
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-12845 Pick the merge commit that mentions the vulnerability. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* thunar: upgrade 4.16.9 -> 4.16.11Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | | | | | | | | | | Changelog: 4.6.11: - Dont reload the view when text is copied - NULL checks to prevent crash on malformed bookmark URI - Use 'g_timeout_add_full' to set tree-view cursor - Fix signal disconnect in thunar_window_unrealize - Don't go beyond THUNAR_N_VISIBLE_COLUMNS while parsing col widths - Translation Updates: 4.16.10: - Fix signal disconnect to prevent crash - Don't go beyond THUNAR_N_VISIBLE_COLUMNS while parsing col widths https://gitlab.xfce.org/xfce/thunar/-/blob/thunar-4.16.11/NEWS Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tumbler: upgrade 4.16.0 -> 4.16.1Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | | Changelog: - gst-thumbnailer: Add mime type check - desktop-thumbnailer: Guard against null path - Fix typo in gthread version https://gitlab.xfce.org/xfce/tumbler/-/blob/tumbler-4.16.1/NEWS Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xfce4-panel: upgrade 4.16.3 -> 4.16.6Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | Contains translation updates and assorted bugfixes. Changelog: https://gitlab.xfce.org/xfce/xfce4-panel/-/blob/xfce-4.16/NEWS Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xfdesktop: upgrade 4.16.0 -> 4.16.1Gyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | | | | | | | | | | | Changelog: - Resolve deadlock on background change - Allocate memory after error processing - Remove unused function call - autoconf: Remove AC_HEADER_STDC - Do not delete property not set - Set a pixmap XID, not the XID of the root window - Fix next background - build: Fix intltool lock file problem during make distcheck - Increase opacity of xfce-verticals bg - Fix Applications Menu memory leak - Fix gettext extraction from settings/xfce-backdrop-settings.desktop.in.in - Translation Updates https://github.com/xfce-mirror/xfdesktop/releases/tag/xfdesktop-4.16.1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-django: fix CVE-2025-64459Haixiao Yan2025-12-182-0/+61
| | | | | | | | | | | | | | | | The methods QuerySet.filter(), QuerySet.exclude(), and QuerySet.get(), and the class Q() were subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the _connector argument. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-64459 https://shivasurya.me/security/django/2025/11/07/django-sql-injection-CVE-2025-64459.html Upstream-patch: https://github.com/django/django/commit/98e642c69181c942d60a10ca0085d48c6b3068bb Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* proftpd: patch CVE-2024-48651Gyorgy Sarvari2025-12-172-1/+323
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651 Backport the patch mentioned in the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* openh264: patch CVE-2025-27091Gyorgy Sarvari2025-12-172-0/+28
| | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-27091 The advisory confirms that the bug was fixed in v2.6.0. When looking at the relevant Github advisory[1], it mentions the name of the implementer. Pick the patch that was included in this release, created by the mentioned Github account and isn't only a cosmetic or build-system change. [1]: https://github.com/cisco/openh264/security/advisories/GHSA-m99q-5j7x-7m9x Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* postgresql: upgrade 14.19 -> 14.20Gyorgy Sarvari2025-12-172-2/+2
| | | | | | | | Beside other bugfixes, it contains fixes for CVE-2025-12817 and CVE-2025-12818. Release notes: https://www.postgresql.org/docs/release/14.20/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-21 19:42:09 +0000