Gyorgy Sarvari
15b3c0f141
Contains fixes for CVE-2026-34078 and CVE-2026-34079 Add explicit CVE_STATUS tags for these CVEs, because they are tracked without version info by NVD at this time. Changelog: 17.6: Bug fixes: - Fix the remaining regression for Chromium based browsers by not leaking file descriptors down to wrapped command - Fix a regression when installing extra-data without a runtime, which is the case for openh264 - Fix the remaining regression for Epiphany by ignoring unusable sandbox-expose paths for sub-sandboxes in the portal - Fix the installed tests by allowing to add a new ref to an existing temporary ostree repo - Avoid closing fds 0/1/2 when they are used as a bad argument to flatpak-run, and reduce duplication in handling file descriptor arguments Enhancements: - Disable auto-pin in flatpak-repair to preserve the pin state across re-installs - Small improvements for the tests 17.5: Bug fixes: - Fix regressions caused by the sandbox escape security fix, which impact some browsers, browser-based apps and Steam (#6577, #6569, #6576, #6574) Enhancements: - Expand test coverage of flatpak-run features used by flatpak-portal (#6573) 17.4: Security fixes: - Fix a complete sandbox escape which leads to host file access and code execution in the host context (CVE-2026-34078) - Prevent arbitrary file deletion on the host filesystem (CVE-2026-34079) - Prevent arbitrary read-access to files in the system-helper context (GHSA-2fxp-43j9-pwvc) - Prevent orphaning cross-user pull operations (GHSA-89xm-3m96-w3jg) Enhancements: - Enable ntsync unconditionally - Automatic branch following for extensions to ensure that "no-autodownload" extensions stay functional after an update that requires a new branch - Translation updates: eo, kk, sr, zh_CN Bug fixes: - Prevent CPR sequence from showing up in the terminal - Fix a crash for apps/runtimes with multiarch permission - Fixes for Coverity warnings - Add test-preinstall.sh to the test matrix source - Fix a test message to refer to "systemd-localed" instead of "located" Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com> Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
meta-oe
This layer depends on:
URI: git://github.com/openembedded/openembedded-core.git branch: master
luajit recipe requires host compiler to be able to generate 32bit code when target is 32bit e.g. arm, so ensure that $CC -m32 is functional on build host, if building this recipe, needed packages to fullfit this might have different names on different host distributions e.g. on archlinux based distributions install prerequisites like below
pacman -S lib32-gcc-libs lib32-glibc
Ubuntu sudo apt-get install gcc-multilib linux-libc-dev:i386
Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-oe]' in the subject'
When sending single patches, please use something like: 'git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-oe][PATCH"'
You are encouraged to fork the mirror on GitHub https://github.com/openembedded/meta-openembedded to share your patches, this is preferred for patch sets consisting of more than one patch.
Note, it is discouraged to send patches via GitHub pull request system. Such patches get less attention from developers and can be mishandled or not reviewed properly. Please use emails instead. For exemple, you can use 'git request-pull' to generate an email referencing your git repository.
Other services like GitLab, repo.or.cz or self-hosted setups are of course accepted as well, 'git fetch ' works the same on all of them. We recommend GitHub because it is free, easy to use, has been proven to be reliable and has a really good web GUI.
Layer maintainer: Khem Raj raj.khem@gmail.com