Ankur Tyagi
233e6a56e5
tinyproxy: patch CVE-2026-55202
...
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202
[1]https://security-tracker.debian.org/tracker/CVE-2026-55202
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:34 +05:30
Ankur Tyagi
33649b0657
tinyproxy: patch CVE-2026-54387
...
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387
[1]https://security-tracker.debian.org/tracker/CVE-2026-54387
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:33 +05:30
Ankur Tyagi
985acd9e7c
tinyproxy: patch CVE-2026-31842
...
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842
[1]https://security-tracker.debian.org/tracker/CVE-2026-31842
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:33 +05:30
Ankur Tyagi
6b06704ac1
libyang: patch CVE-2026-41401
...
Backport patch identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401
[1]https://security-tracker.debian.org/tracker/CVE-2026-41401
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:32 +05:30
Ankur Tyagi
abf11a785d
valkey: mark CVE-2026-56684 and CVE-2026-63639 patched
...
Also mentioned in the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56684
https://nvd.nist.gov/vuln/detail/cve-2026-63639
[1]https://github.com/valkey-io/valkey/releases/tag/9.0.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:32 +05:30
Ankur Tyagi
2b272378cc
python3-zeroconf: patch CVE-2026-47184
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47184
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:31 +05:30
Ankur Tyagi
4a1d7cfb5c
python3-zeroconf: patch CVE-2026-47183
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47183
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:31 +05:30
Ankur Tyagi
67e8e3baf6
python3-zeroconf: patch CVE-2026-47180
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47180
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:30 +05:30
Ankur Tyagi
683afd55b2
miniupnpd: patch CVE-2026-5720
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-5720
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:30 +05:30
Ankur Tyagi
0b90ef42bc
libssh: mark CVEs patched
...
Changelog[1] also confirms the fix.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-15370
https://nvd.nist.gov/vuln/detail/cve-2026-59843
https://nvd.nist.gov/vuln/detail/cve-2026-59844
https://nvd.nist.gov/vuln/detail/cve-2026-59845
https://nvd.nist.gov/vuln/detail/cve-2026-59846
https://nvd.nist.gov/vuln/detail/cve-2026-59847
https://nvd.nist.gov/vuln/detail/cve-2026-59848
https://nvd.nist.gov/vuln/detail/cve-2026-59849
https://nvd.nist.gov/vuln/detail/cve-2026-59850
[1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:30 +05:30
Ankur Tyagi
6541aefe60
libssh: ignore CVE-2025-14821
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14821
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:29 +05:30
Ankur Tyagi
bb3f5628f1
libnfs: patch CVE-2026-57918
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57918
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:29 +05:30
Ankur Tyagi
6ace2f0b5e
libnfs: patch CVE-2026-53689
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53689
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:28 +05:30
Abhishek Bachiphale
f015b96ad0
thrift: fix CVE-2026-48145
...
Improper Validation of Certificate with Host Mismatch vulnerability in
Apache Thrift C++ bindings. This issue affects Apache Thrift: before
0.24.0.
Backport patch to fix CVE-2026-48145.
Reference:
[https://nvd.nist.gov/vuln/detail/cve-2026-48145 ]
Upstream Patch:
[https://github.com/apache/thrift/commit/c1457c69fbd49c6d554dafe91f1004049537322b ]
Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:28 +05:30
Abhishek Bachiphale
2c673e4a4f
thrift: fix CVE-2026-48586
...
Improper Handling of Highly Compressed Data (Data Amplification)
vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib
bindings. This issue affects Apache Thrift: before 0.24.0.
Backport patch to fix CVE-2026-48586.
Reference:
[https://nvd.nist.gov/vuln/detail/cve-2026-48586 ]
Upstream Patch:
[https://github.com/apache/thrift/commit/e3c8c534cacdbef039f4bb0bcf4b2744a982e3bf ]
[https://github.com/apache/thrift/commit/702d00f9053133aba7186f2dbb242a91a1ddd491 ]
Signed-off-by: Abhishek Bachiphale <Abhishek.Bachiphale@windriver.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 10:13:24 +05:30
Adarsh Jagadish Kamini
29cdca4152
thrift: fix CVE-2026-55970
...
Backport patch to fix CVE-2026-55970.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-55970
Upstream fix:
https://github.com/apache/thrift/commit/4da36faeef0b7db4b1dea560b01eb15957335934
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:16 +05:30
Adarsh Jagadish Kamini
fe4f335ffe
thrift: fix CVE-2026-55969
...
Backport patch to fix CVE-2026-55969.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-55969
Upstream fix:
https://github.com/apache/thrift/commit/983c813c9a1a2302d9a3ae23d7368beceaac2d0a
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:15 +05:30
Adarsh Jagadish Kamini
244521fbe6
thrift: fix CVE-2026-45112
...
Backport patch to fix CVE-2026-45112.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-45112
Upstream fix:
https://github.com/apache/thrift/commit/16b3673827498d1f4b05f8026d5d580b8e8f5aa2
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:15 +05:30
Adarsh Jagadish Kamini
50b2a64565
thrift: fix CVE-2026-41608
...
Backport patch to fix CVE-2026-41608.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-41608
Upstream fix:
https://github.com/apache/thrift/commit/8c605880ea4ef050a689c859de3b702ad8d4ce7b
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:14 +05:30
Ankur Tyagi
194a8339ce
libkcapi: patch CVE-2026-71225
...
Backport commit fixing the CVE as per the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-71225
[1]https://github.com/smuellerDD/libkcapi/releases/tag/v1.5.1
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:14 +05:30
Ankur Tyagi
27947c5852
libkcapi: patch CVE-2026-71227
...
Backport commit fixing the CVE as per the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-71227
[1]https://github.com/smuellerDD/libkcapi/releases/tag/v1.5.1
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:13 +05:30
Ankur Tyagi
4ff7b629f8
libkcapi: patch CVE-2026-71226
...
Backport commits[1][2] needed to cherry pick fix for the CVE as per the
release notes[3]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-71226
[1]https://github.com/smuellerDD/libkcapi/commit/e8396c28c2cd2b81f69fc68500fcb2ec7163b4fd
[2]https://github.com/smuellerDD/libkcapi/commit/d9f16d5fbcf8270110a8f6f35523525f345ca311
[3]https://github.com/smuellerDD/libkcapi/releases/tag/v1.5.1
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:13 +05:30
Ankur Tyagi
4dab380557
libiec61850: patch CVE-2026-19206
...
Backport commits[1][2] in order to cherry pick fix mentioned in NVD.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19206
[1]https://github.com/mz-automation/libiec61850/commit/c85175ddf7018beb753d85a740d4c2c77f61c96c
[2]https://github.com/mz-automation/libiec61850/commit/6178540e8cdd26b7884a482905140cc9084966a1
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:12 +05:30
Ankur Tyagi
91c41d12e2
libiec61850: patch CVE-2026-19108
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19108
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:12 +05:30
Ankur Tyagi
09f09c81ad
libiec61850: patch CVE-2026-18583
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-18583
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:12 +05:30
Ankur Tyagi
f4c8ac2da1
libiec61850: patch CVE-2026-18582
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-18582
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:11 +05:30
Ankur Tyagi
a7088b0fda
libiec61850: mark CVE-2024-45969 patched
...
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]
[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:11 +05:30
Ankur Tyagi
96c1b7730f
libheif: patch CVE-2026-62377
...
Details:
https://nvd.nist.gov/vuln/detail/CVE-2026-62377
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:10 +05:30
Ankur Tyagi
8dcbf99224
libheif: patch CVE-2026-62289
...
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-62289
[1]https://security-tracker.debian.org/tracker/CVE-2026-62289
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:10 +05:30
Himanshu Jadon
c27765e057
samba, libldb: add package conflicts
...
samba package also installs LDB command line tools and python LDB
module. libldb package installs the same tools and pyldb module from
standalone LDB source.
pkgdata shows the conflict clearly:
samba: /usr/bin/ldbadd
libldb: /usr/bin/ldbadd
samba-python3: site-packages/ldb.so
pyldb: site-packages/ldb.so
So when both samba and libldb are added in same image, rootfs can fail
because package manager sees same files from two different packages.
Both package sets are not expected to be installed together.
Add RCONFLICTS for samba/libldb and samba-python3/pyldb. This makes the
conflict explicit during dependency resolution instead of failing later
as file install conflict.
Older meta-networking had similar conflict handling for samba/libldb in
commit: https://git.openembedded.org/meta-openembedded/commit/?id=8e641e28f630dac61a03373ad70c72a2370ad11e
This change adds the same handling again with current python3 package names.
Signed-off-by: Himanshu Jadon <hjadon@cisco.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit ee1c39e595anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:09 +05:30
Ankur Tyagi
14e1292075
libheif: patch CVE-2026-41071
...
Backport commit identified by Debian[1]
Also backport[2] which is needed to cherry-pick[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41071
[1]https://security-tracker.debian.org/tracker/CVE-2026-41071
[2]https://github.com/strukturag/libheif/commit/71755d3d41a117685a3274bdd1214fc50a760f20
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:09 +05:30
Ankur Tyagi
bb1a4701e6
libheif: patch CVE-2026-32741
...
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32741
[1]https://security-tracker.debian.org/tracker/CVE-2026-32741
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:08 +05:30
Ankur Tyagi
f179d08aed
libheif: patch CVE-2026-32740
...
Backport commit identified by Debian[1] to the original file which was
renamed by upstream commit[2].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32740
[1]https://security-tracker.debian.org/tracker/CVE-2026-32740
[2]https://github.com/strukturag/libheif/commit/f05c61ee8427ac3e39a3e5802a390b5aa99ae281
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:08 +05:30
Ankur Tyagi
6bc5abde11
libheif: patch CVE-2026-32739
...
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32739
[1]https://security-tracker.debian.org/tracker/CVE-2026-32739
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:07 +05:30
Ankur Tyagi
18e20ab7d2
libheif: patch CVE-2026-32738
...
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32738
[1]https://security-tracker.debian.org/tracker/CVE-2026-32738
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:07 +05:30
Ankur Tyagi
635e8fd545
libfido2, libfido2-initial: ignore CVE-2026-40947
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-40947
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:06 +05:30
Ankur Tyagi
4a63a2afa1
libde265: patch CVE-2026-49346
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:06 +05:30
Ankur Tyagi
c83399f83f
libde265: patch CVE-2026-49337
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:06 +05:30
Ankur Tyagi
bd09bb41b4
libde265: patch CVE-2026-49295
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:05 +05:30
Ankur Tyagi
53bb41bcf0
libde265: mark CVE-2026-45382 and CVE-2026-45383 patched
...
Release Note[1] also mentions fixed CVE.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-45382
https://nvd.nist.gov/vuln/detail/cve-2026-45383
[1] https://github.com/strukturag/libde265/releases/tag/v1.0.19
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:05 +05:30
Ankur Tyagi
4a1281dd55
lcms: patch CVE-2026-42798
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-42798
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:04 +05:30
Ankur Tyagi
5060c9fe3a
jq: ignore CVE-2025-49014
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-49014
Fixes:
WARNING: jq-1.8.1-r0 do_sbom_cve_check_recipe: jq-1.8.1: Found unpatched CVEs: CVE-2025-49014
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:04 +05:30
Joel Winarske
aa32734876
capnproto: build position independent code
...
The recipe produces static archives only, and does not compile them PIC, so
linking capnp or kj into a shared library fails:
libkj.a(exception.c++.o): relocation R_X86_64_TPOFF32 against
`kj::(anonymous namespace)::threadLocalCallback' can not be used when making
a shared object; local-exec is incompatible with -shared
kj/exception.c++ has a file-scope thread_local, which non-PIC code compiles to
the local-exec TLS model. A shared object cannot use that model, so the link
fails on any consumer that puts capnp inside a .so. Debian and Fedora do not
hit this because they ship shared libcapnp.
Set CMAKE_POSITION_INDEPENDENT_CODE. Packaging is unchanged: still static,
still no .so, no new packages and no ABI surface, only the code model differs.
Backport of the same change sent for master, where the recipe is 1.5.0.
Signed-off-by: Joel Winarske <joel.winarske@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:03 +05:30
Ankur Tyagi
86fba2b580
iniparser: mark CVE-2025-0633 pached
...
Also mentioned in the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633
[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:03 +05:30
Ankur Tyagi
3513e3868e
iftop: ignore CVE-2026-3824, CVE-2026-3825 and CVE-2026-3826
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-3824
https://nvd.nist.gov/vuln/detail/cve-2026-3825
https://nvd.nist.gov/vuln/detail/cve-2026-3826
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:02 +05:30
Ankur Tyagi
df3f814ab8
hdf5: patch CVE-2026-19025
...
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:02 +05:30
Ankur Tyagi
637f437de9
hdf5: patch CVE-2026-17574
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:01 +05:30
Ankur Tyagi
f46990293c
hdf5: patch CVE-2026-17573
...
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.
[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:01 +05:30
Ankur Tyagi
c279e9e688
hdf5: patch CVE-2026-17572
...
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.
[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:00 +05:30
Ankur Tyagi
f1a7be5e8d
hostapd: patch CVE-2026-58374
...
Apply hostapd patches recommended by upstream[1] as mentioned in the NVD[2]
[1] https://w1.fi/security/2026-1/
[2] https://nvd.nist.gov/vuln/detail/cve-2026-58374
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com >
2026-09-15 07:52:00 +05:30
Ankur Tyagi
Abhishek Bachiphale
Adarsh Jagadish Kamini
Himanshu Jadon
Joel Winarske