mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity
31,242 Commits 65 Branches 0 Tags
197101abccfe61ef23e9d018f2a2d87a7e4cc542
Commit Graph
31242 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Peter Marko 197101abcc grpc: update gRPC repo roots 
See https://emudhra.we-have-a-problem.com/

Removed testing part of the patch. It has changed a lot meanwhile, we
don't run tests and this does not change code, only certificates.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 12:46:48 +05:30
Peter Marko b301ae142a nss: remove compromised eMudhra certificates 
See https://emudhra.we-have-a-problem.com/

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 12:46:48 +05:30
Jason Schonberg a1e7a94404 php: upgrade 8.2.34 -> 8.2.35 
This is a security update.  Fixes unauthenticated remote code execution.

CVE-2026-109618 CVE-2026-109619

Advisory: https://www.php.net/archive/2026.php#2026-10-21-5

Changelog: https://www.php.net/ChangeLog-8.php#8.2.35

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:53 +05:30
Rohini Sangam 7356c16d4c nodejs: Security fix for CVE-2026-48937 
Pick patch from [1] also mentioned at Debian tracker in [2]

[1] https://github.com/nodejs/node/commit/a1a5bb968303229d4a3a7c9e389dc3ece6237b4c
[2] https://security-tracker.debian.org/tracker/CVE-2026-48937

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:52 +05:30
Rohini Sangam 24c9df0563 nodejs: Security fix for CVE-2026-48619 
Pick patch from [1] also mentioned at Debian tracker in [2]

[1] https://github.com/nodejs/node/commit/c79968e108002c2394bdb9e9cefb2c8c8cc202f8
[2] https://security-tracker.debian.org/tracker/CVE-2026-48619

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:52 +05:30
Darsh Kelaiya 9af60e729b ntfs-3g-ntfsprogs: fix CVE-2026-40706 
This patch applies the upstream allocation fix shown in [1]. The NVD
record describing the vulnerability is referenced in [3].

The fix in [1] allocates space for the worst-case number of POSIX ACL
entries in ntfs_build_permissions_posix(). The follow-up in [2] is
included to handle allocation failure: check the malloc result, set
errno to ENOMEM, and return NULL before using the descriptor.

[1] https://github.com/tuxera/ntfs-3g/commit/e48e1ef2a1fcff13a590c2224ec21c5bd5d3e92e
[2] https://github.com/tuxera/ntfs-3g/commit/c5413e242309f88ce5a83c0c2538184b19eea1bc
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40706

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:51 +05:30
Darsh Kelaiya 7cfe364cc3 ntfs-3g-ntfsprogs: fix CVE-2026-42616 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/dc1b682e99b6c055b0281ca543a8420b698420d1
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-42616

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:51 +05:30
Darsh Kelaiya b7f9581cd3 ntfs-3g-ntfsprogs: fix CVE-2026-42618 
This patch applies the upstream fixes shown in [1] and [2]. The NVD
record describing the vulnerability is referenced in [3].

[1] https://github.com/tuxera/ntfs-3g/commit/e021cbe3d7a42963110e4561f2a1327614c20a00
[2] https://github.com/tuxera/ntfs-3g/commit/6aa66d98980ac1d966d7977c7b079f4fe380eb42
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-42618

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:50 +05:30
Darsh Kelaiya 22750284b2 ntfs-3g-ntfsprogs: fix CVE-2026-46569 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/961ed5c2fa2f36ef6a347f04e1fa586113c97e7c
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46569

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:50 +05:30
Darsh Kelaiya a7f59f05c0 ntfs-3g-ntfsprogs: fix CVE-2026-46570 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/5ab37421ebbcbf33bf96876c7a034393bda05a25
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46570

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:49 +05:30
Darsh Kelaiya 861b62a7cc ntfs-3g-ntfsprogs: fix CVE-2026-46571 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/b912272b30c552b0457e40a0a68b1fac2587aaea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46571

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:49 +05:30
Darsh Kelaiya d9a9a74915 ntfs-3g-ntfsprogs: fix CVE-2026-46572 and CVE-2026-42617 
This patch applies the upstream fixes shown in [1], [2], and [3].
The NVD records describing the vulnerabilities are referenced in
[4] and [5].

[1] https://github.com/tuxera/ntfs-3g/commit/2ead8a3ccf940c0219ffba587fab54e21462b3a5
[2] https://github.com/tuxera/ntfs-3g/commit/dfd1a7c6eb23a22238ec193451fa59c989b4381f
[3] https://github.com/tuxera/ntfs-3g/commit/edf2b892356684ca8f2fc5898943c7a9b90ffb80
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-46572
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-42617

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:49 +05:30
Rohini Sangam 19db4514a1 nodejs: Security fix for CVE-2026-48617 
Pick patch from [1] also mentioned at Debian tracker in [2]

[1] https://github.com/nodejs/node/commit/2f62693801a12bc8a485b3b7da3239ac522f607d
[2] https://security-tracker.debian.org/tracker/CVE-2026-48617

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:48 +05:30
Ankur Tyagi 5d26da35b0 apache2: upgrade 2.4.68 -> 2.4.69 
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.69

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:48 +05:30
Peter Marko 7df01e5023 squid: patch CVE-2026-104786 
Pick SQUID-2026:7/SQUID-2026:8 patch per [1] and [2].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-j9pf-q9f6-v44c
[2] https://github.com/squid-cache/squid/security/advisories/GHSA-vh99-xw7j-fx5c

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:47 +05:30
Peter Marko d51d8d88d8 squid: patch CVE-2026-61642 
Pick SQUID-2026:6 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-537g-4gfh-w7m6

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:47 +05:30
Peter Marko 6355625b42 squid: patch CVE-2026-50012 
Pick SQUID-2026:5 patch per [1].
Also add compilation error fix per [2].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-5vmx-9x64-9284
[2] https://security-tracker.debian.org/tracker/CVE-2026-50012

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:46 +05:30
Peter Marko 520a186bd7 squid: patch CVE-2026-47729 
Pick SQUID-2026:4 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:46 +05:30
Peter Marko 9c598b5eff squid: patch CVE-2026-32748 
Pick SQUID-2026:2 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:45 +05:30
Peter Marko d657b86f28 squid: patch CVE-2026-33515 
Pick SQUID-2026:3 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:45 +05:30
Peter Marko 4cf01e38f6 squid: patch CVE-2026-33526 
Pick SQUID-2026:1 patch per [1].

[1] https://github.com/squid-cache/squid/security/advisories/GHSA-hpfx-h48q-gvwg

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:44 +05:30
Yogita Urade 1c0c901d65 hdf5: Fix CVE-2026-17574 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-17574

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:44 +05:30
Yogita Urade f930afb284 hdf5: Fix CVE-2026-17573 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-17573

Signed-off-by: Yogita Urade <yurade@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:43 +05:30
Peter Marko a346f23e3a libwebsockets: patch CVE-2026-78161 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-78161

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:43 +05:30
Mehmet Fide 89444b3446 spidev-test: clean the build dir before configure 
The recipe builds out of tree with O=${B}, and the kernel's tools/build
writes fixdep .cmd files into ${B} that list the compiler's own headers
by absolute path, version included. When the toolchain changes (gcc
13.4 -> 13.5 here) do_compile reruns in the same ${B}, make cannot find
the old prerequisite and stops:

  make[1]: *** No rule to make target '.../recipe-sysroot-native/usr/lib/arm-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/13.4.0/include/stddef.h', needed by '.../spidev_test.o'.  Stop.

Empty ${B} before configure, as bpftool does.

Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit bd52d9b479)
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:42 +05:30
Peter Marko e7165359fb syslog-ng: patch CVE-2026-39879 
Pick patches per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-39879

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:42 +05:30
Peter Marko df6ab201fe cjson: patch CVE-2026-87933 
Pick patch from Github PR mentioned in NVD report.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:41 +05:30
Peter Marko 4e6937fa8f c-ares: patch CVE-2026-69184 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-69184

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:41 +05:30
Peter Marko 9c30658af2 c-ares: patch CVE-2026-69186 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-69184

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:40 +05:30
João Marcos Costa (Schneider Electric) aaeb87a013 ntpsec: add CVE_STATUS for CVE-2016-1548 
This vulnerability was fixed since v0.9.3 (tag name 'NTPsec_0_9_3') [1],
and the version range is not well defined as of today, for instance,
in NVD database [2]. This can lead to false positives in CVE reports.

Mark this CVE as fixed.

[1] https://github.com/ntpsec/ntpsec/blob/master/NEWS.adoc#2016-05-17-093
[2] https://nvd.nist.gov/vuln/detail/cve-2016-1548

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:40 +05:30
João Marcos Costa (Schneider Electric) d90a138b1a ntp: add CVE-2016-1548 to CVE_STATUS_NTP 
This vulnerability actually affects 4.2.8p4 and earlier [1], and
meta-networking provides as of now 4.2.8p17.

Add it to CVE_STATUS_NTP so this CVE is no longer reported.

[1] https://security-tracker.debian.org/tracker/CVE-2016-1548

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:39 +05:30
Darsh Kelaiya 0517530717 python3-aiohttp: fix CVE-2026-54273 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [4].

The follow-up from [2] is kept as a separate recipe patch. It adapts
the declined WebSocket-upgrade replay from [3], applies the queue
pause after replay, and includes the corresponding regression tests.

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced with CVE-2025-69224
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/dfdfa9d5aad5d21f91c79fb2ceeba0f8046cb6cf
[2] https://github.com/aio-libs/aiohttp/commit/47babd8c23ca79e2bae6cc8dcb5752b61e369fc7
[3] https://github.com/aio-libs/aiohttp/commit/8943d34337c133aa2a33f1fd10a30950d8dcb20e
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-54273

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:39 +05:30
Darsh Kelaiya 9848bb178a python3-aiohttp: fix CVE-2026-54279 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/a329a7aacad5284f087af36103aff778746da0f2
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54279

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:39 +05:30
Darsh Kelaiya 1afb67e3c1 python3-aiohttp: fix CVE-2026-54278 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/4f7480e474cccc6a8cc2c92ad3f17a31dedf8232
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54278

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:38 +05:30
Darsh Kelaiya 49de46b2f3 python3-aiohttp: fix CVE-2026-54277 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

The generated aiohttp/_http_parser.c changes are omitted. The
recipe-time Cython regeneration introduced with CVE-2025-69224
regenerates that file from the patched _http_parser.pyx before the
accelerated parser is compiled.

[1] https://github.com/aio-libs/aiohttp/commit/5ab61bb4cd88f19b712f12c7c9295fe262bf804d
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54277

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:38 +05:30
Darsh Kelaiya 8f838e1006 python3-aiohttp: fix CVE-2026-54275 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/0ca2b6c28a25726527a8b60f25960262a91ed0e0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54275

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:37 +05:30
Darsh Kelaiya bb01c56027 python3-aiohttp: fix CVE-2026-54274 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/14b6ee851fb16ec199acb950de0c82d476799e7d
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-54274

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:37 +05:30
Darsh Kelaiya 8e776e0477 python3-aiohttp: fix CVE-2026-50269 
This patch applies the reviewed upstream fix shown in [1].
For aiohttp 3.9.5, it also backports the required header
validation from prerequisite commit [2]. The advisory
identifying the fix is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/bf88077ebb14f4c29924b8e8904cba20c55c28b8
[2] https://github.com/aio-libs/aiohttp/commit/1e3ecd48ec423c1fcc729c98adff31172faae1ef
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-50269

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:36 +05:30
Darsh Kelaiya 84c7554df6 python3-aiohttp: fix CVE-2026-47265 
This patch applies the upstream stable-branch fix in [1], which
backports the original upstream commit in [2]. The advisory
identifying the vulnerability is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/f54c40851b0d6c4bbdab97ba518a223adda32478
[2] https://github.com/aio-libs/aiohttp/commit/d57efb05f5073071ceb2d3b35d72d9d0bc4512a2
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-47265

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:36 +05:30
Darsh Kelaiya 73aac78272 python3-aiohttp: fix CVE-2026-34525 
This patch applies the reviewed upstream fix commits shown in
[1] and [2]. The advisory identifying the fix is referenced in
[3].

[1] https://github.com/aio-libs/aiohttp/commit/e00ca3cca92c465c7913c4beb763a72da9ed8349
[2] https://github.com/aio-libs/aiohttp/commit/53e2e6fc58b89c6185be7820bd2c9f40216b3000
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34525

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:35 +05:30
Darsh Kelaiya 807c758926 python3-aiohttp: fix CVE-2026-34520 
This patch applies the reviewed upstream fix shown in [1].
The CVE record is referenced in [2]. It also backports
the C-parser null-byte validation and adapts its
regression test from [3].

[1] https://github.com/aio-libs/aiohttp/commit/9370b9714a7a56003cacd31a9b4ae16eab109ba4
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34520
[3] https://github.com/aio-libs/aiohttp/commit/db560cfeab32aa35f3d06f7a24238bedc01ffe2b

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:35 +05:30
Darsh Kelaiya 627d177c3e python3-aiohttp: fix CVE-2026-34517 
This patch applies the reviewed upstream fix shown in [1]. The
advisory identifying the fix is referenced in [2].

[1] https://github.com/aio-libs/aiohttp/commit/cbb774f38330563422ca0c413a71021d7b944145
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-34517

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:34 +05:30
Darsh Kelaiya ddec3bbbc6 python3-aiohttp: fix CVE-2026-34516 
This patch applies the upstream stable-branch fix in [1], which
backports the original upstream commit in [2]. The advisory
identifying the fix is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/8a74257b3804c9aac0bf644af93070f68f6c5a6f
[2] https://github.com/aio-libs/aiohttp/commit/5fe9dfb64400a574f5ba3f2d3b49b7db47567c29
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34516

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:34 +05:30
Darsh Kelaiya 1a8597f6cb python3-aiohttp: fix CVE-2026-34519 
This patch applies the upstream stable-branch fix in [1], which
backports the original upstream commit in [2]. The advisory
identifying the fix is referenced in [3].

[1] https://github.com/aio-libs/aiohttp/commit/53b35a2f8869c37a133e60bf1a82a1c01642ba2b
[2] https://github.com/aio-libs/aiohttp/commit/18510482de080bf741c560bf2a190fdc54b4eed4
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-34519

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-26 10:10:33 +05:30
Anuj Mittal 0f00f8b9a2 vboxguestdrivers: fix vboxvideo build on kernels lacking drm_fb_helper_alloc_info 
Kernel 6.6.151 dropped the drm_fb_helper_alloc_info() declaration as
part of a stable backport, causing vbox_fb.c to fail with:

  vbox_fb.c:329:16: error: implicit declaration of function 'drm_fb_helper_alloc_info'

The existing RTLNX_VER_MIN(6,19,0) check can't express this since the
change landed mid-series in 6.6.y/6.12.y/6.18.y. Backport master
commit b249fbbf1b ("vboxguestdrivers: fix
 vboxvideo build on kernels lacking drm_fb_helper_alloc_info"),
adapted for the 7.0.14 recipe.

Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-29 16:10:23 +05:30
Jason Schonberg c8b0f3d79e php: upgrade 8.2.33 -> 8.2.34 
This is a security release.

CVE-2025-1218 CVE-2025-14181
CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769
CVE-2026-6103 CVE-2026-17545 CVE-2026-92842 CVE-2026-93682

Changelog: https://www.php.net/ChangeLog-8.php#8.2.34

Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:34 +05:30
Benjamin Robin (Schneider Electric) a064adfbd1 libwebsockets: fix CVE-2026-19773 
Backport the fix from v5 branch.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:34 +05:30
Benjamin Robin (Schneider Electric) 307a3bdc40 libwebsockets: update to version 4.3.10 
This version already include the fixes for CVE-2025-11677 and for
CVE-2025-11678. The LICENSE was slightly changed to clarify the license
summary.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:33 +05:30
Himani Ramesh Barde cb7844b35d postfix: fix build on hosts with Linux 7.x kernel 
makedefs only recognizes kernel majors 3-6. Hosts running a 7.x
kernel get "Unknown system type: Linux 7.0.0-..." and the native
build fails. Add 7 to the version match in makedefs and sys_defs.h.

Already fixed in postfix 3.11.

Upstream-Status: Backport [postfix 3.11]
Signed-off-by: Himani Ramesh Barde <HimaniRamesh.Barde@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:33 +05:30
Rohini Sangam e22d8fc3e1 python3-pillow: Security fix for CVE-2026-59204 
Pick patch from [1] also mentioned at NVD report in [2]

[1] https://github.com/python-pillow/Pillow/commit/13ada41172142f2fd9f0906f615a00ea623a11ca
[2] https://nvd.nist.gov/vuln/detail/cve-2026-59204

Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-09-28 14:55:32 +05:30