summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* xwayland: fix CVE-2025-49177Archana Polampalli2025-07-092-0/+56
| | | | | | | | | | | A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests (From OE-Core rev: 89dde7f86e1c2e61ed71ecf92e908dbe402a2668) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: fix CVE-2025-49176Archana Polampalli2025-07-093-0/+133
| | | | | | | | | | | A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check. (From OE-Core rev: 17033023d679a597e31964b0fed2b2e89cdf61ec) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xwayland: fix CVE-2025-49175Archana Polampalli2025-07-092-0/+93
| | | | | | | | | | | A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash. (From OE-Core rev: 2c8e82f860792e7fb99c78c512be57ce74774a34) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-urllib3: fix CVE-2025-50181Yogita Urade2025-07-092-0/+218
| | | | | | | | | | | | | | | | | | | | | urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-50181 Upstream patch: https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857 (From OE-Core rev: 574146765ea3f9b36532abf4ebc8bd2976396f0b) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: backport patches to fix CVE-2025-4598Chen Qi2025-07-095-0/+382
| | | | | | | | | | | | | | | | | | | Patch 0003 is the actual patch to fix CVE. Patch 0002 is a preparation patch which systemd upstream uses for all actively maintained branches in preparation for patch 0003. Patch 0001 is a bug fix patch and is needed to avoid conflict introduced by patch 0002. Note that patch 0002 claims itself to be of no functional change, so this patch 0001 is really needed for patch 0002. Patch 0004 is a compilation fix patch which adds a macro needed by previous 0002 patch. (From OE-Core rev: a2e75ca4fa01d5005906fb88d28d52ea951def00) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: Fix CVE-2025-5914Colin Pinnell McAllister2025-07-092-0/+47
| | | | | | | | | Adds patch to backport fix for CVE-2025-5914. (From OE-Core rev: 4a4c6e0382834e03480e07f30ed5efa23f6c6fe2) Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.28kirkstone-4.0.28Steve Sakoman2025-06-271-1/+1
| | | | | | (From OE-Core rev: 75e54301c5076eb0454aee33c870adf078f563fd) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 4.0.28Steve Sakoman2025-06-271-1/+1
| | | | | | (From meta-yocto rev: 0bf3dcef1caa80fb047bf9c3514314ab658e30ea) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2022-48434Colin Pinnell McAllister2025-06-271-0/+4
| | | | | | | | | | | The patch for CVE-2022-48434 was removed when ffmpeg was updated to 5.0.3. The CVE was fixed in 5.0.2, but NVD has not updated the affected versions yet. Added an ignore for this CVE to mark as fixed. (From OE-Core rev: a8c6e2da68c9fc6c692b41c7370ec937680f788c) Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-4673Praveen Kumar2025-06-272-0/+71
| | | | | | | | | | | | | | | | Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-4673 Upstream-patch: https://github.com/golang/go/commit/b897e97c36cb62629a458bc681723ca733404e32 (From OE-Core rev: c07547c19e5372ed5eaac8530b2dd651302542a8) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: Correctly handle cost data of tests with arbitrary chars in nameMoritz Haase2025-06-253-1/+207
| | | | | | | | | | | | | | | | | | | | | | | ctest automatically optimizes the order of (parallel) test execution based on historic test case runtime via the COST property (see [0]), which can have a significant impact on overall test run times. Sadly this feature is broken in CMake < 4.0.0 for test cases that have spaces in their name (see [1]). This commit is a backport of f24178f3 (which itself backports the upstream fix). the patch was adapted slightly to apply cleanly to the older CMake version in kirkstone. As repeated test runs are expected to mainly take place inside the SDK, the patch is only applied to 'nativesdk' builds. [0]: https://cmake.org/cmake/help/latest/prop_test/COST.html [1]: https://gitlab.kitware.com/cmake/cmake/-/issues/26594 Reported-By: John Drouhard <john@drouhard.dev> (From OE-Core rev: f6a160f7ea57af6dfeca003e6c05aa42419fb755) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemtap: add sysroot Python paths to configure flagsSoumya Sambu2025-06-251-0/+7
| | | | | | | | | Explicitly set Python-related flags to use sysroot-staged headers and tools. (From OE-Core rev: 85a5d7b1d2c8600f30e38e034f828e5897d9a093) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2024-3566Peter Marko2025-06-252-0/+6
| | | | | | | | | | | | | | | | | NVD ([1]) tracks this as: cpe:2.3:a:golang:go:*:*:*:*:*:*:*:* Running on/with cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Yocto cve-check ignores the "Running on/with", so it needs to be ignored explicitly. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-3566 (From OE-Core rev: 571fd82e29fe809c63a5743e534ed7816d787963) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: fix CVE-2025-4476Changqing Li2025-06-252-0/+39
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/440 (From OE-Core rev: 2be01469687f30f33b768164f66916b081cc8c62) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: fix CVE-2025-4948Changqing Li2025-06-252-0/+39
| | | | | | | | | | Refer: http://gitlab.gnome.org/GNOME/libsoup/-/issues/449 (From OE-Core rev: d5af0295d26f8967dfe49a53ffa6f275e249d087) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: fix CVE-2025-46421Changqing Li2025-06-252-0/+48
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/439 (From OE-Core rev: 33bf900bcb563c5769b75e69059751f969a8771f) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: fix CVE-2025-32907Changqing Li2025-06-252-0/+40
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/428 (From OE-Core rev: e6d9dd16d9b70cc8d3a9ca8b2fc542d547b456b9) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Fix CVE-2025-4969Hitendra Prajapati2025-06-252-0/+77
| | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/07b94e27afafebf31ef3cd868866a1e383750086 (From OE-Core rev: 5a6af5bcbe45184e7ac0535549c25cbe64113ba7) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix CVE-2025-4948Changqing Li2025-06-252-0/+98
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/449 (From OE-Core rev: 95383d7d95631a4c3b385a073ce1deff744bf725) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix CVE-2025-46421Changqing Li2025-06-252-0/+140
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/439 (From OE-Core rev: 388453296c32759623ed35a8142c6af2df7f30b0) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix CVE-2025-32051Changqing Li2025-06-253-0/+88
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/401 (From OE-Core rev: 4af9a40f53a6a9607999f0f4b28d2ce1eaf325a2) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix CVE-2025-32907Changqing Li2025-06-253-0/+270
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/issues/429 (From OE-Core rev: e31c9f12193d040480eca6a4be6a9ec6675b19f8) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-4969Hitendra Prajapati2025-06-252-0/+77
| | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/07b94e27afafebf31ef3cd868866a1e383750086 (From OE-Core rev: ea267b82e1fdc5cc7bf055d3eec1190e19ae79de) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: patch CVE-2025-4476Ashish Sharma2025-06-252-0/+39
| | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/e64c221f9c7d09b48b610c5626b3b8c400f0907c] (From OE-Core rev: 4cd294674ed05e1b72e722b46ac1e2b5f3603460) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bsp-guide: update lonely "4.12" kernel reference to "6.12"Robert P. J. Day2025-06-201-1/+1
| | | | | | | | | | | | | To accompany earlier updating of kernel version, update this lonely reference to be consistent. (From yocto-docs rev: 97cd3ee7f3bf1de8454708d1852ea9cdbd45c39b) Signed-off-by: "Robert P. J. Day" <rpjday@crashcourse.ca> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit e26c2018cd663de91ee08e0cba55eda1a4c30210) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bsp guide: update kernel version example to 6.12Robert P. J. Day2025-06-201-8/+13
| | | | | | | | | | | | | | Change the sample kernel version being used from 4.4 to a more modern 6.12. (From yocto-docs rev: 4894e00cc69cf499d28b90a991d4bac0cecb97e7) Signed-off-by: "Robert P. J. Day" <rpjday@crashcourse.ca> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 1bad12b6ccfe1c0d26918926176a0c743568de26) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: classes: nativesdk: move note to appropriate sectionQuentin Schulz2025-06-201-10/+10
| | | | | | | | | | | | | | | | The nativesdk- prefix to the recipe filename should only be used when using the inherit method as the BBCLASSEXTEND method will do some magic when generating the "implicit" name of the recipe. This matches the instructions for the native class. (From yocto-docs rev: 84ab43b9766e0415e090c6af404ce1c61316f384) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 15fe239e1e62b9add737aa732dd7f5e9948ee03d) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: classes: reword to clarify that native/nativesdk options are ↵Quentin Schulz2025-06-201-2/+4
| | | | | | | | | | | | | | | | | | | | exclusive We explain how to create a native (nativesdk) recipe in two different ways via a bullet list but reading quickly the instructions may mislead one into doing both options whereas they are incompatible. This rewords both the nativesdk and native sections so that the second bullet point starts with an Or and explicit that this applies to target recipes. (From yocto-docs rev: c2e814ba75524225390ecad0d3615e48f866374a) Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 6d0d338a5f2686ddeee5eed7b6e05f3db800d33a) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: nptl Use all of g1_start and g_signalsSunil Dora2025-06-202-0/+193
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=91bb902f58264a2fd50fbce8f39a9a290dd23706] (From OE-Core rev: e0857503de9f427d177fe85c32cf0d2748d779fb) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: nptl rename __condvar_quiesce_and_switch_g1Sunil Dora2025-06-202-0/+161
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=4b79e27a5073c02f6bff9aa8f4791230a0ab1867] (From OE-Core rev: e7eb16d59c81636c1fdffca307768776d990d732) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: nptl Fix indentationSunil Dora2025-06-202-0/+170
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=ee6c14ed59d480720721aaacc5fb03213dc153da] (From OE-Core rev: e4b4cd362cfcb7fd6517165ae59cb218420b9039) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: nptl Use a single loop in pthread_cond_wait instaed of a nested loopSunil Dora2025-06-202-0/+106
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=929a4764ac90382616b6a21f099192b2475da674] (From OE-Core rev: eab44f7a027414ef29f6d07617997cc50fc515cd) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: nptl Remove unnecessary quadruple check in pthread_cond_waitSunil Dora2025-06-202-0/+118
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=4f7b051f8ee3feff1b53b27a906f245afaa9cee1] (From OE-Core rev: 761758340002f9dbff8e0668f4883ff623b232a0) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: nptl Remove unnecessary catch-all-wake in condvar group switchSunil Dora2025-06-202-0/+78
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=b42cc6af11062c260c7dfa91f1c89891366fed3e] (From OE-Core rev: 02f2ac08edb506ec43cec93a5b09f5e6d7df02ec) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: nptl Update comments and indentation for new condvar implementationSunil Dora2025-06-202-0/+145
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=0cc973160c23bb67f895bc887dd6942d29f8fee3] (From OE-Core rev: e5296415e97e4d704c4c8d11ad243061a1e14997) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: pthreads NPTL lost wakeup fix 2Sunil Dora2025-06-202-0/+456
| | | | | | | | | | | | | The following commits have been cherry-picked from Glibc master branch: Bug : https://sourceware.org/bugzilla/show_bug.cgi?id=25847 Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=1db84775f831a1494993ce9c118deaf9537cc50a] (From OE-Core rev: c05290e51d0faf661bac587066a79626919609e8) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* e2fsprogs: removed 'sed -u' optionAditya Tayade2025-06-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | In embedded box, sed might be provided another providers like Busybox, hence use generic options whenever possible. /bin/sed -> /etc/alternatives/sed /etc/alternatives/sed -> /bin/busybox.nosuid Here used 'sed -u' option is not necessary, hence removed it. Fixes below error: sed: invalid option -- 'u' Also added 'set -eux' option which halts execution of the script on any failures. (From OE-Core rev: 5b3b290baa0a83f493b7ca25d5ffa5ff279bcc69) (From OE-Core rev: fe7fa1ec7d005d858ccbdd81eb6f7bfab04b7e46) Signed-off-by: Aditya Tayade <Aditya.Tayade@kpit.com> Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 07caee1829d2a61bc018fe0e37ecd482922179ee) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit d2da6b5c5668dbc84b905ba2fe4c9b57b580fd82) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xz: Update LICENSE variable for xz packagesaszh072025-06-201-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Update LICENSE defined for xz packages to match the license information provided in the xz COPYING file. The License information from PACKAGERS file of xz mentions packages with lzma files are in public domain.They ask to use GPLv2+, if only it's not possible to mention "PD and GPLv2+". Include PD license with GPLv2 to packages with lzma content: xz-dev package contains lzma header xz-doc package contains lzma man pages xz packages contains lzma binaries Links: https://github.com/tukaani-project/xz/blob/v5.4.6/COPYING https://github.com/tukaani-project/xz/blob/v5.4.6/PACKAGERS (From OE-Core rev: d511c41dac048fbdd93a54136e93b0623a18a83d) (From OE-Core rev: a9b751f211ccfc1c8d58aba290dc8b4de5383acc) Signed-off-by: Bhabu Bindu <bindu.bhabu@kpit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e5b955def5d9f305f5aba2c68b73287c03fd163) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpng: Improve ptestPoonam Jadhav2025-06-203-33/+38
| | | | | | | | | | | Install libpng test-suite to run it as a ptest. As the test-suite takes more than 30 seconds to run, add libpng-ptest to PTESTS_SLOW in ptest-packagelists.inc (From OE-Core rev: 5835b803acc255c227213670588dd01c5168c266) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* babeltrace/libatomic-ops: correct the SRC_URIGuocai He2025-06-202-3/+3
| | | | | | | | | The old SRC_URIs are not available and need to update. (From OE-Core rev: 94d24ff01573dc1d65078c92150dc252b3e9b145) Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* scripts/install-buildtools: Update to 4.0.27Aleksandar Nikolic2025-06-201-2/+2
| | | | | | | | | Update to the 4.0.27 release of the 4.0.27 series for buildtools (From OE-Core rev: 9277fae3c81a269994faa6ba6f6c9bdfc74e11bd) Signed-off-by: Aleksandar Nikolic <aleksandar.nikolic@zeiss.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: Add "libswresample libavcodec" to CVE_PRODUCTaszh072025-06-201-0/+2
| | | | | | | | | | | | | | | | | | | | | Currently, CVE_PRODUCT only detects vulnerabilities where the product is "ffmpeg". However, there are also vulnerabilities where the product is "libswresample", and "libavcodec" as shown below. https://app.opencve.io/vendors/?vendor=ffmpeg Therefore, add "libswresample libavcodec" to CVE_PRODUCT to detect vulnerabilities where the product is "libswresample libavcodec" as well. (From OE-Core rev: 9684eba5c543de229108008e29afd1dd021a9799) (From OE-Core rev: 34df694e0cdf4c1e3dfc99502a9e615b8c802cdb) Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Naman Jain <namanj1@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-1373Colin Pinnell McAllister2025-06-201-0/+5
| | | | | | | | | | CVE-2025-1373 does not appear to affect ffmpeg 5.0.3. The CVE has been added to the ignore list. (From OE-Core rev: 99cda92e387ca071c4235c14a137510a4fb481c2) Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-46420Vijay Anusuri2025-06-202-0/+61
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/c9083869ec2a3037e6df4bd86b45c419ba295f8e] (From OE-Core rev: cb3a01ba6535b129608fb8d07261069f1fb4b84a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32053Vijay Anusuri2025-06-202-0/+39
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/eaed42ca8d40cd9ab63764e3d63641180505f40a] (From OE-Core rev: de40e2f32af4ec930c80858f8d77a5a1b0967069) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Fix CVE-2025-32053Vijay Anusuri2025-06-202-0/+39
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/eaed42ca8d40cd9ab63764e3d63641180505f40a] (From OE-Core rev: a563a644fcdb556d904c3c391fbf9435fcd4bdf0) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32052Vijay Anusuri2025-06-202-0/+31
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/f182429e5b1fc034050510da20c93256c4fa9652] (From OE-Core rev: f1e94b33fac8a1587aacfee13935587dfc6c147a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Fix CVE-2025-32052Vijay Anusuri2025-06-202-0/+31
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/f182429e5b1fc034050510da20c93256c4fa9652] (From OE-Core rev: ab4d381f1cfd8613c23da514a0786a7505579203) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix CVE-2025-32050Vijay Anusuri2025-06-202-0/+29
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/9bb0a55de55c6940ced811a64fbca82fe93a9323] (From OE-Core rev: f4866635b88b24d5891f83e23c9cc3fc21876b52) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Fix CVE-2025-32050Vijay Anusuri2025-06-202-0/+29
| | | | | | | | | | Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/9bb0a55de55c6940ced811a64fbca82fe93a9323] (From OE-Core rev: c5afbcf487cb7331f641c4dd2c7a972b4cd3c787) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-16 07:55:02 +0000