Commit Graph
40658 Commits
Author SHA1 Message Date
Ankur Tyagi 5a47d11974 tmate: patch CVE-2026-4751
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-4751

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-14 07:59:08 -07:00
Ankur Tyagi 95ac719ca0 udisks2: patch CVE-2026-7867
Backport commits from the PR[1].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7867

[1]https://github.com/storaged-project/udisks/pull/1530

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-14 07:59:08 -07:00
Ankur Tyagi 78a510134e zeroconf: ignore CVEs
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47180
https://nvd.nist.gov/vuln/detail/cve-2026-47183
https://nvd.nist.gov/vuln/detail/cve-2026-47184
https://nvd.nist.gov/vuln/detail/cve-2026-48045
https://nvd.nist.gov/vuln/detail/cve-2026-48487

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-14 07:59:08 -07:00
James Lee cbe28c35b5 mctp: upgrade 2.6 -> 2.7
mctp version 2.7 adds Meson's installation tags to the project, now allowing
binaries to be selectively installed.

Use MESON_INSTALL_TAGS to selectively install files specific to each recipe.
No longer rm in mctpd's do_install step, which was a now-unneeded hack.
Meson tags prevent installation of the extra binaries.

Add mctpd.conf to FILES in the mctpd recipe following its installation to
improve recipe readability.

Signed-off-by: James Lee <james@codeconstruct.com.au>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-14 07:59:07 -07:00
Alex Kiernan 57918219f8 python3-asyncvarlink: upgrade 0.3.2 -> 0.3.3
Alex Kiernan (2):
      VarlinkTransport: stop reading after a failed peek
      VarlinkTransport: treat a failed read as a lost connection

Colin Watson (1):
      types: return NotImplemented from __eq__ for type errors

Helmut Grohne (37):
      varlinkmethod: allow overriding the return type
      reduce contents of the main import and avoid star imports
      CI: tune certification socket timeout
      CI: fixup certification timeout change
      document that it is uploaded to PyPI
      docs/structure.rst: finish truncated paragraph on file descriptors
      pyproject.toml: document development packages
      VarlinkTransport: send correct data on partial send
      validate_interface: fix acceptance of garbage at end
      create_unix_server: actually make the socket non-inheritable
      docs: adapt documentation to pause_reading/resume_reading rename
      __init__.py: improve language of initial __doc__ string
      GenericVarlinkErrorReply: provide a __str__ method
      connect_unix_varlink: fix resource leak in error path
      VarlinkTransport: delay eof_received call
      VarlinkTransport: remember the readable handler function
      VarlinkTransport: turn a magic number into a class attribute
      expand ci coverage to Python 3.15
      VarlinkTransport: fix association of messages and file descriptors
      correctly determine whether typing.override exists
      fix result type of wrapped varlinkmethod
      github: allow manually scheduling workflows
      test_protocol.py: fix missing import
      VarlinkTransport: tighten assertion
      test_protocol.py: close the transport, not the connections
      VarlinkTransport: harden resume_reading against concurrent closing
      TransportTests.test_send_socket: avoid exceptions in callbacks
      VarlinkClientProtocol.call: avoid failing future with no consumers
      test_certification.py: delete unused import
      test_protocol.py: delete unused import again
      tests: add StrictAsyncioTestCase helper class and use it
      tests: another type hint improvement
      test_conversion.py: increase precsion of two type annotations
      varlinkmethod: clarify that the type annotation must signal generators
      add a HACKING.md file clarifying development processes
      add the justfile promised in HACKING.md
      upload to pypi as version 0.3.3

Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 18:57:12 -07:00
Peter Marko c387452547 python3-thrift: upgrade 0.22.0 -> 0.25.0
This upgrade includes fix for 61 CVEs, many of them are for python.
Add a dependency missing at least since 0.20.0 for code:

lib/py/src/server/TProcessPoolServer.py:from multiprocessing import Process, Value, Condition

Release announcement: [1]
Release notes: [2]

[1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy
[2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:07 -07:00
Poornima Lokesh d2aa0f282c mariadb: upgrade 11.4.12 -> 11.4.13
Fixes CVE-2026-107816: an out-of-bounds heap read in the qc_info plugin
when reading information_schema.query_cache_info after caching a query
that contains embedded null bytes, which could disclose adjacent heap
memory or crash the server.

Drop c21bb11be28ae9b2432b2a661bf38a197cf9514d.patch, which is already
included upstream in 11.4.13.

Disable the DuckDB storage engine (new in 11.4.13) via -DPLUGIN_DUCKDB=NO:
it bundles its own CMake subproject that is not cross-compile aware and
fails do_compile in a cross environment.

CVE: CVE-2026-107816
Signed-off-by: Poornima Lokesh <Poornima.Lokesh@windriver.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:07 -07:00
Alex Kiernan cbf3962ed4 python3-yarl: upgrade 1.24.5 -> 1.25.1
aiohttp 3.14.4 requires yarl >= 1.25.1 and imports query_to_pairs,
which 1.24.5 does not have, so importing aiohttp.web fails with:

  ImportError: cannot import name 'query_to_pairs' from 'yarl'

AI-Generated: Claude Opus 5.5 (Claude Code)
Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:07 -07:00
Etienne Cordonnier bce850cb0a uutils-coreutils: improve SUMMARY
The previous SUMMARY could be read as suggesting that this recipe is the
official GNU coreutils project. Reword it to state that uutils is a
separate, Rust reimplementation.

Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:07 -07:00
Leon Anavi cae9015e84 python3-wrapt: Upgrade 2.4.0 -> 2.5.0
Upgrade to release 2.5.0:

- Added with_doc, a decorator for overriding the docstring that
  help(), pydoc and other introspection tools see for a wrapped
  callable without mutating the wrapped function itself. It is the
  companion of with_signature. The docstring can be supplied
  directly, or as a factory callable that derives it from the
  wrapped function at decoration time. When stacked above
  with_signature the factory sees the overridden signature and can
  embed it in the docstring. Assigning to __doc__ on the resulting
  wrapper replaces the override, and deleting it restores
  delegation to the wrapped function. Previously the only option
  was to assign to __doc__ on a wrapper, which writes through to
  the wrapped function since __doc__ on every proxy delegates to
  the wrapped object, and so changed what was reported for the
  wrapped function everywhere. The override is handled for instance
  methods, class methods and static methods, and propagates through
  outer wrapt decorators stacked on top. See the "Docstring
  Override" section of Bundled Decorators for details.
- with_signature now accepts a doc argument for overriding the
  docstring at the same time as the signature, and the factory
  callable may return a tuple of (signature_or_prototype,
  docstring) so that a single factory can derive both from the
  wrapped function in one pass. When doc is supplied, the docstring
  from the tuple is ignored. When neither is given, __doc__
  continues to delegate to the wrapped function as before,
  including for assignment and deletion.
- A class derived from wrapt.BaseObjectProxy may now define __doc__
  as a property, or other descriptor, in its class body, and that
  is used for instances of the class in place of the default
  delegation of __doc__ to the wrapped object. This works with both
  the pure Python implementation and the C extension, and the
  descriptor is inherited by further derived classes. Previously
  the pure Python metaclass overwrote such a descriptor with the
  default delegating property, and the C extension forwarded
  __doc__ to the wrapped object before consulting the type, so it
  was never used. Only __doc__ is affected, with __module__ always
  delegating to the wrapped object. This is the mechanism with_doc
  relies on.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:06 -07:00
Leon Anavi a593dc46ec python3-texttable: Upgrade 1.7.0 -> 1.7.1
Upgrade to release 1.7.1:

- Consume Python 3 row iterators when reading table headers
- Invalidate horizontal lines when characters or widths change

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-13 12:30:06 -07:00
Ankur Tyagi 031bdc4ab3 gpsd: patch CVE-2026-60122
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-60122

(cherry picked from commit da527bb6ba)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:17 -07:00
Ankur Tyagi b9c3d34642 tesseract: patch CVE-2026-88054
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88054

(cherry picked from commit 4c00053135)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:17 -07:00
Ankur Tyagi 4c928862f5 tesseract: patch CVE-2026-88051
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88051

(cherry picked from commit 727354dae2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:17 -07:00
Ankur Tyagi 2ba3ed5dc8 tesseract: patch CVE-2026-88047
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88047

(cherry picked from commit b8fa7aac91)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:16 -07:00
Ankur Tyagi cc2b58f135 tesseract: patch CVE-2026-88050
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88050

(cherry picked from commit 4aab0847c2)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:16 -07:00
Ankur Tyagi 909d433ca0 tesseract: patch CVE-2026-88049
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88049

(cherry picked from commit 218b6a19b1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:16 -07:00
Ankur Tyagi 0aa1782e95 tesseract: patch CVE-2026-88048
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88048

(cherry picked from commit 9e544d6e50)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:15 -07:00
Ankur Tyagi 8ee82e432c tesseract: patch CVE-2026-88052
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88052

(cherry picked from commit 251dd7f80d)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:15 -07:00
Ankur Tyagi bf39596278 strongwan: upgrade 6.0.7 -> 6.1.0
- Remove PACKAGECONFIG entries for soup, tnc-ifmap, tnccs-11, tnccs-dynamic
- Include xauth-generic in default PACKAGECONFIG. This preserves default
  plugin as upstream disabled IKEv1 by default.

root@qemux86-64:~# swanctl --stats
uptime: 38 seconds, since Oct 13 03:27:29 2026
worker threads: 16 total, 11 idle, working: 4/0/1/0
job queues: 0/0/0/0
jobs scheduled: 0
IKE_SAs: 0 total, 0 half-open
mallinfo: sbrk 1503232, mmap 0, used 552176, free 951056
loaded plugins: charon-systemd random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pgp dnskey sshkey pem openssl pkcs8 xcbc cmac kdf drbg curl sqlite attr kernel-netlink resolve socket-default vici updown xauth-generic

Changelog:
https://github.com/strongswan/strongswan/releases/tag/6.1.0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:15 -07:00
Ankur Tyagi 30acdca706 sngrep: patch CVE-2026-90558
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90558

(cherry picked from commit 36ddee53b1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:15 -07:00
Ankur Tyagi ba9537ae1f ntopng: patch CVE-2026-86090 and CVE-2026-86091
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091

(cherry picked from commit ae180302f4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:14 -07:00
Ankur Tyagi 4e8a7265bd ntopng: patch CVE-2026-84990
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990

(cherry picked from commit 2d932fa4e3)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:14 -07:00
Ankur Tyagi df5f8478c4 smarty: mark CVE-2026-82531 patched
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:14 -07:00
Ankur Tyagi c8dd8428d0 cjson: patch CVE-2026-87933
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

(cherry picked from commit 2b3f5cbbd8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:13 -07:00
Ankur Tyagi 96cedce046 python3-eventlet: mark CVE-2023-29483 fixed
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

(cherry picked from commit 47b2ce9cc7)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:13 -07:00
Ankur Tyagi 896ea53058 openvpn: upgrade 2.7.7 -> 2.7.8
Changelog:
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 21:57:12 -07:00
Peter Marko 53ffd4623b thrift: upgrade 0.24.0 -> 0.25.0
This upgrade includes fix for 61 CVEs.
Refreshed/removed patches via devtool.

Release announcement: [1]
Release notes: [2]

[1] https://lists.apache.org/thread/prryfzdozvt6t02c9k5jf46or3m7ctzy
[2] https://github.com/apache/thrift/blob/v0.25.0/CHANGES.md

License-Update: Added notice for MIT license of a Makefile

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 14:20:30 -07:00
Ricardo Salveti b2486769a3 polkit: keep the agent helper units in the main package
Commit 3e423e21e5 ("polkit: enable the agent helper socket") enables
polkit-agent-helper.socket from polkit, but since 03420389ca ("polkit:
Add a separate package for polkit systemd service/dbus config")
polkit-service comes first in PACKAGES and takes the whole systemd unit
directory, so the socket is packaged there. Images that install polkit
without polkit-service then fail in do_rootfs:

  Failed to enable unit: Unit polkit-agent-helper.socket does not exist

Installing polkit-service as well does not help with rpm, as it depends
on polkit, whose postinst then runs before the socket unit is installed.

Only package polkit.service in polkit-service, so the agent helper units
stay in polkit with polkit-agent-helper-1, as FILES:${PN} already
intends.

AI-Generated: Uses Claude Code
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 12:00:52 -07:00
Khem Raj 7a14b1e465 Revert "pipewire: add pw-voiceui SVA voice-UI control/listen client"
This reverts commit a09474fb9a.

Upstream has rejected this patch [1], it was
added here in hope it will be accepted in pipewire.

[1] https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2969#note_3631852

Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Nicolas Dechesne <nicolas.dechesne@oss.qualcomm.com>
Cc: Kiruthika Vijayasekar <kvijayas@qti.qualcomm.com>
Cc: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
2026-10-12 11:51:12 -07:00
Igor Opaniuk eb6f714c6b libzip: drop recipe
The recipe has been moved to oe-core in commit f17e8750c3 ("libzip:
import recipe from meta-oe").

Signed-off-by: Igor Opaniuk <igor.opaniuk@oss.qualcomm.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:57 -07:00
Martin Jansa ced616944a Revert "python3-google-api-core, python3-googleapis-common-protos: set PYPI_PACKAGE_SDIST"
This reverts commit b9cc78ed6b.

The same issue was resolved in:
https://git.openembedded.org/meta-openembedded/diff/meta-python/recipes-devtools/python/python3-google-api-core_2.19.1.bb?id=0a583b35021692dac485c16d85b3f9a9f5601da0
with the only difference of using PYPI_PACKAGE variable
instead of another hardcoded pypi name.

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:57 -07:00
Ankur Tyagi 1c45c216f6 7zip: upgrade 26.03 -> 26.04
Changelog:
https://github.com/ip7z/7zip/releases/tag/26.04

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi 95db044886 open62541: upgrade 1.5.8 -> 1.5.9
Changelog:
https://github.com/open62541/open62541/releases/tag/v1.5.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi 8cd6a6b15a libde265: patch CVE-2026-54240 and CVE-2026-54241
Debian identified same commit as fix for both CVEs[1][2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241

[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi a1a902b3b9 libde265: patch CVE-2026-49346
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

(cherry picked from commit 4a63a2afa1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi 6f9970147f libde265: patch CVE-2026-49337
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337

(cherry picked from commit c83399f83f)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi 2bba25a0e6 libde265: patch CVE-2026-49295
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295

(cherry picked from commit bd09bb41b4)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:35:56 -07:00
Ankur Tyagi 9b938c1616 tinyproxy: patch CVE-2026-55202
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

(cherry picked from commit 233e6a56e5)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:15 -07:00
Ankur Tyagi c3796d630f tinyproxy: patch CVE-2026-54387
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

(cherry picked from commit 33649b0657)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:15 -07:00
Ankur Tyagi 568c569c2f tinyproxy: patch CVE-2026-31842
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

(cherry picked from commit 985acd9e7c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:15 -07:00
Ankur Tyagi d015851ed9 libyang: patch CVE-2026-41401
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

(cherry picked from commit 6b06704ac1)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:14 -07:00
Ankur Tyagi 2c888ebe75 miniupnpd: patch CVE-2026-107159
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:14 -07:00
Ankur Tyagi 0f8cf2b6f7 libiec61850: mark CVE-2024-45969 patched
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]

[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7

(cherry picked from commit a7088b0fda)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:14 -07:00
Ankur Tyagi 796a3d4adb hdf5: patch CVE-2026-19025
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].

[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025

(cherry picked from commit df3f814ab8)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:14 -07:00
Ankur Tyagi 0cdf123177 hdf5: patch CVE-2026-17574
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574

(cherry picked from commit 637f437de9)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:14 -07:00
Ankur Tyagi 5ac7a070e3 hdf5: patch CVE-2026-17573
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573

(cherry picked from commit f46990293c)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:14 -07:00
Ankur Tyagi 5468d43cbd hdf5: patch CVE-2026-17572
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572

(cherry picked from commit c279e9e688)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-12 11:26:14 -07:00
Ankur Tyagi ed7807e83b python3-gunicorn: mark CVE-2024-1135 patched
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-11 21:45:41 -07:00
Ankur Tyagi 2873762621 wolfssl: mark CVEs patched
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

(cherry picked from commit c12fcc9b48)

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
2026-10-11 21:45:41 -07:00