summaryrefslogtreecommitdiffstats
path: root/meta-oe
Commit message (Collapse)AuthorAgeFilesLines
* fio: fix CVE-2025-10823Saravanan2025-10-172-0/+39
| | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-10823 https://github.com/axboe/fio/issues/1982 Upstream-patch: https://github.com/axboe/fio/commit/6a39dfaffdb8a6c2080eec0dc7fb1ee532d54025 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* emlog: set CVE_PRODUCTPeter Marko2025-10-171-0/+2
| | | | | | | | | | This will remove false-positive CVE-2024-50655 from reports. There are different emlog components from other vendors around. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d8d45d909315f5c784234261bb3e97d2e1f0a102) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* st: Update status for CVE-2017-16224Ninette Adhikari2025-10-171-0/+3
| | | | | | | | | | | | | | | The recipe used in the meta-openembedded is a different st package compared to the one which has the CVE issue. Package used in meta-embedded: https://st.suckless.org/ Package with CVE issue: https://www.npmjs.com/package/st No action required. Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit eb9c7bb5645b6a3bcf7c40e1a83c8f4c3b020fa5) Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* poppler: fix CVE-2025-43718Yogita Urade2025-10-172-0/+32
| | | | | | | | | | | | | | | | | | Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular expression for a long pdfsubver string. This occurs in Dict::lookup, Catalog::getMetadata, and associated functions in PDFDoc, with deep recursion in the regex executor (std::__detail::_Executor). Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-43718 Upstream patch: https://gitlab.freedesktop.org/poppler/poppler/-/commit/f54b815672117c250420787c8c006de98e8c7408 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* xsp: CVE status update for CVE-2006-2658Ninette Adhikari2025-10-171-0/+3
| | | | | | | | | | | | | | The recipe used in the `meta-openembedded` is a different xsp package compared to the one which has the CVE issue. Package used in `meta-embedded`: maemo xsp http://repository.maemo.org/pool/maemo/ossw/source/x/xsp/ Package with CVE issue: mono xsp https://github.com/mono/xsp Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3cb411a05744eaa6e822c3d435d9205aa87ff632) Reworked for Kirkstone (CVE_CHECK_IGNORE vs CVE_STATUS) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* zchunk: patch CVE-2023-46228Gyorgy Sarvari2025-10-172-1/+108
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46228 Pick the patch that's mentioned in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* zlog: patch CVE-2021-43521Gyorgy Sarvari2025-10-172-1/+28
| | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2021-43521 Pick the patch that resolves the issue linked in the nvd report. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* iniparser: Fix CVE-2025-0633Soumya Sambu2025-10-172-0/+39
| | | | | | | | | | | | | | | Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory References: https://nvd.nist.gov/vuln/detail/CVE-2025-0633 https://security-tracker.debian.org/tracker/CVE-2025-0633 Upstream patch: https://gitlab.com/iniparser/iniparser/-/commit/072a39a772a38c475e35a1be311304ca99e9de7f Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* iperf2: ignore irrelevant CVEsGyorgy Sarvari2025-10-171-0/+3
| | | | | | | | | | | | | | These CVEs are for iperf3 - which is a similar application in its goals (and name), but an independent project from this, and the projects are independent implementations also, they share no common code. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit aedf74e08230f60c270032e8b937d1ab9bd2fc9c) Reworked for Kirkstone (CVE_STATUS -> CVE_CHECK_IGNORE)) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* imagemagick: Fix CVE-2022-28463virendra thakur2025-10-172-0/+27
| | | | | | | | | Imagemagick is vulnerable to buffer overflow. Reference: https://github.com/ImageMagick/ImageMagick/commit/ca3654ebf7a439dc736f56f083c9aa98e4464b7f Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* cryptsetup: Update the license fieldSana Kazi2025-10-171-1/+1
| | | | | | | | | | | | The below reference clearly states that GPL-2.0-with-OpenSSL-exception is to be used with GPL 2.0 or GPL3.0 and not as a standalone license. Therefore, update the correct license. Reference: https://github.com/aboutcode-org/scancode-licensedb/blob/569d72e13e7c8d14a44380f91e80c5a2d4091f8f/docs/openssl-exception-gpl-2.0.yml#L7 Signed-off-by: Sana Kazi <Sana.Kazi@bmwtechworks.in> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* udisks2: fix CVE-2025-8067Saravanan2025-10-172-1/+40
| | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8067 Upstream-patch: https://github.com/storaged-project/udisks/commit/9ed2186f668c76aeb472de170d62b499d85a1915 Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* botan: patch CVE-2024-50382 and CVE-2024-50383Gyorgy Sarvari2025-10-122-0/+68
| | | | | | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-50382 https://nvd.nist.gov/vuln/detail/CVE-2024-50383 Pick patch mentioned in the URL list of the nist page - the same patch fixes both vulnerabilities. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* botan: patch CVE-2024-39312Gyorgy Sarvari2025-10-122-0/+750
| | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2024-39312 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* botan: patch CVE-2022-43705Gyorgy Sarvari2025-10-125-1/+207
| | | | | | Details: https://nvd.nist.gov/vuln/detail/CVE-2022-43705 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ace: ignore CVE-2009-1147Gyorgy Sarvari2025-10-121-0/+3
| | | | | | The CVE is for another product, for VMWare ACE, not for this one. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* fbida: fix make fbpdf build optionalsimoneScaravati2025-10-102-0/+107
| | | | | | | | this is a backport-like from scarthgap branch: fbida_git.bb and patch 0001-meson.build-make-fbpdf-build-optional.patch From Github Pull request: https://github.com/openembedded/meta-openembedded/pull/1008 Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* collectd: set working SRC_URIGyorgy Sarvari2025-10-021-1/+1
| | | | | | | The project started to outsource the source hosting to Google storage and Github. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* psqlodbc: set valid SRC_URIGyorgy Sarvari2025-10-021-1/+1
| | | | | | The old URI stopped working. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* tree: fix broken linksBenjamin Szőke2025-10-011-2/+2
| | | | | | | | | | | | | New tarball location is: http://oldmanprogrammer.net/tar/tree/ Homepage is: http://oldmanprogrammer.net/source.php?dir=projects/tree Signed-off-by: Benjamin Szőke <egyszeregy@freemail.hu> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0c4079fc28cc36cb2dbfe48093f2cf64106f8b5d) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* span-lite: do not inherit ptestTim Orling2025-10-011-1/+0
| | | | | | | | | This recipe provides no run-ptest script. Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0fc5f550d31f82aa348a4145573df3aea896f5ab) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* smarty: upgrade 4.1.0 -> 4.1.1Wang Mingyu2025-10-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: ========== Security -------- Prevent PHP injection through malicious block name or include file name. This addresses CVE-2022-29221 Fixed ------- Exclude docs and demo from export and composer #751 PHP 8.1 deprecation notices in demo/plugins/cacheresource.pdo.php #706 PHP 8.1 deprecation notices in truncate modifier #699 Math equation max(x, y) didn't work anymore #721 Fix PHP 8.1 deprecated warning when calling rtrim #743 PHP 8.1: fix deprecation in escape modifier #727 Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9374648c390aebb87540781de54b0caf85340b16) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* lcov: Fix Perl PathAlex Yao2025-10-011-1/+1
| | | | | | | | | | | Fixes an issue where lcov is using the system Perl rather than the yocto provided Perl. This causes packages to not be found during runtime such as PerlIO::gzip. Signed-off-by: Alex Yao <alexyao1@meraki.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e66ae31c9522a6acf42720edb7623a93407a983a) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* synergy: patch CVE-2020-15117Peter Marko2025-10-012-0/+49
| | | | | | | | | | | | | | | Pick commit based on [1]. Note that the pick is node from deskflow, which is open-source successor of synergy. If anyone uses thie recipe, it should be switched. [1] https://github.com/deskflow/deskflow/security/advisories/GHSA-chfm-333q-gfpp Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit db283053d096cf77df8e4444ce91e5d882f8850c) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* procmail: patch CVE-2017-16844.Peter Marko2025-10-012-0/+21
| | | | | | | | | | Take patch from Debian. https://sources.debian.org/data/main/p/procmail/3.22-26%2Bdeb10u1/debian/patches/30 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3d97f4c13d5f5810659e107f6461f0b63f6fa92a) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* procmail: patch CVE-2014-3618Peter Marko2025-10-012-1/+32
| | | | | | | | | | Take patch from Debian. https://sources.debian.org/data/main/p/procmail/3.22-20%2Bdeb7u1/debian/patches/CVE-2014-3618.patch Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8378820dab0b6955fb0e2b27f24a1626f9124e5b) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* procmail: Update status for CVE-1999-0475Ninette Adhikari2025-10-011-0/+3
| | | | | | | | | | | | | Current version 3.22 is not affected by the issue. Affected versions: Up to (excl.) 3.2.1 Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 30e6d975e8d7567b40cbdfd22e89bc1a7e1a9c86) Adapted to Kirkstone Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* openct: Fix typo in SUMMARY variableJulian Haller2025-10-011-1/+1
| | | | | | | Signed-off-by: Julian Haller <julian.haller@philips.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 38f62a5fb36ea55205598830bb683ab7447e7fe2) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* ne10: append +git instead of gitr+Martin Jansa2025-10-011-1/+1
| | | | | | | | | | * looks like a typo introduced in: https://git.openembedded.org/meta-openembedded/commit/?id=6e431331d18ded23a78e238ed40d03434e7719d9 * use +git as most other recipes are using Signed-off-by: Martin Jansa <martin.jansa@gmail.com> (cherry picked from commit 10703e5c6a51ef14b357c5c2021979ecedcaeb13) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* multipath-tools: Use https for githubFabio Estevam2025-10-011-1/+1
| | | | | | | | | | | | Per convert-srcuri.py script, github repos should be accessed via https. Change it accordingly. Signed-off-by: Fabio Estevam <festevam@denx.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 4cef1e68ea59510d85b778e11179a2dac47c658b) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libtinyxml: patch CVE-2023-34194Peter Marko2025-10-012-0/+32
| | | | | | | | | | Take patch from Debian: https://salsa.debian.org/debian/tinyxml/-/commit/2366e1f23d059d4c20c43c54176b6bd78d6a83fc Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f4a6966bf0cc48ee7fa83c64c2eec2c4fbf91eb4) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libtinyxml: patch CVE-2021-42260Peter Marko2025-10-012-1/+30
| | | | | | | | | | Take patch from Debian: https://salsa.debian.org/debian/tinyxml/-/commit/38db99c12e43d7d6e349403ce4d39a706708603d Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 066cf35ae588ef5f81266b216624b95d37777661) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libtar: patch CVEsKatariina Lounento2025-10-0113-0/+854
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cve-check.bbclass reported unpatched vulnerabilities in libtar [1,2,3,4,5]. The NIST assigned base score for the worst vulnerability is 9.1 / critical. The patches were taken from the libtar [6] master branch after the latest tag v1.2.20 (the changes in libtar master mostly originate from Fedora and their patches), and from the Fedora 41 libtar source package [7] and the Debian libtar package 1.2.20-8 [8] where the patches were not available in the libtar repository itself. The Fedora patch series was taken in its entirety in order to minimize differences to Fedora's source tree instead of cherry-picking only CVE fixes. Minimizing the differences should avoid issues with potential inter-dependencies between the patches, and hopefully provide better confidence as even the newest patches have been in use in Fedora for nearly 2 years (since December 2022; Fedora rpms/libtar.git commit e25b692fc7ceaa387dafb865b472510754f51bd2). The series includes even the Fedora patch libtar-1.2.20-no-static-buffer.patch, which contains changes *) that match the libtar commit ec613af2e9371d7a3e1f7c7a6822164a4255b4d1 ("decode: avoid using a static buffer in th_get_pathname()") whose commit message says Note this can break programs that expect sizeof(TAR) to be fixed. The patches applied cleanly except for the Fedora srpm patch libtar-1.2.11-bz729009.patch, which is identical with the pre-existing meta-oe patch 0002-Do-not-strip-libtar.patch and is thus omitted. The meta-openembedded recipe does not include any of the patches in Kirkstone [9] nor the current master [10]. libtar does not have newer releases, and the libtar master doesn't contain all of the changes included in the patches. Fedora's libtar.1.2.11-*.patch are not included in the libtar v1.2.20 release either but only in the master branch after the tag v1.2.20. The version number in the filename is supposedly due to the patches being created originally against v1.2.11 but have been upstreamed or at least committed to the master only after v1.2.20. The commit metadata could not be practically completed in most of the cases due to missing commit messages in the original commits and patches. The informal note about the author ("Authored by") was added to the patch commit messages where the commit message was missing the original author(s)' Signed-off-by. *) The patch also contains the changes split to the libtar commits 495d0c0eabc5648186e7d58ad54b508d14af38f4 ("Check for NULL before freeing th_pathname") and 20aa09bd7775094a2beb0f136c2c7d9e9fd6c7e6 ("Added stdlib.h for malloc() in lib/decode.c")) [1] https://nvd.nist.gov/vuln/detail/CVE-2021-33643 [2] https://nvd.nist.gov/vuln/detail/CVE-2021-33644 [3] https://nvd.nist.gov/vuln/detail/CVE-2021-33645 [4] https://nvd.nist.gov/vuln/detail/CVE-2021-33646 [5] https://nvd.nist.gov/vuln/detail/CVE-2013-4420 [6] https://repo.or.cz/libtar.git [7] https://src.fedoraproject.org/rpms/libtar/tree/f41 [8] https://sources.debian.org/patches/libtar/1.2.20-8/CVE-2013-4420.patch/ [9] https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/libtar/libtar_1.2.20.bb?h=kirkstone&id=9a24b7679810628b594cc5a9b52f77f53d37004f [10] https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/libtar/libtar_1.2.20.bb?h=master&id=9356340655b3a4f87f98be88f2d167bb2514a54c Signed-off-by: Katariina Lounento <katariina.lounento@vaisala.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3c9b5b36c8dc619240ac422de2a0aaed0949de08) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* liboop: set correct LICENSEGyorgy Sarvari2025-10-011-1/+1
| | | | | | | Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0ea9584b84b5e23af9cc7285757d9032f31a968f) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libjs-jquery-icheck: Correct LIC_FILES_CHKSUMPeter Kjellerstedt2025-10-011-1/+1
| | | | | | | | | | | Only include the lines from icheck.js that cover the copyright and the license text. License-Update: Only include the relevant parts of icheck.js Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e1bced739968a68ed2743d011cd82791d380678b) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* dash: correct licenceDan McGregor2025-10-011-1/+1
| | | | | | | | | | | | According to its copyright file, dash is only BSD-3-Clause. It has a build time tool from bash that's under the GPL, but only the tool's output is used, not the tool itself. So all compiled artefacts in dash appear to share the same licence. Signed-off-by: Dan McGregor <dan.mcgregor@usask.ca> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8eba35f8b03659ffd73aceb52b6e78da8661a6dd) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* softhsm: switch source to GitHub repositoryJiaying Song2025-10-011-2/+3
| | | | | | | | | | The original source URL is unavailable, so it has been replaced with the official GitHub repository. Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f88db75ffa29e0d654f73cc174e01d9edaec6df2) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* nmap: add missing dependencyGyorgy Sarvari2025-10-011-1/+1
| | | | | | | | | | | | | | | Building with ndiff PACKAGECONFIG failed with the following error: | File "/yocto/sandbox/build/tmp/work/cortexa53-poky-linux/nmap/7.95/nmap-7.95/ndiff/setup.py", line 11, in <module> | import setuptools.command.install | ModuleNotFoundError: No module named 'setuptools' Fix it by adding the missing dependency. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3564ec12de4b5ed470e75a9e045adc6bec83c74d) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* python3-nmap: add missing run-time dependenciesBartosz Golaszewski2025-10-011-1/+5
| | | | | | | | | Add missing RDEPENDS for this package. Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit e20ebe6ce4f8b991cd4f153352274850d416f090) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libmad: patch CVE-2017-8372 and CVE-2017-8373Peter Marko2025-10-012-0/+831
| | | | | | | | | | | | Pick patch [1] from Debian based on [2]. [1] https://salsa.debian.org/multimedia-team/libmad/-/raw/debian/0.15.1b-11/debian/patches/length-check.patch?ref_type=tags [2] https://security-tracker.debian.org/tracker/CVE-2017-8374 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 60eb0214e71c5f761d450bcc484b57df6955bd09) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libmad: patch CVE-2017-8372 and CVE-2017-8373Peter Marko2025-10-012-0/+70
| | | | | | | | | | | | | Pick patch [1] from Debian based on [2] and [3]. [1] https://salsa.debian.org/multimedia-team/libmad/-/blob/debian/0.15.1b-11/debian/patches/md_size.diff?ref_type=tags [2] https://security-tracker.debian.org/tracker/CVE-2017-8372 [3] https://security-tracker.debian.org/tracker/CVE-2017-8373 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 437635f608f2d9b69fefcde9ebfcff2bab64d35e) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libmad: ignore CVE-2017-11552 and CVE-2018-7263Peter Marko2025-10-011-0/+3
| | | | | | | | | | | | | | | These CVEs are for mpg321, not libmad. See Debian assessment: * https://security-tracker.debian.org/tracker/CVE-2017-11552 * https://security-tracker.debian.org/tracker/CVE-2018-7263 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit fee86a312fbcaef7aaad66fe2f6756bd7e57d585) Adapted to Kirkstone. Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* libmad: switch links/SRC_URI to https sitesRandy MacLeod2025-10-011-4/+3
| | | | | | | | | | | Switch to the sourceforge SRC_URI since the mars.org site only supports ftp. Also switch the HOMEPAGE and BUGTRACKER links over to https. and drop the obsolete SRC_URI[md5sum]. Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f61cc5260954e840494194805f6f957f60cd4833) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* audiofile: patch CVE-2017-6839Peter Marko2025-10-012-0/+127
| | | | | | | | | | Use patch from buildroot: https://github.com/buildroot/buildroot/commit/844a7c6281eb442881330a5d36d5a0719f2870bf Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 88faae83b2b0e68827c457f4f348f7d7868f5258) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* audiofile: patch CVE-2017-6831Peter Marko2025-10-012-0/+47
| | | | | | | | | | Use patch from buildroot: https://github.com/buildroot/buildroot/commit/bd5f84d301c4e74ca200a9336eca88468ec0e1f3 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9d668989b1447fb19aff55c1a47acdf8d4e8c5e2) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* audiofile: fix multiple CVEsPeter Marko2025-10-012-0/+80
| | | | | | | | | | | | CVE-2017-6830 / CVE-2017-6834 / CVE-2017-6836 / CVE-2017-6838 Use patch from buildroot: https://github.com/buildroot/buildroot/commit/4a1a8277bba490d227f413e218138e39f1fe1203 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 75f2bd2b3b145d8282db9926d8212c6d81bde99e) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* audiofile: patch CVE-2017-6829Peter Marko2025-10-012-0/+44
| | | | | | | | | | Use patch from buildroot: https://github.com/buildroot/buildroot/commit/434890df2a7c131b40fec1c49e6239972ab299d2 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f29fbaa4650201a059c65572947ed8faa991fcd8) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* audiofile: fix multiple CVEsPeter Marko2025-10-012-0/+46
| | | | | | | | | | | | CVE-2017-6827 / CVE-2017-6828 / CVE-2017-6832 / CVE-2017-6833 / CVE-2017-6835 / CVE-2017-6837 Use patch from buildroot: https://github.com/buildroot/buildroot/commit/cc00bde57fc20d11f8fa4e8ec5f193c091714c55 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 634cbcb91c3ab7154e0cda707663a1e4aa500f4a) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* minicoredumper: correct the sysvinit service file attributeMingli Yu2025-10-011-1/+1
| | | | | | | | | | | | Add the execute attribute for sysvinit service file to fix the below error: $ service minicoredumper status minicoredumper: unrecognized service Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d477cbb5267f39846d129f27d0f6a7f2b001db7b) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* x11vnc: Fix CVE-2020-29074Lee Chee Yang2025-10-012-0/+28
| | | | | | | Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit dbdea59838054f9c908533d486cf3c0c2897c791) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-16 16:00:35 +0000