mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-12 15:31:03 +00:00
Code Issues Projects Releases Wiki Activity
40,622 Commits 65 Branches 0 Tags
f12cb02421808001add080bae2e7eaeebe68ca8a
Commit Graph
40622 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Ankur Tyagi f12cb02421 strongswan: patch CVE-2026-78134 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78134

[1]https://download.strongswan.org/security/CVE-2026-78134/strongswan-5.9.10-6.0.7_eap_inner_auth_cfg.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2352f80100)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 991006d982 strongswan: patch CVE-2026-78135 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78135

[1]https://download.strongswan.org/security/CVE-2026-78135/strongswan-5.9.7-6.0.7_early_create_child_sa.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9b02fe4850)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 2afc7f40c8 strongswan: patch CVE-2026-78132 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78132

[1]https://download.strongswan.org/security/CVE-2026-78132/strongswan-5.1.3-6.0.7_x509_ac_ietfattr_loop.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit dd3053a1a3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 359b6fb067 strongswan: patch CVE-2026-78130 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78130

[1]https://download.strongswan.org/security/CVE-2026-78130/strongswan-5.1.3-6.0.7_x509_ac_issuer_null.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78130).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit d831ff4ac9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi fd21700848 strongswan: patch CVE-2026-78131 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78131

[1]https://download.strongswan.org/security/CVE-2026-78131/strongswan-5.5.3-6.0.7_x509_ac_leaks.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78131).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 41cb8cca46)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 036fde2bb0 strongswan: patch CVE-2026-78133 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78133

[1]https://download.strongswan.org/security/CVE-2026-78133/strongswan-6.0.0-6.0.7_ikev2_rekey_collision.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78133).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 7a55891633)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 7004be1e63 strongswan: patch CVE-2026-78129 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78129

[1]https://download.strongswan.org/security/CVE-2026-78129/strongswan-5.6.3-6.0.7_pkcs5_params_dos.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78129).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9ea8363e30)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 22d52d3b42 strongswan: patch CVE-2026-78127 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78127

[1]https://download.strongswan.org/security/CVE-2026-78127/strongswan-5.3.1-6.0.7_message_log_leak.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 7b8fd4df2e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 9b00eaf6ee strongswan: patch CVE-2026-78126 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78126

[1]https://download.strongswan.org/security/CVE-2026-78126/strongswan-4.4.0-6.0.7_eap_aka_sync_fail.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78126).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit e228e7711e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi a6397902ba strongswan: patch CVE-2026-78124 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78124

[1]https://download.strongswan.org/security/CVE-2026-78124/strongswan-5.0.2-6.0.7_openssl_pkcs7_certs_leak.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit dd0ba33ed2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 8ccc60a8be strongswan: patch CVE-2026-78123 
Use patch[1] provided by strongSwan[2]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78123

[1]https://download.strongswan.org/security/CVE-2026-78123/strongswan-5.0.2-6.0.7_openssl_pkcs7_info_init.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78123).html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit aa064e512a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi a369135b46 sngrep: patch CVE-2026-90558 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90558

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 36ddee53b1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 8527b6772d ntopng: patch CVE-2026-86090 and CVE-2026-86091 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit ae180302f4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 151f9c3204 ntopng: patch CVE-2026-84990 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2d932fa4e3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 95be90acc0 smarty: mark CVE-2026-82531 patched 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 1964bbc475 cjson: patch CVE-2026-87933 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2b3f5cbbd8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 183033afe8 python3-eventlet: mark CVE-2023-29483 fixed 
Fix[1] for the CVE is part of the upstream version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483

[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 47b2ce9cc7)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 6df0b8c576 openvpn: patch CVE-2026-84790 
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

[1]https://security-tracker.debian.org/tracker/CVE-2026-84790

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 7bd75dc53f openvpn: patch CVE-2026-88964 
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8

[1]https://security-tracker.debian.org/tracker/CVE-2026-88964

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 2f0a62d30c openvpn: ignore CVE-2026-84256 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84256

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 21:32:54 +13:00
Ankur Tyagi 41441be1ce swagger-ui: upgrade 5.33.0 -> 5.33.1 
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.1

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 50c590bebc)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 15b8501f24 python3-zeroconf: upgrade 0.151.3 -> 0.151.5 
Changelog:
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.4
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 92fff73409)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi ff9a42b633 python3-werkzeug: upgrade 3.1.8 -> 3.1.9 
Changelog:
https://github.com/pallets/werkzeug/releases/tag/3.1.9

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0d101e1633)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi e56c9807f2 python3-tzdata: upgrade 2026.4 -> 2026.5 
Changelog:
https://github.com/python/tzdata/releases/tag/2026.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 01bd918ea8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 962410d82f python3-django: upgrade 5.2.17 -> 5.2.18 
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.18/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0640fa901d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi e987e0bfde python3-django: upgrade 6.0.8 -> 6.0.9 
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.9/

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c39562d398)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 783752d9f0 python3-astroid: upgrade 4.3.2 -> 4.3.3 
Changelog:
https://github.com/pylint-dev/astroid/releases/tag/v4.3.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 486ef820db)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 9c7e3a2ba9 smarty: upgrade 5.8.4 -> 5.8.5 
Changelog:
https://github.com/smarty-php/smarty/releases/tag/v5.8.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3fe4c22474)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 48393460ad pgpool2: upgrade 4.7.2 -> 4.7.3 
Changelog:
https://www.pgpool.net/docs/latest/en/html/release-4-7-3.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 192d012d9a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 359cbb2b7d python3-gunicorn: mark CVE-2024-1135 patched 
Debian[1] also identified the commit.

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135

[1]https://security-tracker.debian.org/tracker/CVE-2024-1135

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi d7ca8eef26 wolfssl: mark CVEs patched 
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814

[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c12fcc9b48)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 7c8cd0805f tinyproxy: patch CVE-2026-55202 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202

[1]https://security-tracker.debian.org/tracker/CVE-2026-55202

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 233e6a56e5)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 1247ca6a89 tinyproxy: patch CVE-2026-54387 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387

[1]https://security-tracker.debian.org/tracker/CVE-2026-54387

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 33649b0657)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 53ec96a06c tinyproxy: patch CVE-2026-31842 
Backport commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842

[1]https://security-tracker.debian.org/tracker/CVE-2026-31842

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 985acd9e7c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi c829548246 libyang: patch CVE-2026-41401 
Backport patch identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401

[1]https://security-tracker.debian.org/tracker/CVE-2026-41401

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6b06704ac1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 25ed071362 miniupnpd: patch CVE-2026-107159 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi dc56cbbc02 libssh: ignore CVE-2026-59851 
GSSAPI Key Exchange was introduced in v0.12.0[1].
Debian also confirmed the same[2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59851

[1]https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.12.0
[2]https://security-tracker.debian.org/tracker/CVE-2026-59851

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 26f0474644 libssh: mark CVEs patched 
Changelog[1] also confirms the fix.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59843
https://nvd.nist.gov/vuln/detail/cve-2026-59844
https://nvd.nist.gov/vuln/detail/cve-2026-59845
https://nvd.nist.gov/vuln/detail/cve-2026-59846
https://nvd.nist.gov/vuln/detail/cve-2026-59848
https://nvd.nist.gov/vuln/detail/cve-2026-59850

[1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi d1b13ec2ac libssh: ignore CVE-2025-14821 
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14821

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6541aefe60)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 5a964c11f8 libnfs: patch CVE-2026-57918 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57918

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit bb3f5628f1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 8abdf08b09 libnfs: patch CVE-2026-53689 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53689

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6ace2f0b5e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 15d002f266 libiec61850: mark CVE-2024-45969 patched 
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]

[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit a7088b0fda)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 1dac3dca9d jq: ignore already fixed CVEs 
All these CVEs are already fixed in the recipe version[1].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-33948
https://nvd.nist.gov/vuln/detail/cve-2026-39979
https://nvd.nist.gov/vuln/detail/cve-2026-40164
https://nvd.nist.gov/vuln/detail/cve-2026-44777

[1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi a7b6f19ac6 iniparser: mark CVE-2025-0633 pached 
Also mentioned in the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633

[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 86fba2b580)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 38078503c1 hdf5: patch CVE-2026-19025 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].

[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit df3f814ab8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 20416114de hdf5: patch CVE-2026-17574 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 637f437de9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi a0cb67f356 hdf5: patch CVE-2026-17573 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit f46990293c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi f449fa597a hdf5: patch CVE-2026-17572 
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.

[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c279e9e688)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 041660ffc5 libde265: patch CVE-2026-54240 and CVE-2026-54241 
Debian identified same commit as fix for both CVEs[1][2].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241

[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00
Ankur Tyagi 3745d07efc libde265: patch CVE-2026-49346 
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 4a63a2afa1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
 2026-10-13 11:50:55 +13:00