linux/poky.git/meta/recipes-core/libxml/libxml2_2.14.5.bb, branch master

libxml2: upgrade 2.14.5 -> 2.14.6

2025-09-11T10:31:55+00:00

(From OE-Core rev: 28af77eea6fe04c923d57b8b20ad24414ffc8621) Signed-off-by: Wang Mingyu Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

recipes: cleanup CVE_STATUS which are resolved now

2025-08-28T09:47:08+00:00

The don't show up in CVE metrics anymore since they were either fixed upstream or recipe version was upgraded meanwhile. * bind CVE-2019-6470: cpe got corrected in nvd db * libxml2 CVE-2023-45322: version is now higher than NVD cpe * zlib CVE-2023-45853: version is now higher than NVD cpe * gcc CVE-2021-37322: version is now higher than NVD cpe * python3 * CVE-2007-4559: version is now higher than NVD cpe * CVE-2019-18348: version is now higher than NVD cpe * CVE-2020-15523: version is now higher than NVD cpe * CVE-2022-26488: version is now higher than NVD cpe * CVE-2015-20107: version is now higher than NVD cpe * CVE-2023-36632: version is now higher than NVD cpe * rust * CVE-2024-24576: NVD has no cpe, but we have newer version as fix * CVE-2024-43402: version is now higher than NVD cpe * cups CVE-2021-25317: version is now higher than NVD cpe * ghostscript CVE-2023-38559: version is now higher than NVD cpe * libtirpc CVE-2021-46828: version is now higher than NVD cpe * unzip CVE-2008-0888: version is now higher than NVD cpe * ffmpeg CVE-2023-39018: cpe got corrected in nvd db * libxslt CVE-2022-29824: version is now higher than NVD cpe * libyaml * CVE-2024-35325: CVE is now rejected in NVD DB * CVE-2024-35326: CVE is now rejected in NVD DB * CVE-2024-35328: CVE is now rejected in NVD DB Also add comment for iputils regarding reports for FKIE/NVD2. Also remove some trailing spaces in python recipe. (From OE-Core rev: 73ee9789183aa95072af2b51ac9e08203f4e33f9) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: mark CVE-2025-6170 as fixed

2025-08-25T16:47:21+00:00

As shown in [1] when expanding tags including it. NVD tracks this CVE as version-less. [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c340e419505cf4bf1d9ed7019a87cc00ec200434 (From OE-Core rev: d8a9c190811ad9658a74502a371c110f4d24d68f) Signed-off-by: Peter Marko Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie

libxml2: upgrade 2.14.3 -> 2.14.5

2025-07-28T13:51:50+00:00

Release notes: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.14.5 (From OE-Core rev: b82cb6d55033ffff79b5a767bd50b06989c0acfc) Signed-off-by: Hongxu Jia Signed-off-by: Richard Purdie