Commit Graph
38479 Commits
Author SHA1 Message Date
Ankur Tyagi 11f2bab405 freerdp3: patch CVE-2026-66401
Backport commit matching GitHub advisory[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-66401

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jj2-67pg-j6mg

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:48 +05:30
Ankur Tyagi ee9265dada freerdp3: patch CVE-2026-64621
Backport commit matching GitHub advisory[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-64621

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:47 +05:30
Ankur Tyagi 4964784627 freerdp3: patch CVE-2026-64620
Backport commit matching GitHub advisory[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-64620

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjqx-v446-x7fc

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:47 +05:30
Ankur Tyagi a8c04cf8d2 freerdp3: patch CVE-2026-63652
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-63652

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:46 +05:30
Ankur Tyagi 5900c0fece freerdp3: patch CVE-2026-63633
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-63633

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:46 +05:30
Ankur Tyagi d6868b566a freerdp3: patch CVE-2026-55648
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55648

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:45 +05:30
Ankur Tyagi 631ca42559 freerdp3: patch CVE-2026-55564
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55564

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:45 +05:30
Ankur Tyagi 3e87904310 freerdp3: patch CVE-2026-55194
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55194

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:44 +05:30
Ankur Tyagi 1d846e479b freerdp3: patch CVE-2026-55193
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55193

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:44 +05:30
Ankur Tyagi e555fd3307 freerdp3: patch CVE-2026-55192
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55192

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:43 +05:30
Ankur Tyagi e383fd8d1a freerdp3: patch CVE-2026-55191
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55191

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:43 +05:30
Ankur Tyagi 6a620760be freerdp3: patch CVE-2026-40254
Backport commits matching advisory[1] mentioned in the NVD.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-40254

[1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:43 +05:30
Ankur Tyagi 7ce36bf1cc wolfssl: patch CVE-2026-7531
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:42 +05:30
Ankur Tyagi e99f95d5b5 wolfssl: patch CVE-2026-6731
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-6731

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:42 +05:30
Ankur Tyagi 983b006bac wolfssl: patch CVE-2026-6450
Also backport follow-up PR[1] to the initial PR mentioned in the NVD.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-6450

[1]https://github.com/wolfSSL/wolfssl/pull/10274

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:41 +05:30
Ankur Tyagi f2b753bc78 wolfssl: patch CVE-2026-6412
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-6412

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:41 +05:30
Ankur Tyagi c78dd4dd4d wolfssl: patch CVE-2026-6325
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-6325

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:40 +05:30
Ankur Tyagi 91aa2a8e57 wolfssl: patch CVE-2026-6291
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-6291

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:40 +05:30
Ankur Tyagi 140b51ee66 wolfssl: patch CVE-2026-6094
Details
https://nvd.nist.gov/vuln/detail/cve-2026-6094

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:39 +05:30
Ankur Tyagi 4b124297a2 wolfssl: patch CVE-2026-6092
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-6092

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:39 +05:30
Ankur Tyagi c897678f87 wolfssl: patch CVE-2026-6091
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-6091

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:38 +05:30
Ankur Tyagi 7b5f42ff26 wolfssl: patch CVE-2026-55958
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55958

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:38 +05:30
Ankur Tyagi 64f5842834 wolfssl: ignore CVE-2026-12340
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-12340

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:37 +05:30
Ankur Tyagi cfa27d8569 wolfssl: patch CVE-2026-10512
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-10512

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:37 +05:30
Ankur Tyagi 6e7213f4d5 wolfssl: patch CVE-2026-10098
CVE-2026-10098-1.patch is needed to cherry-pick the commit mentioned in the
PR[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-10098

[1]https://github.com/wolfSSL/wolfssl/pull/10554/commits

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:37 +05:30
Ankur Tyagi c12fcc9b48 wolfssl: mark CVEs patched
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:36 +05:30
Ankur Tyagi e8277376bf tesseract: patch CVE-2026-73067
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-73067

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:36 +05:30
Ankur Tyagi 10f315bace tesseract: patch CVE-2026-73066
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-73066

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:35 +05:30
Ankur Tyagi c799467d9c open62541: patch CVE-2026-11946
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-11946

[1]https://security-tracker.debian.org/tracker/CVE-2026-11946

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:35 +05:30
Ankur Tyagi 6093ccb547 nginx: mark CVE-2026-1642 patched
Debian[1] also identified the commit[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-1642

[1]https://security-tracker.debian.org/tracker/CVE-2026-1642
[2]https://github.com/nginx/nginx/commit/784fa05025cb8cd0c770f99bc79d2794b9f85b6e

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:34 +05:30
Ankur Tyagi 233e6a56e5 tinyproxy: patch CVE-2026-55202
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:34 +05:30
Ankur Tyagi 33649b0657 tinyproxy: patch CVE-2026-54387
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:33 +05:30
Ankur Tyagi 985acd9e7c tinyproxy: patch CVE-2026-31842
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:33 +05:30
Ankur Tyagi 6b06704ac1 libyang: patch CVE-2026-41401
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:32 +05:30
Ankur Tyagi abf11a785d valkey: mark CVE-2026-56684 and CVE-2026-63639 patched
Also mentioned in the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56684
https://nvd.nist.gov/vuln/detail/cve-2026-63639

[1]https://github.com/valkey-io/valkey/releases/tag/9.0.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:32 +05:30
Ankur Tyagi 2b272378cc python3-zeroconf: patch CVE-2026-47184
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47184

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:31 +05:30
Ankur Tyagi 4a1d7cfb5c python3-zeroconf: patch CVE-2026-47183
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47183

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:31 +05:30
Ankur Tyagi 67e8e3baf6 python3-zeroconf: patch CVE-2026-47180
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47180

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:30 +05:30
Ankur Tyagi 683afd55b2 miniupnpd: patch CVE-2026-5720
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-5720

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:30 +05:30
Ankur Tyagi 0b90ef42bc libssh: mark CVEs patched
Changelog[1] also confirms the fix.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-15370
https://nvd.nist.gov/vuln/detail/cve-2026-59843
https://nvd.nist.gov/vuln/detail/cve-2026-59844
https://nvd.nist.gov/vuln/detail/cve-2026-59845
https://nvd.nist.gov/vuln/detail/cve-2026-59846
https://nvd.nist.gov/vuln/detail/cve-2026-59847
https://nvd.nist.gov/vuln/detail/cve-2026-59848
https://nvd.nist.gov/vuln/detail/cve-2026-59849
https://nvd.nist.gov/vuln/detail/cve-2026-59850

[1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:30 +05:30
Ankur Tyagi 6541aefe60 libssh: ignore CVE-2025-14821
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14821

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:29 +05:30
Ankur Tyagi bb3f5628f1 libnfs: patch CVE-2026-57918
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57918

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:29 +05:30
Ankur Tyagi 6ace2f0b5e libnfs: patch CVE-2026-53689
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53689

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:28 +05:30
Abhishek Bachiphale f015b96ad0 thrift: fix CVE-2026-48145
Improper Validation of Certificate with Host Mismatch vulnerability in
Apache Thrift C++ bindings. This issue affects Apache Thrift: before
0.24.0.

Backport patch to fix CVE-2026-48145.

Reference:
[https://nvd.nist.gov/vuln/detail/cve-2026-48145]

Upstream Patch:
[https://github.com/apache/thrift/commit/c1457c69fbd49c6d554dafe91f1004049537322b]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:28 +05:30
Abhishek Bachiphale 2c673e4a4f thrift: fix CVE-2026-48586
Improper Handling of Highly Compressed Data (Data Amplification)
vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib
bindings. This issue affects Apache Thrift: before 0.24.0.

Backport patch to fix CVE-2026-48586.

Reference:
[https://nvd.nist.gov/vuln/detail/cve-2026-48586]

Upstream Patch:
[https://github.com/apache/thrift/commit/e3c8c534cacdbef039f4bb0bcf4b2744a982e3bf]
[https://github.com/apache/thrift/commit/702d00f9053133aba7186f2dbb242a91a1ddd491]

Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 10:13:24 +05:30
Adarsh Jagadish Kamini 29cdca4152 thrift: fix CVE-2026-55970
Backport patch to fix CVE-2026-55970.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55970

Upstream fix:
  https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 07:52:16 +05:30
Adarsh Jagadish Kamini fe4f335ffe thrift: fix CVE-2026-55969
Backport patch to fix CVE-2026-55969.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-55969

Upstream fix:
  https://github.com/apache/thrift/commit/983c813c9a1a2302d9a3ae23d7368beceaac2d0a

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 07:52:15 +05:30
Adarsh Jagadish Kamini 244521fbe6 thrift: fix CVE-2026-45112
Backport patch to fix CVE-2026-45112.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-45112

Upstream fix:
  https://github.com/apache/thrift/commit/16b3673827498d1f4b05f8026d5d580b8e8f5aa2

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 07:52:15 +05:30
Adarsh Jagadish Kamini 50b2a64565 thrift: fix CVE-2026-41608
Backport patch to fix CVE-2026-41608.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-41608

Upstream fix:
  https://github.com/apache/thrift/commit/8c605880ea4ef050a689c859de3b702ad8d4ce7b

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 07:52:14 +05:30
Ankur Tyagi 194a8339ce libkcapi: patch CVE-2026-71225
Backport commit fixing the CVE as per the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-71225

[1]https://github.com/smuellerDD/libkcapi/releases/tag/v1.5.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
2026-09-15 07:52:14 +05:30