Analysis:
- The Mbed TLS advisory states the issue occurs when LLVM
select-optimize is enabled. [1]
- The same advisory also states that Arm/x86 builds with
MBEDTLS_HAVE_ASM enabled are not affected. The default mbedtls
configuration in this branch enables MBEDTLS_HAVE_ASM.
- NVD also describes the issue as occurring only with LLVM's
select-optimize feature. [2]
- The mbedtls recipes now evaluate the effective build flags across
target, native, and nativesdk variants, handle the supported
-mllvm spellings, and only mark the CVE unpatched when the
vulnerable LLVM option combination is explicitly enabled and the
Arm/x86 MBEDTLS_HAVE_ASM carve-out does not apply.
- When those conditions are not met, the current mbedtls build
configuration is not affected.
- Hence ignoring/deferred the CVE for now.
Reference:
[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-03-compiler-induced-constant-time-violations/
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-66442
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0eda0f3c55)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Prior to version 2.21, the `radvdump` utility shipped with radvd
contains a stack buffer overflow in the Route Information option
parser.
When processing a crafted ICMPv6 Router Advertisement, `print_ff()`
copies up to 2032 bytes from attacker-controlled packet data into a
16-byte `struct in6_addr` on the stack, overflowing by up to 2016
bytes.
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
CVE-2026-43868:
Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.
CVE-2026-43869:
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
This CVE only affects the Java client, which is not built by the recipe. Marked as
'not-applicable-config'.
Upstream commit:
https://github.com/apache/thrift/commit/a30c552bd0808b7e19f35ad30212ba7a9aee8c66
CVE-2026-43870:
Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory
('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers
('HTTP Request/Response Splitting'), Uncontrolled Resource Consumption vulnerability
in Apache Thrift.
Signed-off-by: Roland Kovacs <roland.kovacs@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The function uio_line_from_file() fails to close the FILE pointer
when fgets() returns NULL, causing a file descriptor leak.
This can be triggered when reading from /sys files that return
empty content, leading to resource exhaustion over time.
Fix this by using goto-based error handling to ensure fclose()
is called on all exit paths.
Signed-off-by: Qliangw <qili00001@gmail.com>
(cherry picked from commit cd75edf25d)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
cca_settings is used without zero initialization, which may
introduce random values and result in invalid nl80211
attributes.
Without this fix, BSS color switch may fail completely and
the feature becomes non-functional. Initialize the structure
before use.
Signed-off-by: Wei Zhang <wei.zhang@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit feb24a676b)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
==========
- Issue 2057 - SQL Injection in mod_wrap2_sql via reverse DNS
hostname (CVE-2026-44331).
- Issue 2056 - Incomplete fix for session management with OpenSSL 3.2.x or
later, when using TLSv1.2 or earlier. This complements the fix for
Issue #1963.
- Issue 2098 - Hard quota limits on uploads do not cause SFTP WRITE requests
to fail as expected.
- Issue 2102 - SSH payload length underflow calculation for ETM/ChaChaPoly
algorithms in mod_sftp.
- Issue 2104 - SSH packet with empty payload triggers null pointer dereference
in mod_sftp.
- Issue 2106 - Bad DSA signatures can lead to out-of-bounds read of heap memory
in mod_sftp.
- Issue 2108 - Mismatched RSA/DSA algorithm signatures can lead to null
dereference in mod_sftp.
- Issue 2115 - SFTP request payload length underflow calculation in mod_sftp.
- Issue 2120 - Several modules fail to build using OpenSSL 4.0.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 88de7c1468)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Building mariadb for ARMv8.3-A and later, fails with:
Assembler messages:
{standard input}:169: Error: selected processor does not support `retaa'
{standard input}:271: Error: selected processor does not support `retaa'
It happens because the pmem_cvap() funciton manually inserts the `.arch
armv8-2.a` clause, making GAS believe that retaa instruction (inserted
by GCC) is invalid.
Replace compiler dependent version by using the generic sys instruction.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit bafc3361bb)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit updates the RDEPENDS for the ptest package to include
${PN}-python only when the 'python' PACKAGECONFIG option is enabled.
This change will ensure that we dont get below failure when ptest is enabled in the distro features,
and packageconfig is not set.
It causes this error-
ERROR: Nothing RPROVIDES 'nftables-python' (meta-openembedded/meta-networking/recipes-filter/nftables/nftables_1.1.6.bb RDEPENDS on or otherwise requires it)
NOTE: Runtime target 'nftables-python' is unbuildable, removing...
Missing or unbuildable dependency chain was: ['nftables-python']
ERROR: Required build target 'nftables' has no buildable providers.
Missing or unbuildable dependency chain was: ['nftables', 'nftables-python']
Signed-off-by: Naman Jain <namanj1@kpit.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2c3c725a3b)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
- ncurses is not a required dependency -> make it a PACKAGECONFIG
PipeWire 1.6.6 (2026-05-26)
This is a bugfix release that is API and ABI compatible with the previous
1.6.x releases.
Highlights
- Fix a bug in the server code that could leave snap clients without
sound. (#5270)
- Relax LADSPA path loading again, absolute paths are only blocked in
unsafe cases.
- Fix a volume restore issue in filter-graph when using custom volume
controls.
- Small fixes and improvements.
PipeWire
- Fix the meta permission check on metadata.
- Make sure we don't accept too many fds.
- Fix potential race with buffer allocation and Suspend. (#3547)
SPA
- Relax LADSPA path loading. Absolute paths are allowed when loading
modules from a config file. They are now only blocked when loading
the pulse ladspa modules and filter-chains in nodes because those
can load ladspa plugins in other processes. (#5222)
- Fix a regression in the dither noise that was silent when no input
was available. (#5260)
- Fix volume initialization in filter-graph. (#5192)
Pulse-server
- Fix a bug in the server code that could leave snap clients without
sound. (#5270)
- Be more careful with the stream suspend messages and only send them
when the stream is monitoring. (#5273)
- Fix monitor mode in pavucontrol.
Tools
- Fix midifile SysEx writing in pw-cat and ensure the header is written
correctly on close.
- Make sure pw-cat does not try to convert Midi to UMP.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit d712bc991a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
* Fixed issue where GDM failed to properly terminate conflicting graphical sessions
started outside of GDM (e.g. ThinLinc, TigerVNC). GDM now queries logind directly
to find and terminate all conflicting sessions
* Fixed plymouth hanging indefinitely on headless systems or systems without monitors,
which prevented the system from reaching graphical.target
* Fixed XDG_DATA_DIRS construction to prevent gnome-shell from failing to find its
files when /usr/share had higher precedence than /usr/local/share
* Fixed bug where GDM would set XDG_SESSION_TYPE=wayland on X11 sessions
* Translation updates
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 78e5d3c646)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Patch contains tree patches which was merge to poco at once
and fix "time" issues
1 - fix(Foundation): Timezone: invalidate utcOffset cache when /etc/localtime changes
Poco commit 1850dc16aabf5980a490bb1b66086d6695abb823 introduced a
TZInfo cache for the UTC offset to avoid repeated tzset() syscalls.
The cache is invalidated only when the TZ environment variable changes.
However, the TZ variable is process-local: if a different process (e.g.
a timezone configuration daemon or an init script) changes the system
timezone by updating /etc/localtime, the running process is not notified
and its TZ environment variable remains unchanged.
On systems that switch timezone by updating /etc/localtime (a symlink)
without touching the TZ env var, the cache is therefore never invalidated
and Timezone::utcOffset() returns the stale value computed at startup.
Fix by extending cacheTZ()/tzChanged() to also track the inode and
mtime of /etc/localtime via stat(2). When either changes the cache is
considered stale and reloaded, preserving the performance benefit for
the common case where neither TZ nor /etc/localtime changes between
calls.
2 - fix(Foundation): DateTimeParser: %S consume optional fractional seconds
Parsing ISO 8601 date strings that contain both fractional seconds and a
timezone offset (e.g. "2013-10-07T08:23:19.120-04:00") with the format
"%Y-%m-%dT%H:%M:%S%z" raises a SyntaxException:
- %S consumes the integer seconds but stops at '.', leaving
".120-04:00" unconsumed.
- %z (parseTZD) is called next but sees '.' and returns without
consuming anything.
- The trailing-garbage check then raises SyntaxException.
Extend the %S case to consume and discard an optional fractional-second
suffix ('.' or ',' followed by one or more digits) immediately after
parsing the integer seconds. This mirrors the existing %s behaviour and
allows %z to see the timezone designator directly, keeping the
trailing-garbage check fully effective for truly invalid input.
3 - test(DateTimeParserTest): add ISO8601 fractional seconds parser test
Add testISO8601FracSeconds to verify that DateTimeParser correctly
handles fractional-second suffixes (dot and comma separated) in
ISO8601_FORMAT strings, and rejects malformed input such as a
bare decimal point with no digits.
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
zlib compression was introduced in version 9.3.3. However, when
cross-compiling kmscon for an architecture other than x86_64, the
genunifont executable tries to use the build-systems zlib instead
of the hosts zlib.
This leads to the following error during compiling:
libz.so: error adding symbols: file in wrong format
Fix this by adding a new native zlib dependency specifically for the
genunifont executable.
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 72154f38fc)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Jason Schonberg
Peter Marko
Deepak Rathore
Roland Kovacs
Qliangw
Shubham Pushpkar
Joao Marcos Costa
Wei Zhang
Wang Mingyu
Mingli Yu
Dmitry Baryshkov
Naman Jain
Ankur Tyagi
Markus Volk
Peter Kjellerstedt
Anton Skorup
Max Krummenacher
Li Zhou
Abhishek Bachiphale
Andrej Kozemcak
Anuj Mittal
Jiaying Song
Adam Duskett