summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended
Commit message (Collapse)AuthorAgeFilesLines
* libpam: fix CVE-2025-6020Hitendra Prajapati2025-07-306-0/+1959
| | | | | | | | | Upstream-Status: Backport from https://github.com/linux-pam/linux-pam/commit/475bd60c552b98c7eddb3270b0b4196847c0072e && https://github.com/linux-pam/linux-pam/commit/592d84e1265d04c3104acee815a503856db503a1 && https://github.com/linux-pam/linux-pam/commit/976c20079358d133514568fc7fd95c02df8b5773 (From OE-Core rev: 4ff5111d2a758bacb803de981177799a8ac7fd0b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: upgrade 1.9.15p5 -> 1.9.17p1Praveen Kumar2025-07-183-6/+57
| | | | | | | | | | | | | | | | | | | | | | | Changelog: =========== * Fixed CVE-2025-32462. Sudo's -h (--host) option could be specified when running a command or editing a file. This could enable a local privilege escalation attack if the sudoers file allows the user to run commands on a different host. * Fixed CVE-2025-32463. An attacker can leverage sudo's -R (--chroot) option to run arbitrary commands as root, even if they are not listed in the sudoers file. The chroot support has been deprecated an will be removed entirely in a future release. License-Update: Copyright updated to 2025 0001-sudo.conf.in-fix-conflict-with-multilib.patch refreshed for 1.9.17 (From OE-Core rev: f8343726bca7f884213436cda3f51684c22ad3f1) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: upgrade from 1.9.15p2 to 1.9.15p5Chen Qi2025-07-181-1/+1
| | | | | | | | | | | | | | (From OE-Core rev: 4b2eccc0ee3f2906f9b04de194b9df6e24c2cdf4) (From OE-Core rev: 9a604a05d4a8158742a2346fc7ebc3c99e58eeb7) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 468633036c4b049b137d80740c4380ae1959e645) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* iputils: patch CVE-2025-48964Peter Marko2025-07-182-0/+100
| | | | | | | | | Pick commit referencing this CVE. (From OE-Core rev: 49ccf7b56a0598f84dcac2532c462aa2c285f66c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2025-46646Peter Marko2025-07-181-0/+2
| | | | | | | | | | | | | The code patched by [1] which fixes this CVE is not available in 9.55.0. Also Debian says in [2] that even 10.0.0 is not yet affected. [1] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f14ea81e6c3d2f51593f23cdf13c4679a18f1a3f [2] https://security-tracker.debian.org/tracker/CVE-2025-46646 (From OE-Core rev: a3e02ed74db2c234b7c3718b4d6b5332468de226) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: fix CVE-2025-5917Divya Chellam2025-07-142-0/+55
| | | | | | | | | | | | | | | | | | | A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by- one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1- byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, lea ding to unpredictable program behavior, crashes, or in specific circumstances, could be lever aged as a building block for more sophisticated exploitation. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5917 Upstream-patch: https://github.com/libarchive/libarchive/commit/7c02cde37a63580cd1859183fbbd2cf04a89be85 (From OE-Core rev: 2b2a2fce345c9bfcad44cc8ef3419f43dd07b022) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: fix CVE-2025-5916Divya Chellam2025-07-142-0/+117
| | | | | | | | | | | | | | | | | | | | | A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5916 Upstream-patch: https://github.com/libarchive/libarchive/commit/ef093729521fcf73fa4007d5ae77adfe4df42403 (From OE-Core rev: 0e939bf5fc7412c7357fcd7d8ae760f023ac40eb) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: fix CVE-2025-5915Divya Chellam2025-07-142-0/+218
| | | | | | | | | | | | | | | | | | | A vulnerability has been identified in the libarchive library. This flaw can lead to a heap b uffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer -Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memo ry buffer, which can result in unpredictable program behavior, crashes (denial of service), o r the disclosure of sensitive information from adjacent memory regions. Reference: https://security-tracker.debian.org/tracker/CVE-2025-5915 Upstream-patches: https://github.com/libarchive/libarchive/commit/a612bf62f86a6faa47bd57c52b94849f0a404d8c (From OE-Core rev: 41e7be4aa28481530d5e259d0f25b238b86c012d) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: Fix CVE-2025-5914Colin Pinnell McAllister2025-07-092-0/+47
| | | | | | | | | Adds patch to backport fix for CVE-2025-5914. (From OE-Core rev: 4a4c6e0382834e03480e07f30ed5efa23f6c6fe2) Signed-off-by: Colin Pinnell McAllister <colin.mcallister@garmin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xz: Update LICENSE variable for xz packagesaszh072025-06-201-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Update LICENSE defined for xz packages to match the license information provided in the xz COPYING file. The License information from PACKAGERS file of xz mentions packages with lzma files are in public domain.They ask to use GPLv2+, if only it's not possible to mention "PD and GPLv2+". Include PD license with GPLv2 to packages with lzma content: xz-dev package contains lzma header xz-doc package contains lzma man pages xz packages contains lzma binaries Links: https://github.com/tukaani-project/xz/blob/v5.4.6/COPYING https://github.com/tukaani-project/xz/blob/v5.4.6/PACKAGERS (From OE-Core rev: d511c41dac048fbdd93a54136e93b0623a18a83d) (From OE-Core rev: a9b751f211ccfc1c8d58aba290dc8b4de5383acc) Signed-off-by: Bhabu Bindu <bindu.bhabu@kpit.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e5b955def5d9f305f5aba2c68b73287c03fd163) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* net-tools: patch CVE-2025-46836Peter Marko2025-06-203-0/+124
| | | | | | | | | Backport patch for this CVE and also patch for its regression. (From OE-Core rev: 7f2ce7ea6bd3397e4a4f3f7bb6957d14838f66c5) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* screen: fix CVE-2025-46804Divya Chellam2025-06-132-0/+132
| | | | | | | | | | | | | | | | | | | A minor information leak when running Screen with setuid-root privileges allosw unprivileged users to deduce information about a path that would otherwise not be available. Affected are older Screen versions, as well as version 5.0.0. Reference: https://security-tracker.debian.org/tracker/CVE-2025-46804 Upstream-patch: https://cgit.git.savannah.gnu.org/cgit/screen.git/commit/?id=e0eef5aac453fa98a2664416a56c50ad1d00cb30 (From OE-Core rev: fa14b05383a322f5fe751c81e8c6f1a8a1df8c9e) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* screen: fix CVE-2025-46802Divya Chellam2025-06-132-0/+147
| | | | | | | | | | | | | | | | For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session. Reference: https://security-tracker.debian.org/tracker/CVE-2025-46802 Upstream-patch: https://cgit.git.savannah.gnu.org/cgit/screen.git/commit/?id=049b26b22e197ba3be9c46e5c193032e01a4724a (From OE-Core rev: b4074e06ff0531481dbb3788a5c1bf9e013b6239) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2025-48708Archana Polampalli2025-06-132-0/+47
| | | | | | | | | | | gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document includes its password in cleartext. (From OE-Core rev: 7052a81e4f9b19b5640b414c10b19f8232d81572) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sysstat: correct the SRC_URIGuocai He2025-06-041-3/+3
| | | | | | | | | | The SRC_URI of http://pagesperso-orange.fr/sebastien.godard is not available and the tarballs of sysstat are in https://sysstat.github.io/versions.html. (From OE-Core rev: 27c31ebd8e05adb2e248e421cbb94c897b3080f5) Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* screen: Fix CVE-2025-46805Hitendra Prajapati2025-06-042-0/+122
| | | | | | | | | Upstream-Status: Backport from https://cgit.git.savannah.gnu.org/cgit/screen.git/commit/?id=161f85b98b7e1d5e4893aeed20f4cdb5e3dfaaa4 (From OE-Core rev: b25b0f785e0b7650e31a45a92be196be6b76ea78) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* iputils: Security fix for CVE-2025-47268Yi Zhao2025-05-282-0/+144
| | | | | | | | | | | | | | | | | | | CVE-2025-47268 ping in iputils through 20240905 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-47268 Patch from: https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40 (From OE-Core rev: a463c8e3950ccf58316d48241c2cd82484f25fda) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2024-29507Peter Marko2025-05-141-1/+1
| | | | | | | | | | | | | | | | | | | Fix for this CVE is [3] (per [1] and [2]). It fixes cidfsubstfont handling which is not present in 9.55.0 yet. It was introduced (as cidsubstpath) in 9.56.0 via [4] and later modified to cidfsubstfont in [5]. Since this recipe has version 9.55.0, mark it as not affected yet. [1] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=7745dbe24514710b0cfba925e608e607dee9eb0f [2] https://nvd.nist.gov/vuln/detail/CVE-2024-29507 [3] https://security-tracker.debian.org/tracker/CVE-2024-29507 [4] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=82efed6cae8b0f2a3d10593b21083be1e7b1ab23 [5] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=4422012f6b40f0627d3527dba92f3a1ba30017d3 (From OE-Core rev: 5c9f3c244971aadee65a98d83668e3d5d63825a0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2025-27837Peter Marko2025-05-141-0/+2
| | | | | | | | | | | | This CVE only impacts codepaths relevant for Windows builds. Se [1] from Debian which marks it as not applicable. [1] https://security-tracker.debian.org/tracker/CVE-2025-27837 (From OE-Core rev: fb5dc4a476bc4054493d6a7eb64a423e3665afb9) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata/tzcode-native: upgrade 2025a -> 2025bPriyal Doshi2025-05-021-3/+3
| | | | | | | (From OE-Core rev: 2568f7ce707d63df1f98b3eeec6639d7a5a2d642) Signed-off-by: Priyal Doshi <pdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: ignore CVE-2024-48615Peter Marko2025-05-021-0/+2
| | | | | | | | | | | | | | | Fix for this CVE [1] is patchong code introduced by [2] in v3.7.5. So v3.6.2 is not affected yet and the CVE can be safely ignored. Also Debian tracker [3] contains this statement. [1] https://github.com/libarchive/libarchive/commit/565b5aea491671ae33df1ca63697c10d54c00165 [2] https://github.com/libarchive/libarchive/commit/2d8a5760c5ec553283a95a1aaca746f6eb472d0f [3] https://security-tracker.debian.org/tracker/CVE-2024-48615 (From OE-Core rev: 60390a3a28242efba32360426b0a3be6af5fb54b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2025-27833Peter Marko2025-05-021-1/+2
| | | | | | | | | | | | | | Vulnerable code was introduced in 9.56.0, so 9.55.0 is not affected yet Commit introducing vulnerable feature: * https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/pdf/pdf_fmap.c?id=0a1d08d91a95746f41e8c1d578a4e4af81ee5949 Commit fixing the vulnerability: * https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=477e36cfa1faa0037069a22eeeb4fc750733f120 (From OE-Core rev: e1f3d02e80f6bdd942321d9f6718dcc36afe9df8) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: Update fix for CVE-2024-10041Shubham Kulkarni2025-05-023-1/+79
| | | | | | | | | | | | | | | Initially, PAM community fixed CVE-2024-10041 in the version v1.6.0 via commit b3020da. But not all cases were covered with this fix and issues were reported after the release. In the v1.6.1 release, PAM community fixed these issues via commit b7b9636. Backport this commit b7b9636, which Fixes: b3020da ("pam_unix/passverify: always run the helper to obtain shadow password file entries") Backport from https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620 (From OE-Core rev: 71035c8c5907f7103ce40b92490a10bd3dde7226) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27836Vijay Anusuri2025-04-113-0/+112
| | | | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8b6d19b2b4079da6863ef25f2370f25d4b054919 & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=d84efb73723384a8b7fb3989c824cfa218060085] (From OE-Core rev: 7399cf17590204f8289f356cce4575592d6e3536) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27835Vijay Anusuri2025-04-112-0/+35
| | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=de900010a6f2310d1fd54e99eeba466693da0e13] (From OE-Core rev: c30c46c2b4048dd58cf91b1523ddeca6075176ec) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27834Vijay Anusuri2025-04-112-0/+58
| | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ef42ff180a04926e187d40faea40d4a43e304e3b] (From OE-Core rev: 06fb236cabf550ea7c92cda0a725dd3db8a8a38b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27832Vijay Anusuri2025-04-112-0/+46
| | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=57291c846334f1585552010faa42d7cb2cbd5c41] (From OE-Core rev: a1cd1e6275cc5ae3c100a3259e24d03937a4b78d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27831Vijay Anusuri2025-04-113-0/+136
| | | | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=bf79b61cb1677d6865c45d397435848a21e8a647 & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=bf79b61cb1677d6865c45d397435848a21e8a647] (From OE-Core rev: 810795d2f1d7798c52675efd94917bf99fb940d0) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2025-27830Vijay Anusuri2025-04-112-0/+80
| | | | | | | | | | Upstream-Status: Backport [https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=8474e1d6b896e35741d3c608ea5c21deeec1078f] (From OE-Core rev: bc74ad209b243b131ea5467b871339f1773ba64b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: ignore CVE-2025-1632Peter Marko2025-04-041-0/+2
| | | | | | | | | | | | | | As already mentioned in [1] when backporting commit including fix for this CVE, this vulnerability applies only from libarchive 3.7.0 commit [2] which introduced bsdunzip which contains this vulnerability. [1] https://git.openembedded.org/openembedded-core/commit/?h=kirkstone&id=ec837d3b21b4f8b98abac53e2833f1490ba6bf1e [2] https://github.com/libarchive/libarchive/commit/c157e4ce8eb170a92945cc2d292fd7106bdfcce1 (From OE-Core rev: bf7654877ba99f0b18a1cf6f83032af5ecabd01f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: patch CVE-2025-25724Peter Marko2025-03-192-0/+41
| | | | | | | | | | | | Pick commit referencing this MR which was merged to master. Note that this commit also patched CVE-2025-1632 in bsdunzip, however that utility was introduced only in 3.7.0, so that part is not applicable in kirkstone. (From OE-Core rev: ec837d3b21b4f8b98abac53e2833f1490ba6bf1e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzcode-native: Fix compiler setting from 2023d versionAlessio Cascone2025-03-131-1/+1
| | | | | | | | | | | | | | Starting from 2023d version, tzcode makefile does not use anymore "cc" variable for C compiler, due to Makefile refactoring. Replacing "cc" with "CC" fixes the issue. (From OE-Core rev: 0216c229d5c60d0023b0a7d6e8ee41bdfa16f8ef) Signed-off-by: Alessio Cascone <alessio.cascone@vimar.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b3cdfca5ef84ed2054faef9abddef3aeed930e17) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata/tzcode-native: upgrade 2024b -> 2025aPriyal Doshi2025-03-131-3/+3
| | | | | | | | | | (From OE-Core rev: 4dc7731d350eab8952330f01beb5acdba7d88bb9) Signed-off-by: Priyal Doshi <pdoshi@mvista.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a15c4e6793c55c8084a61298ef3695e1db2f60cd) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xz: Update SRC_URIGuocai He2025-03-041-1/+1
| | | | | | | | | | | | Update SRC_URI for xz. The the tarball of xz-.tar.gz has been changed from https://tukaani.org/xz/xz-.tar.gz to https://sourceforge.net/projects/lzmautils/files/xz-.tar.gz (From OE-Core rev: 3f0803557ffa0fae557895f955ab2dcac38d7262) Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzcode: Update SRC_URIGuocai He2025-03-041-4/+4
| | | | | | | | | | Update SRC_URI for tzcode. Update the http to https in SRC_URI to fix the do_fetch issue. (From OE-Core rev: b663540d143b0e5fcb9ceeec45cde7fe3e68f9bb) Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* procps: replaced one use of fputs(3) with a write(2) callMingli Yu2025-02-243-0/+110
| | | | | | | | | | | | | | | | | | | | | | | | | This patch is ported from a merge request shown below, and the following represents the original commit text. ------------------------------------------------------ top: In the bye_bye function, replace fputs with the write interface. When top calls malloc, if a signal is received, it will call sig_endpgm to process the signal. In the bye_bye function, if the -b option is enable, the Batch variable is set, the fputs function will calls malloc at the same time. The malloc function is not reentrant, so it will cause the program to crash. (From OE-Core rev: 573f5b2d8fec9f8a4ed17e836ef3feeb6de62e5a) Signed-off-by: Shaohua Zhan <shaohua.zhan@windriver.com> ------------------------------------------------------ Reference(s): https://gitlab.com/procps-ng/procps/-/merge_requests/127 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wget: fix CVE-2024-10524Divya Chellam2025-01-242-0/+198
| | | | | | | | | | | | | | | | | | Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-10524 Upstream-patch: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778 (From OE-Core rev: eed5d59c138c210df91f31ac718383ccaf921faf) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: Fix CVE-2024-20696aszh072025-01-092-0/+115
| | | | | | | | | | | | Add Patch file to fix CVE-2024-20696 CVE: CVE-2024-20696 (From OE-Core rev: 8885aa23d77fcec288a416d199e08c6eee27e027) Signed-off-by: Nitin Wankhade <nitin.wankhade@kpit.com> Signed-off-by: Nikhil R <nikhilr5@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2024-46954Peter Marko2025-01-091-1/+1
| | | | | | | | | | | | | | | Issue in the GhostPCL. GhostPCL not part of this GhostScript recipe. [1] points to [2] as patch, while file base/gp_utf8.c is not part of ghostscript source tarball. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-46954 [2] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=55f587dd039282316f512e1bea64218fd991f934 (From OE-Core rev: 7f1b174b8f12fcf377c45c27022bac99b6652823) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* unzip: Fix configure tests to use modern CKhem Raj2024-12-162-0/+113
| | | | | | | | | | | | Newer compilers end up with errors while compiling these test snippets and build results in failures. (From OE-Core rev: 61bd7eccd8e305e2dd95f0b0b86b09d72e99fc1a) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: fix CVE-2024-10041Divya Chellam2024-12-162-0/+99
| | | | | | | | | | | | | | | | | | | | | A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. References: https://security-tracker.debian.org/tracker/CVE-2024-10041 Upstream patches: https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be (From OE-Core rev: 3422c2533caaa2664944315580c52a2272815305) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cpio: ignore CVE-2023-7216Peter Marko2024-12-091-0/+2
| | | | | | | | | | Same was done in newer Yocto releases. See commit See commit 0f2cd2bbaddba3b8c80d71db274bbcd941d0e60e (From OE-Core rev: 50d8a653104abb9b5cd8a708a7bd97446e894bcf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata&tzcode-native: upgrade 2024a -> 2024bJinfeng Wang2024-12-021-3/+3
| | | | | | | | | (From OE-Core rev: 5aa73ec35a3c65df62f17bc8196a35f28fd3522e) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit c8d3edb2562ea4d980186e78b4abb5a94b1d7b22) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Backport fix for multiple CVE'sVijay Anusuri2024-11-276-0/+255
| | | | | | | | | | | | | | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2024-46951 CVE-2024-46952 CVE-2024-46953 CVE-2024-46955 CVE-2024-46956 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/ghostscript/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ada21374f0c90cc3acf7ce0e96302394560c7aee & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1fb76aaddac34530242dfbb9579d9997dae41264 & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=294a3755e33f453dd92e2a7c4cfceb087ac09d6a & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ca1fc2aefe9796e321d0589afe7efb35063c8b2a & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ea69a1388245ad959d31c272b5ba66d40cebba2c] (From OE-Core rev: 21a81b592a33504d90f8c53842719cb1fcf96271) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2023-46361Archana Polampalli2024-11-152-0/+33
| | | | | | | | | | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. (From OE-Core rev: 3e9018fb14466495be7472a8620918347c732e86) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zstd: patch CVE-2022-4899Peter Marko2024-11-113-1/+153
| | | | | | | | | | | | | Pick commits from [1] linked from [2] via [3]. [1] https://github.com/facebook/zstd/pull/3220 [2] https://nvd.nist.gov/vuln/detail/CVE-2022-4899 [3] https://github.com/facebook/zstd/issues/3200 (From OE-Core rev: eb9c9818088105f9bf20b7fdc04a380ce488a5e6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cracklib: Modify patch to compile with GCC 14Zoltan Boszormenyi2024-11-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | GCC 14 implicitly turns a warning into a compiler error: | ../../git/src/lib/packlib.c: In function ‘PWClose’: | ../../git/src/lib/packlib.c:554:40: error: passing argument 1 of ‘HwmsHostToBigEndian’ from incompatible pointer type [-Wincompatible-pointer-types] | 554 | HwmsHostToBigEndian(tmp_pwp.hwms, sizeof(tmp_pwp.hwms), en_is32); | | ~~~~~~~^~~~~ | | | | | uint32_t * {aka unsigned int *} | ../../git/src/lib/packlib.c:142:27: note: expected ‘char *’ but argument is of type ‘uint32_t *’ {aka ‘unsigned int *’} | 142 | HwmsHostToBigEndian(char *pHwms, int nLen,int nBitType) | | ~~~~~~^~~~~ Add the cast to (char *) to silence it. (From OE-Core rev: 7cca344feaa16cfabbaa2f34e4aab91cc1af39ee) Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zip: Fix build with gcc-14Khem Raj2024-11-023-36/+46
| | | | | | | | | | | | | | | | | | | | | | | | zip's configure fails to link this piece of test code: int main() { return closedir(opendir(".")); } with GCC-14 because it now treats implicit declaration of function as error, unline older GCC version where it was just a warning and this test would build fine. Remove 0002-unix.c-Do-not-redefine-DIR-as-FILE.patch which is now unnecessary (MJ: this part wasn't applicable for kirkstone). (From OE-Core rev: fd31dd1abc8199a1865801259e6f96b78a17d994) Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3422411eb750c7e960b81676637cfb321dbadefb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zip: Make configure checks to be more robustKhem Raj2024-11-023-0/+171
| | | | | | | | | | | | | | Newer compilers are strict and have turned some warnings into hard errors which results in subtle configure check failures. Therefore fix these tests and also enable largefile support via cflags when its desired (From OE-Core rev: 03b7a44e2ff4364cb85758f91d78efa0cf85682d) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Backport CVE-2024-29508Ashish Sharma2024-11-023-0/+339
| | | | | | | | | | | | | Import patch from ubuntu to fix CVE-2024-29508 Upstream-Status: Backport [https://git.launchpad.net/ubuntu/+source/ghostscript/commit/?h=ubuntu/focal-security&id=22b23aa6de7613a4d9c1da9c84d72427c9d0cf1a] Upstream commit: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ff1013a0ab485b66783b70145e342a82c670906a (From OE-Core rev: c5a85dfe661543137e40976e832ac22e4815406a) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-09-28 19:18:41 +0000