mirrors/poky
1
0 Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-10-16 17:27:06 +00:00
Code Issues Projects Releases Wiki Activity
76,224 Commits 38 Branches 627 Tags
c5366e63b1c62978e672c097e00d267ef67eb91c
Commit Graph
76224 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
João Marcos Costa c5366e63b1 curl: add annotation for CVE-2026-10536 
This CVE is detailed here: https://curl.se/docs/CVE-2026-10536.html

and the fix essentially consolidates the fact that HTTP2 stream
dependency is deprecated.

While oe-core provides a PACKAGECONFIG to enable HTTP2, it is not
actually used so the affected part of the code is not compiled. For
instance, in the do_configure logs:

"""
(...)
HTTP2: no (--with-nghttp2, --with-hyper)
(...)
"""

Ignore this CVE unless 'nghttp2' is enabled.

(From OE-Core rev: 637ce45a66ff7125b98fc126321b31cb0cf6bf0f)

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:23 +01:00
Deepak Rathore f1d5865685 sqlite3: fix CVE-2026-11822 and CVE-2026-11824 
This patch applies the upstream fix [1], which addresses memory
corruption vulnerabilities in the SQLite FTS5 full-text search extension.
The GitHub mirror commit [1] corresponds to the SQLite Fossil check-in
shown in [2].

[1] https://github.com/sqlite/sqlite/commit/e0b995b2a62b78979eb65bb8dadfa912eaa8e62f
[2] https://sqlite.org/src/info/061febcf41ca

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-11822
https://nvd.nist.gov/vuln/detail/CVE-2026-11824

(From OE-Core rev: 3de44d1dd09907f620ed349dba563c489a5cecb9)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Siddharth Doshi 8e0b74b1d8 vim: Security Fix for CVE-2026-47167 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-47167
[2] https://security-tracker.debian.org/tracker/CVE-2026-47167

(From OE-Core rev: 4c3c569a7d9e19f7d613d01afd2ab793a4d35453)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Siddharth Doshi 676f7e731a vim: Security Fix for CVE-2026-47162 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-47162
[2] https://security-tracker.debian.org/tracker/CVE-2026-47162

(From OE-Core rev: 2f2d13412852098c0a9c4d633d9f2f340d34b29b)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Siddharth Doshi 0623e8b986 vim: Security Fix for CVE-2026-43961 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://github.com/vim/vim/commit/8af0f098c3a42a28661d0295364e
[2] https://security-tracker.debian.org/tracker/CVE-2026-43961

(From OE-Core rev: 333839503766bdb995092b09546922a3f4ec968e)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Siddharth Doshi 0939d72e83 vim: Security Fix for CVE-2026-42307 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-42307
[2] https://security-tracker.debian.org/tracker/CVE-2026-42307

(From OE-Core rev: ce14ca9604dfa13c619f17282273eb279a79a3ac)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Siddharth Doshi 1c0ffd724f vim: Security Fix for CVE-2026-28422 
Picking patch as per [1], and same patch is mentioned in [2]

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-28422
[2] https://security-tracker.debian.org/tracker/CVE-2026-28422

(From OE-Core rev: 5568c80413e04ffe9a495b28fa1d067bd8cc3209)

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Darsh Kelaiya 7a6a4aa3b1 python3-setuptools: Fix CVE-2026-59890 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://github.com/pypa/setuptools/commit/dd9f436a36486b4cb8a4c70a2321548b0be09b8f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59890

(From OE-Core rev: 0c89d54002ed0411ea34a926ccb80c4b6e4d858c)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
mark.yang 9b68c3fb71 python3-pyasn1: set CVE_PRODUCT 
The default python:pyasn1 does not match the NVD/CNA entries which use
pyasn1 as vendor, so CVEs like CVE-2026-30922 are never reported. Use
the exact pyasn1:pyasn1 pair.

Note: Original commit was for python3-pyasn1_0.6.3.bb. This is adjusted
for scarthgap where recipe version is python3-pyasn1_0.5.1.bb.

Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: 4c2a8f74464cf3b7143bd9e978eef976aea6315e)

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 4971337840e8855740409e8f5dadb3ab3661f033)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
mark.yang 26302ae479 python3-ply: set CVE_PRODUCT 
NVD registers ply as dabeaz:ply, so the default python:ply vendor
prefix never matches and no CVEs are reported. Use the exact
vendor:product pair.

CVE-2025-56005 will then show as unpatched; no fixed release exists.

Suggested-by: Paul Barker <paul@pbarker.dev>
(From OE-Core rev: 069cda2549b0dd841914c5b860f138f6db8b3977)

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bb80fef9a76649fb1144408fbc7e2903439cd556)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
mark.yang 860d4b1c86 python3-cryptography: set CVE_PRODUCT 
NVD lists it as cryptography.io:cryptography and CNA lists it as
pyca:cryptography, so set both vendor:product pairs to match correctly
and precisely.

Suggested-by: Ross Burton <ross.burton@arm.com>
(From OE-Core rev: f4029c635ce3dc1470352d3d3381d9fef19426ed)

Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit b721019e0b2ccbaa8de267e14b282c48a5a3de8b)
Signed-off-by: Himanshu Jadon <hjadon@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Darsh Kelaiya cb5f298597 gawk: Fix CVE-2026-40553 
This patch applies the upstream fix as referenced in [3], using the
commit shown in [1]. It also applies the corrective follow-up [2],
which fixes the snprintf() truncation boundary check. Both commits
are included in gawk 5.4.1, identified as the fixed release in [4].

[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843
[2] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=bfa2e4b890a44100a99d26b54af385479528b12e
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40553
[4] https://cert.pl/en/posts/2026/07/CVE-2026-40467/

(From OE-Core rev: 1f60829da0b2ea7d9f3295ba3cfd3bba972872a2)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Darsh Kelaiya 5cd9ed667f gawk: Fix CVE-2026-40469 
NVD [3] identifies upstream merge commit [2] as the fix. The
CVE-specific change is its second parent [1], which adds 32-bit
overflow checking in do_sub().

[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=aa7272a6e1184cdd21ab8f89200219abd8053eda
[2] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-40469

(From OE-Core rev: 421a3d2166e922c5a8085be0aa9daab13920b613)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Darsh Kelaiya e84e827496 gawk: Fix CVE-2026-40468 
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40468

(From OE-Core rev: a149dbcad38f6f838db303b76fffbfe68052e74e)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Darsh Kelaiya a59438acc8 gawk: Fix CVE-2026-40467 
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-40467

(From OE-Core rev: 157c0642e924dc5f53064322ad8b8143a3621d6b)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Reviewed-by: Leonid Iziumtsev <leonid.iziumtsev@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
AshishKumar Mishra 337c659854 package.bbclass: hardcode emit_pkgdata to run last 
Ensure emit_pkgdata runs after all PACKAGEFUNCS to allow layers to
extend packaging behavior.
Layers can now append custom functions via PACKAGEFUNCS += "func_name"
and they will run before emit_pkgdata generates package metadata.

(From OE-Core rev: 358a847c9dfaf56291f9eb5e2f150cae56044c7c)

Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit aa85baff9ebdd3f932811c3b43d1918c38373cb9)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Shubham Pushpkar 32067f2db1 libsolv: Fix CVE-2026-9149 
This patch applies the upstream fix as referenced in [1], using the CVE advisory shown in [2].
[1] https://github.com/openSUSE/libsolv/commit/210386037c892a720972ad35a3d8f7073b4d763b
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-9149

(From OE-Core rev: 6c39677193adf777b9abe22859842ec692bebdc3)

Signed-off-by: Shubham Pushpkar <spushpka@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
(cherry picked from commit d3fc48836349e81369f5680d808d2e469fce626a)
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-31 16:41:22 +01:00
Niko Mauno 5de2230907 ref-manual: Fix occurrences of omitted space with :prepend 
Add trailing space to value field in :prepend assignments, in
order to avoid providing examples which could lead the users to risk
inadvertent string concatenation.

(From yocto-docs rev: 8496602a28b19fec9ee55dc45572b31a32c70443)

Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit b2f611f498eb22ca42dc436e3cde0c60ad2ba72f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Antonin Godard 173c1c523d kernel-dev/common.rst: remove taskhash mismatch note 
Running 'devtool modify linux-yocto' with latest version of OE-Core and
linux-yocto did not prompt the error, so remove the note.

(From yocto-docs rev: 6a5efba38c8edf17a28cc0bd9f682df582c71705)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit e8debfba3458618a25d21286581adc22bf78a836)
[AG: conflicts: note had different path, remove anyway]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Antonin Godard d8015a395d migration-guides: replace broken link with archive links 
Replace broken link with working archives found on
https://web.archive.org/.

Suggested-by: Quentin Schulz <quentin.schulz@cherry.de>
(From yocto-docs rev: 9db9bf1e64efa4fcce193d7f4ca0c5ca0b1bdaf0)

Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 3288e85934868917f10d66a9130bbdfa5e0ff763)
[AG: conflicts: remove applied hunks for non-existing files]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Daniel Turull 9011c7faaa ref-manual/release-process.rst: update LTS supported versions 
Add Wrynose and remove Kirkstone as supported versions.

(From yocto-docs rev: 032850b7245c853b947218654f9036cced44c36d)

Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
[AG: fix Wyrnose -> Wrynose typo]
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 563e100d5663713e593fd92d2d0fcbddcf25c1c5)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Lee Chee Yang f511852928 migration-guide: add release notes for 5.0.19 
(From yocto-docs rev: 40df1e24e6e8f712212071aba010c7b127c8b4c7)

Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
(cherry picked from commit 95b59a99896052ef7547a54e376d827bf64da43f)
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Hongxu Jia e640c1faf0 bzip2: fix 'bzip2 --version > /tmp/aaa 2>&1' hang 
According to [1]

As of the current version 1.0.8, bzip2 --version will print version
info but it will also continue compressing stdin:

  $ ./bzip2 --version
  bzip2, a block-sorting file compressor.  Version 1.0.8, 13-Jul-2019.

     Copyright (C) 1996-2019 by Julian Seward.

     This program is free software; [...]

  bzip2: I won't write compressed data to a terminal.
  bzip2: For help, type: `bzip2 --help'.

This is a long-standing bug, not new to 1.0.8 -- the same code
(license() followed by break, with no exit) exists in bzip2 1.0.6 and
earlier. The upstream bzip2 master branch on GitLab already includes
this fix.

Debian (and its downstreams like Ubuntu) will patch this out [2],
making the < /dev/null unnecessary, port a part of debian patch
to fix the issue

[1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2
[2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/

(From OE-Core rev: 762321beb0260b1411c7f98f13458ec99a118280)

Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ae4fe4263ba9d372f9b9e80df4ec4697b51c1f9b)
[Jaipaul: backport to scarthgap -- added commit message context that this is a
long-standing bug (not new to 1.0.8), updated Upstream-Status in patch
to actual mailing list URL in the patch file, this patch is already present on master,
wrynose and walnascar branches using the same bzip2 1.0.8]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Darsh Kelaiya 6dacef99fb gzip: Fix CVE-2026-41991 
This patch applies the upstream fix for CVE-2026-41991 as referenced
in [2], using the upstream commit identified in [1].

[1] https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-41991

(From OE-Core rev: 756270e9b67b97b276729daba50febe7093d85b3)

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore 11fbd90126 glib-2.0: fix CVE-2026-58014 
This patch applies the upstream 2.88.1 backport for
CVE-2026-58014. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://gitlab.gnome.org/GNOME/glib/-/commit/94ecb5b44a1cae09f481dd5e693832f129948893
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58014

(From OE-Core rev: cb3cbcb16363f6c351492d19e240c0a02f073749)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore 6ae62b54aa glib-2.0: fix CVE-2026-58013 
This patch applies the upstream 2.88.1 backport for
CVE-2026-58013. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://gitlab.gnome.org/GNOME/glib/-/commit/6a2583dec39bfe05553b16d9b7419d6c2a257244
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58013

(From OE-Core rev: cb2fd8601b4243183d5e219b901439da3f2d41c8)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore 97deef61ea glib-2.0: fix CVE-2026-58012 
This patch applies the upstream 2.86.5 backport for
CVE-2026-58012. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://gitlab.gnome.org/GNOME/glib/-/commit/d337aabd24ee2b8ac2a690dba3ccf26aa70e638f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58012

(From OE-Core rev: b11588f572c1ce6af24da9020793e96404a028b4)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore f5a87ca676 glib-2.0: fix CVE-2026-58011 
This patch applies the upstream 2.86.5 backport for
CVE-2026-58011. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://gitlab.gnome.org/GNOME/glib/-/commit/ae27363f025ffc131e2d75ee88a5cd8320dffe3b
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58011

(From OE-Core rev: a5fe21f357fc41de52e16ef918a737068b0f47e7)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore bb040b7305 glib-2.0: fix CVE-2026-58010 
This patch applies the upstream 2.86.5 backport for
CVE-2026-58010. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://gitlab.gnome.org/GNOME/glib/-/commit/aa1cb87d56111ef989811e824f0ac77484cc997f
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-58010

(From OE-Core rev: 42905f772f74fd9977bb571380c8512f197a1473)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Sudhir Dumbhare d0d68df4c3 libpng: Fix CVE-2026-34757 
These patches apply the upstream fixes [1][2], which address
getter-to-setter aliasing issues in libpng chunk setters that could
cause stale-pointer reads, as described in [3].

[1] https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a
[2] https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc
[3] https://github.com/pnggroup/libpng/issues/836

Reference:
https://security-tracker.debian.org/tracker/CVE-2026-34757
https://nvd.nist.gov/vuln/detail/CVE-2026-34757

Test results on qemux86-64 using ptest-runner:
START: ptest-runner
2026-06-04T11:29
BEGIN: /usr/lib/libpng/ptest
PASS: tests/pnggetset
Testsuite summary
# TOTAL: 33
# PASS:  33
# SKIP:  0
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
DURATION: 80
END: /usr/lib/libpng/ptest
2026-06-04T11:31
STOP: ptest-runner
TOTAL: 1 FAIL: 0

(From OE-Core rev: 392fb4216357fd4eefb6abe3788414f2e60b0889)

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Sudhir Dumbhare 75764cf5d7 gnutls: fix CVE-2026-42009 
This patch applies the upstream fix [1] and [2], as referenced in [3],
to address a DTLS packet reordering flaw where duplicate sequence numbers
could lead to unstable ordering or undefined behavior.

[1] https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d
[2] https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f
[3] https://security-tracker.debian.org/tracker/CVE-2026-42009

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-42009

(From OE-Core rev: 8f3c2010a6bb4b2e7f4508a3ea4c2717294d75a3)

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Sudhir Dumbhare ffc5320e51 gnutls: set status for CVE-2026-3832 
Analysis:
  - CVE-2026-3832 affects GnuTLS OCSP multi-record response handling.
  - The vulnerable OCSP response handling code was introduced in GnuTLS 3.8.8.
  - This vulnerable code is not present in the current GnuTLS 3.8.4.
  - Hence ignoring the CVE for this version.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-3832
https://security-tracker.debian.org/tracker/CVE-2026-3832
https://gitlab.com/gnutls/gnutls/-/issues/1801

(From OE-Core rev: e07d9d20c8c53b21b57f824a8ea471cb4657e717)

Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Enoch Ng 9747726708 libxpm: fix CVE-2026-4367 
Backport the upstream fix for CVE-2026-4367, in which the
`xpmNextWord()` function could attempt to read beyond the file's
end due to improper validation of file boundaries.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-4367

(From OE-Core rev: b3f8956f38b2f2cb0f260ab8853e9d028831f420)

Signed-off-by: Enoch Ng <enoch.ng@windriver.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore 44fd9295ca cups: fix CVE-2026-39316 
Pick the upstream patch [1] as mentioned in [2].

[1] https://github.com/OpenPrinting/cups/commit/0142eeb58e0d718b7d2e1f0d5dd214bd2192cc7f
[2] https://security-tracker.debian.org/tracker/CVE-2026-39316

(From OE-Core rev: f7e5b2536577573a9a9a280c1dda9c21140cfb21)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore 38a2761a99 cups: fix CVE-2026-39314 
Pick the upstream patch [1] as mentioned in [2].

[1] https://github.com/OpenPrinting/cups/commit/928a86b1b794f738f0a3dc87561b2e054bff7ce4
[2] https://security-tracker.debian.org/tracker/CVE-2026-39314

(From OE-Core rev: d3ab2665bb1b99ced4449e85f1a0e0124033b5d3)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:16 +01:00
Deepak Rathore 4ae1f9aec6 cups: fix CVE-2026-34990 
Pick the upstream patch [1] as mentioned in [2].

[1] https://github.com/OpenPrinting/cups/commit/e052dc44da9d12adfbebc51de4975fbadb2ce356
[2] https://security-tracker.debian.org/tracker/CVE-2026-34990

(From OE-Core rev: 5bf5d3da45fcc1494e5e6b3acf23880982518a7b)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Deepak Rathore 6fa69de2bc cups: fix CVE-2026-34979 
Pick the upstream patch [1] as mentioned in [2].

[1] https://github.com/OpenPrinting/cups/commit/0ff8897367c7341f2500770c3977038cdd7c0214
[2] https://security-tracker.debian.org/tracker/CVE-2026-34979

(From OE-Core rev: 7aaebb1682f0ea5f75860523efdef6fefda16307)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Deepak Rathore 335776489f cups: fix CVE-2026-34980 
Pick the upstream fix [1] for CVE-2026-34980 as mentioned in [2], where
the scheduler did not filter control characters from option values.

Also include the upstream regression fixes that followed the CVE fix:

- CVE-2026-34980-regression_p1.patch [3] fixes filter PPD keyword
  processing. The CVE fix parsed PPD keywords into a temporary array,
  but the loop did not advance the keyword pointer. This regression was
  reported in OpenPrinting/cups Issue [4].
- CVE-2026-34980-regression_p2.patch [5] fixes a get_options() regression
  where the option-value parser did not advance the input pointer for
  whitespace/control-character paths.

[1] https://github.com/OpenPrinting/cups/commit/8d0f51cac24cb5bf949c5b6a221e51a150d982e3
[2] https://security-tracker.debian.org/tracker/CVE-2026-34980
[3] https://github.com/OpenPrinting/cups/commit/3f2bdc293243bca938c6de23ba50e6d783189629
[4] https://github.com/OpenPrinting/cups/issues/1562
[5] https://github.com/OpenPrinting/cups/commit/da0ff58c041f7ee129c3c2c72fb14df1f1e4069a

(From OE-Core rev: a64f1bfff50bb9e507705ff671391ec2cafdc692)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Deepak Rathore 9184e90773 cups: fix CVE-2026-34978 
Pick the upstream patch [1] as mentioned in [2].

[1] https://github.com/OpenPrinting/cups/commit/730347c5bbd5e1271149c6739aa858c0c83a7568
[2] https://security-tracker.debian.org/tracker/CVE-2026-34978

(From OE-Core rev: 511d976c70fb591f3bc72b750df1542c4ee84d6a)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
[YC: reverted upstream patch indentation]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Deepak Rathore 8b7ff1d843 cups: fix CVE-2026-41079 
Pick the upstream fix [1] for CVE-2026-41079 as referenced by Debian [2].

[1] https://github.com/OpenPrinting/cups/commit/b7c2525a885f528d243c3a92197ca99609b3f080
[2] https://security-tracker.debian.org/tracker/CVE-2026-41079

(From OE-Core rev: bdb4178b04dabbdba1c1f32aa34bb50ee1a8aedf)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
[YC: reverted modified indentation in imported patch]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Deepak Rathore b9993675ea cups: fix CVE-2026-27447 
Pick the upstream backport [1] for CVE-2026-27447 as mentioned in [2], where
the scheduler treated local user and group names as case-insensitive.

Also include the two upstream regression fixes that followed the CVE
fix:
- CVE-2026-27447-regression_p1.patch [3] fixes a cupsd crash when the
  referenced user does not exist on the server. This regression was
  reported in OpenPrinting/cups Issue [5].
- CVE-2026-27447-regression_p2.patch [4] fixes unauthenticated print
  policies for non-local accounts. This regression was reported in
  OpenPrinting/cups Issue [6].

[1] https://github.com/OpenPrinting/cups/commit/a0c62c1e69604ff061089b750073199fab5a1beb
[2] https://security-tracker.debian.org/tracker/CVE-2026-27447
[3] https://github.com/OpenPrinting/cups/commit/6d97ee39fedf12a7a5429a74f4156ef9bb67f562
[4] https://github.com/OpenPrinting/cups/commit/849fba7d7a1144e48d45c5e6ba2504765912ece0
[5] https://github.com/OpenPrinting/cups/issues/1555
[6] https://github.com/OpenPrinting/cups/issues/1557

(From OE-Core rev: f2aac255fcc1c44ed30a191ba18c4ad46ea4c807)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel 012eac4b8f openssh: Fix CVE-2026-60000 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60000. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60000

(From OE-Core rev: c3dad1896c5377635506c87a09234240c5bbca90)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel cb5e6f65a5 openssh: Fix CVE-2026-60002 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60002. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60002

(From OE-Core rev: c46f65e3f938efa983b24c53206972972d51da24)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel b2a7dabed0 openssh: Fix CVE-2026-60001 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-60001. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-60001

(From OE-Core rev: 11cf9397c6ca0d8c080fbceb190d2a2b72b40da6)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel 6f56dca72f openssh: Fix CVE-2026-59995 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59995. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59995

(From OE-Core rev: 9967952fbfcb130477521324bc9899dafc277439)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel a116ddae05 openssh: Fix CVE-2026-59996 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59996. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59996

(From OE-Core rev: c0c407666d264d94091d994f2d468369c37cc336)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel 5c16db6e87 openssh: Fix CVE-2026-59997 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59997. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59997

(From OE-Core rev: 171530a1066afd2d420c33d063238af7e73ee784)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel 82cf81a3e9 openssh: Fix CVE-2026-59999 
This patch applies the upstream OpenSSH 10.4 backport for
CVE-2026-59999. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].

[1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-59999

(From OE-Core rev: c185f00f350783e8c59b0257eb279f2f7bb0a5de)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Devansh Patel 51d4fee207 libxml2: Fix CVE-2026-11979 
This patch applies the upstream fix as referenced in [2],
using the commit shown in [1].

[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-11979

(From OE-Core rev: e2a9a776855ea1de5c7c6817d282ea2f555395ef)

Signed-off-by: Devansh Patel <devanshp@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00
Yoann Congal e5c6f86964 linux-yocto/6.6: update CVE exclusions (6.6.144) 
$ ./meta/recipes-kernel/linux/generate-cve-exclusions.py .../cvelistV5/ 6.6.144 > meta/recipes-kernel/linux/cve-exclusion_6.6.inc

Generated at 2026-07-23 08:09:32.765073+00:00 for kernel version 6.6.144
From cvelistV5 cve_2026-07-23_0700Z

(From OE-Core rev: 9b5c90be9cd6dfa5ed42f2e05935068ba31bac1b)

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
 2026-07-30 13:21:15 +01:00