782d9564e8
linux-atm: fix SRC_URI
...
The previous one stopped working
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-04-23 20:12:51 +02:00
e2988d39a1
strongswan: Fix CVE-2026-25075
...
Pick patch according to [1]
[1] https://download.strongswan.org/security/CVE-2026-25075/
[2] https://www.strongswan.org/blog/2026/03/23/strongswan-vulnerability-(cve-2026-25075).html
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-04-07 10:35:53 +02:00
2fd8d7e485
wireshark: fix CVE-2025-5601
...
Pick patch from [1].
[1] https://security-tracker.debian.org/tracker/CVE-2025-5601
[2] https://gitlab.com/wireshark/wireshark/-/issues/20509
More details :
https://nvd.nist.gov/vuln/detail/CVE-2025-5601
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-03-25 08:41:41 +01:00
9b58919732
ettercap: patch CVE-2026-3603
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2026-3606
Pick the commit that is marked to solve the related Github
issue[1]. Its commit message also references the CVE ID explicitly.
[1]: https://github.com/Ettercap/ettercap/issues/1297
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-03-11 14:39:51 +01:00
bd5d3494e4
memcached: patch CVE-2023-46853
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46853
Backport the patch that is referenced by the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-03-07 21:05:26 +01:00
5307edaa60
memcached: patch CVE-2023-46852
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-46852
Backport the patch that is referenced by the NVD advisory.
The test extension was not backported, because the modified testcase
does not exist in the recipe version yet.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-03-07 21:05:17 +01:00
e01fd0c490
opem-vm-tools: ignore multiple CVEs
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2014-4199
https://nvd.nist.gov/vuln/detail/CVE-2014-4200
https://nvd.nist.gov/vuln/detail/CVE-2022-22943
https://nvd.nist.gov/vuln/detail/CVE-2022-22977
https://nvd.nist.gov/vuln/detail/CVE-2022-31693
https://nvd.nist.gov/vuln/detail/CVE-2023-34057
The fixes for the first two vulnerabilities are already present in the
used version.
As identified by Redhat:
CVE-2014-4199: it has been fixed since version 9.10.2[1]
CVE-2014-4200: it has been fixed since version 9.4.6[2]
CVE-2022-22943, CVE-2022-22977 and CVE-2022-31693 affect only Windows.
CVE-2023-34059 affects only Windows and MacOS.
[1]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-4199
[2]: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-4200
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-03-07 21:04:47 +01:00
331ff3f94b
dovecot: patch CVE-2021-29157
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29157
Backport the patch that it used by Debian[1] to fix this CVE.
[1]: https://sources.debian.org/src/dovecot/1%3A2.3.13%2Bdfsg1-2%2Bdeb11u1/debian/patches
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-02-27 17:00:35 +01:00
cdc87f8f3b
ndpi: ignore CVE-2025-25066
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-25066
The vulnerable code was introduced in v4.12[1], and is not
present in the recipe version. Due to this, ignore the CVE.
[1]: https://github.com/ntop/nDPI/commit/b9348e9d6e0e754c4b17661c643ca258f1540ca1
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-02-27 14:28:50 +01:00
a9f06b91a0
libconfuse: patch CVE-2022-40320
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-40320
Pick the patch that was marked to resolve the github bug in the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-02-27 14:28:50 +01:00
3e3bd7acfc
dovecot: ignore CVE-2025-30189
...
Vulnerable versions are 2.4.0, 2.4.1 according to the full disclosure[1]
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-30189
[1] https://seclists.org/fulldisclosure/2025/Oct/29
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Adapted to Kirkstone.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-02-26 13:36:34 +01:00
42774277a4
wireshark: Fix multiple CVEs
...
Backport fixes for :
* CVE-2024-8645 - Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/8e5f8de8836d3a81276ae5b9bf78cbac58bb6108
* CVE-2026-0960 - Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/f31123dcdbac37272046b58b2f7941bc7fb42934
* CVE-2025-13945 - Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/9139917bd8e2c80a5db7079993d5528db74e3519
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-02-19 12:03:21 +01:00
f8c8241198
strongswan: Security fix for CVE-2025-62291
...
CVE fixed:
- CVE-2025-62291 strongswan: Arbitrary Code Execution and Denial of Service via crafted EAP-MSCHAPv2 message
Upstream-Status: Backport from https://download.strongswan.org/security/CVE-2025-62291/strongswan-4.4.0-6.0.2_eap_mschapv2_failure_request_len.patch
Signed-off-by: Rohini Sangam <rsangam@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-02-11 19:52:14 +01:00
f1cfd1ec5d
openvpn: ignore CVE-2024-4877 and CVE-2025-13751
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-4877
https://nvd.nist.gov/vuln/detail/CVE-2025-13751
The vulnerabilities are specific to Windows platform, not relevant to OE.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-30 18:59:28 +01:00
eb933671af
tcpreplay 4.4.4: Fix CVE-2025-9384
...
There is a NULL Pointer Dereference in ports2PORT when the user passes ill-formatted
portmap string to tcprewrite with option -r or --portmap
Upstream Repository: https://github.com/appneta/tcpreplay.git
Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-9384
CVE: CVE-2025-9384
Signed-off-by: Jackson <jacksonj2@kpit.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-30 18:59:28 +01:00
c021875bc4
memcached: ignore disputed CVE-2022-26635
...
Per [1] this is a problem of applications using memcached inproperly.
This should not be a CVE against php-memcached, but for whatever
software the issue was actually found in. php-memcached and
libmemcached provide a VERIFY_KEY flag if they're too lazy to
filter untrusted user input.
[1] https://github.com/php-memcached-dev/php-memcached/issues/519
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 889ccce684skandigraun@gmail.com >
2026-01-09 14:18:32 +01:00
be06039718
wireshark: ignore CVE-2024-24476, CVE-2024-24478 and CVE-2024-24479
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-24476
https://nvd.nist.gov/vuln/detail/CVE-2024-24478
https://nvd.nist.gov/vuln/detail/CVE-2024-24479
Upstream disputes all three vulnerabilities[1]. Looking at the history,
even though they were valid issues for some period of time, none of
them made it to an actual stable release: the vulnerabilities were
caused, caught and fixed in the same development cycle between two
releases.
CVE-2024-24476: vulnerability introduced with[2], fixed with[3]
CVE-2024-24478: vulnerability introduced with[4], fixed with[5]
CVE-2024-24479: vulnerability introduced with[6], fixed with[7]
Ignore all three of these vulnerabilities, as they are not present
in the used recipe version.
[1]: https://www.wireshark.org/docs/relnotes/wireshark-4.2.4.html
[2]: https://github.com/wireshark/wireshark/commit/395e3b6cb595bfc610f3c26e7e9eb1f8729fd952
[3]: https://github.com/wireshark/wireshark/commit/108217f4bb1afb8b25fc705c2722b3e328b1ad78
[4]: https://github.com/wireshark/wireshark/commit/a9a62ff576ae79e0d6afb3214a5d409ec4cdf9d7
[5]: https://github.com/wireshark/wireshark/commit/80a4dc55f4d2fa33c2b36a99406500726d3faaef
[6]: https://github.com/wireshark/wireshark/commit/53ec634ac2bf5f87a594aa72f16ca21c25a146a9
[7]: https://github.com/wireshark/wireshark/commit/c3720cff158c265dec2a0c6104b1d65954ae6bfd
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-09 14:18:22 +01:00
bca7f71ca2
wireshark: upgrade 3.4.12 -> 3.4.16
...
These are all bugfix releases.
Drop CVE-2022-3190.patch, as it is included in 3.4.16.
Changelogs:
3.4.13: https://www.wireshark.org/docs/relnotes/wireshark-3.4.13.html
3.4.14: https://www.wireshark.org/docs/relnotes/wireshark-3.4.14.html
3.4.15: https://www.wireshark.org/docs/relnotes/wireshark-3.4.15.html
3.4.16: https://www.wireshark.org/docs/relnotes/wireshark-3.4.16.html
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-09 14:17:57 +01:00
634719db25
wireshark: fix CVE-2025-11626
...
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/513e5d49724f4a0695c5d2a08ce422c09cb999c8
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-09 08:29:04 +01:00
fa7d1a059e
tinyproxy: patch CVE-2025-63938
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-63938
Pick the patch that is referenced by the NVD advisory.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:03 +01:00
6d28476b74
nbdkit: remove unused patch
...
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:02 +01:00
2ab2b60609
nbdkit: patch CVE-2025-47712
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47712
Pick the patch from the project's repository which explicitly
mentions this vulnerability ID.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:02 +01:00
4a97186719
nbdkit: patch CVE-2025-47711
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-47711
Pick the patch from the repository which explicitly mentions
this CVE ID.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2026-01-08 22:03:02 +01:00
360720faba
mtr: patch CVE-2025-49809
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-49809
Pick the patch mentioned in the NVD report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-12-25 13:56:58 +01:00
ea388c67e4
wireshark: fix CVE-2025-13499
...
Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/e180152d3dae668249f78c72a55a4ba436b57af7
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-12-16 08:41:05 +01:00
b5a19849c5
usbredir: patch CVE-2021-3700
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-3700
Pick the patch mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-30 15:13:57 +01:00
665e1cad14
spice: correct SRC_URI
...
The previous repository was moved to freedesktop's gitlab instance
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-17 09:08:37 +01:00
c90f715444
netsniff-ng: update SRC_URI branch
...
master branch was renamed to main
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-17 09:08:28 +01:00
77b9cc908f
usbredir: update SRC_URI
...
The previous git repositoy was moved to freedesktop's gitlab instance.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-11-17 09:08:26 +01:00
51b503c1a1
http-parser: fix SRC_URI branch
...
master was renamed to main
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 8fb37f0f95
2025-11-17 09:08:22 +01:00
d342d283b3
unbound: Fix CVE-2022-3204
...
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/137719522a8ea5b380fbb6206d2466f402f5b554
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:35 +01:00
0bf05b6de8
unbound: Fix for CVE-2022-30698 and CVE-2022-30699
...
Upstream-Status: Backport from https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-27 11:17:35 +01:00
7eadf76d76
open-vm-tools: fix CVE-2025-41244
...
VMware Aria Operations and VMware Tools contain a local privilege
escalation vulnerability. A malicious local actor with non-administrative
privileges having access to a VM with VMware Tools installed and managed
by Aria Operations with SDMP enabled may exploit this vulnerability
to escalate privileges to root on the same VM.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-41244
Upstream-patch:
https://github.com/vmware/open-vm-tools/commit/7ed196cf01f8acd09011815a605b6733894b8aab
Signed-off-by: Rajeshkumar Ramasamy <rajeshkumar.ramasamy@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-17 10:51:26 +02:00
b6c9eb2ce5
tcpreplay: fix CVE-2025-51006
...
Within tcpreplay's tcprewrite, a double free vulnerability has been identified
in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxsll2/linuxsll2.c.
This vulnerability is triggered when tcpedit_dlt_cleanup() indirectly
invokes the cleanup routine multiple times on the same memory region.
By supplying a specifically crafted pcap file to the tcprewrite binary,
a local attacker can exploit this flaw to cause a Denial of Service (DoS) via memory corruption.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-17 10:51:26 +02:00
0538af085a
tcpreplay: fix CVE-2025-9157
...
A vulnerability was determined in appneta tcpreplay up to 4.5.2-beta2.
The impacted element is the function untrunc_packet of the file
src/tcpedit/edit_packet.c of the component tcprewrite. Executing
manipulation can lead to use after free. It is possible to launch
the attack on the local host. The exploit has been publicly disclosed
and may be utilized. This patch is called 73008f261f1cdf7a1087dc8759115242696d35da.
Applying a patch is advised to resolve this issue.
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com >
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-17 10:51:26 +02:00
bf9fc50ccc
dovecot: patch CVE-2021-33515
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33515
Backport the relevant patch.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-12 13:08:38 +02:00
91a9a3d61f
dovecot: patch CVE-2022-30550
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-30550
Pick the commit referenced in https://www.openwall.com/lists/oss-security/2022/07/08/1
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com >
2025-10-12 13:08:33 +02:00
e8be179802
recipes: Remove double protocol= from SRC_URIs
...
With the exception of paho-mqtt-cpp, the double protocol= attributes
were added to the SRC_URIs when protocol=https was added to all SRC_URIs
fetching from github.com in commit b402a3076fpeter.kjellerstedt@axis.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 2e0a581beeskandigraun@gmail.com >
2025-09-29 20:15:32 +02:00
23d9cf882f
uftp: upgrade 5.0.2 -> 5.0.3
...
Changelog:
===========
-A memory leak fix in the prior version wasn't applied correctly, resulting
in an invalid memory access causing a crash.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 5d050f078askandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
975368a20e
uftp: upgrade 5.0.1 -> 5.0.2
...
Changelog:
=========
-Fixed bug that caused crash when a CLIENT_KEY arrived out of order
-Fixed option handling on Windows when an argument is missing
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 93a5628ae6skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
76de61ab0a
uftp: upgrade 5.0 -> 5.0.1
...
Changelog:
==========
-On very low speed transfers (<10Kbps) sessions would time out due to a very
large interpacket transmission interval. Fixed by putting a lower limit
on the advertised GRTT of of the interpacket transmission interval.
-Sending of ABORT messages on early shutdown would sometimes fail due to
OpenSSL cleanup functions running before application cleanup. Changed the
ordering of atexit() handlers to ensure OpenSSL cleanup happens last.
-Fixed missing timestamp update when clients read CONG_CTRL messages
-Fix to GRTT handling on server to ensure it doesn't fall below minumim.
-Fixed bypassed checking of existing files on client for backup
-Various logging fixes
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 0a58426ed0skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
68c66db375
libtdb: upgrade 1.4.3 -> 1.4.7
...
* Refresh patches
* Add a patch to skip checking PYTHONHASHSEED
Signed-off-by: Yi Zhao <yi.zhao@windriver.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit cf53340f00skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
8426871255
cifs-utils: upgrade 6.14 -> 6.15
...
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 88ea7fc012skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
d42bb883dd
tnftp: switch the SRC_URI to https
...
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 8f4dc754cfskandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
bb12695af8
ssmping: Use debian mirror for SRC_URI
...
Original URI is not accessible anymore
Drop md5sum
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit ceb9160341skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
790b431538
pimd: switch SRC_URI to https
...
Switch SRC_URI to https (yes, the URI still has ftp in the path!).
Also drop the obsolete SRC_URI[md5sum].
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 9221eaa8d6skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
a88c4f592f
ndisc6: upgrade 1.0.7 -> 1.0.8
...
Changelog
============
Fix potential garbage whilst prining an advertised prefix.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 3fe7c5fae8skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
b2dbbd49ca
ndisc6: upgrade 1.0.6 -> 1.0.7
...
Changelog:
=========
# Do not ignore multicast advertisements when discovery was sent as unicast
(fix regression from 1.0.5).
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit a014528edeskandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
515b34d850
lksctp-tools: upgrade 1.0.20 -> 1.0.21
...
ChangeLog:
https://github.com/sctp/lksctp-tools/blob/v1.0.21/ChangeLog
Signed-off-by: Yi Zhao <yi.zhao@windriver.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 4c3e3638b9skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
bc1a12e9c5
lksctp-tools: upgrade 1.0.19 -> 1.0.20
...
ChangeLog:
https://github.com/sctp/lksctp-tools/blob/v1.0.20/ChangeLog
Drop redundant variables LK_REL, SOLIBVERSION and SOLIBMAJORVERSION in
recipe.
Signed-off-by: Yi Zhao <yi.zhao@windriver.com >
Signed-off-by: Khem Raj <raj.khem@gmail.com >
(cherry picked from commit 162039c327skandigraun@gmail.com >
2025-09-29 20:15:31 +02:00
Gyorgy Sarvari
Vijay Anusuri
Hitendra Prajapati
Ankur Tyagi
Rohini Sangam
Jackson
Peter Marko
Rajeshkumar Ramasamy
Archana Polampalli
Peter Kjellerstedt
Wang Mingyu
Yi Zhao
Randy MacLeod
Khem Raj