summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
...
* glibc: Remove partial BZ#25847 backport patchesSunil Dora2025-10-179-1427/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To facilitate a clean backport of the full 10-commit series addressing the pthread condition variable lost wakeup issue (BZ#25847) in glibc 2.35, remove the existing 8 patches that were applied as a partial backport. The previous partial backport excluded commit: c36fc50781995e6758cae2b6927839d0157f213c ("nptl: Remove g_refs from condition variables") based on guidance from glibc maintainer Florian Weimer(#comment #74) This exclusion was recommended for stable branches to avoid altering the layout of pthread_cond_t, which could introduce ABI incompatibilities. Additionally, the dependent commit dbc5a50d12eff4cb3f782129029d04b8a76f58e7 was not needed in the partial backport. To align with upstream mainline, per maintainer Carlos O'Donell (comment #75), apply the complete 10-commit series for consistency. By removing these patches first, we ensure the subsequent application of the full 10 commits results in cleaner, more reviewable changes without intermixed conflicts or overlaps. Removed patches and corresponding upstream commits: - 0026-PR25847-1.patch: 1db84775f831a1494993ce9c118deaf9537cc50a - 0026-PR25847-2.patch: 0cc973160c23bb67f895bc887dd6942d29f8fee3 - 0026-PR25847-3.patch: b42cc6af11062c260c7dfa91f1c89891366fed3e - 0026-PR25847-4.patch: 4f7b051f8ee3feff1b53b27a906f245afaa9cee1 - 0026-PR25847-5.patch: 929a4764ac90382616b6a21f099192b2475da674 - 0026-PR25847-6.patch: ee6c14ed59d480720721aaacc5fb03213dc153da - 0026-PR25847-7.patch: 4b79e27a5073c02f6bff9aa8f4791230a0ab1867 - 0026-PR25847-8.patch: 91bb902f58264a2fd50fbce8f39a9a290dd23706 Bug reference: https://sourceware.org/bugzilla/show_bug.cgi?id=25847 This change prepares the branch for the full backport in follow-up commits. (From OE-Core rev: 9881dd70305b87945e9649d744bcbc40a1a7b780) Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-11083Peter Marko2025-10-172-0/+78
| | | | | | | | | | Pick patch per link in NVD report. (From OE-Core rev: 99879f41af7272e597c9a8c4c0260d1b690f9051) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: patch CVE-2025-11082Peter Marko2025-10-172-0/+47
| | | | | | | | | | Pick patch per link in NVD report. (From OE-Core rev: cdc458b5dd21614058aac56de68a272201283141) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: patch CVE-2024-8354Peter Marko2025-10-172-0/+76
| | | | | | | | | Pick commit per [1]. (From OE-Core rev: bebd1b24473e3480ae6c4ae2897fbfdf4942ea11) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/sdk/cases/buildcpio.py: use gnu mirror instead of main serverSteve Sakoman2025-10-141-1/+1
| | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html (From OE-Core rev: 0d11c9103f072841baf39166efc133f2a20fc4dc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest/cases/meta_ide.py: use use gnu mirror instead of main serverSteve Sakoman2025-10-141-1/+1
| | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html (From OE-Core rev: 97939775d2b81af392a2f98c922165763ff0ae5f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* conf/bitbake.conf: use gnu mirror instead of main serverGyorgy Sarvari2025-10-141-1/+1
| | | | | | | | | | | | | | | | | | | ftp.gnu.org is the main server of the GNU project, however download speed can vary greatly based on one's location. Using ftpmirror.gnu.org should redirect the request to the closest up-to-date mirror, which should result sometimes in significantly faster download speed, depending on one's location. This should also distribute the traffic more across the mirrors. This information was sourced from https://www.gnu.org/prep/ftp.html . (From OE-Core rev: 8418289277056d582d88916b524b920a2e005c75) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d8c6f01d7467e018aa0ed27a87850d9e4434a47a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* p11-kit: backport fix for handle USE_NLS from masterAshishKumar Mishra2025-10-141-0/+1
| | | | | | | | | | | | | | | | | | | Disable NLS in the build when USE_NLS is off. (From OE-Core rev: b94798ecd535956ef4565663710ea9a701ff21ed) This change corresponds to upstream eeb3974472429a99a724f324dc8a63e435741f68 from master . Since the p11-kit version are different between master & kirkstone applied the patch manually (From OE-Core rev: c621612a12cdbf5c89279b69e28d0e3a0b5d0a86) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: backport fix for handle USE_NLS from masterAshishKumar Mishra2025-10-141-0/+1
| | | | | | | | | | | | | | | | | | Do not build translations when NLS is disabled. (From OE-Core rev: 83795ef6c3fa12a863cd20b7ec1a2607606987b6) This change corresponds to upstream d848b454e64ffbd642590b4bbc378619e1547ad3 from master . Since the systemd version are different between master & kirkstone applied the patch manually (From OE-Core rev: 4b612ae7cbdc8327765c34d0e64fa8e0564891d4) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.35 branch updatesDeepesh Varatharajan2025-10-141-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git log --oneline a66bc3941ff298e474d5f02d0c3303401951141f..4e50046821f05ada5f14c76803845125ddb3ed7d 4e50046821 (HEAD, origin/release/2.35/master) x86-64: Add GLIBC_ABI_DT_X86_64_PLT [BZ #33212] c97735cfde elf: Handle ld.so with LOAD segment gaps in _dl_find_object (bug 31943) 96cc65a28a elf: Extract rtld_setup_phdr function from dl_main e3f04f64fa elf: Do not add a copy of _dl_find_object to libc.so bfae8bf49c arm: Use _dl_find_object on __gnu_Unwind_Find_exidx (BZ 31405) Testing Results: Before After Diff PASS 4605 4609 +4 XPASS 6 6 0 FAIL 358 356 -2 XFAIL 16 16 0 UNRESOLVED 0 1 +1 UNSUPPORTED 197 197 0 Testcases changes testcase-name before after elf/tst-link-map-contiguous-libc(new) - PASS elf/tst-link-map-contiguous-ldso(new) - FAIL elf/check-dt-x86-64-plt(new) - UNRESOLVED misc/tst-tsearch FAIL PASS posix/bug-regex24 FAIL PASS string/tst-cmp FAIL PASS (From OE-Core rev: 932ee96c0dc24ac3cdb9cee5bf96375568b41df0) Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: upgrade 3.0.17 -> 3.0.18Archana Polampalli2025-10-141-1/+1
| | | | | | | | | | | | | | This release incorporates the following bug fixes and mitigations: Fix Out-of-bounds read & write in RFC 3211 KEK Unwrap. (CVE-2025-9230) Fix Out-of-bounds read in HTTP client no_proxy handling. (CVE-2025-9232) Changelog: https://github.com/openssl/openssl/blob/openssl-3.0.18/NEWS.md#openssl-30 (From OE-Core rev: 0a0d640436258269ffaaf23116d41f9a79db5ab7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-47906Archana Polampalli2025-10-142-0/+172
| | | | | | | | | | | | If the PATH environment variable contains paths which are executables (rather than just directories), passing certain strings to LookPath ("", ".", and ".."), can result in the binaries listed in the PATH being unexpectedly returned. (From OE-Core rev: c4d81e32ee3fb7d05db2cfbfaaa8081841bc16ce) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: mark CVE-2023-6601 as patchedPeter Marko2025-10-141-1/+1
| | | | | | | | | | | Per [1] this CVE is fixed by the same commits as the other 3 CVEs. [1] https://security-tracker.debian.org/tracker/CVE-2023-6601 (From OE-Core rev: b0542ad422ac1ba05dd5b8003429b8719619d892) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: ignore CVE-2023-6603Peter Marko2025-10-141-0/+4
| | | | | | | | | | | | | Per [1] this CVE is fixed by [2] which is available in version 5.0, so version 5.0.3 is not vulnerable anymore. [1] https://security-tracker.debian.org/tracker/CVE-2023-6603 [2] https://github.com/FFmpeg/FFmpeg/commit/28c83584e8f3cd747c1476a74cc2841d3d1fa7f3 (From OE-Core rev: dcfd5672474f7a9bf7913c0f0e35f7c40bb685c4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio: ignore CVE-2024-11586Peter Marko2025-10-141-0/+3
| | | | | | | | | | | | | | | | | | | As per the linked ticket, this issue is related to an Ubuntu-specific patch that we don't have. (From OE-Core rev: dc81fdc6bdf8ab39b7f2fd994d50256430c36558) (From OE-Core rev: 72e63e44a0c6ad5a408c4dc59a24288c36463439) Rewritten CVE_STATUS to CVE_CHECK_IGNORE. (From OE-Core rev: 66e45229a9614d33f64167f0259ae1d719839d83) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: patch CVE-2025-59800Peter Marko2025-10-142-0/+37
| | | | | | | | | Pick commit mentioned in the NVD report. (From OE-Core rev: 5109fd6675b6782f10f86f774fe54b6ccecee415) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: patch CVE-2025-59799Peter Marko2025-10-142-0/+42
| | | | | | | | | Pick commit mentioned in the NVD report. (From OE-Core rev: 10a51275bb0f62b018a6182953352ecf7aa3d220) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: patch CVE-2025-59798Peter Marko2025-10-142-0/+135
| | | | | | | | | Pick commit mentioned in the NVD report. (From OE-Core rev: dc65da274b26c1e7f4143154cd7639a93cc658be) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub: ignore CVE-2024-2312Peter Marko2025-10-141-0/+2
| | | | | | | | | | | This CVE is specific to Ubuntu [1]. [1] https://bugs.launchpad.net/ubuntu/+source/grub2-unsigned/+bug/2054127 (From OE-Core rev: dc10bf2f9dd91cbd34af43162b61736fc26aa314) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: ignore CVE-2025-2759Peter Marko2025-10-141-0/+3
| | | | | | | | | | | | | | | | | | Copy statement from [1] that it is problem of installers (non-Linux). Also [2] linked in NVD says "Fixed in 1.25.1 Gstreamer Installer". Since Yocto builds from sources into our own packages, ignore it. [1] https://security-tracker.debian.org/tracker/CVE-2025-2759 [2] https://www.zerodayinitiative.com/advisories/ZDI-25-268/ (From OE-Core rev: 99ee1df6bde2ffd4fa2ddea44c0a9b94d9d77bae) Reworked to CVE_CHECK_IGNORE format. (From OE-Core rev: 2162bc3b305a0b088018e251baad54c356f7855f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0: ignore CVEs fixed in pluginsPeter Marko2025-10-141-3/+9
| | | | | | | | | All these CVEs were fixed in recent commits. (From OE-Core rev: 86f48cdb1b26b6e234dde10b1e636e54e8a7e71f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: Fix CVE-2025-9165Vijay Anusuri2025-10-142-0/+33
| | | | | | | | | Upstream-Commit: https://gitlab.com/libtiff/libtiff/-/commit/ed141286a37f6e5ddafb5069347ff5d587e7a4e0 (From OE-Core rev: 08823f96a400055e5924bae3af0d2dfaf488148b) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: Fix CVE-2025-8961Vijay Anusuri2025-10-142-0/+75
| | | | | | | | | Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5 (From OE-Core rev: 8d956d80f0eae39f9de68c0cd5a361c69b47cda4) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: Patch for CVE-2025-7424Vijay Anusuri2025-10-142-0/+106
| | | | | | | | | | | | | | This patch is taken from the upstream bug, and is used by Apple in their build of WebKit. Origin: https://gitlab.gnome.org/-/project/1762/uploads/627ae84cb0643d9adf6e5c86947f6be6/gnome-libxslt-bug-139-apple-fix.diff Ref: https://gitlab.gnome.org/GNOME/libxslt/-/issues/139 (From OE-Core rev: 2e2fa1ae7f24dadae9cb8371174aa7744aa42028) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* busybox: patch CVE-2025-46394Peter Marko2025-10-143-0/+91
| | | | | | | | | | Pick commit mentioning this CVE. Additionally fix test broken by the CVE fix. (From OE-Core rev: 137299edbc47e8a57173ef3c22bcb719d48d5302) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-bad: Fix CVE-2025-3887Vijay Anusuri2025-10-143-0/+145
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/5463f0e09768ca90aa8c58357c1f4c645db580db & https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/bcaab3609805ea10fb3d9ac0c9d947b4c3563948 (From OE-Core rev: a35bdbdb4d1dd77de7b85ab19d7354be6a11e8b2) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: fix CVE-2025-9714Theo GAIGE2025-10-142-0/+118
| | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21 (From OE-Core rev: 277692c2472f03ae62401bfbd26e8c4d872113d0) Signed-off-by: Theo GAIGE <tgaige.opensource@witekio.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libhandy: update git branch nameGyorgy Sarvari2025-10-031-1/+1
| | | | | | | | | Master branch was renamed to main. (From OE-Core rev: 2285f30e643f52511c328e4f6e1f0c042bea4110) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-jinja2: upgrade 3.1.4 -> 3.1.6Soumya Sambu2025-10-031-1/+4
| | | | | | | | | | | | | | | | | Includes fix for - CVE-2024-56326, CVE-2025-27516, CVE-2024-56201 Changelog: https://github.com/pallets/jinja/blob/3.1.6/CHANGES.rst https://github.com/pallets/jinja/blob/3.1.5/CHANGES.rst (From OE-Core rev: a935ef8f205c9510ebc5539c133960bc72504902) (From OE-Core rev: 7108dccff524888d77f0e5e02d9cc4523a700a91) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1652 -> 9.1.1683Divya Chellam2025-10-031-2/+2
| | | | | | | | | | | | | Handles CVE-2025-9389 Changes between 9.1.1652 -> 9.1.1683 ==================================== https://github.com/vim/vim/compare/v9.1.1652...v9.1.1683 (From OE-Core rev: 24b7e7f719ca600a88aa893b87f6ea821caeadce) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tiff: fix CVE-2025-9900Yogita Urade2025-10-032-0/+58
| | | | | | | | | | | | | | | | | | | | | A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file.[EOL][EOL]By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controlled color data to an arbitrary memory location. This memory corruption can be exploited to cause a denial of service (application crash) or to achieve arbitrary code execution with the permissions of the user. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9900 Upstream patch: https://gitlab.com/libtiff/libtiff/-/commit/3e0dcf0ec651638b2bd849b2e6f3124b36890d99 (From OE-Core rev: f4e5cdeccee02d3ea78db91d5dfdcfd017c40ee0) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: fix CVE-2025-9086Yogita Urade2025-10-032-0/+56
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1, A cookie is set using the secure keyword for https://target 2, curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set 3, The same cookie name is set - but with just a slash as path (path="/"). Since this site is not secure, the cookie should just be ignored. 4, A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-9086 Upstream patch: https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6 (From OE-Core rev: dc842a631b178acd9c4f00c4a3b87831baf08ebb) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* grub2: fix CVE-2024-56738Yogita Urade2025-10-032-0/+76
| | | | | | | | | | | | | | | | | Backport an algorithmic change to grub_crypto_memcmp() so that it completes in constant time and thus isn't susceptible to side-channel attacks. reference: https://git.openembedded.org/openembedded-core/commit/?id=30a1cc225a2bd5d044bf608d863a67df3f9c03be Upstream patch: https://cgit.git.savannah.gnu.org/cgit/grub.git/commit/?id=0739d24cd1648531d0708d1079ff6bbfa6140268 (From OE-Core rev: d6572d29892b7da593acafe3af68cf98230acf04) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2025-47907Praveen Kumar2025-10-034-61/+977
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. Made below changes for Go 1.17 backport: - Replaced `atomic.Pointer[error]` with `atomic.Value`, since atomic pointers are not supported in Go 1.17. - Used errp.(*error) to retrieve and dereference the stored *error, Without this, build fails with: invalid indirect of errp (type interface{}). - Replaced Go 1.18 `any` keyword with `interface{}` for backward compatibility with Go 1.17. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-47907 Upstream-patch: https://github.com/golang/go/commit/8a924caaf348fdc366bab906424616b2974ad4e9 https://github.com/golang/go/commit/298fe517a9333c05143a8a8e1f9d5499f0c6e59b https://github.com/golang/go/commit/c23579f031ecd09bf37c644723b33736dffa8b92 (From OE-Core rev: af9c43c39764ce9ce37785c44dfb83e25cb24703) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.30kirkstone-4.0.30Steve Sakoman2025-09-191-1/+1
| | | | | | (From OE-Core rev: d381eeb5e70bd0ce9e78032c909e4a23564f4dd7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: Fix for CVE-2025-58060 and CVE-2025-58364Vijay Anusuri2025-09-193-0/+141
| | | | | | | | | | | | | | | | | import patch from debian to fix CVE-2025-58060 CVE-2025-58364 Upstream-Status: Backport [import from debian cups 2.4.2-3+deb12u9 Upstream commit https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221 & https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d] (From OE-Core rev: 88585645a041c3c2ee7b39bf5f72885ed7c8775f) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* insane: Ensure that `src-uri-bad` fails correctlyPhilip Lorenz2025-09-191-0/+1
| | | | | | | | | | | | | | | `src-uri-bad` is missing the required call to `oe.qa.exit_if_errors` so the corresponding task is not marked as failed when the QA check is classified as an error. This issue was fixed by the introduction of the do_recipe_qa task in OE-core (e0c71367ab59021fc430ef215bbfc3b525036ba4) which is not part of kirkstone yet. (From OE-Core rev: 4b593ea8df9b1d3dda0adf38786845168360311f) Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* insane: Improve patch warning/error handlingRichard Purdie2025-09-191-8/+15
| | | | | | | | | | | | | | | | | | | | | | | | Currently, whilst patch errors or warnings are shown, the errors don't stop builds. The configuration isn't very configurable from WARN_QA and ERROR_QA either. This patch: * Uses the standard mechanisms to handle the patch fuzz warnings/errors * Makes Upstream-Status checking configurable from WARN/ERROR_QA * Allows that checking to be used with non-core layers * Makes patch-fuzz an error by default (From OE-Core rev: 76a685bfcf927593eac67157762a53259089ea8a) (From OE-Core rev: 4899961965d70281e63582234f0ed299431eff32) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3c3fd6a65e8103f74ae382d196d486b31a168b39) The backported commit was modified to not mark "patch-fuzz" as an error by default (which retains compatibility with kirkstone behaviour). Signed-off-by: Philip Lorenz <philip.lorenz@bmw.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2024-24790Hitendra Prajapati2025-09-191-1/+2
| | | | | | | | | CVE-2024-24790: net/netip module was introduced in go1.18beta1 via a59e33224e42d60a97fa720a45e1b74eb6aaa3d0 (From OE-Core rev: e304b139a8c43a88604ceb93aa933057b1e1748c) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wpa-supplicant: fix CVE-2022-37660Divya Chellam2025-09-126-0/+1679
| | | | | | | | | | | | | | | | | | | | | | | | | | | In hostapd 2.10 and earlier, the PKEX code remains active even after a successful PKEX association. An attacker that successfully bootstrapped public keys with another entity using PKEX in the past, will be able to subvert a future bootstrapping by passively observing public keys, re-using the encrypting element Qi and subtracting it from the captured message M (X = M - Qi). This will result in the public ephemeral key X; the only element required to subvert the PKEX association. CVE-2022-37660-0001, CVE-2022-37660-0002, CVE-2022-37660-0003 and CVE-2022-37660-0004 are dependent commits while CVE-2022-37660-0005 is actual CVE fix. Reference: https://security-tracker.debian.org/tracker/CVE-2022-37660 Upstream-patches: https://git.w1.fi/cgit/hostap/commit/?id=9d3f347a2b14652e767d51142600206a32676b62 https://git.w1.fi/cgit/hostap/commit/?id=80213629981a21825e4688fde1b590e4c4d4bcea https://git.w1.fi/cgit/hostap/commit/?id=bdcccbc2755dd1a75731496782e02b5435fb9534 https://git.w1.fi/cgit/hostap/commit/?id=d7be749335f2585658cf98c4f0e7d6cd5ac06865 https://git.w1.fi/cgit/hostap/commit/?id=15af83cf1846870873a011ed4d714732f01cd2e4 (From OE-Core rev: 3dd917c52ace30607800f0b70a52a52662dda731) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* llvm: fix typo in CVE-2024-0151.patchGyorgy Sarvari2025-09-121-5/+8
| | | | | | | | | | | | | | | | | During backporting the patch, accidentally a variable was removed. In case the recipe is compiled for 32-bit Arm target, compilation fails with the following error: 3.0.1-r0/git/llvm/lib/Target/ARM/ARMISelLowering.cpp:4481:13: error: 'RegVT' was not declared in this scope | 4481 | if (RegVT == MVT::f16 || RegVT == MVT::bf16) | | ^~~~~ This patch corrects the patch, and adds back the removed RegVT variable. (From OE-Core rev: 77f29f8fea58de40459186952d25279877ce4994) Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-1594Archana Polampalli2025-09-122-0/+105
| | | | | | | | | | | | | A vulnerability, which was classified as critical, was found in FFmpeg up to 7.1. This affects the function ff_aac_search_for_tns of the file libavcodec/aacenc_tns.c of the component AAC Encoder. The manipulation leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. (From OE-Core rev: 5a922eb95da7d373ee2bc3018065448fa128e69a) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix multiple CVEsArchana Polampalli2025-09-124-0/+269
| | | | | | | | | | | | | | | | | | | | CVE-2023-6605: A flaw was found in FFmpeg's DASH playlist support. This vulnerability allows arbitrary HTTP GET requests to be made on behalf of the machine running FFmpeg via a crafted DASH playlist containing malicious URLs. CVE-2023-6604: A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation. CVE-2023-6602: flaw was found in FFmpeg's TTY Demuxer. This vulnerability allows possible data exfiltration via improper parsing of non-TTY-compliant input files in HLS playlists. (From OE-Core rev: aa68992ddc5744bb4fdbb3a3cd0636b303449be2) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2025-7700Archana Polampalli2025-09-122-0/+53
| | | | | | | | | NULL Pointer Dereference in FFmpeg ALS Decoder (libavcodec/alsdec.c) (From OE-Core rev: a8344e051e4c705df69f4787726a9eca5c780eff) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pulseaudio: Add audio group explicitlyKyungjik Min2025-09-081-1/+1
| | | | | | | | | | | | | | | | | | | Since pulseaudio-server requires the audio group, we explicitly add it. When use useradd-staticids or do not use the default group in base-passwd, an error will occur because the audio group is not defined. NOTE: pulseaudio: Performing useradd with [--root TOPDIR/tmp/work/cortexa72-poky-linux/pulseaudio/17.0/recipe-sysroot --home-dir /var/run/pulse --gid 998 --groups audio,pulse --no-create-home --system --shell /bin/false --uid 998 pulse] useradd: group 'audio' does not exist ERROR: pulseaudio: useradd command did not succeed. (From OE-Core rev: 71ed9d8394f7e625270ee66f9c2816bba4aa2016) Signed-off-by: Kyungjik Min <dpmin7@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* default-distrovars.inc: Fix CONNECTIVITY_CHECK_URIS redirect issueDeepak Rathore2025-09-082-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | The default CONNECTIVITY_CHECK_URIS uses "https://yoctoproject.org/connectivity.html" which redirect to "https://www.yoctoproject.org/connectivity.html". Some network configurations with proxies or restricted internet access don't handle HTTP redirects properly during the sanity check phase, causing build failures with: ERROR: OE-core's config sanity checker detected a potential misconfiguration. Either fix the cause of this error or at your own risk disable the checker (see sanity.conf). Following is the list of potential problems / advisories: Fetcher failure for URL: 'https://yoctoproject.org/connectivity.html'. URL doesn't work. Updated the default URL to use the final destination directly to avoid redirect-related connectivity check failures. Also updated SDK test cases in https.py to use the corrected URL for consistency. (From OE-Core rev: aceb2920fbdef43db7b0b698865358e288901610) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 60cdf960a3560f391babd559737f1afb31fb2c5c) Signed-off-by: Deepak Rathore <deeratho@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: remove devtool FIXME commentPeter Marko2025-09-081-52/+0
| | | | | | | | | | This comment should not have been merged. It shows that the license did not change. (From OE-Core rev: 652986a4c67fc5d1c69cd3c2cb0d7f197b960be6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.1.1198 -> 9.1.1652Peter Marko2025-09-084-15/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | Handles CVE-2025-53905, CVE-2025-53906, CVE-2025-55157, CVE-2025-55158. Changes between 9.1.1198 -> 9.1.1652 ==================================== https://github.com/vim/vim/compare/v9.1.1198...v9.1.1652 Refresh patches. Disable newly introduced wayland support (in patch version 1485). To this belongs also adding recursion in delete command for dir auto which was newly failing as there is wayland directory inside now. If someone is interested, this can be probably enabled, but without additional work it results in compilation error due to function redefinition conflicts. (From OE-Core rev: e87d427d928234ef0441f9ce1fe8631fbe471094) (From OE-Core rev: bd2dc808baec7e940a09f80afa2c2997efe7cbfe) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: not adjust script pathnames for native scripts eitherMingli Yu2025-09-081-14/+21
| | | | | | | | | | | | | | | | | | | After the below commit introduced, the shebang size of native scripts is also checked, so rework the patch to fix the gap. 377fe11bc0 insane.bbclass: Make do_qa_staging check shebangs Fixes: ERROR: QA Issue: : /work/x86_64-linux/vim-native/9.0.0005-r0/sysroot-destdir/work/x86_64-linux/vim-native/9.0.0005-r0/recipe-sysroot-native/usr/share/vim/vim90/tools/mve.awk maximum shebang size exceeded, the maximum size is 128. [shebang-size] ERROR: QA Issue: : /work/x86_64-linux/vim-native/9.0.0005-r0/sysroot-destdir/work/x86_64-linux/vim-native/9.0.0005-r0/recipe-sysroot-native/usr/share/vim/vim90/tools/efm_perl.pl maximum shebang size exceeded, the maximum size is 128. [shebang-size] (From OE-Core rev: 79232458b9cdc741a2049d83839af73f58a5554c) (From OE-Core rev: 671f8cec8ef463d75e9393c5fc03cf913ef9edf6) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2025-48384Praveen Kumar2025-09-082-0/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config is later read. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read resulting in the submodule being checked out to an incorrect location. If a symlink exists that points the altered path to the submodule hooks directory, and the submodule contains an executable post-checkout hook, the script may be unintentionally executed after checkout. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1. Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-48384 Upstream-patch: https://github.com/git/git/commit/05e9cd64ee23bbadcea6bcffd6660ed02b8eab89 (From OE-Core rev: 34cb9674a5ce337a75af0dc415706d0323c427a6) Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-23 01:30:15 +0000