linux/poky.git, branch kirkstone-4.0.26

build-appliance-image: Update to kirkstone head revision

2025-04-04T15:47:08+00:00

(From OE-Core rev: 1efbe1004bc82e7c14c1e8bd4ce644f5015c3346) Signed-off-by: Steve Sakoman

poky.conf: bump version for 4.0.26

2025-04-04T15:42:48+00:00

(From meta-yocto rev: 3dd438c749099f2a5e808c4690d7ea767263e5b5) Signed-off-by: Steve Sakoman

mesa: Update SRC_URI

2025-04-04T15:42:48+00:00

Update SRC_URI for mesa. The the tarball of mesa has been changed from: https://mesa.freedesktop.org/archive/ to: https://archive.mesa3d.org/ (From OE-Core rev: 6397cd1ad55927c312051cbd42d5825fa8ed969b) Signed-off-by: Guocai He Signed-off-by: Steve Sakoman

yocto-uninative: Update to 4.7 for glibc 2.41

2025-04-04T15:42:48+00:00

(From OE-Core rev: eb89509bfb976cfb62369b05f55534615afaf886) Signed-off-by: Michael Halstead Signed-off-by: Richard Purdie Signed-off-by: Martin Jansa Signed-off-by: Steve Sakoman

llvm : Fix CVE-2024-0151

2025-04-04T15:42:48+00:00

Backport a patch from upstream to fix CVE-2024-0151 Upstream-Status: Backport [https://github.com/llvm/llvm-project/commit/78ff617d3f573fb3a9b2fef180fa0fd43d5584ea] (From OE-Core rev: 883754a84accdc8f8418e83d3c54aa763bcdff87) Signed-off-by: Deepesh Varatharajan Signed-off-by: Steve Sakoman

freetype: patch CVE-2025-27363

2025-04-04T15:42:48+00:00

From [1]: An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild. Per [2] patches [3] and [4] are needed. Unfortunately, the code changed since 2.11.1 and it's not possible to do backport without significant changes. Since Debian and Ubuntu have already patched this CVE, take the patch from them - [5]/[6]. The patch is a combination of patch originally proposed in [7] and follow-up patch [4]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-27363 [2] https://gitlab.freedesktop.org/freetype/freetype/-/issues/1322 [3] https://gitlab.freedesktop.org/freetype/freetype/-/commit/ef636696524b081f1b8819eb0c6a0b932d35757d [4] https://gitlab.freedesktop.org/freetype/freetype/-/commit/73720c7c9958e87b3d134a7574d1720ad2d24442 [5] https://git.launchpad.net/ubuntu/+source/freetype/commit/?h=applied/ubuntu/jammy-devel&id=fc406fb02653852dfa5979672e3d8d56ed329186 [6] https://salsa.debian.org/debian/freetype/-/commit/13295227b5b0d717a343f276d77ad3b89fcc6ed0 [7] https://www.openwall.com/lists/oss-security/2025/03/14/3 (From OE-Core rev: 5a8d4c7a9a0e099da0294141cf5590b55f0503cd) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

perl: ignore CVE-2023-47038

2025-04-04T15:42:47+00:00

Fix for this CVE was backported to 5.34.2 in https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010 This commit is listed in https://security-tracker.debian.org/tracker/CVE-2023-47038 (From OE-Core rev: 46fd9acd6b0e418009f4cec747ae82af60acbc6b) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: ignore CVE-2025-1632

2025-04-04T15:42:47+00:00

As already mentioned in [1] when backporting commit including fix for this CVE, this vulnerability applies only from libarchive 3.7.0 commit [2] which introduced bsdunzip which contains this vulnerability. [1] https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=ec837d3b21b4f8b98abac53e2833f1490ba6bf1e [2] https://github.com/libarchive/libarchive/commit/c157e4ce8eb170a92945cc2d292fd7106bdfcce1 (From OE-Core rev: bf7654877ba99f0b18a1cf6f83032af5ecabd01f) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

zlib: fix CVE-2014-9485

2025-04-04T15:42:47+00:00

Directory traversal vulnerability in the do_extract_currentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive. Reference: https://security-tracker.debian.org/tracker/CVE-2014-9485 Upstream-patch: https://github.com/madler/zlib/commit/14a5f8f266c16c87ab6c086fc52b770b27701e01 (From OE-Core rev: 32c4b28fc06e39ab8ef86aebc5e1e1ae19934495) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

cve-update-nvd2-native: handle missing vulnStatus

2025-04-01T16:02:41+00:00

There is a new CVE which is missing vulnStatus field: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-2682 This leads to: File: '/poky/meta/recipes-core/meta/cve-update-nvd2-native.bb', lineno: 336, function: update_db 0332: 0333: accessVector = None 0334: vectorString = None 0335: cveId = elt['cve']['id'] *** 0336: if elt['cve']['vulnStatus'] == "Rejected": 0337: c = conn.cursor() 0338: c.execute("delete from PRODUCTS where ID = ?;", [cveId]) 0339: c.execute("delete from NVD where ID = ?;", [cveId]) 0340: c.close() Exception: KeyError: 'vulnStatus' (From OE-Core rev: 453c5c8d9031be2b3a25e2a04e0f5f6325ef7298) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman