summaryrefslogtreecommitdiffstats
path: root/meta-networking
Commit message (Collapse)AuthorAgeFilesLines
* linux-atm: fix SRC_URIGyorgy Sarvari2026-04-231-1/+1
| | | | | | The previous one stopped working Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* strongswan: Fix CVE-2026-25075Vijay Anusuri2026-04-072-0/+51
| | | | | | | | | | Pick patch according to [1] [1] https://download.strongswan.org/security/CVE-2026-25075/ [2] https://www.strongswan.org/blog/2026/03/23/strongswan-vulnerability-(cve-2026-25075).html Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* wireshark: fix CVE-2025-5601Hitendra Prajapati2026-03-252-0/+69
| | | | | | | | | | | | | Pick patch from [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-5601 [2] https://gitlab.com/wireshark/wireshark/-/issues/20509 More details : https://nvd.nist.gov/vuln/detail/CVE-2025-5601 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* lldpd: fix xml PACKAGECONFIG dependencyAviv Daum2026-03-131-1/+1
| | | | | | | | | | | The xml PACKAGECONFIG entry uses libxm2, which is a typo and not a valid dependency in OE. Replace it with libxml2 so enabling PACKAGECONFIG:xml pulls in the correct provider. Signed-off-by: Aviv Daum <aviv.daum@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ettercap: patch CVE-2026-3603Gyorgy Sarvari2026-03-112-1/+51
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2026-3606 Pick the commit that is marked to solve the related Github issue[1]. Its commit message also references the CVE ID explicitly. [1]: https://github.com/Ettercap/ettercap/issues/1297 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* memcached: patch CVE-2023-46853Gyorgy Sarvari2026-03-072-0/+115
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46853 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* memcached: patch CVE-2023-46852Gyorgy Sarvari2026-03-072-0/+69
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46852 Backport the patch that is referenced by the NVD advisory. The test extension was not backported, because the modified testcase does not exist in the recipe version yet. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* opem-vm-tools: ignore multiple CVEsGyorgy Sarvari2026-03-071-0/+10
| | | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2014-4199 https://nvd.nist.gov/vuln/detail/CVE-2014-4200 https://nvd.nist.gov/vuln/detail/CVE-2022-22943 https://nvd.nist.gov/vuln/detail/CVE-2022-22977 https://nvd.nist.gov/vuln/detail/CVE-2022-31693 https://nvd.nist.gov/vuln/detail/CVE-2023-34057 The fixes for the first two vulnerabilities are already present in the used version. As identified by Redhat: CVE-2014-4199: it has been fixed since version 9.10.2[1] CVE-2014-4200: it has been fixed since version 9.4.6[2] CVE-2022-22943, CVE-2022-22977 and CVE-2022-31693 affect only Windows. CVE-2023-34059 affects only Windows and MacOS. [1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-4199 [2]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-4200 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dovecot: patch CVE-2021-29157Gyorgy Sarvari2026-02-272-0/+153
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29157 Backport the patch that it used by Debian[1] to fix this CVE. [1]: https://sources.debian.org/src/dovecot/1%3A2.3.13%2Bdfsg1-2%2Bdeb11u1/debian/patches Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ndpi: ignore CVE-2025-25066Gyorgy Sarvari2026-02-271-0/+3
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-25066 The vulnerable code was introduced in v4.12[1], and is not present in the recipe version. Due to this, ignore the CVE. [1]: https://github.com/ntop/nDPI/commit/b9348e9d6e0e754c4b17661c643ca258f1540ca1 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* quagga: ignore CVE-2021-44038Gyorgy Sarvari2026-02-271-0/+1
| | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-44038 The main point of the vulnerability is that the application comes with its own systemd unit files, which execute chmod and chown commands upon start on some files. So when the services are restarted (e.g. after an update), these unit files can be tricked to change the permissions on a malicious file. However OE does not use these unit files - the recipe comes with its own custom unit files, and chown/chmod isn't used at all. Due to this, ignore this vulnerability. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* quagga: patch CVE-2017-3224Gyorgy Sarvari2026-02-272-1/+92
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2017-3224 Quagga is an abandoned project, but it is not without a successor. Frr (or Frrouting) is a fork of Quagga, and they have fixed this vulnerability. That patch from Frr was ported to Quagga. The Frr patch mentions this CVE ID explicitly, and also Debian has identified it as the correct patch[1]. [1]: https://security-tracker.debian.org/tracker/CVE-2017-3224 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* keepalived: patch CVE-2024-41184Gyorgy Sarvari2026-02-275-0/+319
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-41184 Backport the patches referenced by upstream in the bug mentioned by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libconfuse: patch CVE-2022-40320Gyorgy Sarvari2026-02-272-1/+43
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-40320 Pick the patch that was marked to resolve the github bug in the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dante: patch CVE-2024-54662Gyorgy Sarvari2026-02-272-1/+73
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-54662 This backported patch was taken from upstream's website[1], where they identify it as the solution for this vulnerability [1]: https://www.inet.no/dante/ (bottom, "advisories" section) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dovecot: ignore CVE-2025-30189Ankur Tyagi2026-02-261-0/+3
| | | | | | | | | | | | | Vulnerable versions are 2.4.0, 2.4.1 according to the full disclosure[1] Details: https://nvd.nist.gov/vuln/detail/CVE-2025-30189 [1] https://seclists.org/fulldisclosure/2025/Oct/29 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Adapted to Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* wireshark: Fix multiple CVEsHitendra Prajapati2026-02-194-0/+473
| | | | | | | | | | | Backport fixes for : * CVE-2024-8645 - Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/8e5f8de8836d3a81276ae5b9bf78cbac58bb6108 * CVE-2026-0960 - Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/f31123dcdbac37272046b58b2f7941bc7fb42934 * CVE-2025-13945 - Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/9139917bd8e2c80a5db7079993d5528db74e3519 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ez-ipupdate: patch CVE-2003-0887Gyorgy Sarvari2026-02-132-0/+165
| | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2003-0887 The vulnerability is about the default (example) configurations, which place cache files into the /tmp folder, that is world-writeable. The recommendation would be to place them to a more secure folder. The recipe however does not install these example configurations, and as such it is not vulnerable either. Just to make sure, patch these folders to a non-tmp folder (and also install that folder, empty). Some more discussion about the vulnerability: https://bugzilla.suse.com/show_bug.cgi?id=48161 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit dd81ffdb685bd9c2ce1b27d0e5ff3f8e5551e3ad) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* strongswan: Security fix for CVE-2025-62291Rohini Sangam2026-02-112-0/+50
| | | | | | | | | CVE fixed: - CVE-2025-62291 strongswan: Arbitrary Code Execution and Denial of Service via crafted EAP-MSCHAPv2 message Upstream-Status: Backport from https://download.strongswan.org/security/CVE-2025-62291/strongswan-4.4.0-6.0.2_eap_mschapv2_failure_request_len.patch Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libiec61850: patch CVE-2024-45970Gyorgy Sarvari2026-01-302-0/+72
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-45970 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libiec61850: patch CVE-2024-45969Gyorgy Sarvari2026-01-302-1/+33
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-45969 Backport the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* frr: ignore CVE-2023-3748, CVE-2023-41359..61Gyorgy Sarvari2026-01-301-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-3748 https://nvd.nist.gov/vuln/detail/CVE-2023-41359 https://nvd.nist.gov/vuln/detail/CVE-2023-41360 https://nvd.nist.gov/vuln/detail/CVE-2023-41361 Regarding CVE-2023-3748: Based on Debian's investigation, the vulnerability was solved by [1]. However that vulnerable code that was fixed was introduced after the recipe version, only in version 8.4.0[2]. Since the recipe version isn't affected by this CVE, ignore it. Regarding CVE-2023-41359: The pull request[3] referenced by the NVD report references another pull request[4] which was opened to backport the fix. The conversion on this PR confirms that the vulnerable feature was introduced in 8.5. Due to this, ignore this CVE. Regarding CVE-2023-41360: The vulnerable code was introduced[5] in version 8.4.0, and the recipe version is not vulnerable. Due to this ignore this CVE. Regarding CVE-2023-41361: The vulnerable code was introduced[6] in version 9.0 and the recipe version is not vulnerable. Due to this ignore this CVE. [1]: https://github.com/FRRouting/frr/commit/0a95d121ca8e1f43d41d952d6c82d111ca850085 [2]: https://github.com/FRRouting/frr/commit/54a3e60b3ebd3621c4dd90b0b49e8e36e4e100d8 [3]: https://github.com/FRRouting/frr/pull/14232 [4]: https://github.com/FRRouting/frr/pull/15927 [5]: https://github.com/FRRouting/frr/commit/f1aa49293a4a8302b70989aaa9ceb715385c3a7e [6]: https://github.com/FRRouting/frr/commit/234f6fd4f4804bb17bd8cbb1dd91994a914f38d2 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* proftpd: ignore CVE-2021-47865Gyorgy Sarvari2026-01-301-0/+3
| | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-47865 This CVE was opened based on a 5 years old Github issue[1], and has been made public recently. The CVE wasn't officially disputed (yet?), but based on the description and the given PoC the application is working as expected. The vulnerability description and the PoC basically configures proftpd to accept maximum x connections, and then when the user tries to open x + 1 concurrent connections, it refuses new connections over the configured limit. See also discussion in the Github issue. I just put it on the ignore list. [1]: https://github.com/proftpd/proftpd/issues/1298 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* openvpn: ignore CVE-2024-4877 and CVE-2025-13751Gyorgy Sarvari2026-01-301-2/+2
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-4877 https://nvd.nist.gov/vuln/detail/CVE-2025-13751 The vulnerabilities are specific to Windows platform, not relevant to OE. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tcpreplay 4.4.4: Fix CVE-2025-9384Jackson2026-01-302-0/+39
| | | | | | | | | | | | | There is a NULL Pointer Dereference in ports2PORT when the user passes ill-formatted portmap string to tcprewrite with option -r or --portmap Upstream Repository: https://github.com/appneta/tcpreplay.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-9384 CVE: CVE-2025-9384 Signed-off-by: Jackson <jacksonj2@kpit.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-ldap: patch CVE-2025-61912Gyorgy Sarvari2026-01-202-1/+44
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61912 Pick the patch that's mentioned by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-ldap: patch CVE-2025-61911Gyorgy Sarvari2026-01-202-0/+42
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-61911 Pick the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* squid: upgrade 4.15 -> 4.17Gyorgy Sarvari2026-01-201-1/+1
| | | | | | | | | | | | | | | | These are bugfix releases. Changelogs: 4.17: - WCCP: Validate packets better 4.16: - Regression Fix: --with-valgrind-debug build broken since 4.15 - Bug 5129 pt1: remove Lock use from HttpRequestMethod - Bug 5128: Translation: Fix '% i' typo in es/ERR_FORWARDING_DENIED - Bug 4528: ICAP transactions quit on async DNS lookups Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* memcached: ignore disputed CVE-2022-26635Peter Marko2026-01-091-0/+3
| | | | | | | | | | | | | | | | | | | Per [1] this is a problem of applications using memcached inproperly. This should not be a CVE against php-memcached, but for whatever software the issue was actually found in. php-memcached and libmemcached provide a VERIFY_KEY flag if they're too lazy to filter untrusted user input. [1] https://github.com/php-memcached-dev/php-memcached/issues/519 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 889ccce6848276fa68b3736b345552a533bc6bd2) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* wireshark: ignore CVE-2024-24476, CVE-2024-24478 and CVE-2024-24479Gyorgy Sarvari2026-01-091-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-24476 https://nvd.nist.gov/vuln/detail/CVE-2024-24478 https://nvd.nist.gov/vuln/detail/CVE-2024-24479 Upstream disputes all three vulnerabilities[1]. Looking at the history, even though they were valid issues for some period of time, none of them made it to an actual stable release: the vulnerabilities were caused, caught and fixed in the same development cycle between two releases. CVE-2024-24476: vulnerability introduced with[2], fixed with[3] CVE-2024-24478: vulnerability introduced with[4], fixed with[5] CVE-2024-24479: vulnerability introduced with[6], fixed with[7] Ignore all three of these vulnerabilities, as they are not present in the used recipe version. [1]: https://www.wireshark.org/docs/relnotes/wireshark-4.2.4.html [2]: https://github.com/wireshark/wireshark/commit/395e3b6cb595bfc610f3c26e7e9eb1f8729fd952 [3]: https://github.com/wireshark/wireshark/commit/108217f4bb1afb8b25fc705c2722b3e328b1ad78 [4]: https://github.com/wireshark/wireshark/commit/a9a62ff576ae79e0d6afb3214a5d409ec4cdf9d7 [5]: https://github.com/wireshark/wireshark/commit/80a4dc55f4d2fa33c2b36a99406500726d3faaef [6]: https://github.com/wireshark/wireshark/commit/53ec634ac2bf5f87a594aa72f16ca21c25a146a9 [7]: https://github.com/wireshark/wireshark/commit/c3720cff158c265dec2a0c6104b1d65954ae6bfd Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* wireshark: upgrade 3.4.12 -> 3.4.16Gyorgy Sarvari2026-01-092-147/+1
| | | | | | | | | | | | | | These are all bugfix releases. Drop CVE-2022-3190.patch, as it is included in 3.4.16. Changelogs: 3.4.13: https://www.wireshark.org/docs/relnotes/wireshark-3.4.13.html 3.4.14: https://www.wireshark.org/docs/relnotes/wireshark-3.4.14.html 3.4.15: https://www.wireshark.org/docs/relnotes/wireshark-3.4.15.html 3.4.16: https://www.wireshark.org/docs/relnotes/wireshark-3.4.16.html Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* wireshark: fix CVE-2025-11626Hitendra Prajapati2026-01-092-0/+100
| | | | | | | Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/513e5d49724f4a0695c5d2a08ce422c09cb999c8 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* openflow: don't overwrite CVE_CHECK_IGNOREGyorgy Sarvari2026-01-081-4/+4
| | | | | | | | | | The recipe contains two CVE_CHECK_IGNORE declarations, and the second one overwrites the first one - however the first one is also important. Instead of overwriting it, just append them to each other. Also, move the operations closer to each other, so it's easier to see what's going on. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* net-snmp: Fix for CVE-2025-68615Vijay Anusuri2026-01-082-0/+34
| | | | | | | | | Upstream-Status: Backport from https://github.com/net-snmp/net-snmp/commit/b4e6f826d9ddcc2d72eac432746807e1234266db Reference: https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tinyproxy: patch CVE-2025-63938Gyorgy Sarvari2026-01-082-0/+42
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-63938 Pick the patch that is referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* lldpd: patch CVE-2021-43612Gyorgy Sarvari2026-01-082-6/+99
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-43612 Pick the patch referenced by the NVD advisory. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* proftpd: set status of CVE-2001-0027Peter Marko2026-01-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | This ancient CVE [1] is unversioned ("*") in NVD DB. "mod_sqlpw module in ProFTPD does not reset a cached password..." Looking at history and changelog, the module was removed [2] around the time when this CVE was published, likely as reaction to this CVE. "mod_sqlpw.c, mod_mysql.c and mod_pgsql.c have been REMOVED from the distribution. They are currently unmaintained and have numerous bugs." Note: It was later re-introduced as mod_sql when it got fixed under new maintainer. [1] https://nvd.nist.gov/vuln/detail/CVE-2001-0027 [2] https://github.com/proftpd/proftpd/blob/v1.3.8b/NEWS#L3362 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 03a1b56bc7ce88a3b0ad6790606b0498899cc1e3) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* civetweb: patch CVE-2025-9648Ankur Tyagi2026-01-082-0/+235
| | | | | | | | | | | | Details https://nvd.nist.gov/vuln/detail/CVE-2025-9648 Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com> (cherry picked from commit eb338ebb606f22363be5b4114e25a10b494b4f55) Rebased patch on Kirkstone's civetweb. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nbdkit: remove unused patchGyorgy Sarvari2026-01-081-39/+0
| | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nbdkit: patch CVE-2025-47712Gyorgy Sarvari2026-01-082-0/+163
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47712 Pick the patch from the project's repository which explicitly mentions this vulnerability ID. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nbdkit: patch CVE-2025-47711Gyorgy Sarvari2026-01-082-1/+170
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47711 Pick the patch from the repository which explicitly mentions this CVE ID. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* mtr: patch CVE-2025-49809Gyorgy Sarvari2025-12-252-1/+41
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49809 Pick the patch mentioned in the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* proftpd: patch CVE-2024-48651Gyorgy Sarvari2025-12-172-1/+323
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-48651 Backport the patch mentioned in the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* wireshark: fix CVE-2025-13499Hitendra Prajapati2025-12-162-0/+42
| | | | | | | Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/e180152d3dae668249f78c72a55a4ba436b57af7 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* mbedtls: fix CVE-2025-47917Kai Kang2025-12-162-1/+55
| | | | | | | | | | | CVE-2025-47917 is that the function mbedtls_x509_string_to_names() takes a head argument and performs a deep free() on it. Backport patch to fix CVE-2025-47917 and drop the modification in doc file and comment in header file which lack of context. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* znc: patch CVE-2024-39844Gyorgy Sarvari2025-12-142-1/+64
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-39844 Pick the patch that is mentioned in the oss-security[1] advisory [1]: https://www.openwall.com/lists/oss-security/2024/07/03/9 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* babeld: fix installation with usrmergeGyorgy Sarvari2025-12-021-1/+1
| | | | | | | | | | | | In case usrmerge DISTRO_FEATURE is enabled, the recipe installed the application to /bin folder, which is however a symlink to /usr/bin, so the installation ultimately failed. To fix this, set the correct prefix for the installation. This is a partial backport of f91983f1f3e897d25ab477fdfb5baed89ccc0daf Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* usbredir: patch CVE-2021-3700Gyorgy Sarvari2025-11-302-1/+77
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3700 Pick the patch mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* usrsctp: patch CVE-2019-20503Gyorgy Sarvari2025-11-302-1/+56
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2019-20503 Pick the patch mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* spice: correct SRC_URIGyorgy Sarvari2025-11-171-2/+2
| | | | | | The previous repository was moved to freedesktop's gitlab instance Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-22 05:48:59 +0000