linux/poky.git/meta, branch yocto-4.0.30

build-appliance-image: Update to kirkstone head revision

2025-09-19T14:06:05+00:00

(From OE-Core rev: d381eeb5e70bd0ce9e78032c909e4a23564f4dd7) Signed-off-by: Steve Sakoman

cups: Fix for CVE-2025-58060 and CVE-2025-58364

2025-09-19T14:03:31+00:00

import patch from debian to fix CVE-2025-58060 CVE-2025-58364 Upstream-Status: Backport [import from debian cups 2.4.2-3+deb12u9 Upstream commit https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221 & https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d] (From OE-Core rev: 88585645a041c3c2ee7b39bf5f72885ed7c8775f) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

insane: Ensure that `src-uri-bad` fails correctly

2025-09-19T14:03:31+00:00

`src-uri-bad` is missing the required call to `oe.qa.exit_if_errors` so the corresponding task is not marked as failed when the QA check is classified as an error. This issue was fixed by the introduction of the do_recipe_qa task in OE-core (e0c71367ab59021fc430ef215bbfc3b525036ba4) which is not part of kirkstone yet. (From OE-Core rev: 4b593ea8df9b1d3dda0adf38786845168360311f) Signed-off-by: Philip Lorenz Signed-off-by: Steve Sakoman

insane: Improve patch warning/error handling

2025-09-19T14:03:31+00:00

Currently, whilst patch errors or warnings are shown, the errors don't stop builds. The configuration isn't very configurable from WARN_QA and ERROR_QA either. This patch: * Uses the standard mechanisms to handle the patch fuzz warnings/errors * Makes Upstream-Status checking configurable from WARN/ERROR_QA * Allows that checking to be used with non-core layers * Makes patch-fuzz an error by default (From OE-Core rev: 76a685bfcf927593eac67157762a53259089ea8a) (From OE-Core rev: 4899961965d70281e63582234f0ed299431eff32) Signed-off-by: Richard Purdie (cherry picked from commit 3c3fd6a65e8103f74ae382d196d486b31a168b39) The backported commit was modified to not mark "patch-fuzz" as an error by default (which retains compatibility with kirkstone behaviour). Signed-off-by: Philip Lorenz Signed-off-by: Steve Sakoman

go: ignore CVE-2024-24790

2025-09-19T14:03:31+00:00

CVE-2024-24790: net/netip module was introduced in go1.18beta1 via a59e33224e42d60a97fa720a45e1b74eb6aaa3d0 (From OE-Core rev: e304b139a8c43a88604ceb93aa933057b1e1748c) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

wpa-supplicant: fix CVE-2022-37660

2025-09-12T16:24:24+00:00

In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association. CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004 are dependent commits while CVE-2022-37660-0005 is actual CVE fix. Reference: https://security-tracker.debian.org/tracker/CVE-2022-37660 Upstream-patches: https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62 https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534 https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865 https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4 (From OE-Core rev: 3dd917c52ace30607800f0b70a52a52662dda731) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

llvm: fix typo in CVE-2024-0151.patch

2025-09-12T16:24:24+00:00

During backporting the patch, accidentally a variable was removed. In case the recipe is compiled for 32-bit Arm target, compilation fails with the following error: 3.0.1-r0/git/llvm/lib/Target/ARM/ARMISelLowering.cpp:4481:13: error: 'RegVT' was not declared in this scope | 4481 | if (RegVT == MVT::f16 || RegVT == MVT::bf16) | | ^~~~~ This patch corrects the patch, and adds back the removed RegVT variable. (From OE-Core rev: 77f29f8fea58de40459186952d25279877ce4994) Signed-off-by: Gyorgy Sarvari Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2025-1594

2025-09-12T16:24:24+00:00

A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. (From OE-Core rev: 5a922eb95da7d373ee2bc3018065448fa128e69a) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix multiple CVEs

2025-09-12T16:24:24+00:00

CVE-2023-6605: A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs. CVE-2023-6604: A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation. CVE-2023-6602: flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists. (From OE-Core rev: aa68992ddc5744bb4fdbb3a3cd0636b303449be2) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: fix CVE-2025-7700

2025-09-12T16:24:24+00:00

NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec.c) (From OE-Core rev: a8344e051e4c705df69f4787726a9eca5c780eff) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman