mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-12 15:31:03 +00:00
Code Issues Projects Releases Wiki Activity
38,656 Commits 65 Branches 0 Tags
67bd79fa896ec2d1333709b6151ba730eeca1fef
Commit Graph
38656 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Hetvi Thakar 67bd79fa89 nginx: fix CVE-2026-42945 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/524977e7c534e87e5b55739fa74601c9f1102686
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:40 +05:30
Hetvi Thakar c20a117ce1 nginx: fix CVE-2026-42946 
These patches apply the upstream fix sequence as
referenced in [3], using the commits shown in [1] and [2].

[1] https://github.com/nginx/nginx/commit/baef7fdac28e4e1fe26509b50b8d15603393e28e
[2] https://github.com/nginx/nginx/commit/39d7d0ba0799fcff6baee52b6525f45739593cfd
[3] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:40 +05:30
Hetvi Thakar 3c92a9dd3a nginx: fix CVE-2026-42934 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/nginx/nginx/commit/54b7945961b2eaafc480d6b85d9635d0db1c126a
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:39 +05:30
Hetvi Thakar d023b652ac nginx: Fix CVE-2026-40701 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/nginx/nginx/commit/d2b8d47741820c9fb134c6731ecb40b21f3085b1
[2] https://nginx.org/en/security_advisories.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:39 +05:30
Hetvi Thakar 578ad71dfe wireshark: upgrade 4.6.4 -> 4.6.8 
Upgrade Wireshark to the latest 4.6 stable release. This brings
security and bug fixes from releases 4.6.5 through 4.6.8.

Release notes:
[1] https://www.wireshark.org/docs/relnotes/wireshark-4.6.5.html
[2] https://www.wireshark.org/docs/relnotes/wireshark-4.6.6.html
[3] https://www.wireshark.org/docs/relnotes/wireshark-4.6.7.html
[4] https://www.wireshark.org/docs/relnotes/wireshark-4.6.8.html

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:38 +05:30
Hetvi Thakar 88e41d1f3b python3-pyjwt: fix CVE-2026-101918 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:38 +05:30
Hetvi Thakar f1444be16f python3-pyjwt: fix CVE-2026-102275 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:37 +05:30
Hetvi Thakar 395753da37 python3-pyjwt: fix CVE-2026-101917 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:37 +05:30
Hetvi Thakar 95a0df87a1 python3-pyjwt: fix CVE-2026-102271 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:36 +05:30
Hetvi Thakar 2d80df4fa5 python3-pyjwt: fix CVE-2026-102268 and CVE-2026-102270 
This patch applies the shared upstream fix as referenced in [2] and [3],
using the commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9
[3] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:36 +05:30
Hetvi Thakar 6febd066de python3-pyjwt: fix CVE-2026-102267 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:35 +05:30
Hetvi Thakar fb76c963d9 python3-pyjwt: fix CVE-2026-102269 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:35 +05:30
Hetvi Thakar e93a40cd9d python3-pyjwt: fix CVE-2026-102274 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:34 +05:30
Hetvi Thakar e9ab64a631 python3-pyjwt: fix CVE-2026-103001 
This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35
[2] https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:34 +05:30
Hetvi Thakar 36cb562576 python3-grpcio-tools: set status for CVE-2026-33186 
The vulnerability only affects the Go implementation of the library,
not the Python one. Ignore this CVE due to this.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-33186
https://github.com/advisories/GHSA-p77j-4mvh-x3m3

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:33 +05:30
Hetvi Thakar 594491969e python3-grpcio-tools: set status for CVE-2024-37168 
CVE-2024-37168 affects @grpc/grpc-js, the pure JavaScript
implementation, not the gRPC core code included in grpcio-tools.
Therefore the grpc:grpc CPE association is incorrect.

[1] https://nvd.nist.gov/vuln/detail/CVE-2024-37168

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:32 +05:30
Hetvi Thakar 785cc82130 python3-grpcio-tools: set status for CVE-2023-33953 
CVE-2023-33953 is fixed since 1.56.2 per [1].
FKIE sets "defaultStatus": "unknown" so it needs to be set explicitly.

[1] https://nvd.nist.gov/vuln/detail/CVE-2023-33953

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:32 +05:30
Darsh Kelaiya 5b746f28bb libdbi-perl: fix CVE-2026-73193 
These patches apply the upstream fix as referenced in [2], using the
commit shown in [1]. The STRLEN correction [3] is a separate patch.

[1] https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1
[2] https://access.redhat.com/security/cve/cve-2026-73193
[3] https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:31 +05:30
Darsh Kelaiya 26dc43e3df libdbi-perl: fix CVE-2026-73194 
These patches apply the upstream fix as referenced in [2], using the
commit shown in [1]. The overflow correction [3] and portable 32-bit
regression assertion [4] are separate patches.

[1] https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809
[2] https://access.redhat.com/security/cve/cve-2026-73194
[3] https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712
[4] https://github.com/perl5-dbi/dbi/commit/acc903db3086a737936643a5dbbc0e22f9d5c421

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:31 +05:30
Ankur Tyagi b9bbc9b1d2 postfix: upgrade 3.10.13 -> 3.10.14 
Changelog:
http://www.postfix.org/announcements/postfix-3.11.7.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:30 +05:30
Ankur Tyagi 78ee5c7877 libspdm: upgrade 3.8.2 -> 3.8.3 
Changelog:
https://github.com/DMTF/libspdm/releases/tag/3.8.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:30 +05:30
Ankur Tyagi 6fb9fc9a7c udisks2: patch CVE-2026-7867 
Backport commits from the PR[1].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7867

[1]https://github.com/storaged-project/udisks/pull/1530

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:29 +05:30
Ankur Tyagi 08bb24edb7 tmate: patch CVE-2026-4751 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-4751

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:29 +05:30
Ankur Tyagi 9a4f48d6b0 zeroconf: ignore CVEs 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47180
https://nvd.nist.gov/vuln/detail/cve-2026-47183
https://nvd.nist.gov/vuln/detail/cve-2026-47184
https://nvd.nist.gov/vuln/detail/cve-2026-48045
https://nvd.nist.gov/vuln/detail/cve-2026-48487

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:28 +05:30
Ankur Tyagi 06e4cebb34 tinyproxy: patch CVE-2026-54388 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54388

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:28 +05:30
Ankur Tyagi cb2794d5f8 python3-django: upgrade 6.0.8 -> 6.0.9 
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.9/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c39562d398)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:27 +05:30
Ankur Tyagi 5f28f1b1fa python3-django: upgrade 5.2.17 -> 5.2.18 
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.18/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0640fa901d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:27 +05:30
Ankur Tyagi 2ea8ff2166 python3-tzdata: upgrade 2026.4 -> 2026.5 
Changelog:
https://github.com/python/tzdata/releases/tag/2026.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 01bd918ea8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:26 +05:30
Ankur Tyagi 82049f7938 xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9 
Changelog:
https://github.com/flatpak/xdg-dbus-proxy/blob/0.1.9/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:25 +05:30
Ankur Tyagi 224b39660f apache2: upgrade 2.4.68 -> 2.4.69 
Changelog:
https://downloads.apache.org/httpd/CHANGES_2.4.69
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 12:31:25 +05:30
Ankur Tyagi a3ff185867 python3-werkzeug: upgrade 3.1.8 -> 3.1.9 
Changelog:
https://github.com/pallets/werkzeug/releases/tag/3.1.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:34 +05:30
Ankur Tyagi bd53a33212 python3-sdbus: upgrade 0.14.2 -> 0.14.3 
Changelog:
https://github.com/python-sdbus/python-sdbus/releases/tag/0.14.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9ded29815)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:33 +05:30
Ankur Tyagi 8d48ddc08a swagger-ui: upgrade 5.32.14 -> 5.32.15 
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.32.15

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:33 +05:30
Khem Raj ca1537edf3 srt: Match SRCREV to tag 
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c024e49756)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:32 +05:30
Ankur Tyagi ca6032cca4 srt: upgrade 1.5.6 -> 1.5.7 
Changelog:
https://github.com/Haivision/srt/releases/tag/v1.5.7

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 426b417769)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:32 +05:30
Ankur Tyagi 748bb45c9c znc: upgrade 1.10.2 -> 1.10.3 
Changelog:
https://github.com/znc/znc/blob/znc-1.10.3/ChangeLog.md

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:31 +05:30
Ankur Tyagi 9984c5697d cryptsetup: upgrade 2.8.7 -> 2.8.8 
Changelog:
https://gitlab.com/cryptsetup/cryptsetup/-/blob/v2.8.8/docs/v2.8.8-ReleaseNotes?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-28 11:01:31 +05:30
Ankur Tyagi 1f0c94ec4e squid: upgrade 7.6 -> 7.7 
Also refresh patches for the new version.

Changelog:
https://github.com/squid-cache/squid/blob/SQUID_7_7/ChangeLog

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From meta-oe rev: 1ce2305241)
Fixes CVE-2026-104786 and SQUID-2026:8.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-27 13:38:02 +05:30
Khem Raj 55f12ead36 squid: upgrade 7.5 -> 7.6 
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From meta-oe rev: ed02dad69f)
Fixes CVE-2026-47729, CVE-2026-50012 and CVE-2026-61642.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-27 13:38:01 +05:30
Peter Marko facdbc6acc libwebsockets: patch CVE-2026-78161 
Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-78161

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-27 13:38:01 +05:30
Ankur Tyagi 552db40603 rabbitmq-c: patch CVE-2026-44235 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44235

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-27 13:37:07 +05:30
Anuj Mittal f28a144aa0 vboxguestdrivers: fix vboxvideo build on kernels lacking drm_fb_helper_alloc_info 
Kernel 6.6.151 dropped the drm_fb_helper_alloc_info() declaration as
part of a stable backport, causing vbox_fb.c to fail with:

  vbox_fb.c:336:16: error: implicit declaration of function 'drm_fb_helper_alloc_info'

The existing RTLNX_VER_MIN(6,19,0) check can't express this since the
change landed mid-series in 6.6.y/6.12.y/6.18.y. Backport master
commit b249fbbf1b ("vboxguestdrivers: fix
vboxvideo build on kernels lacking drm_fb_helper_alloc_info"), adapted
for the 7.2.8 recipe (which only carries the RTLNX_VER_MIN(6,19,0)
guard upstream).

(cherry picked from commit 0f00f8b9a2)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 13:52:06 +05:30
Mehmet Fide 98d0cdce96 spidev-test: clean the build dir before configure 
The recipe builds out of tree with O=${B}, and the kernel's tools/build
writes fixdep .cmd files into ${B} that list the compiler's own headers
by absolute path, version included. When the toolchain changes (gcc
13.4 -> 13.5 here) do_compile reruns in the same ${B}, make cannot find
the old prerequisite and stops:

  make[1]: *** No rule to make target '.../recipe-sysroot-native/usr/lib/arm-poky-linux-gnueabi/gcc/arm-poky-linux-gnueabi/13.4.0/include/stddef.h', needed by '.../spidev_test.o'.  Stop.

Empty ${B} before configure, as bpftool does.

Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit bd52d9b479)
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:51:02 +05:30
Peter Marko 6ca6acf7e1 syslog-ng: patch CVE-2026-39879 
Pick patches per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-39879

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:51:01 +05:30
Ankur Tyagi da527bb6ba gpsd: patch CVE-2026-60122 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-60122

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:51:01 +05:30
Jason Schonberg c1e467b895 php: upgrade 8.5.10 -> 8.5.11 
This is a security release.

CVE-2025-1218 CVE-2025-14181
CVE-2026-91765 CVE-2026-91766 CVE-2026-91767 CVE-2026-91768 CVE-2026-91769
CVE-2026-6103 CVE-2026-93682 CVE-2026-92842 CVE-2026-17545

Changelog: https://www.php.net/ChangeLog-8.php#8.5.11
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 38accdd031)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:51:00 +05:30
Ankur Tyagi d1446eb906 freerdp3: patch CVE-2026-85090 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85090

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:51:00 +05:30
Ankur Tyagi 031ea834e5 freerdp3: patch CVE-2026-85089 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-85089

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:50:59 +05:30
Ankur Tyagi 9707f8cea7 python3-tornado: patch CVE-2026-91991 
Backport patch from v6.5.8 matching CVE description.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-91991

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:50:59 +05:30
Ankur Tyagi 7aabebd1f4 python3-tornado: patch CVE-2026-82397 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82397

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
 2026-10-06 09:50:58 +05:30