linux/poky.git/meta/recipes-core, branch scarthgap-5.0.12

build-appliance-image: Update to scarthgap head revision

2025-08-22T13:04:30+00:00

(From OE-Core rev: 93c7489d843a0e46fe4fc685b356d0ae885300d7) Signed-off-by: Steve Sakoman

libxml2: ignore CVE-2025-8732

2025-08-22T12:59:55+00:00

The code maintainer disputes the CVE as the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided. Source: https://gitlab.gnome.org/GNOME/libxml2/-/issues/958" (From OE-Core rev: 348ce728af1cea4f909de5c3597801b5612719e4) Signed-off-by: Daniel Turull Signed-off-by: Steve Sakoman

glib-2.0: ignore CVE-2025-4056

2025-08-22T12:59:55+00:00

NVD report [1] says: A flaw was found in GLib. A denial of service on **Windows platforms** may occur if an application attempts to spawn a program using long command lines. The fix [3] (linked from [2]) also changes only files glib/gspawn-win32-helper.c glib/gspawn-win32.c [1] https://nvd.nist.gov/vuln/detail/CVE-2025-4056 [2] https://gitlab.gnome.org/GNOME/glib/-/issues/3668 [3] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4570 (From OE-Core rev: 5858567a9222d9fff6f0a282cf7c7bda4e19af57) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

dropbear: patch CVE-2025-47203

2025-08-22T12:59:54+00:00

Based on Debian patch for this CVE, pick the same commits as mentioned in kirkstone for this CVE except those already included in 2022.83. https://salsa.debian.org/debian/dropbear/-/commit/7f48e75892c40cfc6336137d62581d2c4ca7d84c (From OE-Core rev: 6d287785611c344aa0c97048c3bfc280b1787ff5) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

glibc: fix CVE-2025-8058

2025-08-04T14:55:07+00:00

This is a single commit bump containing only CVE fix $ git log --oneline cff1042cceec3502269947e96cf7023451af22f3..b027d5b145f1b2908f370bdb96dfe40180d0fcb6 b027d5b145 posix: Fix double-free after allocation failure in regcomp (bug 33185) Test results didn't change except newly added test succeeding. (tst-regcomp-bracket-free) (From OE-Core rev: c2b63f171719e2b1c12ba049cbe776adf9e0244b) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libxml2: patch CVE-2025-6170

2025-08-04T14:55:07+00:00

Pick commit referencing this CVE from 2.13 branch. (From OE-Core rev: 061610dfca8a72b71e1baca3ad4aa2c9fb64449b) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

ncurses: patch CVE-2025-6141

2025-08-04T14:55:06+00:00

Pick relevant part of snapshot commit 20250329, see [1]. That has: add a buffer-limit check in postprocess_termcap (report/testcase by Yifan Zhang). [1] https://invisible-island.net/ncurses/NEWS.html#index-t20250329 (From OE-Core rev: 79b080eb93918431c97edbbc80de5f70a2b09a4a) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

glibc: stable 2.39 branch updates

2025-07-29T14:59:53+00:00

$ git log --oneline 06a70769fd0b2e1f2a3085ad50ab620282bd77b3..cff1042cceec3502269947e96cf7023451af22f3 cff1042cce Fix error reporting (false negatives) in SGID tests 1924d341c0 support: Pick group in support_capture_subprogram_self_sgid if UID == 0 Testing Results: Before After Diff PASS 5074 5082 +8 XPASS 4 4 0 FAIL 121 116 -5 XFAIL 16 16 0 UNSUPPORTED 157 154 -3 cff1042cce Fix error reporting (false negatives) in SGID tests Improved SGID test handling by unifying error reporting and using secure temporary directories. Replaced non-standard exit codes and fixed premature exits to avoid masking failures. These changes reduced false negatives, increasing overall test pass rates UNSUPPORTED tests changes -UNSUPPORTED: stdlib/tst-secure-getenv -UNSUPPORTED: elf/tst-env-setuid-static -UNSUPPORTED: elf/tst-env-setuid-tunables FAILed tests changes -FAIL: malloc/tst-aligned-alloc-random-thread-cross-malloc-check -FAIL: malloc/tst-aligned-alloc-random-thread-malloc-check -FAIL: malloc/tst-dynarray -FAIL: malloc/tst-dynarray-mem -FAIL: resolv/tst-resolv-aliases PASSed tests changes +PASS: stdlib/tst-secure-getenv +PASS: elf/tst-env-setuid-static +PASS: elf/tst-env-setuid-tunables +PASS: malloc/tst-aligned-alloc-random-thread-cross-malloc-check +PASS: malloc/tst-aligned-alloc-random-thread-malloc-check +PASS: malloc/tst-dynarray +PASS: malloc/tst-dynarray-mem +PASS: resolv/tst-resolv-aliases (From OE-Core rev: c40b9c33061c4019ed7790ccb799bb3491998b3d) Signed-off-by: Deepesh Varatharajan Signed-off-by: Steve Sakoman

libxml2: fix CVE-2025-49795

2025-07-29T14:59:52+00:00

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service. (From OE-Core rev: b144c3ef3ba1797d925ea44d9450a6ec0fe32047) Signed-off-by: Roland Kovacs Signed-off-by: Steve Sakoman

timedated: wait for jobs before SetNTP response

2025-07-21T16:07:22+00:00

Backport a fix to address the dbus SetNTP response timing issue. Fix is already available since systemd v256-rc1. (From OE-Core rev: 4db0483cfd14e31c3e7cc87d538d73275fd51bbf) Signed-off-by: Michal Seben Signed-off-by: Steve Sakoman