linux/poky.git/meta/recipes-devtools, branch yocto-5.0.9

binutils: patch CVE-2025-1181

2025-04-19T21:42:10+00:00

Import patches from ubuntu: Upstream-Status: Backport [ https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181-pre.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 && https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 Upstream commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 ] (From OE-Core rev: abb575f6ac1f5badae2825f1cb6152379a6658ee) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

binutils: patch CVE-2025-1178 & CVE-2024-57360

2025-04-19T21:42:10+00:00

Backport Fixes for: *CVE-2025-1178 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=75086e9de1707281172cc77f178e7949a4414ed0] *CVE-2024-57360 - Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=5f8987d3999edb26e757115fe87be55787d510b9] (From OE-Core rev: 15a7f68ce14f635acf9b988fc1958ee625de4e11) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

binutils: Fix CVE-2025-1176

2025-04-19T21:42:10+00:00

Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1176.patch?h=applied/ubuntu/jammy-security Upstream commit https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=f9978defb6fab0bd8583942d97c112b0932ac814] (From OE-Core rev: 8d02a680b415f3145f4a4ef71842f336d8e3513b) Signed-off-by: Ashish Sharma Signed-off-by: Steve Sakoman

go: fix CVE-2025-22871

2025-04-16T13:41:24+00:00

Upstream-Status: Backport from https://github.com/golang/go/commit/15e01a2e43ecb8c7e15ff7e9d62fe3f10dcac931 (From OE-Core rev: b343da566856ad17b5dc03d42d9241bcb44cad1b) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

go: fix CVE-2025-22870

2025-04-16T13:41:24+00:00

Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied. (From OE-Core rev: 88e79f915137edc5a37a110abdc79f5800404e45) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

rust-cross-canadian: Set CVE_STATUS ignore for CVE-2024-43402

2025-04-07T13:34:44+00:00

This CVE was created because fix for CVE-2024-24576 was incomplete. Ignore the new CVE in the same way as the old one. See https://nvd.nist.gov/vuln/detail/CVE-2024-43402 As per NVD, this CVE only affects to Windows platform Reference: https://git.yoctoproject.org/meta-lts-mixins/commit/?h=scarthgap/rust&id=13f045acf6388d1e320fd4c0f3ca19ca7a75ef44 (From OE-Core rev: ef2ba1f04f6f21530dc4efe5c4f61cbb0c76c032) Signed-off-by: Virendra Thakur Signed-off-by: Steve Sakoman

ruby: fix CVE-2025-27220

2025-04-01T16:08:42+00:00

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method. Reference: https://security-tracker.debian.org/tracker/CVE-2025-27220 Upstream-patch: https://github.com/ruby/cgi/commit/cd1eb08076c8b8e310d4d553d427763f2577a1b6 (From OE-Core rev: 8c31f8e142894f103409ee10deccc22fdeea897c) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

qemu 8.2.7: ignore CVE-2023-1386

2025-04-01T16:08:42+00:00

Upstream Repository: https://gitlab.com/qemu-project/qemu.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1386 Type: Security Advisory CVE: CVE-2023-1386 Score: 3.3 Analysis: - According to redhat[1] this CVE has closed as not a bug. Reference: [1] https://bugzilla.redhat.com/show_bug.cgi?id=2223985 (From OE-Core rev: 6a5d9e3821246c39ec57fa483802e1bb74fca724) Signed-off-by: Madhu Marri Signed-off-by: Steve Sakoman

nativesdk-libtool: sanitize the script, remove buildpaths

2025-03-26T15:48:51+00:00

Use the same sed command to sanitize libtool script for target recipe and nativesdk one. Otherwise fails with buildpaths QA error: ERROR: nativesdk-libtool-2.5.0-r0 do_package_qa: QA Issue: File /usr/local/oe-sdk-hardcoded-buildpath/sysroots/x86_64-pokysdk-linux/usr/bin/libtool in package nativesdk-libtool contains reference to TMPDIR [buildpaths] (From OE-Core rev: f08df9adf290fb6cbebff24df6bbbbe8e5ce95e0) Upstream-Status: Backport[https://git.yoctoproject.org/poky/commit/?id=89e184da6c9d95a99fd34334df5ac6c5ae87f13a] (From OE-Core rev: a720df7ad77af1f8b1c00a211c88537e5f23edbc) Signed-off-by: Denys Dmytriyenko Signed-off-by: Richard Purdie (cherry picked from commit 89e184da6c9d95a99fd34334df5ac6c5ae87f13a) Signed-off-by: Nikhil R Signed-off-by: Steve Sakoman

gcc: unify cleanup of include-fixed, apply to cross-canadian

2025-03-26T15:48:51+00:00

Since target and cross variants were already doing similar cleanup of include-fixed headers, as those aren't used, unify the code and also apply the same to cross-canadian variant. Some of those header files get processed with a tool that leaves absolute buildpaths inside the file's commented section, causing QA errors. Since those aren't used, let's remove them. This may be a temporary solution until the tool itself gets fixed to not embed absolute buildpaths in the header files: https://lists.openembedded.org/g/openembedded-core/topic/107268307 (From OE-Core rev: 621e0ac9308cc163fb767a27d63fff6570896b92) Signed-off-by: Denys Dmytriyenko Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman