summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools
Commit message (Collapse)AuthorAgeFilesLines
* binutils: fix CVE-2025-11840Yash Shinde2025-12-312-0/+38
| | | | | | | | | | | | | | | | | | | CVE-2025-11840 PR 33455 [BUG] A SEGV in vfinfo at ldmisc.c:527 A reloc howto set up with EMPTY_HOWTO has a NULL name. More than one place emitting diagnostics assumes a reloc howto won't have a NULL name. https://sourceware.org/bugzilla/show_bug.cgi?id=33455 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=f6b0f53a36820da91eadfa9f466c22f92e4256e0] (From OE-Core rev: 85e62aad46eb096cf92907288a3eb1b6f76072c4) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix CVE-2025-11839Yash Shinde2025-12-312-0/+33
| | | | | | | | | | | | | | | | | | CVE-2025-11839 PR 33448 [BUG] Aborted in tg_tag_type at prdbg.c:2452 Remove call to abort in the DGB debug format printing code, thus allowing the display of a fuzzed input file to complete without triggering an abort. https://sourceware.org/bugzilla/show_bug.cgi?id=33448 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=12ef7d5b7b02d0023db645d86eb9d0797bc747fe] (From OE-Core rev: d99979ea5fa475a59d3c21859d3bbbd81e0cdba4) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-39323Libo Chen2025-12-312-0/+56
| | | | | | | | | | | | | | | | | | | | | | | Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex. Made below changes for Go 1.17 backport: - drop the modifications of test codes References: https://nvd.nist.gov/vuln/detail/CVE-2023-39323 Upstream-patch: https://github.com/golang/go/commit/e7c142a19d8b3944c2f1b9ab7fd94c63d8d0c555 (From OE-Core rev: 62f4c3aec8f80a259472ce19104596d08741c101) Signed-off-by: Libo Chen <libo.chen.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rsync: fix CVE-2025-10158Liyin Zhang2025-12-312-0/+37
| | | | | | | | | | | | | | | | CVE-2025-10158: A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2025-10158] Upstream patch: [https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f] (From OE-Core rev: fe4bea86b27551edbe7440ff47041b6d45b2f4e1) Signed-off-by: Liyin Zhang <liyin.zhang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2025-12464Kai Kang2025-12-312-0/+71
| | | | | | | | | | | Backport patch to fix CVE-2025-12464. Reference: https://gitlab.com/qemu-project/qemu/-/commit/a01344d9d7 (From OE-Core rev: 7ef40090719cab3fb9bda3f87a9d700d9b503e3e) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-11494Deepesh Varatharajan2025-12-312-0/+44
| | | | | | | | | | | | | | Since x86 .eh_frame section may reference _GLOBAL_OFFSET_TABLE_, keep _GLOBAL_OFFSET_TABLE_ if there is dynamic section and the output .eh_frame section is non-empty. Backport a patch from upstream to fix CVE-2025-11494 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a] (From OE-Core rev: aa67c21a07dc180a0582be46e239dafd40017ba0) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd-bootchart: update SRC_URI branchGyorgy Sarvari2025-12-051-1/+1
| | | | | | | | | The branch was renamed from master to main. (From OE-Core rev: 80c7fd87fd95a79c6eb5f41b95cf70ccc70d9615) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-61724Archana Polampalli2025-12-052-0/+75
| | | | | | | | | | | The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption. (From OE-Core rev: 188dbac037809d6e8f0e1667f563fea997ea04b8) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-61723Archana Polampalli2025-12-052-0/+222
| | | | | | | | | | The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs. (From OE-Core rev: cfafebef95330e531ab7bb590e5fb566dd5a3dce) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-58189Archana Polampalli2025-12-052-0/+52
| | | | | | | | | | When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped. (From OE-Core rev: b3f055df67cf345c9a17c5c1c874c778d538ba9e) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-58187Archana Polampalli2025-12-052-0/+350
| | | | | | | | | | | Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains. (From OE-Core rev: cea9fcf1b21b1b35b88986b676d712ab8ffa9d67) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: fix CVE-2025-6075Praveen Kumar2025-12-012-0/+365
| | | | | | | | | | | | | | | | If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-6075 Upstream-patch: https://github.com/python/cpython/commit/892747b4cf0f95ba8beb51c0d0658bfaa381ebca (From OE-Core rev: 9a7f33d85355ffbe382aa175c04c64541e77b441) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2024-41123Divya Chellam2025-12-016-0/+415
| | | | | | | | | | | | | | | | | | | | | | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41123 Upstream-patches: https://github.com/ruby/rexml/commit/2c39c91a65d69357cfbc35dd8079b3606d86bb70 https://github.com/ruby/rexml/commit/4444a04ece4c02a7bd51e8c75623f22dc12d882b https://github.com/ruby/rexml/commit/ebc3e85bfa2796fb4922c1932760bec8390ff87c https://github.com/ruby/rexml/commit/6cac15d45864c8d70904baa5cbfcc97181000960 https://github.com/ruby/rexml/commit/e2546e6ecade16b04c9ee528e5be8509fe16c2d6 (From OE-Core rev: 6b2a2e689a69deef6098f6c266542234e46fb24b) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2024-39908Divya Chellam2025-12-0113-0/+689
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when it parses an XML that has many specific characters such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the patches to fix these vulnerabilities. Users are advised to upgrade. Users unable to upgrade should avoid parsing untrusted XML strings. Reference: https://security-tracker.debian.org/tracker/CVE-2024-39908 Upstream-patches: https://github.com/ruby/rexml/commit/f1df7d13b3e57a5e059273d2f0870163c08d7420 https://github.com/ruby/rexml/commit/d146162e9a61574499d10428bc0065754cd26601 https://github.com/ruby/rexml/commit/b5bf109a599ea733663150e99c09eb44046b41dd https://github.com/ruby/rexml/commit/b8a5f4cd5c8fe29c65d7a00e67170223d9d2b50e https://github.com/ruby/rexml/commit/0af55fa49d4c9369f90f239a9571edab800ed36e https://github.com/ruby/rexml/commit/c1b64c174ec2e8ca2174c51332670e3be30c865f https://github.com/ruby/rexml/commit/9f1415a2616c77cad44a176eee90e8457b4774b6 https://github.com/ruby/rexml/commit/c33ea498102be65082940e8b7d6d31cb2c6e6ee2 https://github.com/ruby/rexml/commit/a79ac8b4b42a9efabe33a0be31bd82d33fd50347 https://github.com/ruby/rexml/commit/67efb5951ed09dbb575c375b130a1e469f437d1f https://github.com/ruby/rexml/commit/1f1e6e9b40bf339894e843dfd679c2fb1a5ddbf2 https://github.com/ruby/rexml/commit/910e5a2b487cb5a30989884a39f9cad2cc499cfc (From OE-Core rev: 6e0b70843422cd7cdb25a9e1520dd64bf701fea6) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2024-35176Divya Chellam2025-12-012-0/+113
| | | | | | | | | | | | | | | | | | | | REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many `<`s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-35176 Upstream-patch: https://github.com/ruby/rexml/commit/4325835f92f3f142ebd91a3fdba4e1f1ab7f1cfb (From OE-Core rev: a89fcaf0c3ac2afd95e836bc1356832296135696) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-idna: Fix CVE-2024-3651Vijay Anusuri2025-12-012-0/+2486
| | | | | | | | | | | | | | import patch from debian to fix CVE-2024-3651 Upstream-Status: Backport [import from debian 3.3-1+deb12u1 Upstream commit https://github.com/kjd/idna/commit/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7] (From OE-Core rev: 7359d3cdf2210e81a26d8712769f7e23bfbc1bb7) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1377Soumya Sambu2025-11-242-0/+69
| | | | | | | | | | | | | | | | | | | | A vulnerability, which was classified as problematic, has been found in GNU elfutils 0.192. This issue affects the function gelf_getsymshndx of the file strip.c of the component eu-strip. The manipulation leads to denial of service. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of the patch is fbf1df9ca286de3323ae541973b08449f8d03aba. It is recommended to apply a patch to fix this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-1377 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=fbf1df9ca286de3323ae541973b08449f8d03aba (From OE-Core rev: e4e8392e688ceb0d8e68fe48118383c031178b5e) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* elfutils: Fix CVE-2025-1376Soumya Sambu2025-11-242-0/+59
| | | | | | | | | | | | | | | | | | | | | | A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-1376 Upstream patch: https://sourceware.org/git/?p=elfutils.git;a=commit;h=b16f441cca0a4841050e3215a9f120a6d8aea918 (From OE-Core rev: 1126e5c1e63b876499c78ac403d1327645edf1c7) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-urllib3: Upgrade 1.26.18 -> 1.26.20Soumya Sambu2025-11-191-1/+1
| | | | | | | | | | | | | Includes fix for CVE-2024-37891 Changelog: ---------- https://github.com/urllib3/urllib3/blob/1.26.20/CHANGES.rst (From OE-Core rev: 2e805113fe0488224f05524360eeff729dd12d91) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust-cross-canadian: Ignore CVE-2024-43402Saquib Iltaf2025-11-191-0/+2
| | | | | | | | | | | Ignore CVE-2024-43402 as its not applicable. CVEs are specific to Microsoft Windows. (From OE-Core rev: 3044ae9e6e84faada8c1425238e9e9c3060b1a3a) Signed-off-by: Saquib Iltaf <saquib.iltaf@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Don't use ftp.gnome.orgJason Schonberg2025-11-062-2/+2
| | | | | | | | | | | http://ftp.gnome.org/pub/gnome redirects to https://download.gnome.org bitbake.conf defines ${GNOME_MIRROR} to be https://download.gnome.org/sources/ (From OE-Core rev: 1e1993b72f2b6109ce3d0ef950553b74b2b37b27) Signed-off-by: Jason Schonberg <schonm@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2024-24783Hitendra Prajapati2025-11-062-0/+84
| | | | | | | | | Upstream-Status: Backport https://github.com/golang/go/commit/be5b52bea674190ef7de272664be6c7ae93ec5a0 (From OE-Core rev: b7d89fae22b317199b8f72978712075078a17005) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-11413Peter Marko2025-11-062-0/+39
| | | | | | | | | | | | | | | | | | | | | | | | Pick commit per NVD CVE report. Note that there were two patches for this, first [1] and then [2]. The second patch moved the original patch to different location. Cherry-pick of second patch is successful leaving out the code removing the code from first location, so the patch attached here is not identical to the upstream commit but is identical to applying both and merging them to a single patch. [1] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=1108620d7a521f1c85d2f629031ce0fbae14e331 [2] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=72efdf166aa0ed72ecc69fc2349af6591a7a19c0 (From OE-Core rev: 98df728e6136d04af0f4922b7ffbeffb704de395) (From OE-Core rev: 8d1a830c713a299f67fc512ed8bc0be21be4b9f0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-11412Peter Marko2025-11-062-0/+36
| | | | | | | | | | | | | | Pick commit per NVD CVE report. (From OE-Core rev: 6b94ff6c584a31d2b1e06d1e1dc19392d759b4b7) (From OE-Core rev: 9130f3471f4814979cfdfa66ca118929f240cb30) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2025-48386Hitendra Prajapati2025-10-312-0/+98
| | | | | | | | | Upstream-Status: Backport from https://github.com/git/git/commit/9de345cb273cc7faaeda279c7e07149d8a15a319 (From OE-Core rev: 3f2fce1ababbf6c94a9e4995d133d5338913b2ce) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix CVE-2025-8225Yash Shinde2025-10-312-0/+48
| | | | | | | | | | | | | | | | | | | CVE: CVE-2025-8225 It is possible with fuzzed files to have num_debug_info_entries zero after allocating space for debug_information, leading to multiple allocations. * dwarf.c (process_debug_info): Don't test num_debug_info_entries to determine whether debug_information has been allocated, test alloc_num_debug_info_entries. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4] (From OE-Core rev: 9b5bb098b542a43a7aa97cc376c358f0a38778e3) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: fix CVE-2025-11081Yash Shinde2025-10-312-0/+85
| | | | | | | | | | | | | | | | | | | | CVE: CVE-2025-11081 Trying to dump .sframe in a PE file results in a segfault accessing elf_section_data. * objdump (dump_sframe_section, dump_dwarf_section): Don't access elf_section_type without first checking the file is ELF. PR 33406 SEGV in dump_dwarf_section [https://sourceware.org/bugzilla/show_bug.cgi?id=33406] Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=f87a66db645caf8cc0e6fc87b0c28c78a38af59b] (From OE-Core rev: a7d39d40ec867bbcc36d71cf98858a34c619c9fe) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: upgrade 3.10.18 -> 3.10.19Peter Marko2025-10-243-222/+2
| | | | | | | | | | | | | | | | Drop upstreamed patch and refresh remaining patches. Release information: * https://www.python.org/downloads/release/python-31019/ * The release you're looking at is Python 3.10.19, a security bugfix release for the legacy 3.10 series. Handles CVE-2025-59375, CVE-2025-47273 and CVE-2024-6345. (From OE-Core rev: 9b3dbd691f6ebdbdfe88cef3d3a676ddd1399c63) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cmake: fix CVE-2025-9301Saravanan2025-10-242-0/+72
| | | | | | | | | | | | | | Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9301 https://gitlab.kitware.com/cmake/cmake/-/issues/27135 Upstream-patch: https://gitlab.kitware.com/cmake/cmake/-/commit/37e27f71bc356d880c908040cd0cb68fa2c371b8 (From OE-Core rev: 0aacc4298f2cdaaf6d19a58e6e134b6a6ecc5097) Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-11083Peter Marko2025-10-172-0/+78
| | | | | | | | | | Pick patch per link in NVD report. (From OE-Core rev: 99879f41af7272e597c9a8c4c0260d1b690f9051) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-11082Peter Marko2025-10-172-0/+47
| | | | | | | | | | Pick patch per link in NVD report. (From OE-Core rev: cdc458b5dd21614058aac56de68a272201283141) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: patch CVE-2024-8354Peter Marko2025-10-172-0/+76
| | | | | | | | | Pick commit per [1]. (From OE-Core rev: bebd1b24473e3480ae6c4ae2897fbfdf4942ea11) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-47906Archana Polampalli2025-10-142-0/+172
| | | | | | | | | | | | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. (From OE-Core rev: c4d81e32ee3fb7d05db2cfbfaaa8081841bc16ce) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: upgrade 3.1.4 -> 3.1.6Soumya Sambu2025-10-031-1/+4
| | | | | | | | | | | | | | | | | Includes fix for - CVE-2024-56326, CVE-2025-27516, CVE-2024-56201 Changelog: https://github.com/pallets/jinja/blob/3.1.6/CHANGES.rst https://github.com/pallets/jinja/blob/3.1.5/CHANGES.rst (From OE-Core rev: a935ef8f205c9510ebc5539c133960bc72504902) (From OE-Core rev: 7108dccff524888d77f0e5e02d9cc4523a700a91) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-47907Praveen Kumar2025-10-034-61/+977
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. Made below changes for Go 1.17 backport: - Replaced `atomic.Pointer[error]` with `atomic.Value`, since atomic pointers are not supported in Go 1.17. - Used errp.(*error) to retrieve and dereference the stored *error, Without this, build fails with: invalid indirect of errp (type interface{}). - Replaced Go 1.18 `any` keyword with `interface{}` for backward compatibility with Go 1.17. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-47907 Upstream-patch: https://github.com/golang/go/commit/8a924caaf348fdc366bab906424616b2974ad4e9 https://github.com/golang/go/commit/298fe517a9333c05143a8a8e1f9d5499f0c6e59b https://github.com/golang/go/commit/c23579f031ecd09bf37c644723b33736dffa8b92 (From OE-Core rev: af9c43c39764ce9ce37785c44dfb83e25cb24703) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2024-24790Hitendra Prajapati2025-09-191-1/+2
| | | | | | | | | CVE-2024-24790: net/netip module was introduced in go1.18beta1 via a59e33224e42d60a97fa720a45e1b74eb6aaa3d0 (From OE-Core rev: e304b139a8c43a88604ceb93aa933057b1e1748c) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: fix typo in CVE-2024-0151.patchGyorgy Sarvari2025-09-121-5/+8
| | | | | | | | | | | | | | | | | During backporting the patch, accidentally a variable was removed. In case the recipe is compiled for 32-bit Arm target, compilation fails with the following error: 3.0.1-r0/git/llvm/lib/Target/ARM/ARMISelLowering.cpp:4481:13: error: 'RegVT' was not declared in this scope | 4481 | if (RegVT == MVT::f16 || RegVT == MVT::bf16) | | ^~~~~ This patch corrects the patch, and adds back the removed RegVT variable. (From OE-Core rev: 77f29f8fea58de40459186952d25279877ce4994) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2025-48384Praveen Kumar2025-09-082-0/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-48384 Upstream-patch: https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89 (From OE-Core rev: 34cb9674a5ce337a75af0dc415706d0323c427a6) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dpkg: patch CVE-2025-6297Peter Marko2025-08-292-0/+126
| | | | | | | | | | | Pick commit per [1] from 1.22.x branch. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-6297 (From OE-Core rev: aaf58c4ad69203a6437362ef130e8ed3ce267e81) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: ignore CVE-2024-7730Peter Marko2025-08-291-0/+3
| | | | | | | | | | This CVE is for virtio-snd which was introduced in 8.2.0. Therefore ignore this CVE for version 6.2.0. (From OE-Core rev: 93545ef00c4930dd297649934bee0e95c520ee16) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2025-27614-CVE-2025-27613-CVE-2025-46334-CVE-2025-46835Hitendra Prajapati2025-08-222-0/+2501
| | | | | | | | | Upstream-Status: Backport from from https://github.com/git/git/commit/d61cfed2c23705fbeb9c0d08f59e75ee08738950 (From OE-Core rev: a24e44f92114f995e034923a62b96947dc99d6e8) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2025-0913Peter Marko2025-08-181-1/+1
| | | | | | | | | | | | | | | | | | This is problem on Windows platform only. Per NVD report [1], CPE has "and" clause Running on/with cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Also linked patch [2] changes Windows files only (and tests). [1] https://nvd.nist.gov/vuln/detail/CVE-2025-0913 [2] https://go-review.googlesource.com/c/go/+/672396 (From OE-Core rev: 473da932a8f94b7454e0e13912753a7e7545fc17) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: patch CVE-2025-8194Peter Marko2025-08-182-3/+223
| | | | | | | | | | Pick commit from 3.12 branch mentioned in NVD report. https://nvd.nist.gov/vuln/detail/CVE-2025-8194 (From OE-Core rev: 4ae9daf3d05530952a8b002257dd9afda2e077e4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-7545Deepesh Varatharajan2025-08-042-0/+40
| | | | | | | | | | | | | | objcopy: Don't extend the output section size Since the output section contents are copied from the input, don't extend the output section size beyond the input section size. Backport a patch from upstream to fix CVE-2025-7545 Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944] (From OE-Core rev: 4f461ed46b7694fc4815c7f0504b9cefe5da8e19) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: correct fix for CVE-2024-43398Rob Woolley2025-07-304-14/+355
| | | | | | | | | | | | | | | | | | | The previous fix for CVE-2024-43398 did not include patches to provide context for the changes it made. This caused an exception at run-time when ruby parsed rexml/parsers/baseparser.rb. This was first observed when using ruby-native to build the sdformat recipe. With these additional backports, the sdformat build proceeds successfully. The REXML library was also tested manually on-target with a script that used REXML::Document.new file to parse an XML file. (From OE-Core rev: 6bf00fde2d4043c6b558733a33041ce5694342d3) Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* orc: set CVE_PRODUCTPeter Marko2025-07-301-0/+3
| | | | | | | | | | | | | | | There are new CVEs reported for this recipe which are not for this componene, but for a component with same name from apache. sqlite> select vendor, product, id, count(*) from products where product like 'orc' group by vendor, product, id; apache|orc|CVE-2018-8015|1 apache|orc|CVE-2025-47436|4 gstreamer|orc|CVE-2024-40897|1 (From OE-Core rev: c31dec7b32fe34fafd61dd593a2884eee13084fb) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2025-7546Yash Shinde2025-07-302-0/+45
| | | | | | | | | | | | | Report corrupted group section instead of trying to recover. CVE: CVE-2025-7546 Upstream-Status: Backport [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=41461010eb7c79fee7a9d5f6209accdaac66cc6b] PR 33050 [https://sourceware.org/bugzilla/show_bug.cgi?id=33050] (From OE-Core rev: 5860b954681c37ac6685631cce439fd349093689) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tcf-agent: correct the SRC_URIGuocai He2025-07-181-1/+1
| | | | | | | | | The SRC_URI is changed to git://gitlab.eclipse.org/eclipse/tcf/tcf.agent.git (From OE-Core rev: d9f424921179a52ffe053411c44f20e44e7deba1) Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bintuils: stable 2.38 branch updateDeepesh Varatharajan2025-07-181-1/+1
| | | | | | | | | | | | | | | | | | | Below commit on binutils-2.38 stable branch are updated. 9bee8d65d32 x86: Check MODRM for call and jmp in binutils older than 2.45 Before After Diff No. of expected passes 280 280 0 No. of unexpected failures 2 2 0 No. of untested testcases 1 1 0 No. of unsupported tests 7 7 0 Testing was done and there were no regressions found (From OE-Core rev: 7ac807166dfb6723f4e0b53c21f434e21d25563e) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: update CVE productPeter Marko2025-07-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | There are two "new" CVEs reported for python3, their CPEs are: * CVE-2020-1171: cpe:2.3:a:microsoft:python:*:*:*:*:*:visual_studio_code:*:* (< 2020.5.0) * CVE-2020-1192: cpe:2.3:a:microsoft:python:*:*:*:*:*:visual_studio_code:*:* (< 2020.5.0) These are for "Visual Studio Code Python extension". Solve this by addding CVE vendor to python CVE product to avoid confusion with Microsoft as vendor. Examining CVE DB for historical python entries shows: sqlite> select vendor, product, count(*) from products where product = 'python' or product = 'cpython' ...> or product like 'python%3' group by vendor, product; microsoft|python|2 python|python|1054 python_software_foundation|python|2 (From OE-Core rev: 06f615e6939a22bc8f12b30d8dea582ab3ccebe6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 11:13:55 +0000