summaryrefslogtreecommitdiffstats
path: root/meta/recipes-connectivity
Commit message (Collapse)AuthorAgeFilesLines
* inetutils: patch CVE-2026-28372Peter Marko2026-03-202-0/+87
| | | | | | | | | | | | | | | | | | Pick patch according to [1] (equivalent to patch from [2]). This CVE is needed if util-linux >= 2.40 is used which is not the case in Yocto kirkstone, however it's always possible that users update packages in their layers. [1] https://security-tracker.debian.org/tracker/CVE-2026-28372 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-28372 (From OE-Core rev: 46bceb9c66068f6aa9489ef6a7f1a8eafca690a9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* avahi: patch CVE-2026-24401Ankur Tyagi2026-02-272-0/+75
| | | | | | | | | | | | | | | | Details https://nvd.nist.gov/vuln/detail/CVE-2026-24401 (From OE-Core rev: 6930162c44ae94824ff66b0a0fcb02a0a92c02e8) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 183d0ee54f1c194e245a7bbf243c19b3c2acf4f5) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* avahi: patch CVE-2025-68471Amaury Couderc2026-02-272-0/+37
| | | | | | | | | | | | | | (From OE-Core rev: 1786f154563c68739d7dc306b0e332d058ccd3f0) Signed-off-by: Amaury Couderc <amaury.couderc@est.tech> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5ec4156330c765bc52dbce28dbba6def9868d30f) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* avahi: patch CVE-2025-68468Amaury Couderc2026-02-272-0/+33
| | | | | | | | | | | | | | (From OE-Core rev: 7bb3001ce034af29b3b09624cf692d8c0e3346f9) Signed-off-by: Amaury Couderc <amaury.couderc@est.tech> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9f2ed8adc37a42b561b3c4853cf8106fba39889e) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* avahi: patch CVE-2025-68276Ankur Tyagi2026-02-272-0/+66
| | | | | | | | | | | | | | | | | | Backport the patch[1] from the PR[2] mentioned in the nvd[3]. [1] https://github.com/avahi/avahi/commit/2d48e42d44a183f26a4d12d1f5d41abb9b7c6355 [2] https://github.com/avahi/avahi/pull/806 [3] https://nvd.nist.gov/vuln/detail/CVE-2025-68276 Dropped CI changes from the original PR during backport. (From OE-Core rev: a0768998acf23a7d00a5fdbc6fa5302eb144a850) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* bind: Upgrade 9.18.41 -> 9.18.44Vijay Anusuri2026-02-271-1/+1
| | | | | | | | | | | | | | This upgrade fixes CVE-2025-13878 Changelog ========== https://downloads.isc.org/isc/bind9/9.18.44/doc/arm/html/notes.html (From OE-Core rev: d8e70bd838c3b399a2b7a0a7672d8f57a0315e5a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* inetutils: patch CVE-2026-24061Peter Marko2026-02-273-0/+122
| | | | | | | | | | | | Pick patches per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2026-24061 (From OE-Core rev: 042f02ff7072e9cf4b02a335d1d3186d68ba669b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* openssl: upgrade 3.0.18 -> 3.0.19Vijay Anusuri2026-02-274-91/+85
| | | | | | | | | | | | | | | | | | | | | | | | | | This release incorporates the following bug fixes and mitigations: Fixed Stack buffer overflow in CMS AuthEnvelopedData parsing. (CVE-2025-15467) Fixed Heap out-of-bounds write in BIO_f_linebuffer on short writes. (CVE-2025-68160) Fixed Unauthenticated/unencrypted trailing bytes with low-level OCB function calls. (CVE-2025-69418) Fixed Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion. (CVE-2025-69419) Fixed Missing ASN1_TYPE validation in TS_RESP_verify_response() function. (CVE-2025-69420) Fixed NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex() function. (CVE-2025-69421) Fixed Missing ASN1_TYPE validation in PKCS#12 parsing. (CVE-2026-22795) Fixed ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function. (CVE-2026-22796) Changelog: https://github.com/openssl/openssl/blob/openssl-3.0.19/NEWS.md Refreshed CVE-2023-50781 patches for openssl-3.0.19 Reference: https://openssl-library.org/news/secadv/20260127.txt (From OE-Core rev: 9b419ead79a1c137ba98d86969fd29808d6da49e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* libpcap: patch CVE-2025-11964Peter Marko2026-01-262-0/+34
| | | | | | | | | | | | | Pick patch per [1]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-11964 (From OE-Core rev: 026c6e7ee386ae09b9a2ef22d69730fc838ddf4f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpcap: patch CVE-2025-11961Peter Marko2026-01-263-0/+473
| | | | | | | | | | | | | | Pick patch per [1]. Also pick additional preparation patch to apply it cleanly. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-11961 (From OE-Core rev: 714fb7c711b414407598e3a94b0600fe7f857e38) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: fix CVE-2025-61984Hitendra Prajapati2025-12-122-0/+99
| | | | | | | | | | | | | | | | | | | | | ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted sources are the command line and %-sequence expansion of a configuration file. Note: openssh does not support variable expansion until 10.0, so backport adapts for this. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-61984 Upstream-Status: Backport from https://github.com/openssh/openssh-portable/commit/35d5917652106aede47621bb3f64044604164043 (From OE-Core rev: 7ca0c7a4d17c707658669e255689ecd4183c7e9b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bind: upgrade 9.18.33 -> 9.18.41Praveen Kumar2025-11-061-1/+1
| | | | | | | | | | | | | | This upgrade fixes CVE-2025-8677,CVE-2025-40778 and CVE-2025-40780. Changelog ========== https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/changelog.html (From OE-Core rev: deca51264991a2f6c6e450f8fa8b4a233280b700) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: patch CVE-2025-24912Peter Marko2025-11-063-0/+151
| | | | | | | | | | | | | | | | Pick patches as listed in NVD CVE report. Note that Debian lists one of the patches as introducing the vulnerability. This is against what the original report [1] says. Also the commit messages provide hints that the first patch fixes this issue and second is fixing problem with the first patch. [1] https://jvn.jp/en/jp/JVN19358384/ (From OE-Core rev: d0907754e0b44c5e41242bc1603278f86101fa31) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: fix CVE-2025-61985Archana Polampalli2025-11-062-0/+36
| | | | | | | | | | ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. (From OE-Core rev: 5170bd2f8a63bcc310667a327ea2ab96c783c4f6) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: upgrade 3.0.17 -> 3.0.18Archana Polampalli2025-10-141-1/+1
| | | | | | | | | | | | | | This release incorporates the following bug fixes and mitigations: Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232) Changelog: https://github.com/openssl/openssl/blob/openssl-3.0.18/NEWS.md#openssl-30 (From OE-Core rev: 0a0d640436258269ffaaf23116d41f9a79db5ab7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: fix CVE-2022-37660Divya Chellam2025-09-126-0/+1679
| | | | | | | | | | | | | | | | | | | | | | | | | | | In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association. CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004 are dependent commits while CVE-2022-37660-0005 is actual CVE fix. Reference: https://security-tracker.debian.org/tracker/CVE-2022-37660 Upstream-patches: https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62 https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534 https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865 https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4 (From OE-Core rev: 3dd917c52ace30607800f0b70a52a52662dda731) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: fix CVE-2023-50781Jiaying Song2025-08-297-1/+1806
| | | | | | | | | | | | | | | | | | | | | | | | A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data. The CVE-2023-50781 in M2Crypto is addressed by modifying OpenSSL because M2Crypto relies on OpenSSL for its cryptographic operations.The issue stems from OpenSSL’s RSA PKCS#1 v1.5 padding verification being vulnerable to Bleichenbacher-type attacks.To mitigate this, OpenSSL introduced an implicit rejection mechanism in the RSA PKCS#1 v1.5 padding.Therefore, resolving the vulnerability requires changes within OpenSSL itself to ensure M2Crypto’s security. References: https://nvd.nist.gov/vuln/detail/CVE-2023-50781 https://github.com/openssl/openssl/pull/13817/commits https://todo.sr.ht/~mcepl/m2crypto/342?__goaway_challenge=meta-refresh&__goaway_id=45a03d6accb7b343867110db1f7fb334 (From OE-Core rev: d24c4923d6f7a25bdc3ec5d4ac6bee32bb0bae88) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* avahi: fix CVE-2024-52615Zhang Peng2025-08-082-0/+229
| | | | | | | | | | | | | | | | | | CVE-2024-52615: A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries. This issue simplifies attacks where malicious DNS responses are injected. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52615] [https://github.com/avahi/avahi/security/advisories/GHSA-x6vp-f33h-h32g] Upstream patches: [https://github.com/avahi/avahi/commit/4e2e1ea0908d7e6ad7f38ae04fdcdf2411f8b942] (From OE-Core rev: 7bd9fee6d654326ea921b51113de99f793e11545) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2023-4235Archana Polampalli2025-07-182-0/+38
| | | | | | | | | | | | | A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver_report(). (From OE-Core rev: 3a3519324ec390044ff9f97c0f32027782699124) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2023-4232Archana Polampalli2025-07-182-0/+31
| | | | | | | | | | | | | A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_status_report(). (From OE-Core rev: 02005c81a55930d9f57d44674cdc5eb6171c8c76) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: fix CVE-2024-41996Archana Polampalli2025-07-182-0/+49
| | | | | | | | | | | | | | | | | Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations. The client may cause asymmetric resource consumption. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE and validate the order of the public key. Reference: https://github.com/openssl/openssl/pull/25088 (From OE-Core rev: 635fc639a13a6b28cac5c67cff23b7f4477bc41c) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: upgrade 3.0.16 -> 3.0.17Peter Marko2025-07-181-1/+1
| | | | | | | | | | Release information: https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3016-and-openssl-3017-1-jul-2025 (From OE-Core rev: 678f4f98f145c887a220b846babc9648ea6ff974) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nfs-utils: don't use signals to shut down nfs server.NeilBrown2025-06-041-24/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since Linux v2.4 it has been possible to stop all NFS server by running rpc.nfsd 0 i.e. by requesting that zero threads be running. This is preferred as it doesn't risk killing some other process which happens to be called "nfsd". Since Linux v6.6 - and other stable kernels to which Commit: 390390240145 ("nfsd: don't allow nfsd threads to be signalled.") has been backported - sending a signal no longer works to stop nfs server threads. This patch changes the nfsserver script to use "rpc.nfsd 0" to stop server threads. (From OE-Core rev: 415e73d53e5342f3f6ff6acd521ded2df3fbca1f) Signed-off-by: NeilBrown <neil@brown.name> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7b09ad289a36) Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* connman :fix CVE-2025-32366Praveen Kumar2025-05-282-0/+42
| | | | | | | | | | | | | | | | | | | | | In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whether the sum of *end and *rdlen exceeds max. Consequently, *rdlen may be larger than the amount of remaining packet data in the current state of parsing. Values of stack memory locations may be sent over the network in a response. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32366 Upstream-patch: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4 (From OE-Core rev: 1b9156124b4a07e0e3e0ab09e87d654eae6c7b4e) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: Fix CVE-2025-32728Vijay Anusuri2025-05-282-0/+45
| | | | | | | | | Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/fc86875e6acb36401dfc1dfb6b628a9d1460f367] (From OE-Core rev: 68413e1413eb87254d68f30920574b0e2c766782) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* connman :fix CVE-2025-32743Praveen Kumar2025-05-142-0/+44
| | | | | | | | | | | | | | | | | | | | In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-32743 Upstream-patch: https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d90b911f6760959bdf1393c39fe8d1118315490f (From OE-Core rev: ece0fb01bf28fa114f0a6e479491b4b6f565c80c) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ppp: patch CVE-2024-58250Peter Marko2025-05-022-1/+186
| | | | | | | | | | | | | | | | Backport patch to remove vulnerable component. This is a breaking change, but there will be no other fix for this CVE as upstream did the deletion without providing a fix first. If someone really needs this feature, which the commit message describes as deprecated, bbappend with patch removal is possible. License-Update: passprompt plugin removed (From OE-Core rev: d04a2b5f4899845429e1c5893535f5df1221fcbf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: patch CVE-2024-7537Peter Marko2025-04-112-0/+60
| | | | | | | | | | Pick commit https://web.git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=e6d8d526d5077c0b6ab459efeb6b882c28e0fdeb (From OE-Core rev: 7f3a567b8e1446863e6c5c4336b4cb174592f799) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssh: Fix CVE-2025-26465Vijay Anusuri2025-03-132-0/+141
| | | | | | | | | Upstream-Status: Backport from https://github.com/openssh/openssh-portable/commit/0832aac79517611dd4de93ad0a83577994d9c907 (From OE-Core rev: 934c212859e12235599835e8cfd8857e4be44ff8) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bind: Upgrade 9.18.28 -> 9.18.33Vijay Anusuri2025-03-041-1/+1
| | | | | | | | | | | | | | | | | Includes security fixes for CVE-2024-12705 CVE-2024-11187 and other bug fixes Release Notes: https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-32 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-31 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-30 https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-29 (From OE-Core rev: 3488171fb594a28f8e9ed110e94c6a191f8f390e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: upgrade 3.0.15 -> 3.0.16Peter Marko2025-02-153-330/+1
| | | | | | | | | | | | | | Release information: https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3015-and-openssl-3016-11-feb-2025 All CVEs were already patched, so this upgrade fixes only minor bugs. Remove CVE patches included in the new version. (From OE-Core rev: 68c01710e3522af317f8fe09465b56e6aca01615) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: patch CVE-2024-13176Peter Marko2025-02-052-0/+126
| | | | | | | | | | | | Picked [1] per link in [2]. [1] https://github.com/openssl/openssl/commit/07272b05b04836a762b4baa874958af51d513844 [2] https://nvd.nist.gov/vuln/detail/CVE-2024-13176 (From OE-Core rev: cb18163c11d7f8b62b829f203b00a4e14513c6cf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: patch CVE-2024-7540, CVE-2024-7541, CVE-2024-7542Peter Marko2025-01-242-0/+53
| | | | | | | | | | Cherry-pick commit https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=29ff6334b492504ace101be748b256e6953d2c2f (From OE-Core rev: f76c9f6940df64654710a83a6f3c6168b63fc611) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* socat: patch CVE-2024-54661Peter Marko2025-01-242-1/+116
| | | | | | | | | | | | | Picked upstream commit https://repo.or.cz/socat.git/commitdiff/4ee1f31cf80019c5907876576d6dfd49368d660f Since this was the only commit in 1.8.0.2 it also contained release changes which were dropped. (From OE-Core rev: aa3187749ae9e04b91ad18be733ce09be63a50db) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* avahi: fix CVE-2024-52616Zhang Peng2025-01-242-0/+105
| | | | | | | | | | | | | | | | | | | | CVE-2024-52616: A flaw was found in the Avahi-daemon, where it initializes DNS transaction IDs randomly only once at startup, incrementing them sequentially after that. This predictable behavior facilitates DNS spoofing attacks, allowing attackers to guess transaction IDs. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-52616] [https://github.com/avahi/avahi/security/advisories/GHSA-r9j3-vjjh-p8vm] Upstream patches: [https://github.com/avahi/avahi/commit/f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7] (From OE-Core rev: 7708d0c346b23ab3e687e2a2ca464d77d55cebd7) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2024-7547Yogita Urade2025-01-182-0/+30
| | | | | | | | | | | | | | | | | | | | | | | | | oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of SMS PDUs. The issue results from the lack of proper validation of the length of user- supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23460. Reference: https://security-tracker.debian.org/tracker/CVE-2024-7547 Upstream patch: https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=305df050d02aea8532f7625d6642685aa530f9b0 (From OE-Core rev: 8c32d91b64ae296d7832ddeb42983f4f3c237946) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2024-7546Yogita Urade2025-01-182-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23459. Reference: https://security-tracker.debian.org/tracker/CVE-2024-7546 Upstream patch: https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=79ea6677669e50b0bb9c231765adb4f81c375f63 (From OE-Core rev: 33b2a67b3134498e8c4845efddc7854b4d2315cd) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2024-7545Yogita Urade2025-01-182-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23458. Reeference: https://security-tracker.debian.org/tracker/CVE-2024-7545 Upstream patch: https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=556e14548c38c2b96d85881542046ee7ed750bb5 (From OE-Core rev: f062d2e4ad3d0a35a2dadda679632d5d213b8487) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2024-7544Yogita Urade2025-01-182-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23457. Reference: https://security-tracker.debian.org/tracker/CVE-2024-7544 Upstream patch: https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a240705a0d5d41eca6de4125ab2349ecde4c873a (From OE-Core rev: c4e7d6fad2ed96296bcea2b7d12b41e1354eafa8) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2024-7543Yogita Urade2025-01-182-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of STK command PDUs. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-23456. Reference: https://security-tracker.debian.org/tracker/CVE-2024-7543 Upstream patch: https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=90e60ada012de42964214d8155260f5749d0dcc7 (From OE-Core rev: 31ba25646b78d60923b1d897a43e37ef6f9edd51) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2024-7539Yogita Urade2025-01-182-0/+89
| | | | | | | | | | | | | | | | | | | | | | | | | oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CUSD commands. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-23195. Reference: https://security-tracker.debian.org/tracker/CVE-2024-7539 Upstream Patch: https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=389e2344f86319265fb72ae590b470716e038fdc (From OE-Core rev: b1626a0df6911172adafa85a99d36486eb7e2c62) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: patch CVE-2024-9143Peter Marko2024-11-022-0/+203
| | | | | | | | | Pick patch from branch openssl-3.0. (From OE-Core rev: 75e1dedf85ac093fc43eb88a59bfe980bb363bf9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: Patch security advisory 2024-2Peter Marko2024-10-074-0/+143
| | | | | | | | | | | Pick patches according to http://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt SAE H2E and incomplete downgrade protection for group negotiation (From OE-Core rev: 58b8ad7e33f47f06409be84430a8c2a22b4dd92f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: Patch CVE-2024-3596Peter Marko2024-10-0710-0/+618
| | | | | | | | | | | | | | | Picked patches according to http://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt First patch is style commit picked to have a clean cherry-pick of all mentioned commits without any conflict. Patch CVE-2024-3596_07.patch has hostapd code removed as it is not present in wpa-supplicant download tarball. (From OE-Core rev: 6f65fd4d98b5a5dcd410b2dcfeb2e6f229c3b973) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: Ignore CVE-2024-5290Peter Marko2024-10-071-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | NVD CVE report [1] links Ubuntu bug [2] which has a very good description/discussion about this issue. It applies only to distros patching wpa-supplicant to allow non-root users (e.g. via netdev group) to load modules. This is not the case of Yocto. Quote: So upstream isn't vulnerable as they only expose the dbus interface to root. Downstreams like Ubuntu and Chromium added a patch that grants access to the netdev group. The patch is the problem, not the upstream code IMHO. There is also a commit [3] associated with this CVE, however that only provides build-time configuration to limit paths which can be accessed but it acts only as a mitigation for distros which allow non-root users to load crafted modules. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-5290 [2] https://bugs.launchpad.net/ubuntu/+source/wpa/+bug/2067613 [3] https://w1.fi/cgit/hostap/commit/?id=c84388ee4c66bcd310db57489eac4a75fc600747 (From OE-Core rev: 603047ab3c85009c384793cdbdd8e6ae1aebd737) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpcap: Security fix for CVE-2023-7256 & CVE-2024-8006Vijay Anusuri2024-09-277-1/+753
| | | | | | | | | | | | | | | | | | | Reference: https://security-tracker.debian.org/tracker/CVE-2023-7256 https://security-tracker.debian.org/tracker/CVE-2024-8006 Upstream commits: https://github.com/the-tcpdump-group/libpcap/commit/ba493d37d418b126d7357df553bd065cbc99384e https://github.com/the-tcpdump-group/libpcap/commit/f72f48a26abdd2eb11a4a8fb3596ee67b8f8cbe6 https://github.com/the-tcpdump-group/libpcap/commit/c1ceab8f191031a81996035af20685e6f9b7f1b7 https://github.com/the-tcpdump-group/libpcap/commit/73da0d4d65ef0925772b7b7f82a5fbb3ff2c5e4f https://github.com/the-tcpdump-group/libpcap/commit/2aa69b04d8173b18a0e3492e0c8f2f7fabdf642d https://github.com/the-tcpdump-group/libpcap/commit/8a633ee5b9ecd9d38a587ac9b204e2380713b0d6 (From OE-Core rev: ea9d2a0189036c7c323685ad931392cb467ade7e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* iw: Fix LICENSENiko Mauno2024-09-161-1/+1
| | | | | | | | | | | | | | | | | The contents of the COPYING file included in the source code match those of ISC license: https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/tree/COPYING?h=v6.9 which seems to have been in effect since 2008 commit https://git.kernel.org/pub/scm/linux/kernel/git/jberg/iw.git/commit?id=622c36ae94a880fb53f7f051f1b26616f5b553c1 ("license under ISC"). (From OE-Core rev: 87da7445a2a77fe73e3524cd50112842e91235b6) (From OE-Core rev: 686abc98421198d8224423cc95f97e3cd16296c1) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Upgrade 3.0.14 -> 3.0.15Siddharth Doshi2024-09-1610-2198/+2
| | | | | | | | | | | | | | | | | | Updated SRC_URI link and format due to change in openssl website. CVE's Fixed by upgrade: CVE-2024-5535: Fixed possible buffer overread in SSL_select_next_proto(). CVE-2024-6119: Fixed possible denial of service in X.509 name checks - Removed backports of CVE-2024-5535 as it is already fixed. Detailed Information: https://github.com/openssl/openssl/blob/openssl-3.0/CHANGES.md#changes-between-3014-and-3015-3-sep-2024 (From OE-Core rev: 299118bf8e50055de28139b23781f2d34eb6eae0) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bind: Upgrade 9.18.24 -> 9.18.28Divya Chellam2024-09-041-1/+1
| | | | | | | | | | | | | | | | Includes security fixes for CVE-2024-4076, CVE-2024-1737, CVE-2024-0760, CVE-2024-1975 and other bug fixes Release Notes: https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html#notes-for-bind-9-18-28 https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html#notes-for-bind-9-18-27 https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html#notes-for-bind-9-18-26 https://downloads.isc.org/isc/bind9/9.18.28/doc/arm/html/notes.html#notes-for-bind-9-18-25 (From OE-Core rev: 1f065d8358ab0fb6c08b2aad2145786c31294721) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ofono: fix CVE-2023-2794Yogita Urade2024-08-165-0/+244
| | | | | | | | | | | | | | | | | | | | | | | | A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for this memcpy length in decode_submit(), but it was forgotten in decode_deliver(). Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-2794 Upstream patches: https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=a90421d8e45d63b304dc010baba24633e7869682 https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=7f2adfa22fbae824f8e2c3ae86a3f51da31ee400 https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=07f48b23e3877ef7d15a7b0b8b79d32ad0a3607e https://git.kernel.org/pub/scm/network/ofono/ofono.git/commit/?id=8fa1fdfcb54e1edb588c6a5e2688880b065a39c9 (From OE-Core rev: 5114e9064dbabd5258f512cd97c79fc40f848b98) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 10:52:18 +0000