Commit Graph

30852 Commits

Author SHA1 Message Date
Gyorgy Sarvari baf3635c7d apache2: ignore irrelevant CVEs
Ignore a number of CVEs for this recipe (because they are for another software,
outdated version, or because they affect only non-Linux platforms). This commit
is a backport of a number of commits from the master branch (which uses the same
version of the recipe):

0e7733f1b8
1b86a60f62
59d3949e3e
1b86a60f62
da2b5e8b93
0e7733f1b8

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:10:21 +08:00
Peter Marko 1c7b78eb6c ace: ignore CVE-2009-1147
This CVE is for vmware ace.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:09:45 +08:00
Changqing Li 9da44cc133 mariadb: correct STACK_DIRECTION setting
STACK_DIRECTION = 1 means stack grow upwards
STACK_DIRECTION = -1 means stack grow downwards

In the majority of modern architectures, stack grows downwards. So set
STACK_DIRECTION = 1 is not right. But the failure is not exposed before,
mysqld can start normally, and simple runtime operation like create db,
table, select info, works well. But it is exposed after commit [1] is
merged, mysqld will start failed with error:
2025-02-12  3:18:19 0 [ERROR] Could not open mysql.plugin table: "Thread stack overrun:  16752824 bytes used of a 299008 byte stack, and 81920 bytes needed

Since commit [2], mariadb started to determine the default
STACK_DIRECTION in CMake based on the ISA, and we have set correct
CMAKE_SYSTEM_PROCESSOR in cmake.bbclass, so just don't pass it.

[1] https://github.com/MariaDB/server/commit/bddbef3573349b0565c43c27beba47c89358f39f
[2] https://github.com/MariaDB/server/commit/d0abbdf56e11ccc88447c1dc80caaf355c94be3b
[3] https://jira.mariadb.org/browse/MDEV-36051

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cdd8b41d6e)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:08:57 +08:00
Adrian Freihofer 1dfa9a4db6 thrift: fix build with gcc 15
Cherry-pick a patch adding missing cstdint include for int64_t in
Mutex.h

Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:08:31 +08:00
mark.yang 92b5724cef srecord: fix build failure with gcc-15
srecord/input/file/hp64k.h:82:21: error: ‘uint16_t’ has not been declared
   82 |     bool read_u16be(uint16_t *dest);
      |                     ^~~~~~~~
/home/abuild/rpmbuild/BUILD/srecord-1.65.0-build/srecord-1.65.0-Source/./srecord/input/file/hp64k.h:1:1: note: ‘uint16_t’ is defined in header ‘<cstdint>’; this is probably fixable by adding ‘#include <cstdint>’
  +++ |+#include <cstdint>
    1 | //
make[2]: *** [srecord/CMakeFiles/lib_srecord.dir/build.make:222: srecord/CMakeFiles/lib_srecord.dir/arglex/tool/input.cc.o] Error 1

    * From gcc 13, cstdint header must be explicitly included for uint_X data types.
    * See also: https://gcc.gnu.org/gcc-13/porting_to.html#header-dep-changes

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:08:10 +08:00
Saravanan e6df081618 udisks2: upgrade 2.10.1 -> 2.10.2
This patch addresses below CVE's:
CVE-2025-6019
CVE-2025-8067

Changelog:
https://github.com/storaged-project/udisks/releases

Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:06:34 +08:00
Grygorii Tertychnyi 177686278f libusbgx: fix gadget-stop install
It was by mistake installed gadget-start instead.

Signed-off-by: Grygorii Tertychnyi <grembeter@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b8e970395e)
Signed-off-by: Kurt Kiefer <kekiefer@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:06:21 +08:00
Gyorgy Sarvari a4f61ba2e0 collectd: set working SRC_URI
The project started to outsource the source hosting to Google storage
and Github.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:06:17 +08:00
hongxu e9dc408e74 indent: fix CVE-2024-0911
Backport a fix from upstream to resolve CVE-2024-0911

  https://git.savannah.gnu.org/git/indent.git feb2b646e6c3a05018e132515c5eda98ca13d50d

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 26ef6a9c2d)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:05:53 +08:00
Yogita Urade d181391f33 indent: fix CVE-2023-40305
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace
in indent.c via a crafted file.

Reference:
https://savannah.gnu.org/bugs/index.php?64503

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 7da6cb848b)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:05:53 +08:00
Gyorgy Sarvari 00a0fcfd72 psqlodbc: set valid SRC_URI
The old URI stopped working.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:05:46 +08:00
Jeroen Hofstee 49db959f00 nodejs: ignore CVE-2024-3566
CVE-2024-3566 only effects Microsoft Windows.

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:05:40 +08:00
Jeroen Hofstee 0b7b87ad31 php: ignore CVE-2024-3566
CVE-2024-3566 only effects Microsoft Windows.

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d68c56e1ed)
Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:05:40 +08:00
Gyorgy Sarvari 8659bf94b0 mosh: set working SRC_URI
The project switched to storing their releases on Github, and
the original links stopped working.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:05:36 +08:00
Praveen Kumar 0d88144a27 polkit: fix CVE-2025-7519
A flaw was found in polkit. When processing an XML policy with 32 or
more nested elements in depth, an out-of-bounds write can be triggered.
This issue can lead to a crash or other unexpected behavior, and
arbitrary code execution is not discarded. To exploit this flaw, a
high-privilege account is needed as it's required to place the
malicious policy file properly.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-7519

Upstream-patch:
https://github.com/polkit-org/polkit/commit/107d3801361b9f9084f78710178e683391f1d245

Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 16:00:16 +08:00
Sunil Dora 8b5cb4ee98 layer.conf: add bpftrace to NON_MULTILIB_RECIPES
bpftrace need line up with kernel architecture type,
so add it to NON_MULTILIB_RECIPES.

bpftrace must be built with the same architecture (32-bit/64-bit) as the kernel
to ensure compatibility when tracing kernel functions and using eBPF features.

Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f8498f2699)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-10-06 15:59:57 +08:00
Wang Mingyu e621da9470 procmail: Add -Wno-implicit-int to fix error of do_compile
Without the option -Wno-implicit-int , the following error will occur and the command  procmail will not be installed to target.
lmtp.c:54:8: error: type defaults to 'int' in declaration of 'ctopfd' [-Wimplicit-int]
   54 | static ctopfd;
      |        ^~~~~~
make[1]: [Makefile:239: lmtp.o] Error 1 (ignored)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d23de74dc8)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 10:04:48 +08:00
Khem Raj ac273bd3e1 procmail: Fix build with GCC-14
aids building on newer build hosts which now have moved to gcc-14
as well, so using cmdline option just for target compile is not
enough as it runs tests using host compiler as well

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6d13c58e38)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 10:04:31 +08:00
Peter Marko 2565b54cc3 procmail: patch CVE-2017-16844.
Take patch from Debian.
https://sources.debian.org/data/main/p/procmail/3.22-26%2Bdeb10u1/debian/patches/30

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 3d97f4c13d)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 10:04:24 +08:00
Peter Marko 1bb9a6ca07 procmail: patch CVE-2014-3618
Take patch from Debian.
https://sources.debian.org/data/main/p/procmail/3.22-20%2Bdeb7u1/debian/patches/CVE-2014-3618.patch

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8378820dab)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 10:03:57 +08:00
Wang Mingyu 3528b77492 procmail: fix build failure with gcc-14
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a7d9829277)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 10:00:35 +08:00
Khem Raj b57123a090 ckermit: Fix build with GCC-15
Also fix native pieces to build with gcc-14 while here

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f8ece969ea)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 09:59:12 +08:00
Khem Raj 8e13509610 ckermit: Define return type for main
Newer compilers e.g. clang19+ will treat implicit function prototypes
as errors, therefore define main() with a valid return type

Fixes
ckwart.c:531:1: error: return type defaults to ‘int’ [-Wimplicit-int]
  531 | main(argc,argv) int argc; char **argv; {
      | ^~~~

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9813fb56d2)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 09:59:08 +08:00
Khem Raj 9c3d2c86b2 enca: Fix cross builds
Some portions are built using host CC, which
is important when doing cross compile to pass correct flags
otherwise it fails when using newer host compiler e.g. gcc-14

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 32eb262643)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-24 09:56:49 +08:00
Khem Raj adcb6e9841 ssmping: Use debian mirror for SRC_URI
Original URI is not accessible anymore
Drop md5sum

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ceb9160341)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:15 +08:00
Gyorgy Sarvari 293446bfa9 mod-dnssd: update SRC_URI
Upstream repository url changed.

Fixes unsuccessful fetch warning.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 10c13bf1fb)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:15 +08:00
Wang Mingyu 9a3078e6fe rp-pppoe: update SRC_URI
Upstream repository url changed.

Fixes unsuccessful fetch warning.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c400aca52a)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:15 +08:00
Jeroen Knoops 429e7401a2 nng: Rename default branch of github.com:nanomsg/nng.git
Default branch is renamed from `master` to `main`. Commitshas are the
same.

Signed-off-by: Jeroen Knoops <jeroen.knoops@philips.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 58679b6a51)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:14 +08:00
Wang Mingyu 371879bee7 geoip: fix do_fetch error
Change the SRC_URI to the correct value due to the following error:
ERROR: geoip-1.6.12-r0 do_fetch: Bitbake Fetcher Error: FetchError('Unable to fetch URL from any source.', 'http://sources.openembedded.org/GeoIP.dat.20181205.gz;apply=no;name=GeoIP-dat;')

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit aadc2ac9dc)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:14 +08:00
Khem Raj c5e3b885f2 gtkwave: Add libtirpc to depends
It was missing as the recipe is using --with-tirpc

Signed-off-by: Khem Raj <raj.khem@gmail.com>

Adapted for Walnascar
Signed-off-by: Gyorgy Sarvari <gyorgy.sarvari@gmail.com>
(cherry picked from commit 8832aa3ca8)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:14 +08:00
Marc Ferland a05db3fd5c libvncserver: fix generated LibVNCServerTargets.cmake
The currently generated LibVNCServerTargets.cmake will include the
following 'set_target_properties':

    set_target_properties(LibVNCServer::vncclient PROPERTIES
      INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
      INTERFACE_LINK_LIBRARIES "systemd;/usr/lib/libz.so;/usr/lib/liblzo2.so;/usr/lib/libjpeg.so;/usr/lib/libgcrypt.so;/usr/lib/libgnutls.so"
    )

INTERFACE_LINK_LIBRARIES here points to absolute paths which hardcodes
the library paths. From CMake doc [1]:

    Note that it is not advisable to populate the INTERFACE_LINK_LIBRARIES
    of a target with absolute paths to dependencies. That would hard-code
    into installed packages the library file paths for dependencies as
    found on the machine the package was made on.

This breaks krfb build (kde desktop sharing server) since CMake cannot
find these libraries. Removing the absolute paths solves the issue.

Note: I also added a 'inherit pkgconfig' since libvncserver uses it to
detect libsystemd presence.

1: https://cmake.org/cmake/help/latest/prop_tgt/INTERFACE_LINK_LIBRARIES.html

Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2156942867)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:13 +08:00
Jef Driesen fd29867987 lcov: Add missing RDEPENDS for nativesdk
When building an SDK with lcov included, gcov isn't included in the SDK
by default. Running lcov to generate coverage fails, because it tries to
use the gcov binary from the host system instead and that cause problems
if the gcc versions do not match.

Signed-off-by: Jef Driesen <jefdriesen@telenet.be>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
(cherry picked from commit 0cd6283a41)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:13 +08:00
Peter Marko 2392237655 fcgi: patch CVE-2025-23016
Pick commit referencing this CVE.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
(cherry picked from commit 6e86e0dd54)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:13 +08:00
Peter Marko 06a0862287 fontforge: patch CVE-2024-25081 and CVE-2024-25082
Pick commit from PR [1] linked from [2] and [3] which mlso entions both
these CVEs.

[1] https://github.com/fontforge/fontforge/pull/5367
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-25081
[3] https://nvd.nist.gov/vuln/detail/CVE-2024-25082

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
(cherry picked from commit 1e6dbd183b)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:12 +08:00
Hitendra Prajapati e930b71d14 openjpeg: fix for CVE-2025-54874
Upstream-Status: Backport https://github.com/uclouvain/openjpeg/commit/f809b80c67717c152a5ad30bf06774f00da4fd2d

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
(cherry picked from commit 5d0643f194)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 16:30:12 +08:00
Shubham Pushpkar d9e2cae64f cjson 1.7.18: Fix CVE-2025-57052
Upstream Repository: https://github.com/DaveGamble/cJSON.git

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-57052
Type: Security Fix
CVE: CVE-2025-57052
Score: 9.8
Patch: https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa

Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:16:33 +08:00
Archana Polampalli a5de2a5728 apache2: upgrade 2.4.64 - 2.4.65
fixes CVE-2025-54090

Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.65

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:09:56 +08:00
Anil Dongare 49aa81f2d5 libssh 0.10.6: Fix CVE-2025-8114
Upstream Repository: https://git.libssh.org/projects/libssh.git/

Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-8114
Type: Security Fix
CVE: CVE-2025-8114
Score: 4.7
Patch: https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:08:04 +08:00
AshishKumar Mishra 385b1baa2b meta-oe: image: optionally remove RAW image after sparse image creation
When creating sparse images, the RAW image is no longer needed in
some workflows such as Android and CI pipelines. These RAW images
can be multi-GB artifacts and consume significant disk space.

This change introduces a configuration option
`DELETE_RAWIMAGE_AFTER_SPARSE_CMD` which, when set to "1",
removes the RAW image after sparse image generation.

This reduces disk usage in builds where sparse images are the
final deliverables and RAW images are not required.

Default behavior is unchanged: RAW images are kept unless the
variable is explicitly enabled:

    DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "1"   # Delete RAW image
    DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "0"   # Default behavior

(cherry-picked from f5246b7df4 in master )

Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:08:04 +08:00
Zoltán Böszörményi 5856e22d34 gutenprint: 5.3.5
This fixes an installation error:

| make[5]: Entering directory '.../tmp/work/corei7-64-oe-linux/gutenprint/5.3.4/build/src/cups'
| chmod 700 .../tmp/work/corei7-64-oe-linux/gutenprint/5.3.4/image/usr/libexec/cups/backend/backend_gutenprint
| chmod: cannot access '.../tmp/work/corei7-64-oe-linux/gutenprint/5.3.4/image/usr/libexec/cups/backend/backend_gutenprint': No such file or directory

Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:08:00 +08:00
Yoann Congal c85ecb6a43 gutenprint: fix a build race-condition
Gutenprint install hooks run in parallel but depend on each other. This
is a race condition and might trigger a build failure (e.g on AB [0]):
| chmod 700 $WORKDIR/image/usr/libexec/cups/backend/backend_gutenprint
| chmod: cannot access '$WORKDIR/image/usr/libexec/cups/backend/backend_gutenprint': Not a directory
| make[5]: *** [Makefile:2166: install-exec-hook] Error 1

Fixes this by adding an explicit dependency between the dependent
targets.

[0]: https://autobuilder.yoctoproject.org/valkyrie/#/builders/87/builds/46/steps/33/logs/stdio

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:02:51 +08:00
Zhang Peng 95f7aea47c wxwidgets: fix CVE-2024-58249
CVE-2024-58249:
In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-58249]

Upstream patches:
[https://github.com/wxWidgets/wxWidgets/commit/f2918a9ac823074901ce27de939baa57788beb3d]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>

(walnascar rev: d3d3df49d5)
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:02:32 +08:00
Yi Zhao 8bdec6baaa wxwidgets: upgrade 3.2.1 -> 3.2.6
ChangeLog:
https://raw.githubusercontent.com/wxWidgets/wxWidgets/v3.2.6/docs/changes.txt

* Drop 0001-locale-Avoid-using-glibc-specific-defines-on-musl.patch as
  it has been merged upstream
* Refresh patches
* Add UPSTREAM_CHECK_GITTAGREGEX

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>

(master rev: 903ed68669)
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:02:32 +08:00
Haixiao Yan 40db628f58 python3-posix-ipc: fix runtime error
Fix follow runtime error: ./build_support/src/sniff_mq_prio_max:
/lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by
./build_support/src/sniff_mq_prio_max)

Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:01:46 +08:00
Zhang Peng 92730597e9 iperf3: fix CVE-2025-54350
CVE-2025-54350:
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion
failure and application exit upon a malformed authentication attempt.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2025-54350]

Upstream patches:
[https://github.com/esnet/iperf/commit/4eab661da0bbaac04493fa40164e928c6df7934a]

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 10:00:37 +08:00
Martin Jansa db93848ead nodejs: fix build with gcc-15 on host
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 09:59:39 +08:00
Divya Chellam 3702195a7e libssh: fix CVE-2025-5987
A flaw was found in libssh when using the ChaCha20 cipher with the
OpenSSL library. If an attacker manages to exhaust the heap space,
this error is not detected and may lead to libssh using a partially
initialized cipher context. This occurs because the OpenSSL error
code returned aliases with the SSH_OK code, resulting in libssh not
properly detecting the error returned by the OpenSSL library.
This issue can lead to undefined behavior, including compromised
data confidentiality and integrity or crashes.

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-5987

Upstream-patch:
https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=90b4845e0c98574bbf7bea9e97796695f064bf57

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 09:59:05 +08:00
Divya Chellam 71b601e3d7 libssh: fix CVE-2025-4878
A vulnerability was found in libssh, where an uninitialized variable
exists under certain conditions in the privatekey_from_file() function.
This flaw can be triggered if the file specified by the filename doesn't
exist and may lead to possible signing failures or heap corruption.

Reference:
https://security-tracker.debian.org/tracker/CVE-2025-4878

Upstream-patches:
https://git.libssh.org/projects/libssh.git/commit/?id=697650caa97eaf7623924c75f9fcfec6dd423cd1
https://git.libssh.org/projects/libssh.git/commit/?id=b35ee876adc92a208d47194772e99f9c71e0bedb

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-23 09:57:53 +08:00
Deepak Rathore b9fb6556a3 protobuf 4.25.8: Mark CVE-2024-7254 as patched
Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2024-7254
Type: Security Fix
CVE: CVE-2024-7254
Score: 8.7
Patch: https://github.com/protocolbuffers/protobuf/commit/850fcce9176e

Analysis:
The original fix [1] for CVE-2024-7254 is listed in the NVD security
tracker (https://nvd.nist.gov/vuln/detail/CVE-2024-7254) and was
subsequently backported to the v4.25.8 version via commit [2].
Hence, this CVE is considered patched in the current source.

Reference:
[1] https://github.com/protocolbuffers/protobuf/commit/cc8b3483a558
[2] https://github.com/protocolbuffers/protobuf/commit/850fcce9176e (v4.25.8)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-12 08:15:13 +08:00
Martin Schwan 10fc221938 linuxptp: Add systemd instance specifier for ptp4l dependency
Add the instance specifier to the ptp4l dependency for the phc2sys
service, so the corresponding service is automatically started
correctly. This fixes the following error messages, when starting the
phc2sys@... service:

    Failed to restart phc2sys@eth0.service: Unit ptp4l.service not found.

Signed-off-by: Martin Schwan <m.schwan@phytec.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 31f0b9d3d5)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2025-09-12 08:15:13 +08:00