linux/poky.git/meta/recipes-connectivity/avahi, branch kirkstone

avahi: patch CVE-2026-24401

2026-02-27T15:54:02+00:00

Details https://nvd.nist.gov/vuln/detail/CVE-2026-24401 (From OE-Core rev: 6930162c44ae94824ff66b0a0fcb02a0a92c02e8) Signed-off-by: Ankur Tyagi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 183d0ee54f1c194e245a7bbf243c19b3c2acf4f5) Signed-off-by: Yoann Congal Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

avahi: patch CVE-2025-68471

2026-02-27T15:54:02+00:00

(From OE-Core rev: 1786f154563c68739d7dc306b0e332d058ccd3f0) Signed-off-by: Amaury Couderc Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 5ec4156330c765bc52dbce28dbba6def9868d30f) Signed-off-by: Yoann Congal Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

avahi: patch CVE-2025-68468

2026-02-27T15:54:02+00:00

(From OE-Core rev: 7bb3001ce034af29b3b09624cf692d8c0e3346f9) Signed-off-by: Amaury Couderc Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 9f2ed8adc37a42b561b3c4853cf8106fba39889e) Signed-off-by: Yoann Congal Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

avahi: patch CVE-2025-68276

2026-02-27T15:54:02+00:00

Backport the patch[1] from the PR[2] mentioned in the nvd[3]. [1] https://github.com/avahi/avahi/commit/2d48e42d44a183f26a4d12d1f5d41abb9b7c6355 [2] https://github.com/avahi/avahi/pull/806 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-68276 Dropped CI changes from the original PR during backport. (From OE-Core rev: a0768998acf23a7d00a5fdbc6fa5302eb144a850) Signed-off-by: Ankur Tyagi Signed-off-by: Yoann Congal Signed-off-by: Peter Marko Signed-off-by: Yoann Congal Signed-off-by: Paul Barker

avahi: fix CVE-2024-52615

2025-08-08T13:30:55+00:00

CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: 7bd9fee6d654326ea921b51113de99f793e11545) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

avahi: fix CVE-2024-52616

2025-01-24T15:49:28+00:00

CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52616] [https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm] Upstream patches: [https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7] (From OE-Core rev: 7708d0c346b23ab3e687e2a2ca464d77d55cebd7) Signed-off-by: Zhang Peng Signed-off-by: Steve Sakoman

avahi: backport CVE-2023-1981 & CVE's follow-up patches

2023-12-15T14:00:33+00:00

import patches from ubuntu to fix CVE-2023-1981 CVE-2023-38469-2 CVE-2023-38470-2 CVE-2023-38471-2 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f & https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237 & https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c & https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460] Ref: https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/nanbield-nut&id=a9203c46cd64c3ec5e5b00e381bbac85733f85df (From OE-Core rev: 32c0a3dc4d65065639260e77783dc427d4b1cfe3) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38473

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. (From OE-Core rev: 3a9b67f222d6e004a8b56eedca6ff869e9aba710) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38472

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. (From OE-Core rev: 1b699ac1e8519cd488ee033919b9205283b7b465) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman

avahi: fix CVE-2023-38469

2023-11-28T15:00:32+00:00

A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. (From OE-Core rev: 8bd1980fd4175be3dd68987f8c5653409b76f544) Signed-off-by: Meenali Gupta Signed-off-by: Steve Sakoman