linux/poky.git/meta/recipes-extended, branch scarthgap-5.0.9

libarchive: upgrade 3.7.4 -> 3.7.9

2025-04-19T21:42:10+00:00

These is update with only bug and security releases. On top of previous CVE patches, also CVE-2024-48615 is handled. Also many security fixes without CVE assigment are included. Note that upgrade to 3.7.5 on master required fix of test in python3-libarchive-c, however that recipe does not yet have ptest in scarthgap and the fix was in test only, not in productive code, so it is not necessary in scarthgap. Also remove CVE_STATUS which was obsolete already before this upgrade. (From OE-Core rev: f20516a3ed8a39d7e4deddf11dd2acd871894048) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

ghostscript: upgrade 10.04.0 -> 10.05.0

2025-04-16T13:41:24+00:00

This upgrade addresses CVEs: CVE-2025-27835 CVE-2025-27832 CVE-2025-27831 CVE-2025-27836 CVE-2025-27830 CVE-2025-27833 CVE-2025-27833 CVE-2025-27834 Changelog: https://ghostscript.readthedocs.io/en/gs10.05.0/News.html (From OE-Core rev: 2c851f74fa72c30d447d59d450eb9bc036404f55) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

xz: patch CVE-2025-31115

2025-04-16T13:41:24+00:00

Cherry-pick commits from [1] linked from [2] from branch v5.4 [1] https://tukaani.org/xz/xz-cve-2025-31115.patch [2] https://tukaani.org/xz/threaded-decoder-early-free.html (From OE-Core rev: 952ea12f08a4e42f787a21fb98adaf4b17d0aee1) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

xz: upgrade 5.4.6 -> 5.4.7

2025-04-16T13:41:24+00:00

License-Update: homepage update in [1] [1] https://github.com/tukaani-project/xz/commit/c5c091332c6953a0ce940cb355ea9e99491429fc (From OE-Core rev: e6565ca37da4821f8e3924fe6bc6a6f4eeedd9a9) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

mc: set ac_cv_path_ZIP to avoid buildpaths QA issues

2025-04-07T13:34:44+00:00

* in builds with zip in HOSTTOOLS mc fails with: ERROR: mc-4.8.31-r0 do_package_qa: QA Issue: File /usr/libexec/mc/extfs.d/uzip in package mc-helpers-perl contains reference to TMPDIR [buildpaths] and it's because of the path to zip: mc/4.8.31/package $ grep -R styhead . ./usr/libexec/mc/extfs.d/uzip:my $app_zip = "TMPDIR/hosttools/zip"; * don't use /usr/bin/env as in other cases, because app_zip is then used e.g. with: my $cmd_addlink = "$app_zip -g -y"; (From OE-Core rev: 4003b5faa1e5acfa025e1d0df4e021e06cf8724c) Signed-off-by: Martin Jansa Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

libarchive: patch CVE-2025-1632 and CVE-2025-25724

2025-03-19T14:25:56+00:00

Pick commit referencing this MR which was merged to master. (From OE-Core rev: a4ff82c789d50a3f411170636679ce46c8f84b25) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

tzcode-native: Fix compiler setting from 2023d version

2025-03-10T19:30:52+00:00

Starting from 2023d version, tzcode makefile does not use anymore "cc" variable for C compiler, due to Makefile refactoring. Replacing "cc" with "CC" fixes the issue. (From OE-Core rev: c297d2cd8d28463adca5158c9895f1492754d569) Signed-off-by: Alessio Cascone Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit b3cdfca5ef84ed2054faef9abddef3aeed930e17) Signed-off-by: Steve Sakoman

tzdata/tzcode-native: upgrade 2024b -> 2025a

2025-03-10T19:30:52+00:00

(From OE-Core rev: 34b0f99ffd9beab4d400b05f259fc26f3da0386b) Signed-off-by: Priyal Doshi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit a15c4e6793c55c8084a61298ef3695e1db2f60cd) Signed-off-by: Steve Sakoman

wget: fix CVE-2024-10524

2025-01-24T15:59:38+00:00

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-10524 Upstream-patch: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778 (From OE-Core rev: 425c3f55bd316a563597ff6ff95f8104848e2f10) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

groff: Fix race issues for parallel build

2025-01-18T14:26:45+00:00

Fixed race issues for parallel build: groff: error: couldn't exec soelim: Permission And: groff: error: couldn't exec grn: Permission denied (From OE-Core rev: 44b625a820a22c99f4fa1d4ed6b6de98c5d75884) Signed-off-by: Robert Yang (cherry picked from commit b9ee7ea9ab05a1887c863dc9fccc65cb9e6850df) Signed-off-by: Steve Sakoman