Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-4.0.29 2025-08-08T13:32:44+00:00 2025-08-08T13:32:44+00:00 Steve Sakoman steve@sakoman.com 2025-08-08T13:31:30+00:00 urn:sha1:81ab000fa437ca04f584a3327b076f7a512dc6d0 (From OE-Core rev: bd620eb14660075fd0f7476bbbb65d5da6293874) Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-08T13:30:56+00:00 Steve Sakoman steve@sakoman.com 2025-08-06T15:05:49+00:00 urn:sha1:3c825671cb8f30e6205f1bcf177f3432161295f5 (From meta-yocto rev: e916d3bad58f955b73e2c67aba975e63cd191394) Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-08T13:30:56+00:00 Peter Marko peter.marko@siemens.com 2025-07-30T22:08:47+00:00 urn:sha1:b4dcef5ed5dfa15c05c770d8772419551929febb This is a single commit bump containing only CVE fix $ git log --oneline d80401002011f470d9c6eb604bf734715e9b3a8c..a66bc3941ff298e474d5f02d0c3303401951141f a66bc3941f posix: Fix double-free after allocation failure in regcomp (bug 33185) Test results didn't change except newly added test succeeding. (tst-regcomp-bracket-free) Also add CVE-2025-0395 ignore which was already included in previous hash bumps. Also drop an unreferenced patch. (From OE-Core rev: 3921549f6420e44a250d06cdef2c9d423fb6e39f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-08T13:30:56+00:00 Peter Marko peter.marko@siemens.com 2025-08-03T19:17:38+00:00 urn:sha1:a7f2f317f558347a6210601ca047889c25608ab4 The vulnerable code was introduced in 3.44.0 via [1]. (See fix commit [2]) Also Debian says "not vulnerabele yet for 3.40.1 in [3] [1] https://github.com/sqlite/sqlite/commit/e1e67abc5cf67f931aab1e471eda23d73f51d456 [2] https://sqlite.org/src/info/498e3f1cf57f164f [3] https://security-tracker.debian.org/tracker/CVE-2025-3277 (From OE-Core rev: ebacd5cd2827c1a9a45a92353518f9d976597526) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-08T13:30:56+00:00 Peter Marko peter.marko@siemens.com 2025-08-03T08:52:07+00:00 urn:sha1:bedacbb603d377c4b615fb86e3bcee2dac6ca117 Pick patch [1] listed in [2]. Also pick another patch which is precondition to this one introducing variable needed for the check. [1] https://sqlite.org/src/info/12ad822d9b827777 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-7458 (From OE-Core rev: 4d5093e5103016c08b3a32fd83b1ec9edd87cd5a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-08T13:30:55+00:00 Zhang Peng peng.zhang1.cn@windriver.com 2025-07-31T06:06:42+00:00 urn:sha1:9e416e05f6af7a97d0a589dbc687f743180e2bb0 CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: 7bd9fee6d654326ea921b51113de99f793e11545) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-04T13:40:00+00:00 Marco Cavallini m.cavallini@koansoftware.com 2025-07-21T09:39:38+00:00 urn:sha1:f29a38bdcb908a75b8314b500802ffa651f976ed After compact vsdisk you have to detach it before exiting otherwise the vdisk remains attached. DISKPART> select vdisk file="<path_to_VHDX_file>" DISKPART> attach vdisk readonly DISKPART> compact vdisk DISKPART> detach <------------ new missing command DISKPART> exit (From yocto-docs rev: bf855ecaf4bec4cef9bbfea2e50caa65a8339828) Signed-off-by: Marco Cavallini <m.cavallini@koansoftware.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 1cc65ddf1a074f61fe5a63d222f3079b7fcb4c1e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-04T13:40:00+00:00 Vijay Anusuri vanusuri@mvista.com 2025-07-29T10:01:56+00:00 urn:sha1:bc3d85398a0ffc26f5c808e0daa44a5af17a7180 Upstream-Status: Backport from https://github.com/sqlite/sqlite/commit/c52e9d97d485a3eb168e3f8f3674a7bc4b419703 (From OE-Core rev: b4a2f74ba0b40abcdf56c4b58cae5f7ce145d511) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-04T13:40:00+00:00 Deepesh Varatharajan Deepesh.Varatharajan@windriver.com 2025-07-29T09:15:32+00:00 urn:sha1:31dd8d47a6ce0f4298e92e537b7cf836a093dfab objcopy: Don't extend the output section size Since the output section contents are copied from the input, don't extend the output section size beyond the input section size. Backport a patch from upstream to fix CVE-2025-7545 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944] (From OE-Core rev: 4f461ed46b7694fc4815c7f0504b9cefe5da8e19) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2025-08-04T13:40:00+00:00 Peter Marko peter.marko@siemens.com 2025-07-28T20:19:19+00:00 urn:sha1:7a75b9b4a7b8ae30d4dae646f3228b57e93be9b2 Pick commit referencing this CVE from 2.13 branch. (From OE-Core rev: 9418c88c964dffc21abe6a056db72c3c81e25137) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>