mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-10-16 18:48:07 +00:00
Code Issues Projects Releases Wiki Activity
40,645 Commits 65 Branches 0 Tags
4c928862f5dcaafafe117abe01d1be7eec8654ff
Commit Graph
40645 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ankur Tyagi 4c928862f5 tesseract: patch CVE-2026-88051 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88051

(cherry picked from commit 727354dae2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:17 -07:00
Ankur Tyagi 2ba3ed5dc8 tesseract: patch CVE-2026-88047 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88047

(cherry picked from commit b8fa7aac91)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:16 -07:00
Ankur Tyagi cc2b58f135 tesseract: patch CVE-2026-88050 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88050

(cherry picked from commit 4aab0847c2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:16 -07:00
Ankur Tyagi 909d433ca0 tesseract: patch CVE-2026-88049 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88049

(cherry picked from commit 218b6a19b1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:16 -07:00
Ankur Tyagi 0aa1782e95 tesseract: patch CVE-2026-88048 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88048

(cherry picked from commit 9e544d6e50)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi 8ee82e432c tesseract: patch CVE-2026-88052 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88052

(cherry picked from commit 251dd7f80d)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi bf39596278 strongwan: upgrade 6.0.7 -> 6.1.0 
- Remove PACKAGECONFIG entries for soup, tnc-ifmap, tnccs-11, tnccs-dynamic
- Include xauth-generic in default PACKAGECONFIG. This preserves default
  plugin as upstream disabled IKEv1 by default.

root@qemux86-64:~# swanctl --stats
uptime: 38 seconds, since Oct 13 03:27:29 2026
worker threads: 16 total, 11 idle, working: 4/0/1/0
job queues: 0/0/0/0
jobs scheduled: 0
IKE_SAs: 0 total, 0 half-open
mallinfo: sbrk 1503232, mmap 0, used 552176, free 951056
loaded plugins: charon-systemd random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pgp dnskey sshkey pem openssl pkcs8 xcbc cmac kdf drbg curl sqlite attr kernel-netlink resolve socket-default vici updown xauth-generic

Changelog:
https://github.com/strongswan/strongswan/releases/tag/6.1.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi 30acdca706 sngrep: patch CVE-2026-90558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90558

(cherry picked from commit 36ddee53b1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:15 -07:00
Ankur Tyagi ba9537ae1f ntopng: patch CVE-2026-86090 and CVE-2026-86091 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091

(cherry picked from commit ae180302f4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi 4e8a7265bd ntopng: patch CVE-2026-84990 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990

(cherry picked from commit 2d932fa4e3)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi df5f8478c4 smarty: mark CVE-2026-82531 patched 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:14 -07:00
Ankur Tyagi c8dd8428d0 cjson: patch CVE-2026-87933 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

(cherry picked from commit 2b3f5cbbd8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:13 -07:00
Ankur Tyagi 96cedce046 python3-eventlet: mark CVE-2023-29483 fixed 
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

(cherry picked from commit 47b2ce9cc7)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:13 -07:00
Ankur Tyagi 896ea53058 openvpn: upgrade 2.7.7 -> 2.7.8 
Changelog:
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 21:57:12 -07:00
Peter Marko 53ffd4623b thrift: upgrade 0.24.0 -> 0.25.0 
This upgrade includes fix for 61 CVEs.
Refreshed/removed patches via devtool.

Release announcement: [1]
Release notes: [2]

[1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy
[2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md

License-Update: Added notice for MIT license of a Makefile

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 14:20:30 -07:00
Ricardo Salveti b2486769a3 polkit: keep the agent helper units in the main package 
Commit 3e423e21e5 ("polkit: enable the agent helper socket") enables
polkit-agent-helper.socket from polkit, but since 03420389ca ("polkit:
Add a separate package for polkit systemd service/dbus config")
polkit-service comes first in PACKAGES and takes the whole systemd unit
directory, so the socket is packaged there. Images that install polkit
without polkit-service then fail in do_rootfs:

  Failed to enable unit: Unit polkit-agent-helper.socket does not exist

Installing polkit-service as well does not help with rpm, as it depends
on polkit, whose postinst then runs before the socket unit is installed.

Only package polkit.service in polkit-service, so the agent helper units
stay in polkit with polkit-agent-helper-1, as FILES:${PN} already
intends.

AI-Generated: Uses Claude Code
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 12:00:52 -07:00
Khem Raj 7a14b1e465 Revert "pipewire: add pw-voiceui SVA voice-UI control/listen client" 
This reverts commit a09474fb9a.

Upstream has rejected this patch [1], it was
added here in hope it will be accepted in pipewire.

[1] https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2969#note_3631852

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Nicolas Dechesne <nicolas.dechesne@oss.qualcomm.com>
Cc: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Cc: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
 2026-10-12 11:51:12 -07:00
Igor Opaniuk eb6f714c6b libzip: drop recipe 
The recipe has been moved to oe-core in commit f17e8750c3 ("libzip:
import recipe from meta-oe").

Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:57 -07:00
Martin Jansa ced616944a Revert "python3-google-api-core, python3-googleapis-common-protos: set PYPI_PACKAGE_SDIST" 
This reverts commit b9cc78ed6b.

The same issue was resolved in:
https://git.openembedded.org/meta-openembedded/diff/meta-python/recipes-devtools/python/python3-google-api-core_2.19.1.bb?id=0a583b35021692dac485c16d85b3f9a9f5601da0
with the only difference of using PYPI_PACKAGE variable
instead of another hardcoded pypi name.

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:57 -07:00
Ankur Tyagi 1c45c216f6 7zip: upgrade 26.03 -> 26.04 
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.04

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 95db044886 open62541: upgrade 1.5.8 -> 1.5.9 
Changelog:
https://github.com/open62541/open62541/releases/tag/v1.5.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 8cd6a6b15a libde265: patch CVE-2026-54240 and CVE-2026-54241 
Debian identified same commit as fix for both CVEs[1][2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241

[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi a1a902b3b9 libde265: patch CVE-2026-49346 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

(cherry picked from commit 4a63a2afa1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 6f9970147f libde265: patch CVE-2026-49337 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337

(cherry picked from commit c83399f83f)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 2bba25a0e6 libde265: patch CVE-2026-49295 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295

(cherry picked from commit bd09bb41b4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:35:56 -07:00
Ankur Tyagi 9b938c1616 tinyproxy: patch CVE-2026-55202 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

(cherry picked from commit 233e6a56e5)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi c3796d630f tinyproxy: patch CVE-2026-54387 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

(cherry picked from commit 33649b0657)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi 568c569c2f tinyproxy: patch CVE-2026-31842 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

(cherry picked from commit 985acd9e7c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:15 -07:00
Ankur Tyagi d015851ed9 libyang: patch CVE-2026-41401 
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

(cherry picked from commit 6b06704ac1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 2c888ebe75 miniupnpd: patch CVE-2026-107159 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 0f8cf2b6f7 libiec61850: mark CVE-2024-45969 patched 
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]

[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7

(cherry picked from commit a7088b0fda)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 796a3d4adb hdf5: patch CVE-2026-19025 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].

[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025

(cherry picked from commit df3f814ab8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 0cdf123177 hdf5: patch CVE-2026-17574 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574

(cherry picked from commit 637f437de9)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 5ac7a070e3 hdf5: patch CVE-2026-17573 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573

(cherry picked from commit f46990293c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi 5468d43cbd hdf5: patch CVE-2026-17572 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572

(cherry picked from commit c279e9e688)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-12 11:26:14 -07:00
Ankur Tyagi ed7807e83b python3-gunicorn: mark CVE-2024-1135 patched 
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 2873762621 wolfssl: mark CVEs patched 
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

(cherry picked from commit c12fcc9b48)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 58ca5eac91 iniparser: mark CVE-2025-0633 pached 
Also mentioned in the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633

[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6

(cherry picked from commit 86fba2b580)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi bef03c1c45 gerbera: ignore CVE-2025-23386 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-23386

This vulnerability is due to openSUSE specific packaging issue.

(cherry picked from commit 369d962967)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 34576300e0 gpm: ignore CVE-2025-4558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-4558

(cherry picked from commit e134adc8f3)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:41 -07:00
Ankur Tyagi 997a8ab5af haveged: ignore CVE-2026-41054 
Debian[1] also confirms the fixed version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41054

[1] https://security-tracker.debian.org/tracker/CVE-2026-41054

(cherry picked from commit 086a780db0)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 0b890c4745 dool: patch CVE-2026-56652 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56652

(cherry picked from commit 53bbf2771b)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 0a807241ff dool: patch CVE-2026-56651 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56651

(cherry picked from commit 2e1445decd)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 567dad7713 bcc: correct CVE_PRODUCT mapping 
Use "iovisor:bpf_compiler_collection", the exact NVD identity for the
https://github.com/iovisor/bcc source.

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 13d46c5cb2 gpsd: patch CVE-2026-58459 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58459

(cherry picked from commit 57e1f7d3d2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi 6ed50c8a2b eject: ignore CVE-2026-28065 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-28065

(cherry picked from commit e6d111c169)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:40 -07:00
Ankur Tyagi ead8f70fa6 dovecot: ignore already fixed CVEs 
Upstream has confirmed that these vulnerabilities are fixed,
and Debian has also identified the relevant commits:

CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028
CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032
CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859
CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851
CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603
CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016
CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020
CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006

(cherry picked from commit 86a9ad852a)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:39 -07:00
Ankur Tyagi 187e2890da civetweb: ignore CVE-2026-5789 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-5789

(cherry picked from commit db080436aa)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:39 -07:00
Ankur Tyagi 52ef4850f4 capnproto: ignore CVE-2026-59704 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59704

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 21:45:39 -07:00
Johannes Schneider 3de9f29b7f imx-cst: restore PKCS#11 signing on OpenSSL 4 via the provider 
0015-fix-openssl-4-engine-api-removal made CST build against OpenSSL 4 by
stubbing out the removed ENGINE API, but left PKCS#11-backed signing broken:
ENGINE_by_id("pkcs11") returns NULL, so engine_ctx_init() fails. Add a patch
that reimplements the pkcs11 certificate and key loading on OSSL_STORE and the
pkcs11 provider (pkcs11-provider), restoring HSM/token-backed signing on
OpenSSL 4. OpenSSL 3 builds are unaffected.

Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Johannes Schneider <johannes.schneider@leica-geosystems.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
 2026-10-11 11:03:51 -07:00