Ankur Tyagi
2a8300a0ef
7zip: upgrade 26.04 -> 26.05
...
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.05
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 533d0a63acankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
e5a8e3e298
7zip: upgrade 26.03 -> 26.04
...
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.04
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 1c45c216f6ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
496cb3f327
apache2: upgrade 2.4.68 -> 2.4.69
...
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.69
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit cf030e73b8ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Jason Schonberg
1e4a1a7cdc
php: upgrade 8.5.11 -> 8.5.12
...
This is a security update. Fixes unauthenticated remote code execution.
CVE-2026-109618 CVE-2026-109619
Advisory: https://www.php.net/archive/2026.php#2026-10-21-5
Changelog: https://www.php.net/ChangeLog-8.php#8.5.12
Signed-off-by: Jason Schonberg <schonm@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 898ac0ba1cankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Jason Schonberg
82e99aebb4
brotli: upgrade 1.2.0 -> 1.2.1
...
This is a security release
CVE-2026-111497: out-of-bounds write permits remote code execution
Changelog: https://github.com/google/brotli/releases/tag/v1.2.1
Signed-off-by: Jason Schonberg <schonm@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit b5d66bf60dankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
a252864b76
ntpsec: upgrade 1.2.5 -> 1.2.6
...
Changelog:
https://gitlab.com/NTPsec/ntpsec/-/blob/NTPsec_1_2_6/NEWS.adoc?ref_type=tags
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit b730ef39a1ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
03be564adc
unbound: upgrade 1.26.1 -> 1.26.2
...
Details:
https://github.com/NLnetLabs/unbound/releases/tag/release-1.26.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Ankur Tyagi
fa4dfa140d
libmspack: patch CVE-2026-110602
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-110602
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-26 23:15:53 +13:00
Peter Marko
f16173e6a4
python3-grpcio: update gRPC repo roots
...
See https://emudhra.we-have-a-problem.com/
Use a copy function instead of adding the patch two times becuase there
are two copies of certificates in the sources.
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:51 +13:00
Peter Marko
1a0a133351
grpc: update gRPC repo roots
...
See https://emudhra.we-have-a-problem.com/
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:40 +13:00
Peter Marko
8a760baf57
nss: remove compromised eMudhra certificates
...
See https://emudhra.we-have-a-problem.com/
Signed-off-by: Peter Marko <peter.marko@siemens.com >
2026-10-26 23:14:32 +13:00
Ankur Tyagi
a07cefff6a
swagger-ui: upgrade 5.33.2 -> 5.33.3
...
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 67b4387a4dankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
b625e91dcf
libvncserver: patch CVE-2026-50538
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50538
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
105c0a7d4b
libvncserver: patch CVE-2026-32853
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32853
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
3f2eb98cd8
libvncserver: patch CVE-2026-32854
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32854
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
4ba15423c7
libvncserver: patch CVE-2026-44988
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44988
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
3e1f043594
ncp: ignore CVE-2025-14577 and CVE-2026-35087
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14577
https://nvd.nist.gov/vuln/detail/cve-2026-35087
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Ankur Tyagi
60a1ac73cb
mtr: patch CVE-2026-14461
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-14461
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:51 +13:00
Peter Marko
ac8179c9b1
nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629
...
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
{
"lessThan": "*",
"status": "affected",
"version": "1.23.3",
"versionType": "custom"
}
Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 959f4c8f09mominux@gmail.com >
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-24 23:30:19 +13:00
Peter Marko
3ee18e1a42
nginx: upgrade 1.30.5 -> 1.30.6
...
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have
been released, with fixes for buffer overflow vulnerability when using
alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when
evaluating string expressions with variables (CVE-2026-93479), request
body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery
vulnerability when using TLS session ticket key rotation
(CVE-2026-97629), and use-after-free vulnerability when using
ngx_http_ssi_module with AIO (CVE-2026-97205).
Signed-off-by: Peter Marko <peter.marko@siemens.com >
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com >
(cherry picked from commit 6cdd413248ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
b05877ef8e
netdata: mark CVE-2026-83602 fixed
...
Fix identified by NVD is included in the patch release[1] v2.10.4
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-83602
[1]https://github.com/netdata/netdata/pull/22825
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
406da4cb70
nmap: patch CVE-2026-72712
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-72712
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
e3266bede8
nmap: patch CVE-2026-58058
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58058
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
7629323ae3
pjproject: patch CVE-2026-84975
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84975
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:11 +13:00
Ankur Tyagi
eaf5f50981
pjproject: patch CVE-2026-77396
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-77396
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-21 21:35:00 +13:00
Ankur Tyagi
59a6a134d6
pjproject: patch CVE-2026-57166
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57166
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
aac29142ed
pjproject: patch CVE-2026-57165
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57165
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
274e935099
pjproject: patch CVE-2026-57164
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57164
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
3cc8b60359
pjproject: patch CVE-2026-57163
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57163
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
f7758a033e
pjproject: patch CVE-2026-57162
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57162
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
371f20419d
pjproject: patch CVE-2026-57161
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57161
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
78f0ee20cc
pjproject: patch CVE-2026-57160
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57160
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
bb27c215be
pjproject: mark CVE-2026-26967 fixed
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-26967
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
27b41701a0
opensc: patch CVE-2026-103531
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-103531
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
3e78f34c9b
poppler: patch CVE-2026-102620
...
Also backport commit[1] to allow cherry-pick of the commit fixing the CVE.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102620
[1]https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
435cd16e9b
poppler: patch CVE-2026-102621
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102621
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
bedbe1184f
postfix: ignore CVE-2023-32182
...
Details:
https://nvd.nist.gov/vuln/detail/cve-2023-32182
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:20 +13:00
Ankur Tyagi
9771015a7d
proftpd: mark CVE-2026-53994 fixed
...
Debian[1] identified the issue[2] associated with this CVE.
Changelog[3] confirms the resolution.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53994
[]https://security-tracker.debian.org/tracker/CVE-2026-53994
[]https://github.com/proftpd/proftpd/issues/2115
[]https://github.com/proftpd/proftpd/blob/v1.3.9b/NEWS#L35
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:10 +13:00
Ankur Tyagi
3e0c7af047
psqlodbc: patch CVE-2026-109448
...
Backport the commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-109448
[1]https://security-tracker.debian.org/tracker/CVE-2026-109448
PTEST pass:
root@qemuarm64:~# ptest-runner psqlodbc
START: ptest-runner
2026-10-17T09:22
BEGIN: /usr/lib/psqlodbc/ptest
...
DURATION: 43
END: /usr/lib/psqlodbc/ptest
2026-10-17T09:23
STOP: ptest-runner
TOTAL: 1 FAIL: 0
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:14:07 +13:00
Ankur Tyagi
622cd276dd
rapidjson: mark CVE-2024-38517 fixed
...
Commit mentioned in the NVD is part of the current version:
$ git log HEAD --oneline | grep 8269bc2b
8269bc2b Prevent int underflow when parsing exponents
Details:
https://nvd.nist.gov/vuln/detail/cve-2024-38517
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-19 00:13:53 +13:00
Ankur Tyagi
babb18114e
samba: ignore CVE-2026-2340
...
Also confirmed in the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-2340
[1]https://www.samba.org/samba/history/samba-4.23.8.html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-17 12:06:28 +13:00
Ankur Tyagi
bc11cbea9e
python3-cbor2: upgrade 6.1.4 -> 6.1.5
...
Changelog:
https://github.com/agronholm/cbor2/releases/tag/6.1.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-16 18:37:03 +13:00
Ankur Tyagi
2b5240d701
python3-pyjwt: upgrade 2.13.0 -> 2.14.0
...
Changelog:
https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-16 18:36:57 +13:00
Ankur Tyagi
6894d75451
libxmp: upgrade 4.7.3 -> 4.7.4
...
Changelog:
https://github.com/libxmp/libxmp/releases/tag/libxmp-4.7.4
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:24 +13:00
Ankur Tyagi
3fb79999f2
libmikmod: upgrade 3.3.14 -> 3.3.15
...
Changelog:
https://sourceforge.net/p/mikmod/mikmod/ci/libmikmod-3.3.15/tree/libmikmod/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:19 +13:00
Ankur Tyagi
6cb8fca0bc
libspdm: upgrade 3.8.2 -> 3.8.3
...
Changelog:
https://github.com/DMTF/libspdm/releases/tag/3.8.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:09 +13:00
Ankur Tyagi
b598e510a5
spitools: upgrade 1.1.0 -> 1.1.1
...
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:35:01 +13:00
Ankur Tyagi
63837fd4bd
freerdp3: upgrade 3.32.1 -> 3.32.2
...
Dropped patch that is part of the upstream version.
Changelog:
https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:34:44 +13:00
Ankur Tyagi
492ba8a3af
swagger-ui: upgrade 5.33.1 -> 5.33.2
...
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 22:34:28 +13:00
Ankur Tyagi
991d096781
xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9
...
Changelog:
https://github.com/flatpak/xdg-dbus-proxy/blob/0.1.9/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com >
2026-10-14 17:28:24 +13:00
Ankur Tyagi
Jason Schonberg
Peter Marko