summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* bitbake: bitbake: Bump version to 2.12.1Martin Jansa2025-09-172-2/+2
| | | | | | | | | | | | To indicate compatibility with python 3.14 [YOCTO #15858] (Bitbake rev: aab6b5ab43d6589f0a8ccacd0832a45eb0aa0fd0) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: Use a "fork" multiprocessing contextJoshua Watt2025-09-177-9/+35
| | | | | | | | | | | | | | | | | | Python 3.14 changes the default multiprocessing context from "fork" to "forkserver"; however bitbake heavily relies on "fork" to efficiently pass data to the child processes. As such, make "fork" context in the bb namespace and use it in place of the normal multiprocessing module. Note that multiprocessing contexts were added in Python 3.4, so this should be safe to use even before Python 3.14 [YOCTO #15858] (Bitbake rev: 0d9d8d0863e82e986c33c08064ce9a99224a06d5) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-target-config: Add has-thread-local optionPer x Johansson2025-09-091-0/+1
| | | | | | | | | | | | | | The "has-elf-tls" option was removed by the commit 8e1614a906086fb46c5dd7b7f2dffab91194165c. However is should have been renamed to "has-thread-local", since it was renamed and not removed in rust by this commit. https://github.com/rust-lang/rust/commit/391332c5d9d5a5e97a0d36e011a87ad43045cfd3 (From OE-Core rev: 575a4316f661392eb73d1d97300511e2bca24ada) Signed-off-by: Per x Johansson <perxjoh@axis.com> Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio: Add audio group explicitlyKyungjik Min2025-09-092-1/+2
| | | | | | | | | | | | | | | | | | | Since pulseaudio-server requires the audio group, we explicitly add it. When use useradd-staticids or do not use the default group in base-passwd, an error will occur because the audio group is not defined. NOTE: pulseaudio: Performing useradd with [--root TOPDIR/tmp/work/cortexa72-poky-linux/pulseaudio/17.0/recipe-sysroot --home-dir /var/run/pulse --gid 998 --groups audio,pulse --no-create-home --system --shell /bin/false --uid 998 pulse] useradd: group 'audio' does not exist ERROR: pulseaudio: useradd command did not succeed. (From OE-Core rev: 4fc918da4667eebbbdae3def8c38209a3d650f97) Signed-off-by: Kyungjik Min <dpmin7@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issueDeepak Rathore2025-09-092-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default CONNECTIVITY_CHECK_URIS uses "https://yoctoproject.org/connectivity.html" which redirect to "https://www.yoctoproject.org/connectivity.html". Some network configurations with proxies or restricted internet access don't handle HTTP redirects properly during the sanity check phase, causing build failures with: ERROR: OE-core's config sanity checker detected a potential misconfiguration. Either fix the cause of this error or at your own risk disable the checker (see sanity.conf). Following is the list of potential problems / advisories: Fetcher failure for URL: 'https://yoctoproject.org/connectivity.html'. URL doesn't work. Updated the default URL to use the final destination directly to avoid redirect-related connectivity check failures. Also updated SDK test cases in https.py to use the corrected URL for consistency. (From OE-Core rev: 894648f4173a8a0e489e720e2b543cd22e39a878) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 60cdf960a3560f391babd559737f1afb31fb2c5c) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2025-8534Yogita Urade2025-09-092-0/+63
| | | | | | | | | | | | | | | | | | | | | | | | | | A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used." Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-8534 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/6ba36f159fd396ad11bf6b7874554197736ecc8b (From OE-Core rev: 6db99609f8aeca660fa01fc9e32008a2e37aae03) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: Security fix for CVE-2024-13978, CVE-2025-8176, CVE-2025-8177Siddharth Doshi2025-09-098-1/+316
| | | | | | | | | | | | | | | | | | | Upstream-Status: Backport from [https://gitlab.com/libtiff/libtiff/-/commit/7be20ccaab97455f192de0ac561ceda7cd9e12d1, https://gitlab.com/libtiff/libtiff/-/commit/2ebfffb0e8836bfb1cd7d85c059cd285c59761a4, https://gitlab.com/libtiff/libtiff/-/commit/3994cf3b3bc6b54c32f240ca5a412cffa11633fa, https://gitlab.com/libtiff/libtiff/-/commit/ce46f002eca4148497363f80fab33f9396bcbeda, https://gitlab.com/libtiff/libtiff/-/commit/ecc4ddbf1f0fed7957d1e20361e37f01907898e0, https://gitlab.com/libtiff/libtiff/-/commit/75d8eca6f106c01aadf76b8500a7d062b12f2d82, https://gitlab.com/libtiff/libtiff/-/commit/e8c9d6c616b19438695fd829e58ae4fde5bfbc22] CVE's Fixed: CVE-2024-13978 libtiff: LibTIFF Null Pointer Dereference CVE-2025-8176 libtiff: LibTIFF Use-After-Free Vulnerability CVE-2025-8177 libtiff: LibTIFF Buffer Overflow (From OE-Core rev: 16d8a873c57b174e4d6581b58d890f2157aa2f2c) (From OE-Core rev: f52df68fc89f0da9ea8ea8197462c9f55d0de46c) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-8225Peter Marko2025-09-092-0/+42
| | | | | | | | | | | | | | | | | | | | | Pick commit [1] mentioned in [2]. [1] https://gitlab.com/gnutools/binutils-gdb/-/commit/e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-8225 Testsuite did not show any changes in results: === binutils Summary === # of expected passes 310 # of unexpected failures 1 # of untested testcases 1 # of unsupported tests 9 (From OE-Core rev: 3d79514f90a6f731a5333417641500b8e52e410a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "linux-yocto/6.12: riscv: Enable TUNE_FEATURES based KERNEL_FEATURES"Steve Sakoman2025-09-021-16/+0
| | | | | | | | | | This reverts commit 9296d038106aebfb66e3a76c4444597e2e1a2263. Since this patch, it looks like qemuriscv64 doesn't boot in Walnascar. (From OE-Core rev: 49f47169953b807d430461ca33f3a2b076119712) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* yocto-uninative: Update to 4.9 for glibc 2.42Michael Halstead2025-08-291-5/+5
| | | | | | | | (From OE-Core rev: adbb7737cbfbe241df514704b9bb237e41505310) Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* yocto-uninative: Update to 4.8 for GCC 15.1Michael Halstead2025-08-291-4/+4
| | | | | | | | (From OE-Core rev: ea3a60aabab3b7b456bd086f9e59b42d9ba62ce3) Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | | | | | | | | Below list of CVEs are addressed in this release CVE-2025-47183 CVE-2025-47219 CVE-2025-47806 CVE-2025-47807 CVE-2025-47808 (From OE-Core rev: 340b182d5fc972175f1d2a89127f807073c10255) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-vaapi: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: 5b918f7a9002472c271f412bec19c6ef9eaf6098) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-rtsp-server: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: fb4f3b3d2ee5d6098993cf59337b5d982be74b19) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-python: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: c5742f1c6037c588e91011883b8cf5af6bd360a5) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-ugly: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: fac2cdbd50d7e1e74910cc4c035471305372d5d7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: 01d4f52c290dc4acc7dd6e129db5470a626bfa90) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: 7b024f5983e83fbde68aaaeaeeff4997d22ba825) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-bad: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: b819ceba86919df9b99533825dff2efe14164d74) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-libav: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: d40b0da3070dcd42bed756a47f98b09f04632cab) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gst-devtools: upgrade 1.24.12 -> 1.24.13Archana Polampalli2025-08-291-1/+1
| | | | | | | (From OE-Core rev: 294522f993b5246ff4a4bf35d1f8fa66c29d1a63) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1198 -> 9.1.1652Peter Marko2025-08-294-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Handles CVE-2025-53905, CVE-2025-53906, CVE-2025-55157, CVE-2025-55158. Changes between 9.1.1198 -> 9.1.1652 ==================================== https://github.com/vim/vim/compare/v9.1.1198...v9.1.1652 Refresh patches. Disable newly introduced wayland support (in patch version 1485). To this belongs also adding recursion in delete command for dir auto which was newly failing as there is wayland directory inside now. If someone is interested, this can be probably enabled, but without additional work it results in compilation error due to function redefinition conflicts. (From OE-Core rev: e87d427d928234ef0441f9ce1fe8631fbe471094) (From OE-Core rev: 99e24ba524157ed70ad05b0b1a14fcca8df52246) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-db-native: fix fetcher for CVEs missing nodesPeter Marko2025-08-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | As of now, update of CVE DB from FKIE source (which is the defailt) fails with following error: File: '<build>/poky/meta/recipes-core/meta/cve-update-db-native.bb', lineno: 393, function: update_db_fkie 0389: [cveId, cveDesc, cvssv2, cvssv3, cvssv4, date, accessVector, vectorString]).close() 0390: 0391: for config in elt['configurations']: 0392: # This is suboptimal as it doesn't handle AND/OR and negate, but is better than nothing *** 0393: for node in config["nodes"]: 0394: parse_node_and_insert(conn, node, cveId, False) 0395: 0396:def update_db(d, conn, jsondata): 0397: if (d.getVar("NVD_DB_VERSION") == "FKIE"): Exception: KeyError: 'nodes' Entry for new CVE-2025-32915 is broken. (From OE-Core rev: 5bc27449381d2a53588dc7ad1fe2b78783d5c240) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: set status for CVE-2025-8224Peter Marko2025-08-291-0/+1
| | | | | | | | | | Commit mentioned in CVE report is already included in current hash. Can be verified by trying to cherry-pick. (From OE-Core rev: c7297f46efa410a9204d3d386d307deada967bb6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-5918Peter Marko2025-08-294-0/+590
| | | | | | | | | | | | | Pick commits per [1] Additionally pick a commit needed to apply these cleanly. [1] https://security-tracker.debian.org/tracker/CVE-2025-5918 (From OE-Core rev: 20687d6eed86003eacd5c91ebfd1101f6413ee3f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-5917Peter Marko2025-08-292-0/+50
| | | | | | | | | | | Pick commit per [1] [1] https://security-tracker.debian.org/tracker/CVE-2025-5917 (From OE-Core rev: 59b3c2f9dcf523a441bdaeac52c590d469b0b8ac) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-5916Peter Marko2025-08-292-0/+112
| | | | | | | | | | | Pick commit per [1] [1] https://security-tracker.debian.org/tracker/CVE-2025-5916 (From OE-Core rev: aa9adf9b4d5b0169dfe44503c247d48538d16929) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: mark CVE-2025-32989 and CVE-2025-32990 as fixedPeter Marko2025-08-291-0/+3
| | | | | | | | | | | | This is mentioned in [1]. NVD tracks this as version-less CVE. [1] https://gitlab.com/gnutls/gnutls/-/blob/3.8.10/NEWS?ref_type=tags#L8 (From OE-Core rev: 0c84e464d67df1111e62edc5d4f9ad398e19e40a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-firmware: fix FILES to drop RDEPENDS on full packagePatryk Seregiet2025-08-261-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | linux-firmware-rtl8723 and linux-firmware-adsp-sst contain symlinks to files that were previously packaged only in the main linux-firmware package. This caused both subpackages to inherit an unintended RDEPENDS on the full package. This change resolves the issue by ensuring all required files are correctly included in their respective subpackages. Thanks to Peter Kjellerstedt for figuring out the rootcause. (From OE-Core rev: cf27c7d040e7a5f1bbc60fb36c98686704bd7dc5) (From OE-Core rev: 4b785d2d416944a78bf4c09e85a508ae80e35ca4) Signed-off-by: Patryk Seregiet <patryk.seregiet@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (master rev: cf27c7d040e7a5f1bbc60fb36c98686704bd7dc5) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bash: use -std=gnu17 also for native CFLAGSMartin Jansa2025-08-261-0/+3
| | | | | | | | | | | | | | | * fixes builds on host with gcc-15: http://errors.yoctoproject.org/Errors/Details/853016/ ../../bash-5.2.37/builtins/mkbuiltins.c:268:29: error: too many arguments to function ‘xmalloc’; expected 0, have 1 268 | error_directory = xmalloc (2 + strlen (argv[arg_index])); | ^~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (From OE-Core rev: 0c09f4a449fc03e6f5dfb6e5961c0a0471a7816d) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pkgconfig: fix build with gcc-15Martin Jansa2025-08-262-0/+37
| | | | | | | | | | | | | | | | | | | | * on hosts with gcc-15 or whenever glib PACKAGECONFIG isn't enabled and pkgconfig uses own old bundled glib * fixes: http://errors.yoctoproject.org/Errors/Details/853015/ ../../../git/glib/glib/goption.c:169:14: error: two or more data types in declaration specifiers 169 | gboolean bool; | ^~~~ ../../../git/glib/glib/goption.c:169:18: warning: declaration does not declare anything 169 | gboolean bool; | ^ (From OE-Core rev: 092ee1703d81b8aaed452189dd329320483087d3) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix gprofng broken symbolic link with gp-*Harish Sadineni2025-08-262-0/+63
| | | | | | | | | | | | | | | | | | | | | In binutils 2.44, application names were changed from the gp- prefix (e.g., gp-display-text, gp-archive) to the gprofng- prefix (e.g., gprofng-display-text, gprofng-archive). Temporary gp-* symlinks were added to maintain compatibility with the older gprofng-gui. However, these compatibility symlinks did not support cross-platform toolchain prefixes, which resulted in broken gp-* symbolic links. Support for cross-platform prefixes are added upstream in binutils 2.45, so this change backports that fix to resolve broken symlinks issue. Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=90803ffdcc4d8c3d17566bf8dccadbad312f07a9] (From OE-Core rev: 55684a63904365d8a6ab2a8ce9e091f29b0b7df5) Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: upgrade 1.24.5 -> 1.24.6Peter Marko2025-08-267-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | Upgrade to latest 1.24.x release [1]: $ git --no-pager log --oneline go1.24.5..go1.24.6 7f36edc26d [release-branch.go1.24] go1.24.6 83b4a5db24 [release-branch.go1.24] database/sql: avoid closing Rows while scan is in progress 0f5133b742 [release-branch.go1.24] os/exec: fix incorrect expansion of "", "." and ".." in LookPath 6e1c4529e4 [release-branch.go1.24] cmd/compile: for arm64 epilog, do SP increment with a single instruction 731de13dc3 [release-branch.go1.24] os/user: user random name for the test user account 390ffce7d6 [release-branch.go1.24] runtime: prevent unnecessary zeroing of large objects with pointers b454859a8a [release-branch.go1.24] runtime: stash allpSnapshot on the M Fixes CVE-2025-47906 and CVE-2025-47907 [2]. [1] https://github.com/golang/go/compare/go1.24.5...go1.24.6 [2] https://groups.google.com/g/golang-announce/c/x5MKroML2yM (From OE-Core rev: a348c04d449c0ba36b2ef278bea08919f0e6d19f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> (cherry picked from commit f3072c210ac0a1e4d8046d920c3ebc29f9916b72) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: patch CVE-2025-6052Peter Marko2025-08-263-1/+135
| | | | | | | | | | | Backport commits from [1] which references this CVE. [1] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4681 (From OE-Core rev: a96c84cb861cb550ddcabd2396a74b00f0035ba4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: update 2.84.2 -> 2.84.4Peter Marko2025-08-265-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Overview of changes in GLib 2.84.4, 2025-08-08 ============================================== * Bugs fixed: - #3716 (CVE-2025-7039) (#YWH-PGM9867-104) Buffer Under-read on GLib through glib/gfileutils.c via get_tmp_file() (Michael Catanzaro) - #3721 GFile leak in g_local_file_set_display_name during error handling (Philip Withnall, Michael Catanzaro) - !4668 Backport !4667 “Incorrect output parameter handling in closure helper of g_settings_bind_with_mapping_closures” to glib-2-84 - !4675 Backport !4674 “gfileutils: fix computation of temporary file name” to glib-2-84 - !4679 Backport !4677 and !4678 “Fix GFile leak in g_local_file_set_display_name()” to glib-2-84 - !4697 Backport !4696 “gthreadpool: Catch pool_spawner creation failure” to glib-2-84 - !4705 Backport !4702 “gio/filenamecompleter: Fix leaks” to glib-2-84 - !4711 Backport !4708 “gfilenamecompleter: Fix g_object_unref() of undefined value” to glib-2-84 Overview of changes in GLib 2.84.3, 2025-06-13 ============================================== * Bugs fixed: - !4656 Backport !4655 “gstring: Fix overflow check when expanding the string” to glib-2-84 !4656 solves first half of CVE-2025-6052 (From OE-Core rev: 8d5df566ef2c3d342ca0eb2421b4a583b02969da) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: update 2.84.1 -> 2.84.2Praveen Kumar2025-08-263-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Overview of changes in GLib 2.84.2, 2025-05-20 ============================================== * Bugs fixed: - !4576 Backport !4575 “gclosure: fix ATOMIC_CHANGE_FIELD to read vint atomically” to glib-2-84 - !4595 Backport !4582 “Windows: fix wrong typelib path” to glib-2-84 - !4614 Backport "gstring: carefully handle gssize parameters" - !4616 Backport !4613 “Update macOS job for new CI runner” to glib-2-84 - !4623 Backport !4617 “gdate: Call tzset before localtime_r” to glib-2-84 - !4639 Backport -Wsign-conversion fixes for g_get_locale_variants() from !4590 to glib-2-84 - !4640 Backport !4620 “glocalfile: Disable faccessat()-based query_exists on Android” to glib-2-84 (From OE-Core rev: 3deb6b59f3fa91d4fa755f49dad4ac62c3a518fb) (From OE-Core rev: 45419176357954027607c7f92fd5ad11b5e87a42) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glib-2.0: update 2.84.0 -> 2.84.1Markus Volk2025-08-264-77/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - remove backport patch Overview of changes in GLib 2.84.1, 2025-04-03 ============================================== * Fix test failure when building against gobject-introspection ≥1.83.4 (#3634, work by Philip Withnall) * Bugs fixed: - #3630 2.84.0 build failure on Linux: ../gio/gnetworkmonitornetlink.c:47:10: fatal error: netlink/netlink_route.h: No such file or directory (Philip Withnall) - #3634 test failure with gobject-introspection 1.83.4: warning: element doc:format from state 3 is unknown, ignoring (Philip Withnall) - #3636 gio/trash does not handle special characters well - #3642 `g_cancellable_connect()` documentation incorrect (Marco Trevisan (Treviño)) - #3643 g_cancellable_connect(): is it safe to unref cancellable from callback? (Marco Trevisan (Treviño)) - #3649 Crash with some registry key values in GWin32AppInfo (Philip Withnall) - !4484 Memory sanitizer fixes - !4489 gobject: Be consistent in using atomic logic to handle the GParamSpecPool - !4541 gsettings: Port docs to gi-docgen format, add missing annotations and make various improvements - !4544 tests: Don't install runner scripts without installed_tests - !4545 Update French translation - !4547 Update Catalan translation - !4548 Update Turkish translation - !4551 Updated Danish translation - !4552 Update Persian translation - !4553 docs: Document GSignalFlags members added after 2.0 - !4554 Update Indonesian translation - !4555 tests: Add a test for g_object_freeze_notify() being called too often - !4557 gfileinfo: Slightly expand docs for g_file_info_get_attribute_as_string() - !4558 gi: Dynamically set doc-format - !4561 tests: Various fixes to create temporary files in /tmp rather than the build directory - !4562 gdbusnameowning: Convert docs to gi-docgen linking syntax - !4563 giounix-private: Fix macro for checking for epoll_create1() - !4565 Fix LGPL in header - !4567 gutils: make documentation of g_set_prgname() clearer - !4568 docs: Add some detail - !4569 Update Romanian translation - !4570 gspawn-win32: Fix potential integer overflows in argv handling - !4571 gvarianttype: Improve docs on type validation * Translation updates: - Catalan (Jordi Mas) - Danish (Ask Hjorth Larsen) - French (Vincent Chatelain) - Indonesian (Andika Triwidada) - Persian (Danial Behzadi) - Romanian (Antonio Marin) - Turkish (Sabri Ünal) (From OE-Core rev: 676b9acbe94f055a351da3bdcfbe457411e1877c) (From OE-Core rev: d818b5952001bacd4dbb24ea475df33e50bc1b53) Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> This upgrade fixes CVE-2025-4056 Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1377Soumya Sambu2025-08-262-0/+69
| | | | | | | | | | | | | | | | | | | | | A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1377 https://ubuntu.com/security/CVE-2025-1377 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=fbf1df9ca286de3323ae541973b08449f8d03aba (From OE-Core rev: 36436f0996d3a84fe6a59434dec1a92704110602) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1376Soumya Sambu2025-08-262-0/+58
| | | | | | | | | | | | | | | | | | | | | | A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1376 https://ubuntu.com/security/CVE-2025-1376 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=b16f441cca0a4841050e3215a9f120a6d8aea918 (From OE-Core rev: 603881e34e3bbb7435f0ae91553036eef7f1cb06) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1372Soumya Sambu2025-08-262-0/+52
| | | | | | | | | | | | | | | | | | | | | | A vulnerability was found in GNU elfutils 0.192. It has been declared as critical. Affected by this vulnerability is the function dump_data_section/print_string_section of the file readelf.c of the component eu-readelf. The manipulation of the argument z/x leads to buffer overflow. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is 73db9d2021cab9e23fd734b0a76a612d52a6f1db. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1372 https://ubuntu.com/security/CVE-2025-1372 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=73db9d2021cab9e23fd734b0a76a612d52a6f1db (From OE-Core rev: 76c57e74071f8f2f312d5c62e1f7a1ac74db54be) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1371Soumya Sambu2025-08-262-0/+42
| | | | | | | | | | | | | | | | | | | | | A vulnerability has been found in GNU elfutils 0.192 and classified as problematic. This vulnerability affects the function handle_dynamic_symtab of the file readelf.c of the component eu-read. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is identified as b38e562a4c907e08171c76b8b2def8464d5a104a. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1371 https://ubuntu.com/security/CVE-2025-1371 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=b38e562a4c907e08171c76b8b2def8464d5a104a (From OE-Core rev: 36a322934f6f7dc8d0890c531d68c0f7de69be13) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1365Soumya Sambu2025-08-262-0/+153
| | | | | | | | | | | | | | | | | | | | | | A vulnerability, which was classified as critical, was found in GNU elfutils 0.192. This affects the function process_symtab of the file readelf.c of the component eu-readelf. The manipulation of the argument D/a leads to buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5e5c0394d82c53e97750fe7b18023e6f84157b81. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1365 https://ubuntu.com/security/CVE-2025-1365 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=5e5c0394d82c53e97750fe7b18023e6f84157b81 (From OE-Core rev: deb03581745a0722e1a52a8d4ee63cdc863ad014) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1352Soumya Sambu2025-08-262-0/+155
| | | | | | | | | | | | | | | | | | | | | | | A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue. References: https://nvd.nist.gov/vuln/detail/CVE-2025-1352 https://ubuntu.com/security/CVE-2025-1352 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=2636426a091bd6c6f7f02e49ab20d4cdc6bfc753 (From OE-Core rev: 9f104c2005975c1dce6e67b23e34ab5a2e8f85ab) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to walnascar head revisionyocto-5.2.3walnascar-5.2.3Steve Sakoman2025-08-151-1/+1
| | | | | | (From OE-Core rev: 347cb0861dde58613541ce692778f907943a60ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 5.2.3Steve Sakoman2025-08-151-1/+1
| | | | | | (From meta-yocto rev: ce011415ab4e583a4545cd91aceff4190225f31d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dropbear: patch CVE-2025-47203Peter Marko2025-08-152-0/+374
| | | | | | | | | | | Pick patch per Debian security page [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-47203 (From OE-Core rev: b109c117e68bf44f623124ea1bb2468f3657665c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/classes.rst: document the testexport classAntonin Godard2025-08-131-0/+16
| | | | | | | | | | | | | This class has been in OE-Core for a while but never documented in the reference manual. Add some description for it and link to the existing documentation on it. (From yocto-docs rev: e664a70adb5bc19041b3b5f553fb90dcddff99d0) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 362a331255525fc853dab3af4ec905c417fabb0b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document SPL_DTB_BINARYAntonin Godard2025-08-132-0/+8
| | | | | | | | | | | This variable is part of uboot-sign but not documented. (From yocto-docs rev: ce4a0ec193301ed5373bab02938355ba222d2804) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 05eb461cb1da76ad9cbaf634da7f47447b3f6765) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual/variables.rst: document the FIT_CONF_PREFIX variableAntonin Godard2025-08-131-0/+4
| | | | | | | | | | | | Added by commit 7892ee3dc37d ("kernel-fitimage: allow overriding FIT configuration prefix") in OE-Core, but never documented. (From yocto-docs rev: 1b6a3610d5d24580de34b7821413b0f1ea52b508) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 860891492b96eb127af5e7bab6348fca12167c68) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* overview-manual/yp-intro.rst: fix broken link to articleErik Lindsten2025-08-131-1/+1
| | | | | | | | | | (From yocto-docs rev: 2255bff51dc38897243fe48b28fa9773fb6a4e6d) Signed-off-by: Erik Lindsten <erik@awto.se> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit b9680ad83ad3fc5e2b87594f7c62c057134d198b) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-10-04 12:43:38 +0000