summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
Commit message (Collapse)AuthorAgeFilesLines
* gnutls: Fix CVE-2025-14831Vijay Anusuri2026-04-0210-0/+1640
| | | | | | | | | | | | | | Picked commits which mentions this CVE per [1]. [1] https://ubuntu.com/security/CVE-2025-14831 [2] https://security-tracker.debian.org/tracker/CVE-2025-14831 [3] https://gitlab.com/gnutls/gnutls/-/issues/1773 (From OE-Core rev: d0e844108702e553950cab60d51f1cc4cfeed993) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev>
* gnupg: patch CVE-2025-68973Peter Marko2026-02-272-0/+109
| | | | | | | | | | | | | Pick patch from 2.4 branch per [1]. [1] https://security-tracker.debian.org/tracker/CVE-2025-68973 (From OE-Core rev: 66df136096c6a7e29edea0fbc0132b234032965f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: ignore CVE-2025-66476Ankur Tyagi2026-02-271-0/+2
| | | | | | | | | | | Details https://nvd.nist.gov/vuln/detail/CVE-2025-66476 (From OE-Core rev: f42ed917ab6a4a91d473ef5b2107cdf0f1961c57) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtasn1: Fix CVE-2025-13151Hugo SIMELIERE2026-02-162-0/+31
| | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.com/gnutls/libtasn1/-/commit/d276cc495a2a32b182c3c39851f1ba58f2d9f9b8 (From OE-Core rev: 3f9f51783597a682efdf989bebac2934b1f7040c) Signed-off-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-14524Amaury Couderc2026-02-162-0/+45
| | | | | | | | | (From OE-Core rev: 951113a6e8185969444b5e28292f23434dba1f6c) Signed-off-by: Amaury Couderc <amaury.couderc@est.tech> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix CVE-2025-10148Hitendra Prajapati2026-02-162-0/+58
| | | | | | | | | | | | | | | | | | | | | | | | | | | curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious server to induce traffic between the two communicating parties that could be interpreted by an involved proxy (configured or transparent) as genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could then be served to all users of that proxy. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-10148 Upstream patch: https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa (From OE-Core rev: 3793ee12d8da4f8f90a0ffcad180ef8122251491) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-15224Peter Marko2026-01-262-0/+32
| | | | | | | | | | | | | Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-15224.html (From OE-Core rev: 83c7d4acc5da661b44055db95355c3c420f7afac) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-15079Peter Marko2026-01-262-0/+33
| | | | | | | | | | | | | Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-15079.html (From OE-Core rev: 48a162d90daada0f992e665696f7f2e738780af1) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-14819Peter Marko2026-01-263-0/+160
| | | | | | | | | | | | | | | | | Pick patch per [1]. Additionally pick commit with definition of CURL_UNCONST to make the cherry-pick possible without build errors. It will be probably needed also by further CVE patches. [1] https://curl.se/docs/CVE-2025-14819.html (From OE-Core rev: 3a8e5ae08380ca201df950546dd5f02f9bbe1237) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: patch CVE-2025-14017Peter Marko2026-01-262-0/+116
| | | | | | | | | | | | | Pick patch per [1]. [1] https://curl.se/docs/CVE-2025-14017.html (From OE-Core rev: 2284de47317ada818f916be65abf13969294541c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Paul Barker <paul@pbarker.dev> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsoup: fix CVE-2025-12105Changqing Li2026-01-022-0/+35
| | | | | | | | | | Refer: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/481 (From OE-Core rev: 1ac9ad3faf022684ae709f4494a430aee5fb9906) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Use host CA bundle by default for native(sdk) buildsMoritz Haase2025-12-311-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes YOCTO #16077 Commit 0f98fecd (a backport of 4909a46e) broke HTTPS downloads in opkg in the SDK, they now fail with: > SSL certificate problem: self-signed certificate in certificate chain The root cause is a difference in the handling of related env vars between curl-cli and libcurl. The CLI will honour CURL_CA_BUNDLE and SSL_CERT_DIR|FILE (see [0]). Those are set in the SDK via env setup scripts like [1], so curl continued to work. The library however does not handle those env vars. Thus, unless the program utilizing libcurl has implemented a similar mechanism itself and configures libcurl accordingly via the API (like for example Git in [2] and [3]), there will be no default CA bundle configured to verify certificates against. Opkg only supports setting the CA bundle path via config options 'ssl_ca_file' and 'ssl_ca_path'. Upstreaming and then backporting a patch to add env var support is not a feasible short-time fix for the issue at hand. Instead it's better to ship libcurl in the SDK with a sensible built-in default - which also helps any other libcurl users. This patch is based on a proposal by Peter.Marko@siemens.com in the related mailing list discussion at [4]. (cherry picked from commit 3f819f57aa1960af36ac0448106d1dce7f38c050) [0]: https://github.com/curl/curl/blob/400fffa90f30c7a2dc762fa33009d24851bd2016/src/tool_operate.c#L2056-L2084 [1]: https://git.openembedded.org/openembedded-core/tree/meta/recipes-support/curl/curl/environment.d-curl.sh?id=3a15ca2a784539098e95a3a06dec7c39f23db985 [2]: https://github.com/git/git/blob/6ab38b7e9cc7adafc304f3204616a4debd49c6e9/http.c#L1389 [3]: https://github.com/git/git/blob/6ab38b7e9cc7adafc304f3204616a4debd49c6e9/http.c#L1108-L1109 [4]: https://lists.openembedded.org/g/openembedded-core/topic/115993530#msg226751 (From OE-Core rev: 0e553b685c0a987a7be1eee16b7b5e3e48a036e2) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> CC: matthias.schiffer@ew.tq-group.com CC: Peter.Marko@siemens.com Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: Fix CVE-2025-11731Mingli Yu2025-12-312-1/+44
| | | | | | | | | | | Backport the patch [1] to fix CVE-2025-11731. [1] https://gitlab.gnome.org/GNOME/libxslt/-/commit/fe508f201efb9ea37bfbe95413b8b28251497de3 (From OE-Core rev: e70c70e0359418197699f18c9e2cbfd7ebac705d) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: fix regression in KEX method validation (GH-1553)Vijay Anusuri2025-12-172-0/+74
| | | | | | | | | | | | | | | Resolves: https://github.com/libssh2/libssh2/issues/1553 Regression caused by https://github.com/libssh2/libssh2/commit/00e2a07e824db8798d94809156e9fb4e70a42f89 Backport fix https://github.com/libssh2/libssh2/commit/4beed7245889ba149cc372f845d5969ce5103a5d (From OE-Core rev: c348296ff0181921e8aa5a16d8d90db75f7b3e7c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: upgrade 1.11.0 -> 1.11.1Vijay Anusuri2025-12-172-469/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: https://github.com/libssh2/libssh2/releases/tag/libssh2-1.11.1 Dropped CVE-2023-48795.patch which is already included in version 1.11.1 Resolves: https://github.com/libssh2/libssh2/issues/1326 License-Update: Copyright symbols were changed from (C) to lowercase (c) ptest results: root@qemux86-64:~# ptest-runner libssh2 START: ptest-runner 2025-12-08T12:37 BEGIN: /usr/lib/libssh2/ptest PASS: mansyntax.sh PASS: test_simple PASS: test_sshd.test DURATION: 6 END: /usr/lib/libssh2/ptest 2025-12-08T12:37 STOP: ptest-runner TOTAL: 1 FAIL: 0 (From OE-Core rev: 71316433eb018e831d72a873365aa53ed04f14f4) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libmicrohttpd: disable experimental code by defaultPeter Marko2025-12-171-0/+4
| | | | | | | | | | | | | | | | | | | Introduce new packageconfig to explicitly avoid compilation of experimental code. Note that the code was not compiled by default also before this patch, this now makes it explicit and makes it possible to check for the flags in cve-check code. This is less intrusive change than a patch removing the code which was rejected in patch review. This will solve CVE-2025-59777 and CVE-2025-62689 as the vulnerable code is not compiled by default. Set appropriate CVE status for these CVEs based on new packageconfig. (From OE-Core rev: 9e3c0ae261afb7b9ff9528dbc147fb6c89d5a624) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Ensure 'CURL_CA_BUNDLE' from host env is indeed respectedMoritz Haase2025-12-051-2/+2
| | | | | | | | | | | | | | | | | | Due to what looks like a copy'n'paste mistake, the environment setup script might override 'CURL_CA_BUNDLE' from the host env instead of leaving it untouched. Fix that. (cherry picked from commit 545e43a7a45be02fda8fc3af69faa20e889f58c4) CC: changqing.li@windriver.com CC: raj.khem@gmail.com CC: Peter.Marko@siemens.com (From OE-Core rev: ef198b0c6063ede32cb93fe44eb89937c076a073) Signed-off-by: Moritz Haase <Moritz.Haase@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-9820Peter Marko2025-12-052-0/+251
| | | | | | | | | | | | | This CVE is announced under [1]. Pick commit which mentions this CVE per [2]. [1] https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18 [2] https://security-tracker.debian.org/tracker/CVE-2025-9820 (From OE-Core rev: 37dcb0f617f02f95293455d58927e0da4e768cc4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: patch CVE-2025-7709Hugo SIMELIERE2025-11-262-0/+34
| | | | | | | | | | | Pick commit used in debian patch https://git.launchpad.net/ubuntu/+source/sqlite3/commit/?id=9a309a50fa99e3b69623894bfd7d1f84d9fab33c Upstream-Status: Backport [https://github.com/sqlite/sqlite/commit/192d0ff8ccf0bf55776a5930cdc64e25f87299d6] (From OE-Core rev: baaf28f6f2eac600f7caf53660a0b75f0329e86a) Signed-off-by: Bruno VERNAY <bruno.vernay@se.com> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: fix on-target postinstall scriptGyorgy Sarvari2025-11-141-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | When the package is installed directly on the machine (instead of installing it in the rootfs directly), the postinstall script fails with the following error: /usr/sbin/update-ca-certificates: line 75: shift: shift count out of range The reason is that the "update-ca-certificates" script is executed with the "--sysroot" argument, and as the sysroot $D is passed. However on the target system this variable doesn't exist, so the argument is passed without this mandatory value, and the execution fails. To avoid this error, check if the $D variable exists, and pass the --sysroot argument only when it does. Reported-by: WXbet <Wxbet@proton.me> (From OE-Core rev: 9a2bd3b6e2e53071a1463d2804d0d4fb17b1814f) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit cf39461e97098a1b28693299677888ba7e8bfccf) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: upgrade 20241223 -> 20250419Wang Mingyu2025-11-144-44/+7
| | | | | | | | | | | | | | | | | 0001-Revert-mozilla-certdata2pem.py-print-a-warning-for-e.patch 0001-update-ca-certificates-don-t-use-Debianisms-in-run-p.patch refreshed for 20250419 0002-sbin-update-ca-certificates-add-a-sysroot-option.patch removed since it's included in 20250419 (From OE-Core rev: dd05818a422c8c5be1aef06405d200280b382b91) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e39cc1fb7234bf2b37856296d3c0d10ddf8cae64) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: submit sysroot patch upstream, drop default-sysroot.patchAlexander Kanavin2025-11-145-118/+49
| | | | | | | | | | | | | | | | | | | | | | | ca-certificates/0002-update-ca-certificates-use-SYSROOT.patch was using a non-standard environment variable, and was replaced with a patch that adds a command line option (and then this was submitted upstream). ca-certificates recipe was tweaked accordingly, and nothing else in core or meta-oe is using update-ca-certificates. Drop default-sysroot.patch as the use case is unclear: sysroot is explicitly specified in all known invocations of update-ca-certificate, and if there's a place where it isn't, then update-ca-certificates will error out trying to write to /etc, and should be fixed to explicitly specify the sysroot. (From OE-Core rev: a80185fd72a2be183783b0e464c07f1043d7dd37) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 90d9f0ba674d4fe8e9291f0513c13dff3775c545) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: upgrade 20240203 -> 20241223Richard Purdie2025-11-146-29/+38
| | | | | | | | | (From OE-Core rev: 7e4ce7c927f6328e013db53690a2ef841b1bb9bf) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 48a236c2f78fee5e6db19c6be23b4a18df025607) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: get sources from debian tarballsAlexander Kanavin2025-11-141-14/+3
| | | | | | | | | | | | | | git repo no longer has tags for recent versions which means we had missed several of them, and wouldn't be able to get notifications about any future releases. (From OE-Core rev: 44c113497c7e3f9f06604e892df1eb717bb3410d) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 81f013fd1312551628701bf36ac62746a2606dbd) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: Add comment for provenance of SRCREVTheodore A. Roth2025-11-141-0/+7
| | | | | | | | | | | | | | Provide references for how the SRCREV was arrived at for the 20240203 release. (From OE-Core rev: b1d86653f1485aa56fe8bf050931d5b8657ee499) Signed-off-by: Theodore A. Roth <troth@openavr.org> Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6916cdb0f05f6644edb1e432a9421595abb9f0ca) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ca-certificates: update 20211016 -> 20240203Theodore A. Roth2025-11-143-9/+9
| | | | | | | | | | | | | | The 20240203 version is the same as used in Ubuntu >= 24.04 and Debian Trixie (testing). (From OE-Core rev: 63620f034019b3b3585e263bd26b3fadd9a1692e) Signed-off-by: Theodore A. Roth <troth@openavr.org> Signed-off-by: Theodore A. Roth <theodore_roth@trimble.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ce19168885a04b0d77e81c1fd1c4262b195a47d4) Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: ignore CVE-2025-10966Peter Marko2025-11-141-0/+1
| | | | | | | | | | | | Per [1] this CVE applies only when wolfssl backed is used. 8.17.0 removed WolfSSL support completely. [1] https://curl.se/docs/CVE-2025-10966.html (From OE-Core rev: 3de9b86c295c88005d4df53e5137bb09ea104ed0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* lz4: fix CVE-2025-62813David Nyström2025-11-032-2/+76
| | | | | | | | | | | | | | | | | | Prevent attackers to cause a denial of service (application crash) or possibly have unspecified other impact when the application processes untrusted LZ4 frames. For example, LZ4F_createCDict_advanced in lib/lz4frame.c mishandles NULL checks. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-62813 Upstream patch: https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82 (From OE-Core rev: 0a63e3e120cc6958e2963a3ad510ec7c03f1adae) Signed-off-by: David Nyström <david.nystrom@est.tech> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: only set CA bundle in target buildMatthias Schiffer2025-11-031-1/+3
| | | | | | | | | | | | | | | | | | | In native/nativesdk builds, sysconfdir refers to a recipe sysroot directory, which will disappear once the workdir is cleaned up, breaking libcurl's HTTPS connections. By simply not setting --with-ca-bundle at all in non-target builds, curl defaults to the host system's CA certificates, which is desirable anyways to allow builds in environments that require local CA certificates. (From OE-Core rev: 4909a46e93ba774c960c3d3c277e2a669af3fea6) (From OE-Core rev: 0f98fecda8a0436f760e6fd9f3b7eb510e5258b8) Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* icu: Backport patch to fix build issues with long paths (>512 chars)Carlos Alberto Lopez Perez2025-10-242-0/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | There is a bug libicu that causes libicu to be installed incorrectly when the build system uses long paths (more than 512 chars). This condition is not very difficult to trigger on a OE build system due to the long paths an the deep of the directories that are usually generated by default. Also the bug is very subtle and won't be detected by the QA post-install processes because what this bug causes is that a different version of libicudata.so.X.Y (one without data) is installed instead of the one containing the data, but there won't be any file missed on the installation (just that it installed the wrong one). See: https://unicode-org.atlassian.net/browse/ICU-22813 This patch backports the fix from upstream/main (From OE-Core rev: 67d1352873957decacde30ff208fb7bb635b0c5d) (From OE-Core rev: 0860992436092f7651e22e2b894f0d0a365a9bb0) Signed-off-by: Carlos Alberto Lopez Perez <clopez@igalia.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Benjamin Hahn <B.Hahn@phytec.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnupg: mark CVE-2025-30258 as patchedPeter Marko2025-10-241-0/+1
| | | | | | | | | | | | | | Per NVD report [1] this CVE is fixed by [2]. This commit was backported to 2.4.8 via [3]. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-30258 [2] https://dev.gnupg.org/rG48978ccb4e20866472ef18436a32744350a65158 [3] https://gitlab.com/freepg/gnupg/-/commit/da0164efc7f32013bc24d97b9afa9f8d67c318bb (From OE-Core rev: 88fe1eaa4bcd7c838902d8cdc067276c5f32624d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1652 -> 9.1.1683Divya Chellam2025-09-301-2/+2
| | | | | | | | | | | | | Handles CVE-2025-9389 Changes between 9.1.1652 -> 9.1.1683 ==================================== https://github.com/vim/vim/compare/v9.1.1652...v9.1.1683 (From OE-Core rev: 55e0c38dc28b73fa689446e2d5e564d235a24084) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* p11-kit: backport fix for handle USE_NLS from masterAshishKumar Mishra2025-09-301-0/+1
| | | | | | | | | | | | | | | | | | | Disable NLS in the build when USE_NLS is off. (From OE-Core rev: b94798ecd535956ef4565663710ea9a701ff21ed) This change corresponds to upstream eeb3974472429a99a724f324dc8a63e435741f68 from master . Since the p11-kit version are different between master & scarthgap applied the patch manually (From OE-Core rev: 96602ea67463170c4cadf748525f5615ce9bbd91) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* shared-mime-info: Handle USE_NLSPhilip Lorenz2025-09-301-1/+4
| | | | | | | | | | | | | | Skip building of translations when NLS is disabled. (From OE-Core rev: b58a3f4e9c78522423a94821b7ba7a35eb18f75a) (From OE-Core rev: 49a9aebc0e9f668cf2896d0b522f8194bb4049ad) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: fix CVE-2025-9086Yogita Urade2025-09-302-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1, A cookie is set using the secure keyword for https://target 2, curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set 3, The same cookie name is set - but with just a slash as path (path="/"). Since this site is not secure, the cookie should just be ignored. 4, A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9086 Upstream patch: https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6 (From OE-Core rev: b0cc7001a628deaa96d1aebb5ded52797898a0be) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: apply patch for CVE-2025-7424Ross Burton2025-09-302-1/+105
| | | | | | | | | | | | | This patch is taken from the upstream bug, and is used by Apple in their build of WebKit. (From OE-Core rev: f59e07fd9f6c437e30431607763672fde42511ad) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Anil Dongare <adongare@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* buildtools-tarball: fix unbound variable issues under 'set -u'Haixiao Yan2025-09-221-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | When Bash runs with 'set -u' (nounset), accessing an unset variable directly (e.g. [ -z "$SSL_CERT_FILE" ]) causes a fatal "unbound variable" error. As a result, the fallback logic to set SSL_CERT_FILE/SSL_CERT_DIR is never triggered and the script aborts. The current code assumes these variables may be unset or empty, but does not guard against 'set -u'. This breaks builds in stricter shell environments or when users explicitly enable 'set -u'. Fix this by using parameter expansion with a default value, e.g. "${SSL_CERT_FILE:-}", so that unset variables are treated as empty strings. This preserves the intended logic (respect host env first, then CAFILE/CAPATH, then buildtools defaults) and makes the script robust under 'set -u'. (From OE-Core rev: 4cf131ebd157b79226533b5a5074691dd0e1a4ab) Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4d880c2eccd534133a2a4e6579d955605c0956ec) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: update CVE_STATUS for CVE-2025-5025Vrushti Dabhi2025-09-091-1/+1
| | | | | | | | | | | | This CVE applies only when curl is built with wolfSSL support. Revised CVE_STATUS description to align with CVE details. Reference: https://github.com/openembedded/openembedded-core/commit/93ae0758ef35 (From OE-Core rev: fddc4dcc89a9491abdf8f5d0ea4df9a6526b1538) Signed-off-by: Vrushti Dabhi <vdabhi@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libgpg-error: fix build with gcc-15Martin Jansa2025-09-012-0/+53
| | | | | | | | | Backport a fix for native build with gcc-15 on host (From OE-Core rev: cef0a6c3245a2556614f7e009c2e00e1eb16e08e) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdbm: Use C11 standardKhem Raj2025-09-011-0/+4
| | | | | | | | | | | | | | GCC15 is switching defaults to C23 and gdbm is not yet ready to compile using C23 std. For scarthgap also add it in BUILD_CFLAGS. (From OE-Core rev: 97989d81c5e30434594beadd9449e907e98d3ceb) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gmp: Fix build with older gcc versionsKhem Raj2025-09-012-0/+51
| | | | | | | | | | | | The fix to make this work with GCC15/C23 caused problems with older gcc versions. Add a fix for that. (From OE-Core rev: 237085506a454fb927389d681f30c8c995bc7b2b) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gmp: Fix build with GCC15/C23Khem Raj2025-09-012-0/+26
| | | | | | | | | (From OE-Core rev: 5114bea0e9fe3cc15cb4f4d264a932d5b9897296) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1198 -> 9.1.1652Peter Marko2025-09-014-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Handles CVE-2025-53905, CVE-2025-53906, CVE-2025-55157, CVE-2025-55158. Changes between 9.1.1198 -> 9.1.1652 ==================================== https://github.com/vim/vim/compare/v9.1.1198...v9.1.1652 Refresh patches. Disable newly introduced wayland support (in patch version 1485). To this belongs also adding recursion in delete command for dir auto which was newly failing as there is wayland directory inside now. If someone is interested, this can be probably enabled, but without additional work it results in compilation error due to function redefinition conflicts. (From OE-Core rev: e87d427d928234ef0441f9ce1fe8631fbe471094) (From OE-Core rev: 052fd7e55d2c73f13f63267fbfb5e39fa504baa3) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-6395Peter Marko2025-08-042-0/+300
| | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 14fbbdc51f7d02bc10b8078c0ba1de17f1563d73) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-32990Peter Marko2025-08-042-0/+2110
| | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 823cdb5574c15a595dfeab413421304007899aa2) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-32988Peter Marko2025-08-042-0/+59
| | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 2838dae57a1236d4f6eb97e32eb500892ba67184) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch reject zero-length version in certificate requestPeter Marko2025-08-043-1/+41
| | | | | | | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. The MR contains referece to undiscoled issue, so any security relevant patch should be picked. Binary test file was added as separate file as binary diffs are not supported. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: d1aaef9bbaa240c83cc7d485b55570449203da0b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch read buffer overrun in the "pre_shared_key" extensionPeter Marko2025-08-043-1/+38
| | | | | | | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. The ME contains referece to undiscoled issue, so any security relevant patch should be picked. Binary test file was added as separate file as binary diffs are not supported. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 8f825e7f4ca36d7ac62062e452cea256f3c058aa) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: patch CVE-2025-32989Peter Marko2025-08-043-0/+56
| | | | | | | | | | | | | | Pick relevant commit from 3.8.10 release MR [1]. Binary test file was added as separate file as binary diffs are not supported. [1] https://gitlab.com/gnutls/gnutls/-/merge_requests/1979 (From OE-Core rev: 9d9ce14e2edceb211c3193cef88715d9c67fd3e0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: fix CVE-2025-6965Roland Kovacs2025-07-292-0/+113
| | | | | | | | | | | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. (From OE-Core rev: 52499a5ea3b4ba145914aca873844ab718953289) Signed-off-by: Roland Kovacs <roland.kovacs@est.tech> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 01:03:07 +0000