Sudhir Dumbhare
e0dbf0bcd3
Upstream Repository: https://github.com/HDFGroup/hdf5.git Bug Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2912 Type: Security Fix CVE: CVE-2025-2912 Score: 4.8 Patch: https://github.com/HDFGroup/hdf5/commit/7cc8b5e1010a Analysis: - CVE-2025-2913 was previously fixed by [1], which is also addresses CVE-2025-2912 as noted in [4]. - NVD [2] references the GitHub discussion [3] for CVE-2025-2912, and we successfully reproduced the issue following the steps outlined there. - Applied the fix from [4] and verified resolution using the reproduction steps. - The same patch [4] is already included in OE-scarthgap [5] for CVE-2025-2913. - Therefore, reused the patch from [5] to resolve CVE-2025-2912. References: [1] https://github.com/HDFGroup/hdf5/commit/7cc8b5e1010a [2] https://nvd.nist.gov/vuln/detail/CVE-2025-2912 [3] https://github.com/HDFGroup/hdf5/issues/5370#issue-2917388806 [4] https://github.com/HDFGroup/hdf5/issues/5370#issuecomment-3542881855 [5] https://git.openembedded.org/meta-openembedded/commit/meta-oe/recipes-support/hdf5?h=scarthgap&id=b42e6eb3e51a Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com> Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
meta-oe
This layer depends on:
URI: git://github.com/openembedded/openembedded-core.git branch: scarthgap
luajit recipe requires host compiler to be able to generate 32bit code when target is 32bit e.g. arm, so ensure that $CC -m32 is functional on build host, if building this recipe, needed packages to fullfit this might have different names on different host distributions e.g. on archlinux based distributions install prerequisites like below
pacman -S lib32-gcc-libs lib32-glibc
Ubuntu sudo apt-get install gcc-multilib linux-libc-dev:i386
Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-oe][scarthgap]' in the subject'
When sending single patches, please use something like: 'git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-oe][scarthgap][PATCH"'
You are encouraged to fork the mirror on GitHub https://github.com/openembedded/meta-openembedded to share your patches, this is preferred for patch sets consisting of more than one patch.
Other services like GitLab, repo.or.cz or self-hosted setups are of course accepted as well, 'git fetch ' works the same on all of them. We recommend GitHub because it is free, easy to use, has been proven to be reliable and has a really good web GUI.
layer maintainer: Armin Kuster akuster808@gmail.com