summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* poppler: fix CVE-2025-52885Yogita Urade2025-10-172-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-52885 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/4ce27cc826bf90cc8dbbd8a8c87bd913cccd7ec0 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* yasm: fix CVE-2024-22653Praveen Kumar2025-10-172-0/+33
| | | | | | | | | | | | | | yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasm_section_bcs_append function at section.c. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-22653 Upstream-patch: https://github.com/yasm/yasm/commit/121ab150b3577b666c79a79f4a511798d7ad2432 Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fio: fix CVE-2025-10823Saravanan2025-10-172-0/+39
| | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-10823 https://github.com/axboe/fio/issues/1982 Upstream-patch: https://github.com/axboe/fio/commit/6a39dfaffdb8a6c2080eec0dc7fb1ee532d54025 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* squid: mark CVE-2025-54574 as patchedPeter Marko2025-10-171-1/+1
| | | | | | | | | | | | | Per [1] CVE-2025-54574 is fixed in patch for CVE-2023-5824. That was a composite patch from more commits. When checking it, it really contains also commit [2] which is mentioned as fix for CVE-2025-54574. [1] https://security-tracker.debian.org/tracker/CVE-2025-54574 [2] https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* emlog: set CVE_PRODUCTPeter Marko2025-10-171-0/+2
| | | | | | | | | | This will remove false-positive CVE-2024-50655 from reports. There are different emlog components from other vendors around. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d8d45d909315f5c784234261bb3e97d2e1f0a102) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* apache2: ignore CVE-2025-3891Gyorgy Sarvari2025-10-171-0/+2
| | | | | | | | | | The vulnerability was reported against mod_auth_openidc, which module is a 3rd party one, and not part of the apache2 source distribution. The affected module is not part of the meta-oe universe currently, so ignore the CVE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* st: Update status for CVE-2017-16224Ninette Adhikari2025-10-171-0/+3
| | | | | | | | | | | | | | | The recipe used in the meta-openembedded is a different st package compared to the one which has the CVE issue. Package used in meta-embedded: https://st.suckless.org/ Package with CVE issue: https://www.npmjs.com/package/st No action required. Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit eb9c7bb5645b6a3bcf7c40e1a83c8f4c3b020fa5) Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2022-0829Gyorgy Sarvari2025-10-172-0/+26
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-0829 Pick the patch from the nvd report details. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2022-0824Gyorgy Sarvari2025-10-172-0/+28
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-0824 Pick the patch mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2019-15642Gyorgy Sarvari2025-10-172-0/+27
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2019-15642 Pick the patch mentioned in the nvm report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2017-17089Gyorgy Sarvari2025-10-172-0/+30
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2017-17089 Pick the patch referenced in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* webmin: patch CVE-2017-15644, CVE-2017-15645 and CVE-2017-15646Gyorgy Sarvari2025-10-172-1/+55
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2017-15644 https://nvd.nist.gov/vuln/detail/CVE-2017-15645 https://nvd.nist.gov/vuln/detail/CVE-2017-15646 Pick the patch mentioned in the nvd report (same patch is marked to fix all three vulnerabilities). Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* poppler: fix CVE-2025-43718Yogita Urade2025-10-172-0/+32
| | | | | | | | | | | | | | | | | | Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor). Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-43718 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xsp: CVE status update for CVE-2006-2658Ninette Adhikari2025-10-171-0/+3
| | | | | | | | | | | | | | The recipe used in the `meta-openembedded` is a different xsp package compared to the one which has the CVE issue. Package used in `meta-embedded`: maemo xsp http://repository.maemo.org/pool/maemo/ossw/source/x/xsp/ Package with CVE issue: mono xsp https://github.com/mono/xsp Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3cb411a05744eaa6e822c3d435d9205aa87ff632) Reworked for Kirkstone (CVE_CHECK_IGNORE vs CVE_STATUS) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* zchunk: patch CVE-2023-46228Gyorgy Sarvari2025-10-172-1/+108
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46228 Pick the patch that's mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* zlog: patch CVE-2021-43521Gyorgy Sarvari2025-10-172-1/+28
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-43521 Pick the patch that resolves the issue linked in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* iniparser: Fix CVE-2025-0633Soumya Sambu2025-10-172-0/+39
| | | | | | | | | | | | | | | Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory References: https://nvd.nist.gov/vuln/detail/CVE-2025-0633 https://security-tracker.debian.org/tracker/CVE-2025-0633 Upstream patch: https://gitlab.com/iniparser/iniparser/-/commit/072a39a772a38c475e35a1be311304ca99e9de7f Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* iperf2: ignore irrelevant CVEsGyorgy Sarvari2025-10-171-0/+3
| | | | | | | | | | | | | | These CVEs are for iperf3 - which is a similar application in its goals (and name), but an independent project from this, and the projects are independent implementations also, they share no common code. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit aedf74e08230f60c270032e8b937d1ab9bd2fc9c) Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* open-vm-tools: fix CVE-2025-41244Rajeshkumar Ramasamy2025-10-172-0/+125
| | | | | | | | | | | | | | | | | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges having access to a VM with VMware Tools installed and managed by Aria Operations with SDMP enabled may exploit this vulnerability to escalate privileges to root on the same VM. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-41244 Upstream-patch: https://github.com/vmware/open-vm-tools/commit/7ed196cf01f8acd09011815a605b6733894b8aab Signed-off-by: Rajeshkumar Ramasamy <rajeshkumar.ramasamy@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: Fix CVE-2022-28463virendra thakur2025-10-172-0/+27
| | | | | | | | | Imagemagick is vulnerable to buffer overflow. Reference: https://github.com/ImageMagick/ImageMagick/commit/ca3654ebf7a439dc736f56f083c9aa98e4464b7f Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tcpreplay: fix CVE-2025-51006Archana Polampalli2025-10-172-0/+98
| | | | | | | | | | | | Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c. This vulnerability is triggered when tcpedit_dlt_cleanup() indirectly invokes the cleanup routine multiple times on the same memory region. By supplying a specifically crafted pcap file to the tcprewrite binary, a local attacker can exploit this flaw to cause a Denial of Service (DoS) via memory corruption. Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tcpreplay: fix CVE-2025-9157Archana Polampalli2025-10-172-1/+46
| | | | | | | | | | | | | A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2. The impacted element is the function untrunc_packet of the file src/tcpedit/edit_packet.c of the component tcprewrite. Executing manipulation can lead to use after free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. This patch is called 73008f261f1cdf7a1087dc8759115242696d35da. Applying a patch is advised to resolve this issue. Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cryptsetup: Update the license fieldSana Kazi2025-10-171-1/+1
| | | | | | | | | | | | The below reference clearly states that GPL-2.0-with-OpenSSL-exception is to be used with GPL 2.0 or GPL3.0 and not as a standalone license. Therefore, update the correct license. Reference: https://github.com/aboutcode-org/scancode-licensedb/blob/569d72e13e7c8d14a44380f91e80c5a2d4091f8f/docs/openssl-exception-gpl-2.0.yml#L7 Signed-off-by: Sana Kazi <Sana.Kazi@bmwtechworks.in> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* udisks2: fix CVE-2025-8067Saravanan2025-10-172-1/+40
| | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8067 Upstream-patch: https://github.com/storaged-project/udisks/commit/9ed2186f668c76aeb472de170d62b499d85a1915 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* botan: patch CVE-2024-50382 and CVE-2024-50383Gyorgy Sarvari2025-10-122-0/+68
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-50382 https://nvd.nist.gov/vuln/detail/CVE-2024-50383 Pick patch mentioned in the URL list of the nist page - the same patch fixes both vulnerabilities. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* botan: patch CVE-2024-39312Gyorgy Sarvari2025-10-122-0/+750
| | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-39312 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* botan: patch CVE-2022-43705Gyorgy Sarvari2025-10-125-1/+207
| | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-43705 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dovecot: patch CVE-2021-33515Gyorgy Sarvari2025-10-122-0/+77
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33515 Backport the relevant patch. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dovecot: patch CVE-2022-30550Gyorgy Sarvari2025-10-122-0/+138
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-30550 Pick the commit referenced in https://www.openwall.com/lists/oss-security/2022/07/08/1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* civetweb: patch CVE-2020-27304Gyorgy Sarvari2025-10-123-0/+119
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2020-27304 Take the patches referenced in https://jfrog.com/blog/cve-2020-27304-rce-via-directory-traversal-in-civetweb-http-server/ (which URL is also referenced by NIST) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* apache2: ignore irrelevant CVEsGyorgy Sarvari2025-10-121-0/+19
| | | | | | | | | | | | | | | | Ignore a number of CVEs for this recipe (because they are for another software, outdated version, or because they affect only non-Linux platforms). This commit is a backport of a number of commits from the master branch (which uses the same version of the recipe): 0e7733f1b8f51949ec91d82267d5d864ac0be16a 1b86a60f6283b08acadc50914075d93dd362700b 59d3949e3ed673bd049aadfd2238213b550f1461 1b86a60f6283b08acadc50914075d93dd362700b da2b5e8b93c248363581b1bd4ff67ff1d8357c41 0e7733f1b8f51949ec91d82267d5d864ac0be16a Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ace: ignore CVE-2009-1147Gyorgy Sarvari2025-10-121-0/+3
| | | | | | The CVE is for another product, for VMWare ACE, not for this one. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fbida: fix make fbpdf build optionalsimoneScaravati2025-10-102-0/+107
| | | | | | | | this is a backport-like from scarthgap branch: fbida_git.bb and patch 0001-meson.build-make-fbpdf-build-optional.patch From Github Pull request: https://github.com/openembedded/meta-openembedded/pull/1008 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* collectd: set working SRC_URIGyorgy Sarvari2025-10-021-1/+1
| | | | | | | The project started to outsource the source hosting to Google storage and Github. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* psqlodbc: set valid SRC_URIGyorgy Sarvari2025-10-021-1/+1
| | | | | | The old URI stopped working. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xfce4-sensors-plugin: correct netcat PACKAGECONFIGGyorgy Sarvari2025-10-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | In case netcat PACKAGECONFIG is enabled, do_configure fails with the following error message: | configure: error: hddtemp isn't queryable via netcat (use --disable-pathchecks to disable this check) hddtemp service keeps a TCP port open to query the sensor data. In case netcat is enabled for this recipe, the configure script will search for the netcat binary, and will try to query this hddtemp port, as a sanity check. This check is performed independently from the hddtemp PACKAGECONFIG. Since hddtemp isn't running in the build environment (probably) and network connection is also disabled, this check fails. To avoid this problem, add the extra config argument suggested by the error message. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b16f9c6f046fa6275d1afa7ee60acc8d85849163) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-send2trash: add missing run-time dependenciesBartosz Golaszewski2025-10-021-0/+2
| | | | | | | | | Add missing RDEPENDS for this package. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e7430b5874ae68c02a4cc0ecdbe76b62446c67c6) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-pyparted: add missing run-time dependenciesBartosz Golaszewski2025-10-021-1/+4
| | | | | | | | | Add missing RDEPENDS for this package. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9249052f98dde632173cbad95c7e6a3cd5e42651) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-thrift: add missing run-time dependenciesBartosz Golaszewski2025-10-021-0/+1
| | | | | | | | | Add missing RDEPENDS for this package. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e015b0e996aa0e442cc4e64a4ff21ae717f0ee24) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-hpack: add missing run-time dependenciesBartosz Golaszewski2025-10-021-0/+2
| | | | | | | | | Add missing RDEPENDS for this package. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 1659a00086a360f64129fb28eaaf3066ae7589d6) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-txws: add missing run-time dependenciesBartosz Golaszewski2025-10-021-0/+5
| | | | | | | | | Add missing RDEPENDS for this package. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d334d496c36f326c9025fbe259f96fce62edaf1f) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-pyconnman: Add 'future' runtime dependencyMarcus Flyckt2025-10-011-1/+1
| | | | | | | | | | pyconnman has an install_requires on 'future', but the corresponding 'python3-future' is missing from the recipes RDEPENDS. Signed-off-by: Marcus Flyckt <mafl@kvaser.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 4ccb2fa47f066077e013befab18b08bd4d1df70e) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-gsocketpool: add missing run-time dependenciesBartosz Golaszewski2025-10-011-1/+2
| | | | | | | | | Add missing RDEPENDS for this package. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b6304859867a78b98253b9c9e15484b482031a1d) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libcrypt-openssl-guess-perl: fix syntax for PROVIDESYi Zhao2025-10-011-1/+1
| | | | | | | | | PROVIDES_${PN} -> PROVIDES Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9d543525642a4369f60b9d3ea721e55d0a605fce) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tree: fix broken linksBenjamin Szőke2025-10-011-2/+2
| | | | | | | | | | | | | New tarball location is: http://oldmanprogrammer.net/tar/tree/ Homepage is: http://oldmanprogrammer.net/source.php?dir=projects/tree Signed-off-by: Benjamin Szőke <egyszeregy@freemail.hu> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0c4079fc28cc36cb2dbfe48093f2cf64106f8b5d) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* span-lite: do not inherit ptestTim Orling2025-10-011-1/+0
| | | | | | | | | This recipe provides no run-ptest script. Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0fc5f550d31f82aa348a4145573df3aea896f5ab) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: upgrade 4.1.0 -> 4.1.1Wang Mingyu2025-10-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: ========== Security -------- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221 Fixed ------- Exclude docs and demo from export and composer #751 PHP 8.1 deprecation notices in demo/plugins/cacheresource.pdo.php #706 PHP 8.1 deprecation notices in truncate modifier #699 Math equation max(x, y) didn't work anymore #721 Fix PHP 8.1 deprecated warning when calling rtrim #743 PHP 8.1: fix deprecation in escape modifier #727 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9374648c390aebb87540781de54b0caf85340b16) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* lcov: Fix Perl PathAlex Yao2025-10-011-1/+1
| | | | | | | | | | | Fixes an issue where lcov is using the system Perl rather than the yocto provided Perl. This causes packages to not be found during runtime such as PerlIO::gzip. Signed-off-by: Alex Yao <alexyao1@meraki.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e66ae31c9522a6acf42720edb7623a93407a983a) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* synergy: patch CVE-2020-15117Peter Marko2025-10-012-0/+49
| | | | | | | | | | | | | | | Pick commit based on [1]. Note that the pick is node from deskflow, which is open-source successor of synergy. If anyone uses thie recipe, it should be switched. [1] https://github.com/deskflow/deskflow/security/advisories/GHSA-chfm-333q-gfpp Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit db283053d096cf77df8e4444ce91e5d882f8850c) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* procmail: patch CVE-2017-16844.Peter Marko2025-10-012-0/+21
| | | | | | | | | | Take patch from Debian. https://sources.debian.org/data/main/p/procmail/3.22-26%2Bdeb10u1/debian/patches/30 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3d97f4c13d5f5810659e107f6461f0b63f6fa92a) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-23 12:59:36 +0000