summaryrefslogtreecommitdiffstats
path: root/meta-oe
Commit message (Collapse)AuthorAgeFilesLines
* libsodium: patch CVE-2025-69277Peter Marko2026-01-122-0/+63
| | | | | | | | | Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-69277 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* php: ignore CVE-2024-3566Jeroen Hofstee2026-01-081-0/+1
| | | | | | | | | | | CVE-2024-3566 only effects Microsoft Windows. Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d68c56e1ed2adc8246a18424ed5d9ede5e8254a0) Adapted to Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* spitools: upgrade 1.0.1 -> 1.0.2Gyorgy Sarvari2026-01-081-2/+2
| | | | | | | | | | This is a bugfix release, with some ioctl handling fixes. Changelog: - Adjust the handling of SPI_IOC_RD_LSB_FIRST ioctl call - Parameter for SPI_IOC_WR_LSB_FIRST ioctl is {0, 1}. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tree: upgrade 2.0.2 -> 2.0.4Gyorgy Sarvari2026-01-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: 2.0.4: - Fix missing comma in JSON output. 2.0.3: - Fix segfault when filelimit is used and tree encounters a directory it cannot enter. - Use += when assigning CFLAGS and LDFLAGS in the Makefile allowing them to be modified by environment variables during make. (Ben Brown) Possibly assumes GNU make. - Fixed broken -x option (stops recursing.) - Fix use after free (causing segfault) for dir/subdir in list.c - Fixes for .gitignore functionality - Fixed * handing in patmatch. Worked almost like ** before, now properly stops at /'s. These issues were the result of forgetting that patmatch() was just to match filenames to patterns, not paths. - Patterns starting with / are actually relative to the .gitignore file, not the root of the filesystem, go figure. - Patterns without /'s in .gitignore apply to any file in any directory under the .gitignore, not just the .gitignore directory - Remove "All rights reserved" from copyright statements. A left-over from trees original artistic license. - Add in --du and --prune to --help output - Fixed segfault when an unknown directory is given with -X - Fixed output up for -X and -J options. - Remove one reference to strnlen which isn't necessary since it may not be available on some OS's. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* usb-modeswitch: upgrade 2.6.0 -> 2.6.2Gyorgy Sarvari2026-01-081-2/+1
| | | | | | | | | | | | | | Changelog: 2.6.2: - Bug in C code (with gcc 1.5) fixed 2.6.1: - Wrapper now handles devices with non-continuous interface numbering: www.draisberghof.de/usb_modeswitch/bb/viewtopic.php?f=2&t=2915&p=19605 - catch error with retrieving the active configuration, exit gracefully: https://bugs.launchpad.net/bugs/1880191 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xdg-user-dirs: upgrade 0.17 -> 0.18Gyorgy Sarvari2026-01-081-2/+1
| | | | | | | | | Changelog: - Fixed minor leak - Documentation fixes - Updated translations Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* recipes-core/toybox: Switch SRC_URI to HTTPS for reliable fetchSanjay Chitroda2026-01-081-1/+1
| | | | | | | | | The upstream site (landley.net) serves inconsistent content when using HTTP, causing checksum mismatches during do_fetch. Using HTTPS ensures stable downloads and resolves checksum failures. Signed-off-by: Sanjay Chitroda <sanjayembeddedse@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: ignore CVE-2024-36137Gyorgy Sarvari2026-01-081-1/+1
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-36137 The vulnerability affects the permission model, which was introduced[1] in v20 - the recipe version isn't vulerable yet. [1]: https://github.com/nodejs/node/commit/00c222593e49d817281bc88a322f41f8dca95885 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: ignore CVE-2024-3566 and CVE-2024-36138Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-3566 https://nvd.nist.gov/vuln/detail/CVE-2024-36138 This vulnerabilities affect Windows only. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* sassc: ignore CVE-2022-43357Peter Marko2026-01-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | This CVE is fixed in current libsass recipe version. So wrapper around it will also not show this problem. It's usual usecase is to be statically linked with libsass which is probably the reason why this is listed as vulnerable component. [1] links [2] as issue tracker which points to [3] as fix. [4] as base repository for the recipe is not involved and files from [3] are not present in this repository. [1] https://nvd.nist.gov/vuln/detail/CVE-2022-43357 [2] https://github.com/sass/libsass/issues/3177 [3] https://github.com/sass/libsass/pull/3184 [4] https://github.com/sass/sassc/ Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 576b84263bac4dda26d84d116a9e7628a126f866) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Kirkstone has also the fixed libsass version (3.6.6), the CVE can be considered fixed. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: patch CVE-2024-27983Gyorgy Sarvari2026-01-082-0/+41
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-27983 Pick the patch that mentions this CVE ID explcitly in its commit message. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: ignore CVE-2024-22017Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-22017 The vulnerability is related to the io_uring usage of libuv. Libuv first introduced io_uring support in v1.45[1]. oe-core ships a non-vulnerable version (1.44.2), and nodejs vendors also an older version (1.43). Mark this CVE as ignored for this recipe version. [1]: https://github.com/libuv/libuv/commit/d2c31f429b87b476a7f1344d145dad4752a406d4 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: patch CVE-2023-39333Gyorgy Sarvari2026-01-082-0/+58
| | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-39333 Backport the patch that mentions this CVE ID explicitly in its commit message. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: ignore CVE-2023-30583, CVE-2023-30584 and CVE-2023-30587Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-30583 https://nvd.nist.gov/vuln/detail/CVE-2023-30584 https://nvd.nist.gov/vuln/detail/CVE-2023-30587 None of these vulnerabilities are present in the recipe version. CVE-2023-30583: While the main feature (blob) was intruced in v16, the vulnerable code (load blobs from file) was introduced in v20[1], and as such, the vulnerability is not present in the recipe version. CVE-2023-30584, CVE-2023-30587: The whole vulnerable feature (permission model) was introduced[2] in v20. Ignore these CVE IDs. [1]: https://github.com/nodejs/node/commit/950cec4c2642c15e2913f35babadda56c1d8a723 [2]: https://github.com/nodejs/node/commit/00c222593e49d817281bc88a322f41f8dca95885 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fio: ignore CVE-2025-10824Gyorgy Sarvari2026-01-081-0/+3
| | | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-10824 The upstream maintainer wasn't able to reproduce the issue[1], and the related bug is closed without further action. [1]: https://github.com/axboe/fio/issues/1981 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a275078cbeaa0fafcfa4eb60ca69f05a8fe3df99) Adapted to Kirkstone (CVE_STATUS -> CVE_CHECK_STATUS) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* atop: patch CVE-2025-31160Gyorgy Sarvari2026-01-082-0/+608
| | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-31160 Backport the patch that's subject references the CVE id explicitly. I was able to verify the patch with a reproducer[1] (which is mentioned in a reference[2] in the nvd report). Without the patch atop crashed, with the patch it worked fine (both with and without -k/-K flags). [1]: https://blog.bismuth.sh/blog/bismuth-found-the-atop-bug [2]: https://gist.github.com/kallsyms/3acdf857ccc5c9fbaae7ed823be0365e Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* php: upgrade 8.1.33 -> 8.1.34Gyorgy Sarvari2026-01-081-1/+1
| | | | | | | | | | | | | | | Comes with fixes for CVE-2025-14177, CVE-2025-14178 and CVE-2025-14180 Changelog: - Curl: Fix curl build and test failures with version 8.16. - Opcache: Reset global pointers to prevent use-after-free in zend_jit_status(). - PDO: Fixed: PDO quoting result null deref. (CVE-2025-14180) - Standard: * Fixed: Null byte termination in dns_get_record(). * Fixed: Heap buffer overflow in array_merge(). (CVE-2025-14178) * Fixed: Information Leak of Memory in getimagesize. (CVE-2025-14177) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xmlsec1: update SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | The tarball was moved to a subfolder. Adapt the SRC_URI. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* softhsm: correct SRC_URI branchGyorgy Sarvari2026-01-081-1/+1
| | | | | | The develop branch doesn't exist anymore. The fetched commit is on the main branch. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* thrift: fix SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | | The tarball was moved to an archive server, so the link stopped working. Update it to the new location. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* srecord: fix SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | | | The tarball was moved to a new folder in the SourceForge project, and the original convenience link stopped working. Use the direct link instead. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* pcp: switch SRC_URI to gitGyorgy Sarvari2026-01-081-2/+4
| | | | | | | | | | | The original link stopped working. I have compared the original tarball's content with this revision: the contents are bit-identical to each other. The only difference is that the original tarball came with an extra "debian/control" file which is not present in the git repository, but it not using for compiling. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tcsh: update SRC_URIGyorgy Sarvari2026-01-081-1/+1
| | | | | | The tarball was moved to a new subfolder, making do_fetch fall back to a mirror. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* hunspell: patch CVE-2019-16707Gyorgy Sarvari2026-01-082-1/+28
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2019-16707 Pick the patch that resolves the Github issue[1] that tracked this vulnerability. [1]: https://github.com/hunspell/hunspell/issues/624 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: patch CVE-2023-28447Gyorgy Sarvari2026-01-082-0/+75
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-28447 Pick the patch that is referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: update CVE_PRODUCTAnkur Tyagi2026-01-081-0/+2
| | | | | | | Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit ceadb83fcf18134b40b36cddcacbc8192ea68f82) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: patch CVE-2018-25047Gyorgy Sarvari2026-01-082-1/+143
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2018-25047 Pick the patch that resolved the issue referenced in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* snappy: add CVE_PRODUCTEmil Kronborg Andersen2025-12-251-0/+2
| | | | | | | | | | If CVE_PRODUCT is not explicitly set to google:snappy, CVEs are found for https://github.com/KnpLabs/snappy instead. Signed-off-by: Emil Kronborg Andersen <emkan@prevas.dk> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b888130e957eb4fe9d69fd70f3b3778ba980b728) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dbus-broker: patch CVE-2022-31212Gyorgy Sarvari2025-12-252-1/+73
| | | | | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-31212 A detailed writeup[1] is referenced by the nvd report, which describes that the vulnerability itself is not in the application, rather in a dependency of it, in c-shutil, which is pulled in as a submodule. Pick the patch from this submodule that fixes a stack overflow, and adds a test explictly verifying the described vulnerability. [1]: https://sec-consult.com/vulnerability-lab/advisory/memory-corruption-vulnerabilities-dbus-broker/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cups-filters: patch CVE-2023-24805Gyorgy Sarvari2025-12-252-0/+214
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-24805 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cups-filters: patch CVE-2025-64524Gyorgy Sarvari2025-12-252-0/+82
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-64524 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cups-filters: patch CVE-2025-57812Gyorgy Sarvari2025-12-252-1/+130
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57812 Backport the patch that is referenced by te nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* redis: ignore CVE-2025-46686Gyorgy Sarvari2025-12-252-0/+4
| | | | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-46686 Upstream disputes that it is a security violation, and says that implementing a mitigation for this would negatively affect the rest of the application, so they elected to ignore it. See Github advisory about the same vulnerability: https://github.com/redis/redis/security/advisories/GHSA-2r7g-8hpc-rpq9 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nanopb: patch CVE-2024-53984Gyorgy Sarvari2025-12-252-1/+39
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-53984 Pick the patch referenced by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* zabbix: patch CVE-2025-49643Gyorgy Sarvari2025-12-252-0/+39
| | | | | | | | | | | The actual patch was identified by checking the file that was modified in the tag 6.0.42, and also by looking at the Jira item referenced by it: the patch references DEV-4466, the same ID that is referenced in the Jira ticket[1] referenced by the NVD report (look in the "All Activity" tab). [1]: https://support.zabbix.com/browse/ZBX-27284 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: patch CVE-2025-62171Gyorgy Sarvari2025-12-252-0/+27
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-62171 Pick the patch that's mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: patch CVE-2025-65955Gyorgy Sarvari2025-12-252-0/+26
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2025-65955 Pick the patch referenced by the NVD report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: patch CVE-2022-1115Gyorgy Sarvari2025-12-252-0/+26
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-1115 Pick the patch referenced in the NVD report. Tested successfully against the PoC described in the related Github issue[1]. [1]: https://github.com/ImageMagick/ImageMagick/issues/4974 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* krb5: fix for CVE-2024-3596Hitendra Prajapati2025-12-252-0/+629
| | | | | | | Upstream-Status: Backport from https://github.com/krb5/krb5/commit/871125fea8ce0370a972bf65f7d1de63f619b06c Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nodejs: fix CVE_PRODUCTGyorgy Sarvari2025-12-221-1/+1
| | | | | | | | | | The CVE_PRODUCT is set with a weak default assignment in the cve-check.bbclass, which means that when the recipe uses +=, it overrides the original weak adefault value instead of appending to it. Set all applicable values in CVE_PRODUCT variable explicitly. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* postgresql: upgrade 14.19 -> 14.20Gyorgy Sarvari2025-12-172-2/+2
| | | | | | | | Beside other bugfixes, it contains fixes for CVE-2025-12817 and CVE-2025-12818. Release notes: https://www.postgresql.org/docs/release/14.20/ Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* botan: patch CVE-2024-34702Gyorgy Sarvari2025-12-161-1/+1
| | | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-34702 The same patch fixes both CVE-2024-39312 and CVE-2024-34702, according to the release notes[1] of the final 2.9.x release. [1]: https://github.com/randombit/botan/blob/2.19.5/news.rst Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* audit: Fix CVE_PRODUCTShinji Matsunaga2025-12-162-0/+4
| | | | | | | | | | | | | | | | | | | Fix "audit" set in CVE_PRODUCT to "linux:audit" to detect only vulnerabilities where the vendor is "linux". Currently, CVE_PRODUCT also detects vulnerabilities where the vendor is "visionsoft", which are unrelated to the "audit" in this recipe. https://www.opencve.io/cve?vendor=visionsoft&product=audit In addition, all the vulnerabilities currently detected in "audit" have the vendor of "visionsoft" or "linux". Therefore, fix "audit" set in CVE_PRODUCT to "linux:audit". Signed-off-by: Shinji Matsunaga <shin.matsunaga@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e87e51da49fe121be8f6dd4cec3263a345f2f876) Adapted to Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* gosu: set SRCREV_FORMAT variableGyorgy Sarvari2025-12-141-2/+4
| | | | | | | | | | | | | | | | | The recipe fetches from multiple repositories, however the SRCREV_FORMAT variable wasn't set. Due to this the recipe couldn't reuse sstate artifacts from a mirror, only threw warnings: WARNING: gosu-1.14-r0 do_package_qa_setscene: ExpansionError('SRCPV', '${@bb.fetch2.get_srcrev(d)}', FetchError('The SRCREV_FORMAT variable must be set when multiple SCMs are used.\nThe SCMs are: git://github.com/tianon/gosu.git;branch=master;protocol=https git://github.com/opencontainers/runc;name=runc;branch=main;protocol=https', None)) WARNING: Setscene task (/cocto/kirkstone-next/meta-openembedded/meta-oe/recipes-support/ gosu/gosu_1.14.bb:do_package_qa_setscene) failed with exit code '1' - real task will be run instead Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* sysdig: set SRCREV_FORMATGyorgy Sarvari2025-12-141-0/+2
| | | | | | | | | | | | | | | | | It fetches from multiple repositories, but didn't have SRCREV_FORMAT set. Because of this, the recipe couldn't use sstate artifacts from a mirror, just threw many warnings: WARNING: sysdig-0.28.0-r0 do_package_qa_setscene: ExpansionError('SRCPV', '${@bb.fetch2.get_srcrev(d)}', FetchError('The SRCREV_FORMAT variable must be set when multiple SCMs are used.\nThe SCMs are:\ngit://github.com/draios/sysdig.git;branch=dev;protocol=https;name=sysdig git://github.com/falcosecurity/libs;protocol=https;branch=master;name=falco;subdir=git/falcosecurity-libs', None)) WARNING: Setscene task (/cocto/kirkstone-next/meta-openembedded/meta-oe/recipes-extended/sysdig/sysdig_0.28.0.bb :do_package_qa_setscene) failed with exit code '1' - real task will be run instead Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* zlog: patch CVE-2024-22857Gyorgy Sarvari2025-12-142-0/+32
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-22857 Pick the patch from the PR mentioned by the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ImageMagick: Fix CVE-2023-34151Divyanshu Rathore2025-12-125-0/+2343
| | | | | | | | | | | | | | | | | Backport the fix for CVE-2023-34151 Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/3d6d98d8a2be30d74172ab43b5b8e874d2deb158] Add below patch to fix 0011-ImageMagick-Fix-CVE-2023-34151.patch Add below support patch to fix 0011-ImageMagick-Add-support-patch-1-to-fix-CVE-2023-3415.patch 0011-ImageMagick-Add-support-patch-2-to-fix-CVE-2023-3415.patch 0011-ImageMagick-Add-support-patch-3-to-fix-CVE-2023-3415.patch Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ImageMagick: Fix CVE-2025-55298Divyanshu Rathore2025-12-126-0/+706
| | | | | | | | | | | | | | | | | | | Backport the fix for CVE-2025-55298 Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/439b362b93c074eea6c3f834d84982b43ef057d5] [https://github.com/ImageMagick/ImageMagick/commit/1f93323df9d8c011c31bc4c6880390071f7fb895] Add below patch to fix 0010-ImageMagick-Fix-CVE-2025-55298-1.patch 0010-ImageMagick-Fix-CVE-2025-55298-2.patch Add below support patch to fix 0010-ImageMagick-Add-support-patch-1-to-fix-CVE-2025-5529.patch 0010-ImageMagick-Add-support-patch-2-to-fix-CVE-2025-5529.patch 0010-ImageMagick-Add-support-patch-3-to-fix-CVE-2025-5529.patch Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ImageMagick: Fix CVE-2025-55154Divyanshu Rathore2025-12-122-0/+85
| | | | | | | | | | | | Backport the fix for CVE-2025-55154 Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/db986e4782e9f6cc42a0e50151dc4fe43641b337] Add below patch to fix 0009-ImageMagick-Fix-CVE-2025-55154.patch Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ImageMagick: Fix CVE-2025-57807Divyanshu Rathore2025-12-122-0/+52
| | | | | | | | | | | | Backport the fix for CVE-2025-57807 Upstream-Status: Backport [https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e] Add below patch to fix 0008-ImageMagick-Fix-CVE-2025-57807.patch Signed-off-by: Divyanshu Rathore <Divyanshu.Rathore@bmwtechworks.in> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-02-13 20:05:35 +0000