[oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs

[oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-47180
https://nvd.nist.gov/vuln/detail/cve-2026-47183
https://nvd.nist.gov/vuln/detail/cve-2026-47184
https://nvd.nist.gov/vuln/detail/cve-2026-48045
https://nvd.nist.gov/vuln/detail/cve-2026-48487

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-networking/recipes-protocols/zeroconf/zeroconf_0.9.bb | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/meta-networking/recipes-protocols/zeroconf/zeroconf_0.9.bb b/meta-networking/recipes-protocols/zeroconf/zeroconf_0.9.bb
index cb26699212..a9c19cb38f 100644
--- a/meta-networking/recipes-protocols/zeroconf/zeroconf_0.9.bb
+++ b/meta-networking/recipes-protocols/zeroconf/zeroconf_0.9.bb
@@ -35,3 +35,9 @@ do_install () {
     install -c -m 755 ${UNPACKDIR}/debian-zeroconf ${D}${sysconfdir}/network/if-up.d/zeroconf
     install -c ${UNPACKDIR}/zeroconf-default ${D}${sysconfdir}/default/zeroconf
 }
+
+CVE_STATUS[CVE-2026-47180] = "cpe-incorrect: this vulnerability is for Python Zeroconf library"
+CVE_STATUS[CVE-2026-47183] = "cpe-incorrect: this vulnerability is for Python Zeroconf library"
+CVE_STATUS[CVE-2026-47184] = "cpe-incorrect: this vulnerability is for Python Zeroconf library"
+CVE_STATUS[CVE-2026-48045] = "cpe-incorrect: this vulnerability is for Python Zeroconf library"
+CVE_STATUS[CVE-2026-48487] = "cpe-incorrect: this vulnerability is for Python Zeroconf library"

[oe][meta-oe][blacksail][PATCH 2/44] udisks2: patch CVE-2026-7867

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport commits from the PR[1].

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7867

[1]https://github.com/storaged-project/udisks/pull/1530

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../udisks/udisks2/CVE-2026-7867-1.patch      | 249 +++++++++++++
 .../udisks/udisks2/CVE-2026-7867-2.patch      | 208 +++++++++++
 .../udisks/udisks2/CVE-2026-7867-3.patch      |  53 +++
 .../udisks/udisks2/CVE-2026-7867-4.patch      |  40 ++
 .../udisks/udisks2/CVE-2026-7867-5.patch      | 348 ++++++++++++++++++
 .../recipes-support/udisks/udisks2_2.10.2.bb  |   9 +-
 6 files changed, 905 insertions(+), 2 deletions(-)
 create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch
 create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch
 create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch
 create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch
 create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch

diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch
new file mode 100644
index 0000000000..e7a5704f6c
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch
@@ -0,0 +1,249 @@
+From 1b417fd9a69e7141927a03bfb39d4d5a78b891b4 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Tue, 28 Apr 2026 19:10:09 +0200
+Subject: [PATCH] udiskslinuxfilesystem: Separate real caller identity from
+ as-user target
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When the 'as-user' option is specified in Filesystem.Mount(), the code
+previously overwrote caller_uid/caller_gid with the target user's identity.
+This meant downstream functions received a uid they believed was the
+D-Bus caller's, but was actually the target's.
+
+Introduce effective_uid/effective_gid/effective_user_name to hold the
+as-user target identity (or the caller's identity when as-user is not
+set). The real D-Bus caller identity is now always resolved into
+caller_uid/caller_gid and used for authorization-related decisions
+(setup_by_user, on_user_seat checks), while effective_* is used for
+mount point calculation, run_as_uid/run_as_gid, and state tracking.
+
+Reported-by: Azizcan Daştan <azizcan.dastan5@gmail.com>
+Reported-by: Özlem Ozan <oozan1725@gmail.com>
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 397eea88d58f77f6e02d537c4c961201b9245943)
+(cherry picked from commit 2d97818f41fbeb645fbb7b0373ed448bd26503f6)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/2d97818f41fbeb645fbb7b0373ed448bd26503f6]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/udiskslinuxfilesystem.c | 93 +++++++++++++++++++++----------------
+ 1 file changed, 53 insertions(+), 40 deletions(-)
+
+diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
+index 9f4880ad..ebdd2e05 100644
+--- a/src/udiskslinuxfilesystem.c
++++ b/src/udiskslinuxfilesystem.c
+@@ -905,7 +905,8 @@ handle_mount_fstab (UDisksDaemon          *daemon,
+                     UDisksObject          *object,
+                     uid_t                  caller_uid,
+                     gid_t                  caller_gid,
+-                    gboolean               mount_other_user,
++                    uid_t                  effective_uid,
++                    gid_t                  effective_gid,
+                     const gchar           *mount_point_to_use,
+                     const gchar           *fstab_mount_options,
+                     GDBusMethodInvocation *invocation,
+@@ -936,7 +937,7 @@ handle_mount_fstab (UDisksDaemon          *daemon,
+        * will be replaced by the name of the drive/device in question
+        */
+       message = N_("Authentication is required to mount $(drive)");
+-      if (mount_other_user)
++      if (caller_uid != effective_uid)
+         {
+           action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
+         }
+@@ -981,14 +982,14 @@ handle_mount_fstab (UDisksDaemon          *daemon,
+       job = udisks_daemon_launch_simple_job (daemon,
+                                              UDISKS_OBJECT (object),
+                                              "filesystem-mount",
+-                                             mount_fstab_as_root ? 0 : caller_uid,
++                                             mount_fstab_as_root ? 0 : effective_uid,
+                                              NULL /* cancellable */);
+ 
+       /* XXX: using run_as_uid for root doesn't work even if the caller is already root */
+-      if (!mount_fstab_as_root && caller_uid != 0)
++      if (!mount_fstab_as_root && effective_uid != 0)
+         {
+-          BDExtraArg uid_arg = { g_strdup ("run_as_uid"), g_strdup_printf ("%d", caller_uid) };
+-          BDExtraArg gid_arg = { g_strdup ("run_as_gid"), g_strdup_printf ("%d", caller_gid) };
++          BDExtraArg uid_arg = { g_strdup ("run_as_uid"), g_strdup_printf ("%d", effective_uid) };
++          BDExtraArg gid_arg = { g_strdup ("run_as_gid"), g_strdup_printf ("%d", effective_gid) };
+           const BDExtraArg *extra_args[3] = { &uid_arg, &gid_arg, NULL };
+ 
+           success = bd_fs_mount (NULL, mount_point_to_use, NULL, NULL, extra_args, &error);
+@@ -1066,8 +1067,9 @@ handle_mount_dynamic (UDisksDaemon          *daemon,
+                       UDisksObject          *object,
+                       uid_t                  caller_uid,
+                       gid_t                  caller_gid,
+-                      const gchar           *caller_user_name,
+-                      gboolean               mount_other_user,
++                      uid_t                  effective_uid,
++                      gid_t                  effective_gid,
++                      const gchar           *effective_user_name,
+                       gchar                **mount_point_to_use,
+                       gboolean              *mpoint_persistent,
+                       GDBusMethodInvocation *invocation,
+@@ -1127,7 +1129,7 @@ handle_mount_dynamic (UDisksDaemon          *daemon,
+    * will be replaced by the name of the drive/device in question
+    */
+   message = N_("Authentication is required to mount $(drive)");
+-  if (mount_other_user)
++  if (caller_uid != effective_uid)
+     {
+       action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
+     }
+@@ -1161,9 +1163,9 @@ handle_mount_dynamic (UDisksDaemon          *daemon,
+   /* Calculate mount point (guaranteed to be valid UTF-8) */
+   *mount_point_to_use = calculate_mount_point (daemon,
+                                                block,
+-                                               caller_uid,
+-                                               caller_gid,
+-                                               caller_user_name,
++                                               effective_uid,
++                                               effective_gid,
++                                               effective_user_name,
+                                                fs_type_to_use,
+                                                mpoint_persistent,
+                                                &error);
+@@ -1178,7 +1180,7 @@ handle_mount_dynamic (UDisksDaemon          *daemon,
+   /* Calculate mount options (guaranteed to be valid UTF-8) */
+   mount_options = udisks_linux_calculate_mount_options (daemon,
+                                                         block,
+-                                                        caller_uid,
++                                                        effective_uid,
+                                                         fs_signature,
+                                                         fs_type_to_use,
+                                                         options,
+@@ -1258,14 +1260,16 @@ handle_mount (UDisksFilesystem      *filesystem,
+   UDisksBlock *block;
+   UDisksDaemon *daemon;
+   UDisksState *state = NULL;
+-  gchar *opt_as_user = NULL;
++  const gchar *opt_as_user = NULL;
+   uid_t caller_uid;
+   gid_t caller_gid;
++  uid_t effective_uid = 0;
++  gid_t effective_gid = 0;
++  gchar *effective_user_name = NULL;
+   const gchar * const *existing_mount_points;
+   gchar *mount_point_to_use = NULL;
+   gboolean mpoint_persistent = TRUE;
+   gchar *fstab_mount_options = NULL;
+-  gchar *caller_user_name = NULL;
+   GError *error = NULL;
+   gboolean system_managed = FALSE;
+   gchar *device = NULL;
+@@ -1323,35 +1327,42 @@ handle_mount (UDisksFilesystem      *filesystem,
+       goto out;
+     }
+ 
++  /* Always resolve the real D-Bus caller identity */
++  if (!udisks_daemon_util_get_caller_uid_sync (daemon,
++                                               invocation,
++                                               NULL /* GCancellable */,
++                                               &caller_uid,
++                                               &error))
++    {
++      g_dbus_method_invocation_return_gerror (invocation, error);
++      g_clear_error (&error);
++      goto out;
++    }
++
++  if (!udisks_daemon_util_get_user_info (caller_uid,
++                                         &caller_gid,
++                                         opt_as_user ? NULL : &effective_user_name,
++                                         &error))
++    {
++      g_dbus_method_invocation_return_gerror (invocation, error);
++      g_clear_error (&error);
++      goto out;
++    }
++
+   if (opt_as_user)
+     {
+-      if (!udisks_daemon_util_get_user_info_by_name (opt_as_user, &caller_uid, &caller_gid, &error))
++      if (!udisks_daemon_util_get_user_info_by_name (opt_as_user, &effective_uid, &effective_gid, &error))
+         {
+           g_dbus_method_invocation_return_gerror (invocation, error);
+           g_clear_error (&error);
+           goto out;
+         }
+-      caller_user_name = g_strdup (opt_as_user);
++      effective_user_name = g_strdup (opt_as_user);
+     }
+   else
+     {
+-      if (!udisks_daemon_util_get_caller_uid_sync (daemon,
+-                                                   invocation,
+-                                                   NULL /* GCancellable */,
+-                                                   &caller_uid,
+-                                                   &error))
+-        {
+-          g_dbus_method_invocation_return_gerror (invocation, error);
+-          g_clear_error (&error);
+-          goto out;
+-        }
+-
+-      if (!udisks_daemon_util_get_user_info (caller_uid, &caller_gid, &caller_user_name, &error))
+-        {
+-          g_dbus_method_invocation_return_gerror (invocation, error);
+-          g_clear_error (&error);
+-          goto out;
+-        }
++      effective_uid = caller_uid;
++      effective_gid = caller_gid;
+     }
+ 
+   /* Mount it */
+@@ -1361,7 +1372,8 @@ handle_mount (UDisksFilesystem      *filesystem,
+                                object,
+                                caller_uid,
+                                caller_gid,
+-                               opt_as_user != NULL,
++                               effective_uid,
++                               effective_gid,
+                                mount_point_to_use,
+                                fstab_mount_options,
+                                invocation,
+@@ -1374,8 +1386,9 @@ handle_mount (UDisksFilesystem      *filesystem,
+                                  object,
+                                  caller_uid,
+                                  caller_gid,
+-                                 caller_user_name,
+-                                 opt_as_user != NULL,
++                                 effective_uid,
++                                 effective_gid,
++                                 effective_user_name,
+                                  &mount_point_to_use,
+                                  &mpoint_persistent,
+                                  invocation,
+@@ -1387,7 +1400,7 @@ handle_mount (UDisksFilesystem      *filesystem,
+   udisks_state_add_mounted_fs (state,
+                                mount_point_to_use,
+                                udisks_block_get_device_number (block),
+-                               caller_uid,
++                               effective_uid,
+                                system_managed,
+                                system_managed ? FALSE : mpoint_persistent);
+ 
+@@ -1395,7 +1408,7 @@ handle_mount (UDisksFilesystem      *filesystem,
+                  device,
+                  system_managed ? " (system)" : "",
+                  mount_point_to_use,
+-                 caller_uid);
++                 effective_uid);
+ 
+   udisks_linux_block_object_trigger_uevent_sync (UDISKS_LINUX_BLOCK_OBJECT (object),
+                                                  UDISKS_DEFAULT_WAIT_TIMEOUT);
+@@ -1409,7 +1422,7 @@ handle_mount (UDisksFilesystem      *filesystem,
+     udisks_state_check (state);
+   g_free (mount_point_to_use);
+   g_free (fstab_mount_options);
+-  g_free (caller_user_name);
++  g_free (effective_user_name);
+   g_free (device);
+   g_clear_object (&object);
+ 
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch
new file mode 100644
index 0000000000..dff53c87d8
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch
@@ -0,0 +1,208 @@
+From 53a3e81a90fa6d71cfb59d63ffffa22bbe071886 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Tue, 28 Apr 2026 19:29:14 +0200
+Subject: [PATCH] udiskslinuxfilesystem: Rework fstab mount authorization for
+ as-user
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The polkit authorization logic in handle_mount_fstab() had two problems
+when 'as-user' was combined with fstab entries containing 'user',
+'users' or 'x-udisks-auth' mount options:
+
+1. The 'filesystem-mount-other-user' polkit check was inside the code
+   block that is skipped when 'user'/'users'/'x-udisks-auth' options
+   are present, allowing an unprivileged caller to mount on behalf of
+   another user without any authorization.
+
+2. When 'user' or 'users' fstab options were present and the initial
+   mount attempt failed with a permission error, the code would fall
+   back to mounting as root. This fallback should only be available
+   when 'x-udisks-auth' is explicitly specified.
+
+Restructure the authorization flow so that:
+ - The 'filesystem-mount-other-user' check is evaluated first,
+   independently of fstab mount options, and is always enforced
+   when caller_uid != effective_uid.
+ - The root fallback on BD_FS_ERROR_AUTH is gated on 'x-udisks-auth'
+   being present, not just any of the user-level mount options.
+ - When root uses 'as-user' without 'user'/'users' fstab options,
+   the root fallback is implicitly enabled.
+ - Regular polkit checks (filesystem-mount, mount-system,
+   mount-other-seat) only apply for same-user mounts without
+   'user'/'users'/'x-udisks-auth'.
+
+Update the D-Bus API documentation to reflect the new behavior.
+
+Reported-by: Azizcan Daştan <azizcan.dastan5@gmail.com>
+Reported-by: Özlem Ozan <oozan1725@gmail.com>
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 68108081aa9049cf3bb2fb0044cb4de83f962390)
+(cherry picked from commit 0050f51d40e468f6a3197ccdc77b5bd59c923a37)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/0050f51d40e468f6a3197ccdc77b5bd59c923a37]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ data/org.freedesktop.UDisks2.xml | 24 ++++++-----
+ src/udiskslinuxfilesystem.c      | 73 ++++++++++++++++++++++++--------
+ 2 files changed, 70 insertions(+), 27 deletions(-)
+
+diff --git a/data/org.freedesktop.UDisks2.xml b/data/org.freedesktop.UDisks2.xml
+index 53194c70..f7201adc 100644
+--- a/data/org.freedesktop.UDisks2.xml
++++ b/data/org.freedesktop.UDisks2.xml
+@@ -2654,7 +2654,8 @@
+         filesystem is mounted on behalf of the specified user instead
+         of the calling one. This has usually an effect on the returned
+         @mount_path and it also allows that user to unmount the
+-        filesystem later. This option expects a user name, not a UID.
++        filesystem later. This option expects a user name, not a UID
++        and always performs an authorization check.
+ 
+         If the device in question is referenced in the
+         <filename>/etc/fstab</filename> file, the
+@@ -2662,15 +2663,18 @@
+         and the given options or filesystem type given in @options are
+         ignored.
+ 
+-        If <literal>x-udisks-auth</literal> is specified as an option
+-        for the device in the <filename>/etc/fstab</filename> file,
+-        then the <command>mount</command> command is run as the
+-        calling user, without performing any authorization check
+-        mentioned above. If this fails because of insufficient
+-        permissions, an authorization check is performed (which
+-        typically results in the user having to authenticate as an
+-        administrator). If authorized, the <command>mount</command>
+-        command is then run as root.
++        If <literal>x-udisks-auth</literal>, <literal>user</literal> or
++        <literal>users</literal> are specified as options for the
++        device in the <filename>/etc/fstab</filename> file, then the
++        <command>mount</command> command is run as the calling user
++        (or the effective user of the <parameter>as-user</parameter>
++        option respectively), without performing any authorization check
++        mentioned above. If this fails because of insufficient permissions
++        and <literal>x-udisks-auth</literal> is specified, an
++        authorization check is performed (which typically results in
++        the user having to authenticate as an administrator). If
++        authorized, the <command>mount</command> command is then run
++        as root.
+ 
+         The filesystem should be unmounted using the
+         org.freedesktop.UDisks2.Filesystem.Unmount() method.
+diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
+index ebdd2e05..eb2a3f21 100644
+--- a/src/udiskslinuxfilesystem.c
++++ b/src/udiskslinuxfilesystem.c
+@@ -918,30 +918,60 @@ handle_mount_fstab (UDisksDaemon          *daemon,
+   const gchar *message = NULL;
+   gboolean success = FALSE;
+   gboolean mount_fstab_as_root = FALSE;
++  gboolean x_udisks_auth = FALSE;
++  gboolean user_mount = FALSE;
+   UDisksBaseJob *job = NULL;
+   GError *error = NULL;
+ 
+   block = udisks_object_peek_block (object);
+   device = udisks_block_get_device (block);
+ 
+-  if (!has_option (fstab_mount_options, "x-udisks-auth") &&
+-      !has_option (fstab_mount_options, "user") &&
+-      !has_option (fstab_mount_options, "users"))
++  x_udisks_auth = has_option (fstab_mount_options, "x-udisks-auth");
++  user_mount = x_udisks_auth ||
++               has_option (fstab_mount_options, "user") ||
++               has_option (fstab_mount_options, "users");
++
++  /* 'as-user' rules:
++   *  - when caller is root:
++   *    - if 'user'/'users' present, do not fall back to mounting as root, unless 'x-udisks-auth' is specified
++   *    - if 'user'/'users' not present, try as effective user first and allow fallback to mounting as root (implies 'x-udisks-auth')
++   *  - when caller is unprivileged:
++   *    - always require polkit auth to prevent identity spoofing
++   *    - do not fall back to mounting as root, unless 'x-udisks-auth' is specified
++   *    - if neither 'user'/'users'/'x-udisks-auth' present, failure is expected by nature (unless 'as-user=root')
++   *
++   * general fstab mounting rules:
++   *  - when caller is root, mount as root, allow anything
++   *  - when caller is unprivileged:
++   *    - if 'user'/'users' present, do not fall back to mounting as root, unless 'x-udisks-auth' is specified
++   *    - if only 'x-udisks-auth' present, mount as user and fall back to mounting as root if not successful
++   *    - if neither 'user'/'users'/'x-udisks-auth' present, require polkit auth and mount as root
++   *
++   * Further assumptions:
++   *  - when 'user'/'users' not present and mounting as unprivileged, this typically fails but it is still beneficial to try that e.g. for FUSE mounts
++   *  - assuming libblockdev mount error code mapping works reliably (for the BD_FS_ERROR_AUTH check)
++   */
++
++  if (caller_uid != effective_uid)
++    {
++      /* Always require authorization when mounting on behalf of another user,
++       * regardless of fstab mount options.
++       */
++      action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
++
++      /* When 'user'/'users' not present and the caller is root, allow
++       * fallback mounting as root.
++       */
++      if (caller_uid == 0 && !user_mount)
++        x_udisks_auth = TRUE;
++    }
++  else
++  if (!user_mount)
+     {
+       mount_fstab_as_root = TRUE;
++
+       action_id = "org.freedesktop.udisks2.filesystem-mount";
+-      /* Translators: Shown in authentication dialog when the user
+-       * requests mounting a filesystem.
+-       *
+-       * Do not translate $(drive), it's a placeholder and
+-       * will be replaced by the name of the drive/device in question
+-       */
+-      message = N_("Authentication is required to mount $(drive)");
+-      if (caller_uid != effective_uid)
+-        {
+-          action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
+-        }
+-      else if (!udisks_daemon_util_setup_by_user (daemon, object, caller_uid))
++      if (!udisks_daemon_util_setup_by_user (daemon, object, caller_uid))
+         {
+           if (udisks_block_get_hint_system (block))
+             {
+@@ -952,7 +982,17 @@ handle_mount_fstab (UDisksDaemon          *daemon,
+               action_id = "org.freedesktop.udisks2.filesystem-mount-other-seat";
+             }
+         }
++    }
+ 
++  if (action_id)
++    {
++      /* Translators: Shown in authentication dialog when the user
++       * requests mounting a filesystem.
++       *
++       * Do not translate $(drive), it's a placeholder and
++       * will be replaced by the name of the drive/device in question
++       */
++      message = N_("Authentication is required to mount $(drive)");
+       if (!udisks_daemon_util_check_authorization_sync (daemon,
+                                                         object,
+                                                         action_id,
+@@ -962,7 +1002,6 @@ handle_mount_fstab (UDisksDaemon          *daemon,
+         return FALSE;
+     }
+ 
+-
+   if (!g_file_test (mount_point_to_use, G_FILE_TEST_IS_DIR))
+     {
+       if (g_mkdir_with_parents (mount_point_to_use, 0755) != 0)
+@@ -1011,7 +1050,7 @@ handle_mount_fstab (UDisksDaemon          *daemon,
+ 
+       if (!success)
+         {
+-          if (!mount_fstab_as_root && g_error_matches (error, BD_FS_ERROR, BD_FS_ERROR_AUTH))
++          if (!mount_fstab_as_root && g_error_matches (error, BD_FS_ERROR, BD_FS_ERROR_AUTH) && x_udisks_auth)
+             {
+               g_clear_error (&error);
+               action_id = "org.freedesktop.udisks2.filesystem-fstab";
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch
new file mode 100644
index 0000000000..245e46ac00
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch
@@ -0,0 +1,53 @@
+From 68a82f2afb3a5ca0da207cdd5bbd55e777940e12 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Sun, 3 May 2026 14:00:01 +0200
+Subject: [PATCH] udiskslinuxfilesystem: Log real caller uid for as-user mounts
+
+When a mount is performed with the as-user option targeting a different
+user, log both the effective (target) uid and the real caller uid to
+provide an audit trail of who authorized the operation.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 98e5a76c155640d155280cdb642791f00def736a)
+(cherry picked from commit 132ebab4a196f7fbd01fa28283627b2227eb399b)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/132ebab4a196f7fbd01fa28283627b2227eb399b]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/udiskslinuxfilesystem.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
+index eb2a3f21..5e2508cc 100644
+--- a/src/udiskslinuxfilesystem.c
++++ b/src/udiskslinuxfilesystem.c
+@@ -1443,11 +1443,23 @@ handle_mount (UDisksFilesystem      *filesystem,
+                                system_managed,
+                                system_managed ? FALSE : mpoint_persistent);
+ 
+-  udisks_notice ("Mounted %s%s at %s on behalf of uid %u",
+-                 device,
+-                 system_managed ? " (system)" : "",
+-                 mount_point_to_use,
+-                 effective_uid);
++  if (effective_uid != caller_uid)
++    {
++      udisks_notice ("Mounted %s%s at %s on behalf of uid %u (requested by uid %u)",
++                     device,
++                     system_managed ? " (system)" : "",
++                     mount_point_to_use,
++                     effective_uid,
++                     caller_uid);
++    }
++  else
++    {
++      udisks_notice ("Mounted %s%s at %s on behalf of uid %u",
++                     device,
++                     system_managed ? " (system)" : "",
++                     mount_point_to_use,
++                     effective_uid);
++    }
+ 
+   udisks_linux_block_object_trigger_uevent_sync (UDISKS_LINUX_BLOCK_OBJECT (object),
+                                                  UDISKS_DEFAULT_WAIT_TIMEOUT);
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch
new file mode 100644
index 0000000000..726f3271dc
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch
@@ -0,0 +1,40 @@
+From a17202ed591f07109ce978e5abb999c67de9b3f1 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Tue, 28 Apr 2026 19:10:38 +0200
+Subject: [PATCH] udisksdaemonutil: Pass as-user target to polkit details
+
+When the 'as-user' D-Bus method option is present, propagate the
+target username to polkit details as 'mount.as-user'. This allows
+polkit rules to make fine-grained authorization decisions based on
+who the mount is being performed for.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 681d58a76f6aaa5045eb43e665c65f497d35b810)
+(cherry picked from commit 3b016cc881b1d3c3d843ec13e35102beaaac7023)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/3b016cc881b1d3c3d843ec13e35102beaaac7023]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/udisksdaemonutil.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/udisksdaemonutil.c b/src/udisksdaemonutil.c
+index 3db92f58..36e3184b 100644
+--- a/src/udisksdaemonutil.c
++++ b/src/udisksdaemonutil.c
+@@ -797,6 +797,14 @@ udisks_daemon_util_check_authorization_sync_with_error (UDisksDaemon           *
+   polkit_details_insert (details, "polkit.message", message);
+   polkit_details_insert (details, "polkit.gettext_domain", "udisks2");
+ 
++  if (options != NULL &&
++      g_strcmp0 (action_id, "org.freedesktop.udisks2.filesystem-mount-other-user") == 0)
++    {
++      const gchar *as_user = NULL;
++      g_variant_lookup (options, "as-user", "&s", &as_user);
++      _safe_polkit_details_insert (details, "mount.as-user", as_user);
++    }
++
+   /* Find drive associated with the block device, if any */
+   if (object != NULL)
+     {
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch
new file mode 100644
index 0000000000..6901e71d37
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch
@@ -0,0 +1,348 @@
+From 7e77f3cb5c6658f5522d8d56e882e8df02978d76 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Wed, 29 Apr 2026 16:36:45 +0200
+Subject: [PATCH] tests: Add security tests for as-user mount authorization
+
+Add tests verifying that an unprivileged D-Bus caller cannot exploit
+the 'as-user' option in Filesystem.Mount() to mount on behalf of
+another user without polkit authorization. Use a dedicated
+'udisks_test_target' user instead of 'nobody' to avoid OS-level
+special treatment of system users that could mask real behavior.
+
+Dynamic mount tests (in UdisksFSTestCase, inherited by all FS types):
+- test_mount_as_user_denied: as-user=<another_user> is denied
+- test_mount_as_user_root_denied: as-user=root is denied
+- test_mount_as_user_self: as-user=<self> behaves like plain mount
+
+Fstab mount tests (in NonPOSIXTestCase, inherited by VFAT/EXFAT):
+- test_mount_fstab_{users,user,x-udisks-auth}_as_user_denied:
+  fstab entries that normally allow unprivileged mounting must still
+  require authorization when as-user is specified
+- test_mount_fstab_{users,user,x-udisks-auth}_as_root_denied:
+  same but with as-user=root
+- test_mount_fstab_defaults_as_user_from_root: root can mount
+  fstab 'defaults' device with as-user targeting a non-root user
+- test_mount_fstab_defaults_as_user_denied: unprivileged user
+  cannot mount fstab 'defaults' device with as-user
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 5ec20c9d5719ead510d800bc3eb5a731e5712f39)
+(cherry picked from commit 36231768dde088c8b4d4796ff2d311d089d84052)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/36231768dde088c8b4d4796ff2d311d089d84052]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/tests/dbus-tests/test_80_filesystem.py | 278 +++++++++++++++++++++
+ 1 file changed, 278 insertions(+)
+
+diff --git a/src/tests/dbus-tests/test_80_filesystem.py b/src/tests/dbus-tests/test_80_filesystem.py
+index 1f375ac6..03336512 100644
+--- a/src/tests/dbus-tests/test_80_filesystem.py
++++ b/src/tests/dbus-tests/test_80_filesystem.py
+@@ -30,6 +30,8 @@ class UdisksFSTestCase(udiskstestcase.UdisksTestCase):
+     _can_query_size = False
+ 
+     username = 'udisks_test_user'
++    # a separate target user used for 'as-user' mount tests
++    target_username = 'udisks_test_target'
+ 
+     requested_plugins = BlockDev.plugin_specs_from_names(("fs",))
+ 
+@@ -1037,6 +1039,174 @@ class UdisksFSTestCase(udiskstestcase.UdisksTestCase):
+         pipe.send([True, ''])
+         pipe.close()
+ 
++    def _mount_with_as_user_fail(self, pipe, uid, gid, device, target_user):
++        """ Try to mount @device as user with given @uid and @gid using the
++            'as-user' option set to @target_user. This is expected to fail
++            with a NotAuthorized error.
++        """
++        os.setresgid(gid, gid, gid)
++        os.setresuid(uid, uid, uid)
++
++        try:
++            safe_dbus.call_sync(self.iface_prefix,
++                                self.path_prefix + '/block_devices/' + os.path.basename(device),
++                                self.iface_prefix + '.Filesystem',
++                                'Mount',
++                                GLib.Variant('(a{sv})', ({'as-user': GLib.Variant('s', target_user)},)))
++        except Exception as e:
++            msg = str(e)
++            if 'org.freedesktop.UDisks2.Error.NotAuthorized' in msg and \
++               'Not authorized to perform operation' in msg:
++                pipe.send([True, ''])
++                pipe.close()
++                return
++            else:
++                pipe.send([False, 'Mount DBus call failed with unexpected exception: %s' % msg])
++                pipe.close()
++                return
++
++        pipe.send([False, 'Mount with as-user=%s unexpectedly succeeded for uid %d' % (target_user, uid)])
++        pipe.close()
++
++    def _test_mount_as_user_denied(self, target_user):
++        """ Test that an unprivileged user cannot use as-user to mount on
++            behalf of @target_user without polkit authorization.
++        """
++        self._check_can_create()
++
++        if not self._can_mount:
++            self.skipTest('Cannot mount %s filesystem' % self._fs_signature)
++
++        disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++        self.assertIsNotNone(disk)
++
++        disk.Format(self._fs_signature, self.no_options, dbus_interface=self.iface_prefix + '.Block')
++        self.addCleanup(self.wipe_fs, self.vdevs[0])
++        self.addCleanup(self.try_unmount, self.vdevs[0])
++
++        self.addCleanup(self._remove_user, self.username)
++        uid, gid = self._add_user(self.username)
++
++        if target_user != 'root':
++            self.addCleanup(self._remove_user, target_user)
++            self._add_user(target_user)
++
++        parent_conn, child_conn = Pipe()
++        proc = Process(target=self._mount_with_as_user_fail,
++                       args=(child_conn, int(uid), int(gid), self.vdevs[0], target_user))
++        proc.start()
++        res = parent_conn.recv()
++        parent_conn.close()
++        proc.join()
++
++        if not res[0]:
++            self.fail(res[1])
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_as_user_denied(self):
++        """ Test that an unprivileged user cannot use as-user to mount on
++            behalf of another user without authorization.
++        """
++        self._test_mount_as_user_denied(self.target_username)
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_as_user_root_denied(self):
++        """ Test that an unprivileged user cannot use as-user=root to mount
++            without authorization.
++        """
++        self._test_mount_as_user_denied('root')
++
++    def _mount_as_user_result(self, pipe, uid, gid, device, options):
++        """ Try to mount @device as user with given @uid and @gid using
++            the given @options dict. Returns [True, error_string] on D-Bus
++            error or [True, ''] on success.
++        """
++        os.setresgid(gid, gid, gid)
++        os.setresuid(uid, uid, uid)
++
++        try:
++            safe_dbus.call_sync(self.iface_prefix,
++                                self.path_prefix + '/block_devices/' + os.path.basename(device),
++                                self.iface_prefix + '.Filesystem',
++                                'Mount',
++                                GLib.Variant('(a{sv})', (options,)))
++        except Exception as e:
++            pipe.send([True, str(e)])
++            pipe.close()
++            return
++
++        pipe.send([True, ''])
++        pipe.close()
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_as_user_self(self):
++        """ Test that as-user targeting the caller's own username behaves
++            identically to mounting without as-user (no extra mount-other-user
++            authorization required).
++        """
++        self._check_can_create()
++
++        if not self._can_mount:
++            self.skipTest('Cannot mount %s filesystem' % self._fs_signature)
++
++        disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++        self.assertIsNotNone(disk)
++
++        disk.Format(self._fs_signature, self.no_options, dbus_interface=self.iface_prefix + '.Block')
++        self.addCleanup(self.wipe_fs, self.vdevs[0])
++        self.addCleanup(self.try_unmount, self.vdevs[0])
++
++        self.addCleanup(self._remove_user, self.username)
++        uid, gid = self._add_user(self.username)
++
++        # first try a plain mount without as-user
++        parent_conn, child_conn = Pipe()
++        proc = Process(target=self._mount_as_user_result,
++                       args=(child_conn, int(uid), int(gid), self.vdevs[0], {}))
++        proc.start()
++        res_plain = parent_conn.recv()
++        parent_conn.close()
++        proc.join()
++
++        self.assertTrue(res_plain[0])
++        plain_error = res_plain[1]
++
++        # unmount if the plain mount succeeded
++        if not plain_error:
++            self.try_unmount(self.vdevs[0])
++
++        # now try with as-user=<self>
++        parent_conn, child_conn = Pipe()
++        proc = Process(target=self._mount_as_user_result,
++                       args=(child_conn, int(uid), int(gid), self.vdevs[0],
++                             {'as-user': GLib.Variant('s', self.username)}))
++        proc.start()
++        res_as_user = parent_conn.recv()
++        parent_conn.close()
++        proc.join()
++
++        self.assertTrue(res_as_user[0])
++        as_user_error = res_as_user[1]
++
++        if not plain_error and not as_user_error:
++            return
++        if plain_error and as_user_error:
++            # extract the GDBus error name (e.g. 'org.freedesktop.UDisks2.Error.NotAuthorizedCanObtain')
++            dbus_err_re = re.compile(r'GDBus\.Error:([\w.]+):')
++            plain_match = dbus_err_re.search(plain_error)
++            as_user_match = dbus_err_re.search(as_user_error)
++            plain_err_name = plain_match.group(1) if plain_match else plain_error
++            as_user_err_name = as_user_match.group(1) if as_user_match else as_user_error
++            self.assertEqual(plain_err_name, as_user_err_name,
++                             'as-user=<self> produced a different error than plain mount: '
++                             'plain=%s, as-user=%s' % (plain_error, as_user_error))
++            return
++
++        if plain_error:
++            self.fail('Plain mount failed (%s) but as-user=<self> succeeded' % plain_error)
++        else:
++            self.fail('Plain mount succeeded but as-user=<self> failed: %s' % as_user_error)
++
+     @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
+     def test_mount_as_user(self):
+         """ Test mounting a filesystem on behalf of a different user."""
+@@ -1550,6 +1720,108 @@ class NonPOSIXTestCase(UdisksFSTestCase):
+             self.fail(res[1])
+ 
+ 
++    def _test_mount_fstab_as_user_denied(self, fstab_options, target_user):
++        """ Test that an unprivileged user cannot use 'as-user' option to mount
++            a device listed in /etc/fstab with @fstab_options on behalf of
++            @target_user without polkit authorization.
++        """
++        disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++        self.assertIsNotNone(disk)
++
++        self.addCleanup(self._remove_user, self.username)
++        uid, gid = self._add_user(self.username)
++
++        if target_user != 'root':
++            self.addCleanup(self._remove_user, target_user)
++            self._add_user(target_user)
++
++        self.addCleanup(self.try_unmount, self.vdevs[0])
++        self._prepare_mount_test(disk, True, fstab_options)
++
++        parent_conn, child_conn = Pipe()
++        proc = Process(target=self._mount_with_as_user_fail,
++                       args=(child_conn, int(uid), int(gid), self.vdevs[0], target_user))
++        proc.start()
++        res = parent_conn.recv()
++        parent_conn.close()
++        proc.join()
++
++        if not res[0]:
++            self.fail(res[1])
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_as_user_denied(self):
++        """ Test that user cannot use as-user to mount fstab 'users' device
++            on behalf of another user without authorization.
++        """
++        self._test_mount_fstab_as_user_denied('users', self.target_username)
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_user_as_user_denied(self):
++        """ Test that user cannot use as-user to mount fstab 'user' device
++            on behalf of another user without authorization.
++        """
++        self._test_mount_fstab_as_user_denied('user', self.target_username)
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_x_udisks_auth_as_user_denied(self):
++        """ Test that user cannot use as-user to mount fstab 'x-udisks-auth'
++            device on behalf of another user without authorization.
++        """
++        self._test_mount_fstab_as_user_denied('x-udisks-auth', self.target_username)
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_as_root_denied(self):
++        """ Test that user cannot use as-user=root to mount fstab 'users'
++            device without authorization.
++        """
++        self._test_mount_fstab_as_user_denied('users', 'root')
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_user_as_root_denied(self):
++        """ Test that user cannot use as-user=root to mount fstab 'user'
++            device without authorization.
++        """
++        self._test_mount_fstab_as_user_denied('user', 'root')
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_x_udisks_auth_as_root_denied(self):
++        """ Test that user cannot use as-user=root to mount fstab
++            'x-udisks-auth' device without authorization.
++        """
++        self._test_mount_fstab_as_user_denied('x-udisks-auth', 'root')
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_defaults_as_user_from_root(self):
++        """ Test that root can mount a device listed in /etc/fstab with
++            'defaults' (no 'user', 'users' or 'x-udisks-auth' options)
++            using the 'as-user' option targeting a non-root user.
++        """
++        disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++        self.assertIsNotNone(disk)
++
++        self.addCleanup(self._remove_user, self.target_username)
++        self._add_user(self.target_username)
++
++        self.addCleanup(self.try_unmount, self.vdevs[0])
++        self._prepare_mount_test(disk, True, 'defaults')
++
++        d = dbus.Dictionary(signature='sv')
++        d['as-user'] = self.target_username
++        mnt_path = disk.Mount(d, dbus_interface=self.iface_prefix + '.Filesystem')
++        self.assertIsNotNone(mnt_path)
++        self.assertTrue(os.path.ismount(mnt_path))
++
++    @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++    def test_mount_fstab_defaults_as_user_denied(self):
++        """ Test that an unprivileged user cannot use 'as-user' option to
++            mount a device listed in /etc/fstab with 'defaults' (no 'user',
++            'users' or 'x-udisks-auth') on behalf of another user without
++            polkit authorization.
++        """
++        self._test_mount_fstab_as_user_denied('defaults', self.target_username)
++
++
+ class VFATTestCase(NonPOSIXTestCase):
+     _fs_signature = 'vfat'
+     _can_mount = True
+@@ -1691,6 +1963,12 @@ class UDFTestCase(UdisksFSTestCase):
+     def test_mount_fstab_complex_label_bad(self):
+         super(UDFTestCase, self).test_mount_fstab_complex_label_bad()
+ 
++    def test_mount_as_user_denied(self):
++        self.skipTest('Skipping as-user authorization test for UDF')
++
++    def test_mount_as_user_root_denied(self):
++        self.skipTest('Skipping as-user authorization test for UDF')
++
+ 
+ class FailsystemTestCase(UdisksFSTestCase):
+     # test that not supported operations fail 'nicely'
diff --git a/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb b/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb
index d4c5385ae0..776b5c5043 100644
--- a/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb
+++ b/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb
@@ -18,8 +18,13 @@ DEPENDS += "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
 RDEPENDS:${PN} = "acl"
 
 SRC_URI = " \
-	git://github.com/storaged-project/udisks.git;branch=2.10.x-branch;protocol=https \
-	file://0001-Makefile.am-Dont-include-buildpath.patch \
+    git://github.com/storaged-project/udisks.git;branch=2.10.x-branch;protocol=https \
+    file://0001-Makefile.am-Dont-include-buildpath.patch \
+    file://CVE-2026-7867-1.patch \
+    file://CVE-2026-7867-2.patch \
+    file://CVE-2026-7867-3.patch \
+    file://CVE-2026-7867-4.patch \
+    file://CVE-2026-7867-5.patch \
 "
 SRCREV = "bc623acf9e7488dc105e4b00069d57e303e2616b"
 

[oe][meta-oe][blacksail][PATCH 3/44] tmate: patch CVE-2026-4751

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-4751

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../tmate/files/CVE-2026-4751.patch           | 75 +++++++++++++++++++
 meta-oe/recipes-extended/tmate/tmate_2.4.0.bb |  1 +
 2 files changed, 76 insertions(+)
 create mode 100644 meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch

diff --git a/meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch b/meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch
new file mode 100644
index 0000000000..faf3d2a3ae
--- /dev/null
+++ b/meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch
@@ -0,0 +1,75 @@
+From 27f07d414949259f17aebc02a61f103629d547f1 Mon Sep 17 00:00:00 2001
+From: npt-1707 <npthanh132@gmail.com>
+Date: Tue, 10 Mar 2026 00:19:33 +0800
+Subject: [PATCH] Fix CVE-2018-19387
+
+(cherry picked from commit 3e12f558c7b71b7135403cdd2df77d38538a695c)
+
+CVE: CVE-2026-4751
+Upstream-Status: Backport [https://github.com/tmate-io/tmate/commit/3e12f558c7b71b7135403cdd2df77d38538a695c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ format.c        | 2 ++
+ input.c         | 2 ++
+ server-client.c | 6 ++++++
+ window.c        | 2 ++
+ 4 files changed, 12 insertions(+)
+
+diff --git a/format.c b/format.c
+index f771c85f..3bbb8cf1 100644
+--- a/format.c
++++ b/format.c
+@@ -468,6 +468,8 @@ format_cb_pane_tabs(struct format_tree *ft, struct format_entry *fe)
+ 		return;
+ 
+ 	buffer = evbuffer_new();
++	if (buffer == NULL)
++		fatalx("out of memory");
+ 	for (i = 0; i < wp->base.grid->sx; i++) {
+ 		if (!bit_test(wp->base.tabs, i))
+ 			continue;
+diff --git a/input.c b/input.c
+index 18c8eb9a..8a66d89e 100644
+--- a/input.c
++++ b/input.c
+@@ -766,6 +766,8 @@ input_init(struct window_pane *wp)
+ 	ictx->input_buf = xmalloc(INPUT_BUF_START);
+ 
+ 	ictx->since_ground = evbuffer_new();
++	if (ictx->since_ground == NULL)
++		fatalx("out of memory");
+ 
+ 	input_reset(wp, 0);
+ }
+diff --git a/server-client.c b/server-client.c
+index 21cccc85..e8614d40 100644
+--- a/server-client.c
++++ b/server-client.c
+@@ -121,8 +121,14 @@ server_client_create(int fd)
+ 	c->cmdq->client_exit = 1;
+ 
+ 	c->stdin_data = evbuffer_new();
++	if (c->stdin_data == NULL)
++		fatalx("out of memory");
+ 	c->stdout_data = evbuffer_new();
++	if (c->stdout_data == NULL)
++		fatalx("out of memory");
+ 	c->stderr_data = evbuffer_new();
++	if (c->stderr_data == NULL)
++		fatalx("out of memory");
+ 
+ 	c->tty.fd = -1;
+ 	c->title = NULL;
+diff --git a/window.c b/window.c
+index 45ec7790..9d95bb77 100644
+--- a/window.c
++++ b/window.c
+@@ -945,6 +945,8 @@ window_pane_spawn(struct window_pane *wp, int argc, char **argv,
+ 
+ 	wp->event = bufferevent_new(wp->fd, window_pane_read_callback, NULL,
+ 	    window_pane_error_callback, wp);
++	if (wp->event == NULL)
++		fatalx("out of memory");
+ 
+ 	bufferevent_setwatermark(wp->event, EV_READ, 0, READ_SIZE);
+ 	bufferevent_enable(wp->event, EV_READ|EV_WRITE);
diff --git a/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb b/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb
index 5fb28b0085..9027826ea6 100644
--- a/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb
+++ b/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb
@@ -8,6 +8,7 @@ DEPENDS:append = " libevent libssh msgpack-c ncurses"
 SRC_URI = "\
     git://github.com/tmate-io/tmate.git;protocol=https;branch=master \
     file://0001-fix-finding-msgpack.patch \
+    file://CVE-2026-4751.patch \
 "
 
 SRCREV = "5e00bfa5e137e76c81888727712ced2b3fd99f5b"

[oe][meta-networking][blacksail][PATCH 4/44] tinyproxy: patch CVE-2026-54388

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54388

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../tinyproxy/tinyproxy/CVE-2026-54388.patch  | 32 +++++++++++++++++++
 .../tinyproxy/tinyproxy_1.11.3.bb             |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch

diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch
new file mode 100644
index 0000000000..4dc7f88310
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch
@@ -0,0 +1,32 @@
+From 2639058707dd9d199196b167823ba1865a60ea08 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Thu, 7 May 2026 16:39:48 +0000
+Subject: [PATCH] reqs: prevent multiple content-lengths getting emitted
+
+addressing point 2 of #609
+
+(cherry picked from commit 364cdb67e0ea00a8e4a7037e2693e0711e816adb)
+
+CVE: CVE-2026-54388
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/reqs.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/reqs.c b/src/reqs.c
+index d5037cf..117d755 100644
+--- a/src/reqs.c
++++ b/src/reqs.c
+@@ -681,6 +681,11 @@ add_header_to_connection (pseudomap *hashofheaders, char *header, size_t len)
+         /* Calculate the new length of just the data */
+         len -= sep - header - 1;
+ 
++        /* prevent multiple content-length headers from being inserted */
++        if (!strcasecmp(header, "content-length") &&
++            pseudomap_find (hashofheaders, "content-length"))
++                return 0;
++
+         return pseudomap_append (hashofheaders, header, sep);
+ }
+ 
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
index 25df44301b..46d3a4d7c6 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
@@ -12,6 +12,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
            file://CVE-2026-31842.patch \
            file://CVE-2026-54387.patch \
            file://CVE-2026-55202.patch \
+           file://CVE-2026-54388.patch \
            "
 
 SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"

[oe][meta-oe][blacksail][PATCH 5/44] flatpak: upgrade 1.18.0 -> 1.18.4

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/flatpak/flatpak/blob/1.18.4/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../flatpak/{flatpak_1.18.0.bb => flatpak_1.18.4.bb}          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta-oe/recipes-extended/flatpak/{flatpak_1.18.0.bb => flatpak_1.18.4.bb} (94%)

diff --git a/meta-oe/recipes-extended/flatpak/flatpak_1.18.0.bb b/meta-oe/recipes-extended/flatpak/flatpak_1.18.4.bb
similarity index 94%
rename from meta-oe/recipes-extended/flatpak/flatpak_1.18.0.bb
rename to meta-oe/recipes-extended/flatpak/flatpak_1.18.4.bb
index 879455f63c..74bfb89e62 100644
--- a/meta-oe/recipes-extended/flatpak/flatpak_1.18.0.bb
+++ b/meta-oe/recipes-extended/flatpak/flatpak_1.18.4.bb
@@ -4,11 +4,11 @@ LICENSE = "LGPL-2.1-only"
 LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
 
 SRC_URI = " \
-    git://github.com/flatpak/flatpak;protocol=https;branch=main;tag=${PV} \
+    git://github.com/flatpak/flatpak;protocol=https;branch=flatpak-1.18.x;tag=${PV} \
     file://0001-flatpak-pc-add-pc_sysrootdir.patch \
 "
 
-SRCREV = "5de2b58bdafde88515d9d6b9189bd1cfd3b88c46"
+SRCREV = "a02d0ba48abe9aacc377de15699e5d8c024b5669"
 
 
 inherit meson pkgconfig gettext systemd gtk-doc gobject-introspection python3native mime features_check useradd

[oe][meta-oe][blacksail][PATCH 6/44] xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/flatpak/xdg-dbus-proxy/blob/0.1.9/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../{xdg-dbus-proxy_0.1.7.bb => xdg-dbus-proxy_0.1.9.bb}        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-oe/recipes-support/xdg-dbus-proxy/{xdg-dbus-proxy_0.1.7.bb => xdg-dbus-proxy_0.1.9.bb} (93%)

diff --git a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.9.bb
similarity index 93%
rename from meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb
rename to meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.9.bb
index eb21f701d6..1a65874155 100644
--- a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb
+++ b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.9.bb
@@ -16,7 +16,7 @@ SRC_URI = " \
     file://run-ptest \
     "
 
-SRCREV = "6a170fa77e3cbecb48f9dd2478fe5c0a119eb467"
+SRCREV = "72b40c8f6d9d585cfbdb249690724f740d207087"
 
 CVE_STATUS[CVE-2026-34080] = "fixed-version: fixed in 0.1.7"
 

[oe][meta-webserver][blacksail][PATCH 7/44] swagger-ui: upgrade 5.33.1 -> 5.33.2

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../swagger-ui/{swagger-ui_5.33.1.bb => swagger-ui_5.33.2.bb}   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.1.bb => swagger-ui_5.33.2.bb} (94%)

diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
similarity index 94%
rename from meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb
rename to meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
index db2bb498a8..aeee9e4da6 100644
--- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb
+++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
 SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=main;protocol=https;tag=v${PV}"
 
-SRCREV = "cac3d136b5e37bfbe3288c8591f6f4fcf9870599"
+SRCREV = "e89a91f13cdee432d97ca9d3d1ac1969ff797036"
 
 CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1"
 

[oe][meta-oe][blacksail][PATCH 8/44] freerdp3: upgrade 3.32.1 -> 3.32.2

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Dropped patch that is part of the upstream version.

Changelog:
https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 ...1-winpr-tools-link-only-winpr-public.patch | 76 -------------------
 ...{freerdp3_3.32.1.bb => freerdp3_3.32.2.bb} |  3 +-
 2 files changed, 1 insertion(+), 78 deletions(-)
 delete mode 100644 meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch
 rename meta-oe/recipes-support/freerdp/{freerdp3_3.32.1.bb => freerdp3_3.32.2.bb} (98%)

diff --git a/meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch b/meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch
deleted file mode 100644
index 2dea69c3c4..0000000000
--- a/meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 6682e9ca667271b8ba148a301b4a2f9ac78be2b9 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Mon, 28 Sep 2026 11:57:22 +0200
-Subject: [PATCH] [winpr,tools] link only winpr public
-
-Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/6682e9ca667271b8ba148a301b4a2f9ac78be2b9]
-Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
----
- winpr/tools/CMakeLists.txt          | 18 +++++++++++++-----
- winpr/tools/makecert/CMakeLists.txt |  6 +++---
- 2 files changed, 16 insertions(+), 8 deletions(-)
-
-diff --git a/winpr/tools/CMakeLists.txt b/winpr/tools/CMakeLists.txt
-index 5719c1c65..225b70744 100644
---- a/winpr/tools/CMakeLists.txt
-+++ b/winpr/tools/CMakeLists.txt
-@@ -28,7 +28,8 @@ set(WINPR_TOOLS_API_VERSION "${WINPR_TOOLS_VERSION_MAJOR}")
- 
- set(WINPR_TOOLS_DIR ${CMAKE_CURRENT_SOURCE_DIR})
- set(WINPR_TOOLS_SRCS "")
--set(WINPR_TOOLS_LIBS "")
-+set(WINPR_TOOLS_PUBLIC_LIBS "")
-+set(WINPR_TOOLS_PRIVATE_LIBS "")
- set(WINPR_TOOLS_INCLUDES "")
- set(WINPR_TOOLS_DEFINITIONS "")
- 
-@@ -64,11 +65,18 @@ macro(winpr_tools_include_directory_add)
-   endif()
- endmacro()
- 
--macro(winpr_tools_library_add)
-+macro(winpr_tools_library_public_add)
-   foreach(_lib ${ARGN})
--    list(APPEND WINPR_TOOLS_LIBS "${_lib}")
-+    list(APPEND WINPR_TOOLS_PUBLIC_LIBS "${_lib}")
-   endforeach()
--  set(WINPR_TOOLS_LIBS ${WINPR_TOOLS_LIBS} PARENT_SCOPE)
-+  set(WINPR_TOOLS_PUBLIC_LIBS ${WINPR_TOOLS_PUBLIC_LIBS} PARENT_SCOPE)
-+endmacro()
-+
-+macro(winpr_tools_library_private_add)
-+  foreach(_lib ${ARGN})
-+    list(APPEND WINPR_TOOLS_PRIVATE_LIBS "${_lib}")
-+  endforeach()
-+  set(WINPR_TOOLS_PRIVATE_LIBS ${WINPR_TOOLS_PRIVATE_LIBS} PARENT_SCOPE)
- endmacro()
- 
- macro(winpr_tools_definition_add)
-@@ -89,7 +97,7 @@ addtargetwithresourcefile(${MODULE_NAME} FALSE "${WINPR_VERSION}" WINPR_TOOLS_SR
- 
- add_compile_definitions(${WINPR_DEFINITIONS})
- target_include_directories(${MODULE_NAME} INTERFACE $<INSTALL_INTERFACE:include/winpr${WINPR_VERSION_MAJOR}>)
--target_link_libraries(${MODULE_NAME} PUBLIC ${WINPR_TOOLS_LIBS})
-+target_link_libraries(${MODULE_NAME} PRIVATE ${WINPR_TOOLS_PRIVATE_LIBS} PUBLIC ${WINPR_TOOLS_PUBLIC_LIBS})
- 
- installwithrpath(
-   TARGETS
-diff --git a/winpr/tools/makecert/CMakeLists.txt b/winpr/tools/makecert/CMakeLists.txt
-index 37b831125..0af1fcc08 100644
---- a/winpr/tools/makecert/CMakeLists.txt
-+++ b/winpr/tools/makecert/CMakeLists.txt
-@@ -31,11 +31,11 @@ endif()
- winpr_tools_module_add(${${MODULE_PREFIX}_SRCS})
- 
- if(OPENSSL_FOUND)
--  list(APPEND ${MODULE_PREFIX}_LIBS ${OPENSSL_LIBRARIES})
-+  winpr_tools_library_private_add(${OPENSSL_LIBRARIES})
- endif()
- 
- if(MBEDTLS_FOUND)
--  list(APPEND ${MODULE_PREFIX}_LIBS ${MBEDTLS_LIBRARIES})
-+  winpr_tools_library_private_add(${MBEDTLS_LIBRARIES})
- endif()
- 
--winpr_tools_library_add(${${MODULE_PREFIX}_LIBS} winpr)
-+winpr_tools_library_public_add(winpr)
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.32.1.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.32.2.bb
similarity index 98%
rename from meta-oe/recipes-support/freerdp/freerdp3_3.32.1.bb
rename to meta-oe/recipes-support/freerdp/freerdp3_3.32.2.bb
index f43c8cc7d2..2a985522c0 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.32.1.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.32.2.bb
@@ -8,9 +8,8 @@ RDEPENDS:${PN}-ptest += "cmake coreutils"
 
 inherit pkgconfig cmake ptest
 
-SRCREV = "bf217a504e54cc719880c228e82353382cd7d4fa"
+SRCREV = "97eff6ddfbbfaa8e42a126d362686bd001ff8bdc"
 SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${PV} \
-           file://0001-winpr-tools-link-only-winpr-public.patch \
            file://run-ptest"
 
 

[oe][meta-oe][blacksail][PATCH 9/44] spitools: upgrade 1.1.0 -> 1.1.1

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../spitools/{spitools_1.1.0.bb => spitools_1.1.1.bb}           | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-oe/recipes-support/spitools/{spitools_1.1.0.bb => spitools_1.1.1.bb} (87%)

diff --git a/meta-oe/recipes-support/spitools/spitools_1.1.0.bb b/meta-oe/recipes-support/spitools/spitools_1.1.1.bb
similarity index 87%
rename from meta-oe/recipes-support/spitools/spitools_1.1.0.bb
rename to meta-oe/recipes-support/spitools/spitools_1.1.1.bb
index 69f527a6eb..e2ab0a5d11 100644
--- a/meta-oe/recipes-support/spitools/spitools_1.1.0.bb
+++ b/meta-oe/recipes-support/spitools/spitools_1.1.1.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/cpb-/spi-tools"
 LICENSE = "GPL-2.0-only"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=8c16666ae6c159876a0ba63099614381"
 
-SRCREV = "a19dffe44fee857124a993598caae0c85894f914"
+SRCREV = "74ba65b19e0cf9d1eabd52d17d842200ef901d61"
 
 
 SRC_URI = "git://github.com/cpb-/spi-tools.git;protocol=https;branch=master;tag=${PV}"

[oe][meta-oe][blacksail][PATCH 10/44] libspdm: upgrade 3.8.2 -> 3.8.3

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/DMTF/libspdm/releases/tag/3.8.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libspdm/{libspdm_3.8.2.bb => libspdm_3.8.3.bb}              | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-oe/recipes-support/libspdm/{libspdm_3.8.2.bb => libspdm_3.8.3.bb} (98%)

diff --git a/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb b/meta-oe/recipes-support/libspdm/libspdm_3.8.3.bb
similarity index 98%
rename from meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb
rename to meta-oe/recipes-support/libspdm/libspdm_3.8.3.bb
index f77057d9fd..3ab77a5cfe 100644
--- a/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb
+++ b/meta-oe/recipes-support/libspdm/libspdm_3.8.3.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=8f9b59a81a88da8e812af43728b72dd7"
 DEPENDS = "openssl"
 
 SRC_URI = "git://github.com/DMTF/libspdm.git;branch=release-3.8;protocol=https;tag=${PV}"
-SRCREV = "f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d"
+SRCREV = "98253fee253c9e0b4313e64b373af3c7614c90e5"
 
 inherit cmake
 

[oe][meta-oe][blacksail][PATCH 11/44] libmikmod: upgrade 3.3.14 -> 3.3.15

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://sourceforge.net/p/mikmod/mikmod/ci/libmikmod-3.3.15/tree/libmikmod/NEWS

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../mikmod/{libmikmod_3.3.14.bb => libmikmod_3.3.15.bb}         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-oe/recipes-multimedia/mikmod/{libmikmod_3.3.14.bb => libmikmod_3.3.15.bb} (90%)

diff --git a/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.14.bb b/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.15.bb
similarity index 90%
rename from meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.14.bb
rename to meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.15.bb
index 2468943349..bfd15cabe1 100644
--- a/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.14.bb
+++ b/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.15.bb
@@ -8,7 +8,7 @@ DEPENDS = "alsa-lib texinfo"
 SRC_URI = "\
     ${SOURCEFORGE_MIRROR}/project/mikmod/${BPN}/${PV}/${BPN}-${PV}.tar.gz \
 "
-SRC_URI[sha256sum] = "dffd82b8f254c3489c32098da831f33eac7136843d1e7ccb802f1254ad5b4219"
+SRC_URI[sha256sum] = "dc27b338154b8f88dc9e6317196d42c6abc13bf63c4e055257a18d4e38e1afa2"
 UPSTREAM_CHECK_URI = "https://sourceforge.net/projects/mikmod/files/libmikmod/"
 UPSTREAM_CHECK_REGEX = "/(?P<pver>\d+(\.\d+)+)/"
 

[oe][meta-oe][blacksail][PATCH 12/44] libxmp: upgrade 4.7.3 -> 4.7.4

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/libxmp/libxmp/releases/tag/libxmp-4.7.4

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libxmp/{libxmp_4.7.3.bb => libxmp_4.7.4.bb}                 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-oe/recipes-multimedia/libxmp/{libxmp_4.7.3.bb => libxmp_4.7.4.bb} (85%)

diff --git a/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.3.bb b/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.4.bb
similarity index 85%
rename from meta-oe/recipes-multimedia/libxmp/libxmp_4.7.3.bb
rename to meta-oe/recipes-multimedia/libxmp/libxmp_4.7.4.bb
index 1600686229..a287124801 100644
--- a/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.3.bb
+++ b/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.4.bb
@@ -6,5 +6,5 @@ LIC_FILES_CHKSUM = "file://README;beginline=59;md5=b25470e2863502c9ac9886f09c21a
 inherit cmake pkgconfig
 
 SRC_URI = "git://github.com/libxmp/libxmp.git;protocol=https;branch=master;tag=libxmp-${PV}"
-SRCREV = "1e0812137e4f9e15cc026c0c75af82d71d3cb5ad"
+SRCREV = "5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da"
 

[oe][meta-python][blacksail][PATCH 13/44] python3-pyjwt: upgrade 2.13.0 -> 2.14.0

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../python/{python3-pyjwt_2.13.0.bb => python3-pyjwt_2.14.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-python/recipes-devtools/python/{python3-pyjwt_2.13.0.bb => python3-pyjwt_2.14.0.bb} (84%)

diff --git a/meta-python/recipes-devtools/python/python3-pyjwt_2.13.0.bb b/meta-python/recipes-devtools/python/python3-pyjwt_2.14.0.bb
similarity index 84%
rename from meta-python/recipes-devtools/python/python3-pyjwt_2.13.0.bb
rename to meta-python/recipes-devtools/python/python3-pyjwt_2.14.0.bb
index 1b018f605b..a2cb84587b 100644
--- a/meta-python/recipes-devtools/python/python3-pyjwt_2.13.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pyjwt_2.14.0.bb
@@ -5,7 +5,7 @@ HOMEPAGE = "https://github.com/jpadilla/pyjwt"
 LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=e4b56d2c9973d8cf54655555be06e551"
 
-SRC_URI[sha256sum] = "41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423"
+SRC_URI[sha256sum] = "77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86"
 
 CVE_PRODUCT = "pyjwt"
 

[oe][meta-python][blacksail][PATCH 14/44] python3-cbor2: upgrade 6.1.4 -> 6.1.5

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/agronholm/cbor2/releases/tag/6.1.5

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../python/{python3-cbor2_6.1.4.bb => python3-cbor2_6.1.5.bb}   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-python/recipes-devtools/python/{python3-cbor2_6.1.4.bb => python3-cbor2_6.1.5.bb} (87%)

diff --git a/meta-python/recipes-devtools/python/python3-cbor2_6.1.4.bb b/meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb
similarity index 87%
rename from meta-python/recipes-devtools/python/python3-cbor2_6.1.4.bb
rename to meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb
index 6a894848d6..94d3f30dbb 100644
--- a/meta-python/recipes-devtools/python/python3-cbor2_6.1.4.bb
+++ b/meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb
@@ -3,7 +3,7 @@ LICENSE = "MIT"
 LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a79e64179819c7ce293372c059f1dbd8"
 DEPENDS += "python3-setuptools-scm-native"
 
-SRC_URI[sha256sum] = "01ecc79a28f33d17331943ce508fc1e21f4b06553c73f874f4c77120d72b2ef9"
+SRC_URI[sha256sum] = "6eb06160c42315ac0c4ded461c7d84d92fa18c69d13d17fc1dfc1fae96580c95"
 
 inherit pypi python_setuptools3_rust cargo-update-recipe-crates ptest-python-pytest
 

[oe][meta-networking][blacksail][PATCH 15/44] samba: ignore CVE-2026-2340

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Also confirmed in the release notes[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-2340

[1]https://www.samba.org/samba/history/samba-4.23.8.html

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-networking/recipes-connectivity/samba/samba_4.23.11.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb b/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb
index e498b30bcb..c0d8fe4a00 100644
--- a/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb
+++ b/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb
@@ -46,6 +46,7 @@ UPSTREAM_CHECK_REGEX = "samba\-(?P<pver>\d+\.\d+(\.\d+)+).tar.gz"
 inherit systemd waf-samba cpan-base perlnative update-rc.d perl-version pkgconfig
 
 CVE_STATUS[CVE-2011-2411] = "not-applicable-platform: vulnerable only on HP NonStop Servers"
+CVE_STATUS[CVE-2026-2340] = "fixed-version: fixed since v4.23.8"
 
 # remove default added RDEPENDS on perl
 RDEPENDS:${PN}:remove = "perl"

[oe][meta-oe][blacksail][PATCH 16/44] rapidjson: mark CVE-2024-38517 fixed

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Commit mentioned in the NVD is part of the current version:

$ git log HEAD --oneline | grep 8269bc2b
8269bc2b Prevent int underflow when parsing exponents

Details:
https://nvd.nist.gov/vuln/detail/cve-2024-38517

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb b/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb
index fa20b4d448..f565f0a175 100644
--- a/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb
+++ b/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb
@@ -21,3 +21,5 @@ EXTRA_OECMAKE += "-DLIB_INSTALL_DIR=${libdir}"
 ALLOW_EMPTY:${PN} = "1"
 
 BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2024-38517] = "fixed-version: fixed in the current v1.1.0"

[oe][meta-oe][blacksail][PATCH 17/44] psqlodbc: patch CVE-2026-109448

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Backport the commit identified by Debian[1]

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-109448

[1]https://security-tracker.debian.org/tracker/CVE-2026-109448

PTEST pass:
root@qemuarm64:~# ptest-runner psqlodbc
START: ptest-runner
2026-10-17T09:22
BEGIN: /usr/lib/psqlodbc/ptest
...
DURATION: 43
END: /usr/lib/psqlodbc/ptest
2026-10-17T09:23
STOP: ptest-runner
TOTAL: 1 FAIL: 0

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../psqlodbc/files/CVE-2026-109448.patch      | 243 ++++++++++++++++++
 .../psqlodbc/psqlodbc_18.00.0002.bb           |   1 +
 2 files changed, 244 insertions(+)
 create mode 100644 meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch

diff --git a/meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch b/meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch
new file mode 100644
index 0000000000..12f6cdd1d8
--- /dev/null
+++ b/meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch
@@ -0,0 +1,243 @@
+From 5c9443fb0c8c0e263e1f8d0298987e91c4f5ccea Mon Sep 17 00:00:00 2001
+From: Dave Cramer <davecramer@gmail.com>
+Date: Mon, 12 Oct 2026 11:47:08 -0400
+Subject: [PATCH] Merge commit from fork
+
+The APD, IPD and put-data binding counts are SQLSMALLINT.  Binding
+parameter 32768 wrapped the count to -32768, so execution failed with
+07002 even though every parameter was bound; binding parameter 32769
+then extended the arrays with a memset starting at index -32768,
+writing zeros up to 1.25 MiB before the start of the APD array (and
+likewise for the IPD and put-data arrays), which corrupts the heap.
+
+SQLNumParams and SQL_DESC_COUNT are SQLSMALLINT too, so 32767 is the
+largest parameter count ODBC can describe.  PGAPI_BindParameter now
+returns 07009 for parameter numbers outside 1..32767, which also covers
+parameter number 0 for applications that call the driver without a
+driver manager.
+
+New param-count-limit test binds 32767, 32768 and 32769 parameters.
+
+Assisted-By: Claude
+(cherry picked from commit 86e4418e9553aa0891315db7531f8cd31eb1575e)
+
+CVE: CVE-2026-109448
+Upstream-Status: Backport [https://github.com/postgresql-interfaces/psqlodbc/commit/86e4418e9553aa0891315db7531f8cd31eb1575e]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ bind.c                              |  12 +++
+ test/expected/param-count-limit.out |  12 +++
+ test/src/param-count-limit-test.c   | 142 ++++++++++++++++++++++++++++
+ test/tests                          |   1 +
+ 4 files changed, 167 insertions(+)
+ create mode 100644 test/expected/param-count-limit.out
+ create mode 100644 test/src/param-count-limit-test.c
+
+diff --git a/bind.c b/bind.c
+index 3b566ec..b3e5ca3 100644
+--- a/bind.c
++++ b/bind.c
+@@ -16,6 +16,7 @@
+ /* #include <stdlib.h> */
+ #include <string.h>
+ #include <ctype.h>
++#include <limits.h>
+ #include "bind.h"
+ #include "misc.h"
+ 
+@@ -57,6 +58,17 @@ PGAPI_BindParameter(HSTMT hstmt,
+ 	}
+ 	SC_clear_error(stmt);
+ 
++	/*
++	 * The APD, IPD and put-data counts are SQLSMALLINT, like SQLNumParams
++	 * and SQL_DESC_COUNT, so a larger parameter number would wrap the count
++	 * negative and the next binding would write before the bindings array.
++	 */
++	if (ipar < 1 || ipar > SHRT_MAX)
++	{
++		SC_set_error(stmt, STMT_BAD_PARAMETER_NUMBER_ERROR, "Invalid parameter number for PGAPI_BindParameter.", func);
++		return SQL_ERROR;
++	}
++
+ 	apdopts = SC_get_APDF(stmt);
+ 	if (apdopts->allocated < ipar)
+ 		extend_parameter_bindings(apdopts, ipar);
+diff --git a/test/expected/param-count-limit.out b/test/expected/param-count-limit.out
+new file mode 100644
+index 0000000..623bcbf
+--- /dev/null
++++ b/test/expected/param-count-limit.out
+@@ -0,0 +1,12 @@
++connected
++APD SQL_DESC_COUNT=-1: error SQLSTATE=07009
++APD bind 1 after SQL_DESC_COUNT=-1: ok
++IPD SQL_DESC_COUNT=-1: error SQLSTATE=07009
++IPD bind 1 after SQL_DESC_COUNT=-1: ok
++bind 0: error SQLSTATE=07009
++32767 params, bind 32767: ok
++32767 params, execute: ok
++32767 params, result 1
++32768 params, bind 32768: error SQLSTATE=07009
++32769 params, bind 32768: error SQLSTATE=07009
++disconnecting
+diff --git a/test/src/param-count-limit-test.c b/test/src/param-count-limit-test.c
+new file mode 100644
+index 0000000..e9554cd
+--- /dev/null
++++ b/test/src/param-count-limit-test.c
+@@ -0,0 +1,142 @@
++/*
++ * Test the limits on parameter numbers and descriptor counts.  The driver
++ * keeps parameter binding counts in SQLSMALLINT, so SQLBindParameter with a
++ * parameter number above 32767, or SQL_DESC_COUNT set negative, used to
++ * wrap the count negative and make the next binding write zeros before the
++ * start of the bindings array.
++ */
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++
++#include "common.h"
++
++#define MAX_PARAMS	32767
++
++static void
++print_state(const char *what, SQLRETURN rc, SQLSMALLINT htype, SQLHANDLE h)
++{
++	SQLCHAR		state[6] = "";
++	SQLINTEGER	native;
++	SQLCHAR		msg[256];
++	SQLSMALLINT	len;
++
++	printf("%s: ", what);
++	if (SQL_SUCCEEDED(rc))
++	{
++		printf("ok\n");
++		return;
++	}
++	SQLGetDiagRec(htype, h, 1, state, &native, msg, sizeof(msg), &len);
++	printf("error SQLSTATE=%s\n", (char *) state);
++}
++
++/* SELECT 1 WHERE 1 IN (?, ?, ..., ?) with nparams markers, all bound to 1 */
++static void
++run_with_params(int nparams)
++{
++	SQLRETURN	rc;
++	HSTMT		hstmt = SQL_NULL_HSTMT;
++	SQLINTEGER	one = 1;
++	SQLINTEGER	result = 0;
++	char	   *sql, *p;
++	char		what[64];
++	int			i;
++
++	rc = SQLAllocHandle(SQL_HANDLE_STMT, conn, &hstmt);
++	CHECK_CONN_RESULT(rc, "SQLAllocHandle failed", conn);
++
++	sql = malloc(32 + 2 * nparams);
++	p = sql + sprintf(sql, "SELECT 1 WHERE 1 IN (");
++	for (i = 0; i < nparams; i++)
++	{
++		if (i > 0)
++			*p++ = ',';
++		*p++ = '?';
++	}
++	strcpy(p, ")");
++
++	for (i = 1; i <= nparams; i++)
++	{
++		rc = SQLBindParameter(hstmt, (SQLUSMALLINT) i, SQL_PARAM_INPUT,
++							  SQL_C_SLONG, SQL_INTEGER, 0, 0, &one, 0, NULL);
++		if (!SQL_SUCCEEDED(rc))
++			break;
++	}
++	snprintf(what, sizeof(what), "%d params, bind %d", nparams, i <= nparams ? i : nparams);
++	print_state(what, rc, SQL_HANDLE_STMT, hstmt);
++
++	if (SQL_SUCCEEDED(rc))
++	{
++		rc = SQLExecDirect(hstmt, (SQLCHAR *) sql, SQL_NTS);
++		snprintf(what, sizeof(what), "%d params, execute", nparams);
++		print_state(what, rc, SQL_HANDLE_STMT, hstmt);
++	}
++	if (SQL_SUCCEEDED(rc))
++	{
++		rc = SQLBindCol(hstmt, 1, SQL_C_SLONG, &result, 0, NULL);
++		CHECK_STMT_RESULT(rc, "SQLBindCol failed", hstmt);
++		rc = SQLFetch(hstmt);
++		CHECK_STMT_RESULT(rc, "SQLFetch failed", hstmt);
++		printf("%d params, result %d\n", nparams, (int) result);
++	}
++
++	free(sql);
++	SQLFreeHandle(SQL_HANDLE_STMT, hstmt);
++}
++
++/* Set SQL_DESC_COUNT of the statement's APD or IPD to -1, then bind */
++static void
++negative_desc_count(SQLINTEGER desc_attr, const char *desc_name)
++{
++	SQLRETURN	rc;
++	HSTMT		hstmt = SQL_NULL_HSTMT;
++	SQLHDESC	hdesc;
++	SQLINTEGER	one = 1;
++	char		what[64];
++
++	rc = SQLAllocHandle(SQL_HANDLE_STMT, conn, &hstmt);
++	CHECK_CONN_RESULT(rc, "SQLAllocHandle failed", conn);
++
++	rc = SQLGetStmtAttr(hstmt, desc_attr, &hdesc, 0, NULL);
++	CHECK_STMT_RESULT(rc, "SQLGetStmtAttr failed", hstmt);
++
++	rc = SQLSetDescField(hdesc, 0, SQL_DESC_COUNT, (SQLPOINTER) (SQLLEN) -1, 0);
++	snprintf(what, sizeof(what), "%s SQL_DESC_COUNT=-1", desc_name);
++	print_state(what, rc, SQL_HANDLE_DESC, hdesc);
++
++	rc = SQLBindParameter(hstmt, 1, SQL_PARAM_INPUT, SQL_C_SLONG,
++						  SQL_INTEGER, 0, 0, &one, 0, NULL);
++	snprintf(what, sizeof(what), "%s bind 1 after SQL_DESC_COUNT=-1", desc_name);
++	print_state(what, rc, SQL_HANDLE_STMT, hstmt);
++
++	SQLFreeHandle(SQL_HANDLE_STMT, hstmt);
++}
++
++int
++main(int argc, char **argv)
++{
++	SQLRETURN	rc;
++	HSTMT		hstmt = SQL_NULL_HSTMT;
++	SQLINTEGER	one = 1;
++
++	test_connect();
++
++	negative_desc_count(SQL_ATTR_APP_PARAM_DESC, "APD");
++	negative_desc_count(SQL_ATTR_IMP_PARAM_DESC, "IPD");
++
++	rc = SQLAllocHandle(SQL_HANDLE_STMT, conn, &hstmt);
++	CHECK_CONN_RESULT(rc, "SQLAllocHandle failed", conn);
++	rc = SQLBindParameter(hstmt, 0, SQL_PARAM_INPUT, SQL_C_SLONG,
++						  SQL_INTEGER, 0, 0, &one, 0, NULL);
++	print_state("bind 0", rc, SQL_HANDLE_STMT, hstmt);
++	SQLFreeHandle(SQL_HANDLE_STMT, hstmt);
++
++	run_with_params(MAX_PARAMS);
++	run_with_params(MAX_PARAMS + 1);
++	run_with_params(MAX_PARAMS + 2);
++
++	test_disconnect();
++
++	return 0;
++}
+diff --git a/test/tests b/test/tests
+index 5074bca..c8af1ab 100644
+--- a/test/tests
++++ b/test/tests
+@@ -63,6 +63,7 @@ TESTBINS = exe/connect-test \
+ 	exe/descriptors-free-test \
+ 	exe/primarykeys-include-test \
+ 	exe/interval-overflow-test \
++	exe/param-count-limit-test \
+ 	exe/conn-settings-test \
+ 	exe/percent-decode-test \
+ 	exe/dbms-version-test \
diff --git a/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb b/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb
index ae1d603e1d..9756bcfad2 100644
--- a/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb
+++ b/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb
@@ -23,6 +23,7 @@ SRC_URI = "git://github.com/postgresql-interfaces/psqlodbc.git;protocol=https;br
            file://psqlodbc-remove-some-checks-for-cross-compiling.patch \
            file://psqlodbc-donot-use-the-hardcode-libdir.patch \
            file://psqlodbc-fix-for-ptest-support.patch \
+           file://CVE-2026-109448.patch \
            file://run-ptest \
            "
 

[oe][meta-networking][blacksail][PATCH 18/44] proftpd: mark CVE-2026-53994 fixed

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Debian[1] identified the issue[2] associated with this CVE.
Changelog[3] confirms the resolution.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53994

[]https://security-tracker.debian.org/tracker/CVE-2026-53994
[]https://github.com/proftpd/proftpd/issues/2115
[]https://github.com/proftpd/proftpd/blob/v1.3.9b/NEWS#L35

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb
index 81a7094359..5c194ebb23 100644
--- a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb
+++ b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb
@@ -26,6 +26,7 @@ CVE_VERSION_SUFFIX = "alphabetical"
 
 CVE_STATUS[CVE-2001-0027] = "fixed-version: version 1.2.0rc3 removed affected module"
 CVE_STATUS[CVE-2021-47865] = "upstream-wontfix: it is not a vulnerability but inproper configuration"
+CVE_STATUS[CVE-2026-53994] = "fixed-version: fixed since v1.3.9b"
 
 EXTRA_OECONF += "--enable-largefile INSTALL=install"
 

[oe][meta-networking][blacksail][PATCH 19/44] postfix: ignore CVE-2023-32182

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2023-32182

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb b/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb
index 99a77dd6c3..fe0dd95994 100644
--- a/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb
+++ b/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb
@@ -249,3 +249,5 @@ FILES:${PN}-bin += "${localstatedir} ${bindir}/* ${sbindir}/* \
 FILES:${PN}-cfg = "${sysconfdir}"
 FILES:${PN}-dbg += "${libexecdir}/postfix/.debug"
 ALLOW_EMPTY:${PN} = "1"
+
+CVE_STATUS[CVE-2023-32182] = "not-applicable-platform: this vulnerability is Suse specific"

[oe][meta-oe][blacksail][PATCH 20/44] poppler: patch CVE-2026-102621

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102621

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../poppler/poppler/CVE-2026-102621.patch     | 40 +++++++++++++++++++
 .../poppler/poppler_26.08.0.bb                |  1 +
 2 files changed, 41 insertions(+)
 create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch

diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch
new file mode 100644
index 0000000000..823c3a33db
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch
@@ -0,0 +1,40 @@
+From eaeeb2fe58aad490bc82aa33d75217dead0dd0de Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:02:27 +0200
+Subject: [PATCH] Fix integer overflow in SplashClip::clipToPath
+
+Issue #1763
+
+(cherry picked from commit 323c91036d99926a8b90dc14329f7b40aece22f8)
+
+CVE: CVE-2026-102621
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ splash/SplashClip.cc | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/splash/SplashClip.cc b/splash/SplashClip.cc
+index 78249652c..b096beebd 100644
+--- a/splash/SplashClip.cc
++++ b/splash/SplashClip.cc
+@@ -23,6 +23,8 @@
+ #include <config.h>
+ 
+ #include <algorithm>
++#include "goo/GooCheckedOps.h"
++#include "goo/GooLikely.h"
+ #include "SplashErrorCodes.h"
+ #include "SplashMath.h"
+ #include "SplashPath.h"
+@@ -211,7 +213,9 @@ SplashError SplashClip::clipToPath(const SplashPath &path, const std::array<doub
+     } else {
+         if (antialias) {
+             xPath.aaScale();
+-            yMinAA = yMinI * splashAASize;
++            if (unlikely(checkedMultiply(yMinI, splashAASize, &yMinAA))) {
++                return SplashError::Generic;
++            }
+             yMaxAA = (yMaxI + 1) * splashAASize - 1;
+         } else {
+             yMinAA = yMinI;
diff --git a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
index 8b0783d001..f24ca34366 100644
--- a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
+++ b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
@@ -8,6 +8,7 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
            file://basename-include.patch \
            file://0001-cmake-Do-not-use-isystem.patch \
            file://0001-workaround-build-racing.patch \
+           file://CVE-2026-102621.patch \
            "
 SRC_URI[sha256sum] = "dc906e68cea698109706ac6aa3d2c9d4512fcfcac42d90b8afcda486d1b9abd0"
 

[oe][meta-oe][blacksail][PATCH 21/44] poppler: patch CVE-2026-102620

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Also backport commit[1] to allow cherry-pick of the commit fixing the CVE.

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102620

[1]https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../poppler/poppler/CVE-2026-102620-1.patch   | 145 ++++++++++++++++++
 .../poppler/poppler/CVE-2026-102620-2.patch   |  34 ++++
 .../poppler/poppler_26.08.0.bb                |   2 +
 3 files changed, 181 insertions(+)
 create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch
 create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch

diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch
new file mode 100644
index 0000000000..e85866eddf
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch
@@ -0,0 +1,145 @@
+From b8ce8bb5df02fd3a70f4b34f3d64c88df7089409 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:30:32 +0200
+Subject: [PATCH] FoFiTrueType::cvtSfnts: Move variables closer to where they
+ are used
+
+(cherry picked from commit 786b06dac87dbe28e85ec7ea3d340810f151c25b)
+
+CVE: CVE-2026-102620
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ fofi/FoFiTrueType.cc | 42 +++++++++++++++++++-----------------------
+ 1 file changed, 19 insertions(+), 23 deletions(-)
+
+diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
+index 133fbc45e..e15cfc576 100644
+--- a/fofi/FoFiTrueType.cc
++++ b/fofi/FoFiTrueType.cc
+@@ -1058,9 +1058,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+     TrueTypeTable newTables[nT42Tables];
+     unsigned char tableDir[12 + nT42Tables * 16];
+     bool ok;
+-    unsigned int checksum;
+-    int nNewTables;
+-    int glyfTableLen, length, glyfPos, j, k;
+     std::array<unsigned char, 36> vheaTab = {
+         0, 1, 0, 0, // table version number
+         0, 0, // ascent
+@@ -1081,8 +1078,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+         0, 1 // number of advance heights in vmtx table
+     };
+     std::vector<unsigned char> vmtxTab;
+-    bool needVhea, needVmtx;
+-    int advance;
+ 
+     *maxUsedGlyph = -1;
+ 
+@@ -1116,7 +1111,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+     i = seekTable("loca");
+     pos = tables[i].offset;
+     i = seekTable("glyf");
+-    glyfTableLen = tables[i].len;
++    const int glyfTableLen = tables[i].len;
+     ok = true;
+     for (i = 0; i <= nGlyphs; ++i) {
+         locaTable[i].idx = i;
+@@ -1169,16 +1164,16 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+     }
+ 
+     // count the number of tables
+-    nNewTables = 0;
++    int nNewTables = 0;
+     for (i = 0; i < nT42Tables; ++i) {
+         if (t42Tables[i].required || seekTable(t42Tables[i].tag) >= 0) {
+             ++nNewTables;
+         }
+     }
+-    advance = 0; // make gcc happy
++    int advance = 0; // make gcc happy
+     if (needVerticalMetrics) {
+-        needVhea = seekTable("vhea") < 0;
+-        needVmtx = seekTable("vmtx") < 0;
++        const bool needVhea = seekTable("vhea") < 0;
++        const bool needVmtx = seekTable("vmtx") < 0;
+         if (needVhea || needVmtx) {
+             i = seekTable("head");
+             advance = getU16BE(tables[i].offset + 18, &ok); // units per em
+@@ -1194,10 +1189,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+     // construct the new table headers, including table checksums
+     // (pad each table out to a multiple of 4 bytes)
+     pos = 12 + nNewTables * 16;
+-    k = 0;
++    int k = 0;
+     for (i = 0; i < nT42Tables; ++i) {
+-        length = -1;
+-        checksum = 0; // make gcc happy
++        int length = -1;
++        unsigned int checksum = 0; // make gcc happy
+         if (i == t42HeadTable) {
+             length = 54;
+             checksum = computeTableChecksum(headData);
+@@ -1207,8 +1202,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+         } else if (i == t42GlyfTable) {
+             length = 0;
+             checksum = 0;
+-            glyfPos = tables[seekTable("glyf")].offset;
+-            for (j = 0; j < nGlyphs; ++j) {
++            const int glyfPos = tables[seekTable("glyf")].offset;
++            for (int j = 0; j < nGlyphs; ++j) {
+                 length += locaTable[j].len;
+                 if (length & 3) {
+                     length += 4 - (length & 3);
+@@ -1218,7 +1213,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+                 }
+             }
+         } else {
+-            if ((j = seekTable(t42Tables[i].tag)) >= 0) {
++            const int j = seekTable(t42Tables[i].tag);
++            if (j >= 0) {
+                 length = tables[j].len;
+                 if (checkRegion(tables[j].offset, length)) {
+                     checksum = computeTableChecksum(std::span(file.data() + tables[j].offset, length));
+@@ -1298,7 +1294,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+     }
+ 
+     // compute the font checksum and store it in the head table
+-    checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
++    unsigned int checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
+     for (i = 0; i < nNewTables; ++i) {
+         checksum += newTables[i].checksum;
+     }
+@@ -1325,11 +1321,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+         if (i == t42HeadTable) {
+             dumpString(headData, outputFunc, outputStream);
+         } else if (i == t42LocaTable) {
+-            length = (nGlyphs + 1) * (locaFmt ? 4 : 2);
+             dumpString(locaData, outputFunc, outputStream);
+         } else if (i == t42GlyfTable) {
+-            glyfPos = tables[seekTable("glyf")].offset;
+-            for (j = 0; j < nGlyphs; ++j) {
++            const int glyfPos = tables[seekTable("glyf")].offset;
++            for (int j = 0; j < nGlyphs; ++j) {
+                 if (locaTable[j].len > 0 && checkRegion(glyfPos + locaTable[j].origOffset, locaTable[j].len)) {
+                     dumpString(std::span(file.data() + glyfPos + locaTable[j].origOffset, locaTable[j].len), outputFunc, outputStream);
+                 }
+@@ -1338,13 +1333,14 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+             // length == 0 means the table is missing and the error was
+             // already reported during the construction of the table
+             // headers
+-            if ((length = newTables[i].len) > 0) {
+-                if ((j = seekTable(t42Tables[i].tag)) >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
++            const int length = newTables[i].len;
++            if (length > 0) {
++                const int j = seekTable(t42Tables[i].tag);
++                if (j >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
+                     dumpString(std::span(file.data() + tables[j].offset, tables[j].len), outputFunc, outputStream);
+                 } else if (needVerticalMetrics && i == t42VheaTable) {
+                     if (unlikely(static_cast<size_t>(length) > sizeof(vheaTab))) {
+                         error(errSyntaxWarning, -1, "length bigger than vheaTab size");
+-                        length = sizeof(vheaTab);
+                     }
+                     dumpString(vheaTab, outputFunc, outputStream);
+                 } else if (needVerticalMetrics && i == t42VmtxTable) {
diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch
new file mode 100644
index 0000000000..e41e65ffd9
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch
@@ -0,0 +1,34 @@
+From ac82c990768a4cb3dd4fd15edb92af97b4ac6589 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:47:43 +0200
+Subject: [PATCH] Fix integer overflow in FoFiTrueType::cvtSfnts
+
+Issue #1762
+
+(cherry picked from commit 245d3c6823377755f2c1d5fdddd010279c6ed94d)
+
+CVE: CVE-2026-102620
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ fofi/FoFiTrueType.cc | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
+index e15cfc576..9e280fe89 100644
+--- a/fofi/FoFiTrueType.cc
++++ b/fofi/FoFiTrueType.cc
+@@ -1204,7 +1204,11 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+             checksum = 0;
+             const int glyfPos = tables[seekTable("glyf")].offset;
+             for (int j = 0; j < nGlyphs; ++j) {
+-                length += locaTable[j].len;
++                if (unlikely(checkedAdd(length, locaTable[j].len, &length))) {
++                    error(errSyntaxError, -1, "Integer overflow in glyph table length calculation");
++                    ok = false;
++                    break;
++                }
+                 if (length & 3) {
+                     length += 4 - (length & 3);
+                 }
diff --git a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
index f24ca34366..6cfcf3cf0f 100644
--- a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
+++ b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
@@ -9,6 +9,8 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
            file://0001-cmake-Do-not-use-isystem.patch \
            file://0001-workaround-build-racing.patch \
            file://CVE-2026-102621.patch \
+           file://CVE-2026-102620-1.patch \
+           file://CVE-2026-102620-2.patch \
            "
 SRC_URI[sha256sum] = "dc906e68cea698109706ac6aa3d2c9d4512fcfcac42d90b8afcda486d1b9abd0"
 

[oe][meta-oe][blacksail][PATCH 22/44] opensc: patch CVE-2026-103531

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-103531

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../opensc/opensc/CVE-2026-103531.patch       | 54 +++++++++++++++++++
 .../recipes-support/opensc/opensc_0.27.1.bb   |  1 +
 2 files changed, 55 insertions(+)
 create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch

diff --git a/meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch b/meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch
new file mode 100644
index 0000000000..22776e525b
--- /dev/null
+++ b/meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch
@@ -0,0 +1,54 @@
+From 4b0f46d922866d9453e3631ff5e0a24900fae8dd Mon Sep 17 00:00:00 2001
+From: wanglanlan <wanglanlan@users.noreply.github.com>
+Date: Wed, 2 Sep 2026 08:36:47 +0000
+Subject: [PATCH] setcos: Fix buffer overflow in setcos_construct_fci_44
+
+The FCI construction copied type_attr, sec_attr and prop_attr of the
+file into a fixed 64-byte stack buffer without checking the length.
+Malicious or corrupted attribute lengths (e.g. prop_attr_len > 64,
+reachable through fuzz_pkcs15init and attacker-controlled card
+responses) caused a stack buffer overflow (write).
+
+Return SC_ERROR_INVALID_DATA if any attribute exceeds the buffer size.
+
+Found with the fuzz_pkcs15init fuzzer.
+
+Co-Authored-By: Claude <noreply@anthropic.com>
+(cherry picked from commit ad730304052937c32b4eb489a06835ac6123632c)
+
+CVE: CVE-2026-103531
+Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libopensc/card-setcos.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/libopensc/card-setcos.c b/src/libopensc/card-setcos.c
+index 0ebe7c34f..8c7baa3e4 100644
+--- a/src/libopensc/card-setcos.c
++++ b/src/libopensc/card-setcos.c
+@@ -218,6 +218,8 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
+ 
+ 	/* Type */
+ 	if (file->type_attr_len) {
++		if (file->type_attr_len > sizeof(buf))
++			LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ 		memcpy(buf, file->type_attr, file->type_attr_len);
+ 		sc_asn1_put_tag(0x82, buf, file->type_attr_len, p, *outlen - (p - out), &p);
+ 	} else {
+@@ -271,11 +273,15 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
+ 	}
+ 
+ 	/* Security Attributes */
++	if (file->sec_attr_len > sizeof(buf))
++		LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ 	memcpy(buf, file->sec_attr, file->sec_attr_len);
+ 	sc_asn1_put_tag(0x86, buf, file->sec_attr_len, p, *outlen - (p - out), &p);
+ 
+ 	/* Life cycle status */
+ 	if (file->prop_attr_len) {
++		if (file->prop_attr_len > sizeof(buf))
++			LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ 		memcpy(buf, file->prop_attr, file->prop_attr_len);
+ 		sc_asn1_put_tag(0x8A, buf, file->prop_attr_len, p, *outlen - (p - out), &p);
+ 	}
diff --git a/meta-oe/recipes-support/opensc/opensc_0.27.1.bb b/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
index a1930744ea..bcd94dfb90 100644
--- a/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
+++ b/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
@@ -14,6 +14,7 @@ DEPENDS = "openssl"
 SRCREV = "19868984dc4dc697af6a86d65ab32a1f19a43ea4"
 SRC_URI = "git://github.com/OpenSC/OpenSC;branch=master;protocol=https \
            file://0001-Changes-for-OpenSSL-4.0.0.patch \
+           file://CVE-2026-103531.patch \
            "
 
 CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"

[oe][meta-multimedia][blacksail][PATCH 23/44] pjproject: mark CVE-2026-26967 fixed

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-26967

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 8aa7775205..59684ac7c7 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -118,3 +118,5 @@ RDEPENDS:python3-pjsua2 = "python3-core"
 # and ${PN}-staticdev (the .a files) by bitbake's own default FILES
 # patterns - ${PN} itself ships nothing.
 ALLOW_EMPTY:${PN} = "1"
+
+CVE_STATUS[CVE-2026-26967] = "fixed-version: fixed in v2.17"

[oe][meta-multimedia][blacksail][PATCH 24/44] pjproject: patch CVE-2026-57160

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57160

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-57160.patch  | 42 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 43 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
new file mode 100644
index 0000000000..a25ed5a28e
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
@@ -0,0 +1,42 @@
+From b14ebbccf5c228ca298ad11ecae2cedde792edae Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:43:46 +0700
+Subject: [PATCH] Merge commit from fork
+
+When printing a generic array header (e.g. Allow, Require, Supported,
+Unsupported), the ": " delimiter following the header name was written
+with two unchecked stores. copy_advance() only guarantees that the
+header name itself fits, leaving as little as one byte before the end
+of the buffer. The colon then consumed the last byte and the trailing
+space was written one byte past the buffer end.
+
+Use copy_advance_char_check() for both delimiter bytes, matching the
+boundary-checked pattern already used by every other header printer in
+this file.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit d6a0e7f76611c3a6f530ee051e3e7a622bb1748c)
+
+CVE: CVE-2026-57160
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/d6a0e7f76611c3a6f530ee051e3e7a622bb1748c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjsip/src/pjsip/sip_msg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pjsip/src/pjsip/sip_msg.c b/pjsip/src/pjsip/sip_msg.c
+index 06c8cce86..cdc99ff9e 100644
+--- a/pjsip/src/pjsip/sip_msg.c
++++ b/pjsip/src/pjsip/sip_msg.c
+@@ -964,8 +964,8 @@ static int pjsip_generic_array_hdr_print( pjsip_generic_array_hdr *hdr,
+                             &hdr->sname : &hdr->name;
+ 
+     copy_advance(p, (*hname));
+-    *p++ = ':';
+-    *p++ = ' ';
++    copy_advance_char_check(p, ':');
++    copy_advance_char_check(p, ' ');
+ 
+     if (hdr->count > 0) {
+         unsigned i;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 59684ac7c7..254a2952a2 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -14,6 +14,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 
 SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag=${PV} \
            file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
+           file://CVE-2026-57160.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 25/44] pjproject: patch CVE-2026-57161

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57161

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-57161.patch  | 49 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 50 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
new file mode 100644
index 0000000000..3296013efd
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
@@ -0,0 +1,49 @@
+From 656cd5ec76f0178448053a9ca44ce075cd7a27f9 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:44:40 +0700
+Subject: [PATCH] Merge commit from fork
+
+Bound the number of Service-Route URIs stored in the fixed-size uri[]
+array by checking uri_cnt against PJ_ARRAY_SIZE(uri) before each write.
+Previously the count was only checked as the do/while continuation
+condition, which does not catch accumulation across multiple
+single-URI Service-Route headers, allowing a registrar response with
+more than PJSUA_ACC_MAX_PROXIES headers to write past the array.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit acc03b57cef7a7d31b8e1f5b9117437d7e87c591)
+
+CVE: CVE-2026-57161
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/acc03b57cef7a7d31b8e1f5b9117437d7e87c591]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjsip/src/pjsua-lib/pjsua_acc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/pjsip/src/pjsua-lib/pjsua_acc.c b/pjsip/src/pjsua-lib/pjsua_acc.c
+index f52518a2a..08c5efced 100644
+--- a/pjsip/src/pjsua-lib/pjsua_acc.c
++++ b/pjsip/src/pjsua-lib/pjsua_acc.c
+@@ -2278,14 +2278,14 @@ static void update_service_route(pjsua_acc *acc, pjsip_rx_data *rdata)
+                 return;
+             }
+ 
++            if (uri_cnt >= PJ_ARRAY_SIZE(uri)) {
++                PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
++                return;
++            }
++
+             uri[uri_cnt++] = h->name_addr.uri;
+             h = h->next;
+-        } while (h != hr && uri_cnt != PJ_ARRAY_SIZE(uri));
+-
+-        if (h != hr) {
+-            PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
+-            return;
+-        }
++        } while (h != hr);
+ 
+         /* Prepare to find next Service-Route header */
+         hsr = hsr->next;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 254a2952a2..4c00c4215c 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -15,6 +15,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag=${PV} \
            file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
            file://CVE-2026-57160.patch \
+           file://CVE-2026-57161.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 26/44] pjproject: patch CVE-2026-57162

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57162

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-57162.patch  | 43 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 44 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch
new file mode 100644
index 0000000000..85a9394e25
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch
@@ -0,0 +1,43 @@
+From 1b64bfb240731bbf0fc194dec68bb9d9b08a20b2 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:45:33 +0700
+Subject: [PATCH] Merge commit from fork
+
+sdes_encode_sdp() in transport_srtp_sdes.c wrote each parsed crypto tag
+into the fixed int tags[64] array without bounding the count, while the
+SDP parser allows up to PJMEDIA_MAX_SDP_ATTR (68) attributes. Reject
+the SDP with PJMEDIA_SRTP_ESDPINCRYPTO once the array capacity is
+reached, before the out-of-bounds write.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9)
+
+CVE: CVE-2026-57162
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjmedia/src/pjmedia/transport_srtp_sdes.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/pjmedia/src/pjmedia/transport_srtp_sdes.c b/pjmedia/src/pjmedia/transport_srtp_sdes.c
+index 8f98292ba..45038e585 100644
+--- a/pjmedia/src/pjmedia/transport_srtp_sdes.c
++++ b/pjmedia/src/pjmedia/transport_srtp_sdes.c
+@@ -478,6 +478,15 @@ static pj_status_t sdes_encode_sdp( pjmedia_transport *tp,
+ 
+                 has_crypto_attr = PJ_TRUE;
+ 
++                /* Bound writes to tags[] by its capacity. m_rem->attr_count
++                 * is capped by the SDP parser at PJMEDIA_MAX_SDP_ATTR, which
++                 * can exceed PJ_ARRAY_SIZE(tags); without this guard a remote
++                 * peer can overflow the stack array by sending more than
++                 * PJ_ARRAY_SIZE(tags) a=crypto attributes.
++                 */
++                if (cr_attr_count >= PJ_ARRAY_SIZE(tags))
++                    return PJMEDIA_SRTP_ESDPINCRYPTO;
++
+                 status = parse_attr_crypto(srtp->pool, m_rem->attr[i],
+                                            &tmp_rx_crypto,
+                                            &tags[cr_attr_count]);
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 4c00c4215c..f47d661400 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
            file://CVE-2026-57160.patch \
            file://CVE-2026-57161.patch \
+           file://CVE-2026-57162.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 27/44] pjproject: patch CVE-2026-57163

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57163

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-57163.patch  | 52 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
new file mode 100644
index 0000000000..7b3c681cb9
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
@@ -0,0 +1,52 @@
+From 2276d5ff1fe185a6bb51ab741dd5d88e45dbaa47 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:46:16 +0700
+Subject: [PATCH] Merge commit from fork
+
+The SAN-counting loop in tls_cert_get_info() (ssl_sock_gtls.c) called
+gnutls_x509_crt_get_subject_alt_name() with len still holding
+sizeof(buf) (512) from an earlier getter, while the output buffer is
+only 256 bytes, so an oversized SAN entry overflowed the stack. Set len
+to the true capacity (sizeof(out) - 1, matching the populate loop) on
+every iteration.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit c4a151af86fadd16d9480b2603eeb2abf4fb4f78)
+
+CVE: CVE-2026-57163
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib/src/pj/ssl_sock_gtls.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index de3d5e99e..68ceea3f3 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1018,12 +1018,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+     if (ci->version >= 3) {
+         char out[256] = { 0 };
+         /* Get the number of all alternate names so that we can allocate
+-         * the correct number of bytes in subj_alt_name */
++         * the correct number of bytes in subj_alt_name.
++         *
++         * Pass the true capacity of 'out' as the in/out size argument on
++         * every iteration. 'len' otherwise still holds sizeof(buf) (512)
++         * from an earlier getter, which would let GnuTLS copy an oversized
++         * SubjectAltName entry past the end of the 256-byte 'out' buffer.
++         * Use sizeof(out) - 1 to match the populate loop below, leaving
++         * room for the NUL terminator GnuTLS appends to string names.
++         */
++        len = sizeof(out) - 1;
+         while (gnutls_x509_crt_get_subject_alt_name(cert, seq, out, &len,
+                                                     NULL) !=
+                GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+         {
+             seq++;
++            len = sizeof(out) - 1;
+         }
+ 
+         ci->subj_alt_name.entry = pj_pool_calloc(pool, seq,
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index f47d661400..de8c847271 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -17,6 +17,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57160.patch \
            file://CVE-2026-57161.patch \
            file://CVE-2026-57162.patch \
+           file://CVE-2026-57163.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 28/44] pjproject: patch CVE-2026-57164

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57164

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-57164.patch  | 66 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
new file mode 100644
index 0000000000..0686d681c3
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
@@ -0,0 +1,66 @@
+From 1160ff3c15cfa79f50d4bc6ce8066854f656066c Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:46:48 +0700
+Subject: [PATCH] Merge commit from fork
+
+http_on_data_read() in http_client.c grew the response buffer by a
+single doubling, which is insufficient when the server sends a body
+larger than twice the (attacker-supplied) Content-Length used for the
+initial allocation. Loop the doubling until the buffer fits, with a
+floor for the size==0 case to avoid an infinite loop.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 8d5956afab2ede95ddb199078dc19a8ac0114f3d)
+
+CVE: CVE-2026-57164
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/8d5956afab2ede95ddb199078dc19a8ac0114f3d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/http_client.c | 27 ++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/http_client.c b/pjlib-util/src/pjlib-util/http_client.c
+index bd441acb9..d2771d240 100644
+--- a/pjlib-util/src/pjlib-util/http_client.c
++++ b/pjlib-util/src/pjlib-util/http_client.c
+@@ -432,18 +432,31 @@ static pj_bool_t http_on_data_read(pj_activesock_t *asock,
+                                                 hreq->response.size);
+         }
+ 
+-        /* If the size of data received exceeds its current size,
+-         * grow the buffer by a factor of 2.
++        /* If the size of data received exceeds its current size, grow the
++         * buffer by a factor of 2 repeatedly, until it can actually hold
++         * everything received so far. A single doubling is not sufficient
++         * when the server delivers a body chunk larger than twice the
++         * (possibly undersized) Content-Length used for the initial
++         * allocation, which would otherwise overflow the buffer in the
++         * pj_memcpy() below.
+          */
+-        if (hreq->tcp_state.current_read_size + size > 
+-            hreq->response.size) 
++        if (hreq->tcp_state.current_read_size + size >
++            hreq->response.size)
+         {
+             void *olddata = hreq->response.data;
++            pj_size_t new_size = hreq->response.size;
+ 
+-            hreq->response.data = pj_pool_alloc(hreq->pool, 
+-                                                hreq->response.size << 1);
++            /* Guard against size==0 (Content-Length: 0 with a body), which
++             * would make the doubling loop below spin forever.
++             */
++            if (new_size == 0)
++                new_size = INITIAL_DATA_BUF_SIZE;
++            while (hreq->tcp_state.current_read_size + size > new_size)
++                new_size <<= 1;
++
++            hreq->response.data = pj_pool_alloc(hreq->pool, new_size);
+             pj_memcpy(hreq->response.data, olddata, hreq->response.size);
+-            hreq->response.size <<= 1;
++            hreq->response.size = new_size;
+         }
+ 
+         /* Append the response data. */
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index de8c847271..8e0b358ffe 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57161.patch \
            file://CVE-2026-57162.patch \
            file://CVE-2026-57163.patch \
+           file://CVE-2026-57164.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 29/44] pjproject: patch CVE-2026-57165

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57165

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-57165.patch  | 85 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 86 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch
new file mode 100644
index 0000000000..e2d62b0eef
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch
@@ -0,0 +1,85 @@
+From 5776ee452296d5277d71e2bb011709adec80a533 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:47:29 +0700
+Subject: [PATCH] Merge commit from fork
+
+handle_up_down() in cli_telnet.c accumulated cur_pos + 2*rcmd->len +
+history->slen bytes into a fixed PJ_CLI_MAX_CMDBUF stack buffer with no
+bound check. Size the buffer for the worst case, clamp each term to
+PJ_CLI_MAX_CMDBUF, and replace the trailing unchecked pj_strcat with a
+bounded pj_memcpy.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 628b71638465bacf66e767959e6acbab822eccd6)
+
+CVE: CVE-2026-57165
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/628b71638465bacf66e767959e6acbab822eccd6]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/cli_telnet.c | 33 ++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/cli_telnet.c b/pjlib-util/src/pjlib-util/cli_telnet.c
+index 150727bb5..0a2954bd4 100644
+--- a/pjlib-util/src/pjlib-util/cli_telnet.c
++++ b/pjlib-util/src/pjlib-util/cli_telnet.c
+@@ -1141,7 +1141,14 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+     history = get_prev_history(sess, is_up);
+     if (history) {
+         pj_str_t send_data;
+-        char str[PJ_CLI_MAX_CMDBUF];
++        /* The redraw sequence can accumulate up to
++         *   cur_pos + 2 * rcmd->len + history->slen
++         * bytes, each term bounded by PJ_CLI_MAX_CMDBUF, so size the
++         * local buffer for the worst case and clamp each term below.
++         */
++        char str[PJ_CLI_MAX_CMDBUF * 4];
++        unsigned cur_pos, buf_len;
++        pj_size_t hist_len;
+         enum {
+             MOVE_CURSOR_LEFT = 0x08,
+             CLEAR_CHAR = 0x20
+@@ -1149,15 +1156,24 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+         send_data.ptr = str;
+         send_data.slen = 0;
+ 
++        cur_pos = sess->rcmd->cur_pos;
++        buf_len = sess->rcmd->len;
++        hist_len = history->slen;
++        if (cur_pos > PJ_CLI_MAX_CMDBUF)
++            cur_pos = PJ_CLI_MAX_CMDBUF;
++        if (buf_len > PJ_CLI_MAX_CMDBUF)
++            buf_len = PJ_CLI_MAX_CMDBUF;
++        if (hist_len > PJ_CLI_MAX_CMDBUF)
++            hist_len = PJ_CLI_MAX_CMDBUF;
++
+         /* Move cursor position to the beginning of line */
+-        if (sess->rcmd->cur_pos > 0) {
+-            pj_memset(send_data.ptr, MOVE_CURSOR_LEFT, sess->rcmd->cur_pos);
+-            send_data.slen = sess->rcmd->cur_pos;
++        if (cur_pos > 0) {
++            pj_memset(send_data.ptr, MOVE_CURSOR_LEFT, cur_pos);
++            send_data.slen = cur_pos;
+         }
+ 
+-        if (sess->rcmd->len > (unsigned)history->slen) {
++        if (buf_len > (unsigned)hist_len) {
+             /* Clear the command currently shown*/
+-            unsigned buf_len = sess->rcmd->len;
+             pj_memset(&send_data.ptr[send_data.slen], CLEAR_CHAR, buf_len);
+             send_data.slen += buf_len;
+ 
+@@ -1167,7 +1183,10 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+             send_data.slen += buf_len;
+         }
+         /* Send data */
+-        pj_strcat(&send_data, history);
++        if (hist_len > 0) {
++            pj_memcpy(&send_data.ptr[send_data.slen], history->ptr, hist_len);
++            send_data.slen += hist_len;
++        }
+         telnet_sess_send(sess, &send_data);
+         pj_ansi_strxcpy2((char*)sess->rcmd->rbuf, history, 
+                          sizeof(sess->rcmd->rbuf));
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 8e0b358ffe..e7cae469ed 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -19,6 +19,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57162.patch \
            file://CVE-2026-57163.patch \
            file://CVE-2026-57164.patch \
+           file://CVE-2026-57165.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 30/44] pjproject: patch CVE-2026-57166

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57166

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-57166.patch  | 228 ++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |   1 +
 2 files changed, 229 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch
new file mode 100644
index 0000000000..8311d4c36d
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch
@@ -0,0 +1,228 @@
+From d0b42b902bb6ca8a0a1393799db487642d3bf8ae Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:55:53 +0700
+Subject: [PATCH] Merge commit from fork
+
+* Fix pre-auth stack overflow formatting telnet CLI error indicator
+
+send_err_arg() in cli_telnet.c rendered the error caret into a fixed
+256-byte stack buffer using unchecked pj_strcat2; info->err_pos is
+bounded only by PJ_CLI_MAX_CMDBUF, so a long command line overflowed
+the buffer. Stream the spaces in bounded chunks via telnet_sess_send2,
+clamp the caret offset to PJ_CLI_MAX_CMDBUF, and send the message,
+prompt and echoed command separately, removing the stack buffer.
+
+Co-Authored-By Claude Code
+
+* Apply the same overflow fix to send_ambi_arg()
+
+Per review, send_ambi_arg() has the same issue as send_err_arg(): it
+renders an attacker-influenced number of caret spaces and appends the
+last command into a fixed 1028-byte stack buffer with unchecked
+pj_strcat2. info->err_pos and sess->rcmd->rbuf are bounded only by
+PJ_CLI_MAX_CMDBUF, so a long ambiguous command line could overflow it.
+
+Stream the caret offset in bounded chunks (clamped to PJ_CLI_MAX_CMDBUF)
+and stream the clamped last command separately, mirroring the
+send_err_arg() fix, instead of writing them into the fixed buffer. The
+shared SPACES constant is hoisted to file scope.
+
+Co-Authored-By Claude Code
+
+* Bound completion append in handle_tab()
+
+handle_tab() appended the matched command name into the fixed-size
+sess->rcmd->rbuf at offset len (the current command length) without
+checking that len + name length fits the buffer. len is bounded by the
+receive path, but the completion suffix is added on top, so a long
+completable command line could write past rbuf and its NUL terminator.
+
+Clamp the appended length to the space remaining in rbuf, leaving room
+for the terminator. Found while auditing the telnet CLI for the same
+fixed-buffer overflow pattern as send_err_arg()/send_ambi_arg().
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 4472a31d77a7506ff175dad5abef490f4e31bed1)
+
+CVE: CVE-2026-57166
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/4472a31d77a7506ff175dad5abef490f4e31bed1]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/cli_telnet.c | 116 ++++++++++++++++++-------
+ 1 file changed, 84 insertions(+), 32 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/cli_telnet.c b/pjlib-util/src/pjlib-util/cli_telnet.c
+index 0a2954bd4..67898fdd8 100644
+--- a/pjlib-util/src/pjlib-util/cli_telnet.c
++++ b/pjlib-util/src/pjlib-util/cli_telnet.c
+@@ -680,6 +680,13 @@ static void send_prompt_str(cli_telnet_sess *sess)
+     telnet_sess_send(sess, &send_data);
+ }
+ 
++/* Buffer of spaces, used to stream the caret offset in bounded chunks
++ * instead of writing an attacker-influenced number of spaces into a
++ * fixed-size stack buffer. Shared by send_err_arg() and send_ambi_arg().
++ */
++static const unsigned char SPACES[64] =
++    "                                                                ";
++
+ /*
+  * This method is used to send error message to client, including
+  * the error position of the source command.
+@@ -690,32 +697,45 @@ static void send_err_arg(cli_telnet_sess *sess,
+                          pj_bool_t with_return,
+                          pj_bool_t with_last_cmd)
+ {
+-    pj_str_t send_data;
+-    char data_str[256];
+-    pj_size_t len;
+-    unsigned i;
++    pj_size_t len, remaining;
+     cli_telnet_fe *fe = (cli_telnet_fe *)sess->base.fe;
+ 
+-    send_data.ptr = data_str;
+-    send_data.slen = 0;
+-
+     if (with_return)
+-        pj_strcat2(&send_data, "\r\n");
++        telnet_sess_send2(sess, (const unsigned char*)"\r\n", 2);
+ 
++    /* Compute the caret offset. info->err_pos is derived from
++     * attacker-supplied input (pj_cli_sess_parse) and is bounded only by
++     * PJ_CLI_MAX_CMDBUF, so clamp it before emitting spaces. Otherwise a
++     * ~500-byte command line would overflow the fixed-size stack buffer
++     * this function previously used.
++     */
+     len = fe->cfg.prompt_str.slen + info->err_pos;
+-
+-    /* Set the error pointer mark */
+-    for (i=0;i<len;++i) {
+-        pj_strcat2(&send_data, " ");
++    if (len > PJ_CLI_MAX_CMDBUF)
++        len = PJ_CLI_MAX_CMDBUF;
++
++    remaining = len;
++    while (remaining > 0) {
++        pj_size_t chunk = (remaining > sizeof(SPACES)) ? sizeof(SPACES)
++                                                       : remaining;
++        telnet_sess_send2(sess, SPACES, (int)chunk);
++        remaining -= chunk;
+     }
+-    pj_strcat2(&send_data, "^");
+-    pj_strcat2(&send_data, "\r\n");
+-    pj_strcat(&send_data, msg);
+-    pj_strcat(&send_data, &fe->cfg.prompt_str);
+-    if (with_last_cmd)
+-        pj_strcat2(&send_data, (char *)sess->rcmd->rbuf);
+ 
+-    telnet_sess_send(sess, &send_data);
++    telnet_sess_send2(sess, (const unsigned char*)"^\r\n", 3);
++
++    if (msg && msg->slen > 0)
++        telnet_sess_send(sess, msg);
++    if (fe->cfg.prompt_str.slen > 0)
++        telnet_sess_send(sess, &fe->cfg.prompt_str);
++    if (with_last_cmd) {
++        pj_str_t last;
++        last.ptr = (char *)sess->rcmd->rbuf;
++        last.slen = (pj_ssize_t)pj_ansi_strlen((const char *)sess->rcmd->rbuf);
++        if (last.slen > PJ_CLI_MAX_CMDBUF)
++            last.slen = PJ_CLI_MAX_CMDBUF;
++        if (last.slen > 0)
++            telnet_sess_send(sess, &last);
++    }
+ }
+ 
+ static void send_inv_arg(cli_telnet_sess *sess,
+@@ -765,7 +785,7 @@ static void send_ambi_arg(cli_telnet_sess *sess,
+                           pj_bool_t with_last_cmd)
+ {
+     unsigned i;
+-    pj_size_t len;
++    pj_size_t len, remaining;
+     pj_str_t send_data;
+     char data[1028];
+     cli_telnet_fe *fe = (cli_telnet_fe *)sess->base.fe;
+@@ -779,14 +799,25 @@ static void send_ambi_arg(cli_telnet_sess *sess,
+     send_data.slen = 0;
+ 
+     if (with_return)
+-        pj_strcat2(&send_data, "\r\n");
++        telnet_sess_send2(sess, (const unsigned char*)"\r\n", 2);
+ 
++    /* Compute and clamp the caret offset, then stream the spaces, like
++     * send_err_arg(). info->err_pos is attacker-bounded only by
++     * PJ_CLI_MAX_CMDBUF, so it must not drive writes into data[].
++     */
+     len = fe->cfg.prompt_str.slen + info->err_pos;
+-
+-    for (i=0;i<len;++i) {
+-        pj_strcat2(&send_data, " ");
++    if (len > PJ_CLI_MAX_CMDBUF)
++        len = PJ_CLI_MAX_CMDBUF;
++
++    remaining = len;
++    while (remaining > 0) {
++        pj_size_t chunk = (remaining > sizeof(SPACES)) ? sizeof(SPACES)
++                                                       : remaining;
++        telnet_sess_send2(sess, SPACES, (int)chunk);
++        remaining -= chunk;
+     }
+-    pj_strcat2(&send_data, "^");
++    telnet_sess_send2(sess, (const unsigned char*)"^", 1);
++
+     /* Get the max length of the command name */
+     for (i=0;i<info->hint_cnt;++i) {
+         if (hint[i].type.slen > 0) {
+@@ -874,10 +905,21 @@ static void send_ambi_arg(cli_telnet_sess *sess,
+     }
+     pj_strcat2(&send_data, "\r\n");
+     pj_strcat(&send_data, &fe->cfg.prompt_str);
+-    if (with_last_cmd)
+-        pj_strcat2(&send_data, (char *)sess->rcmd->rbuf);
+-
+     telnet_sess_send(sess, &send_data);
++
++    /* Stream the last command separately with a clamp; sess->rcmd->rbuf
++     * is attacker-bounded only by PJ_CLI_MAX_CMDBUF, so appending it into
++     * data[] could overflow the fixed-size buffer.
++     */
++    if (with_last_cmd) {
++        pj_str_t last;
++        last.ptr = (char *)sess->rcmd->rbuf;
++        last.slen = (pj_ssize_t)pj_ansi_strlen((const char *)sess->rcmd->rbuf);
++        if (last.slen > PJ_CLI_MAX_CMDBUF)
++            last.slen = PJ_CLI_MAX_CMDBUF;
++        if (last.slen > 0)
++            telnet_sess_send(sess, &last);
++    }
+ }
+ 
+ /*
+@@ -1035,10 +1077,20 @@ static pj_bool_t handle_tab(cli_telnet_sess *sess)
+                 }
+                 send_comp_arg(sess, &info);
+ 
+-                pj_memcpy(&sess->rcmd->rbuf[len], info.hint[0].name.ptr,
+-                          info.hint[0].name.slen);
+-
+-                len += (unsigned)info.hint[0].name.slen;
++                /* Append the matched name into the fixed-size rbuf. len is
++                 * attacker-influenced (the typed command length), so clamp
++                 * the copy to leave room for the NUL terminator and avoid
++                 * overflowing rbuf.
++                 */
++                if (len < sizeof(sess->rcmd->rbuf) - 1) {
++                    pj_size_t avail = sizeof(sess->rcmd->rbuf) - 1 - len;
++                    pj_size_t cplen = (pj_size_t)info.hint[0].name.slen;
++                    if (cplen > avail)
++                        cplen = avail;
++                    pj_memcpy(&sess->rcmd->rbuf[len],
++                              info.hint[0].name.ptr, cplen);
++                    len += (unsigned)cplen;
++                }
+                 sess->rcmd->rbuf[len] = 0;
+             }
+         } else {
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index e7cae469ed..9d1e6af253 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -20,6 +20,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57163.patch \
            file://CVE-2026-57164.patch \
            file://CVE-2026-57165.patch \
+           file://CVE-2026-57166.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 31/44] pjproject: patch CVE-2026-77396

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-77396

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-77396.patch  | 74 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 75 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
new file mode 100644
index 0000000000..a02268bf11
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
@@ -0,0 +1,74 @@
+From a927a964d462e9966864b7b2c432942b61038d6b Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Mon, 13 Jul 2026 09:27:02 +0700
+Subject: [PATCH] Merge commit from fork
+
+The AVI player used a chunk length taken from the input file as the
+number of bytes to read into the video frame buffer, whose capacity is
+derived from the (also file-supplied) declared dimensions, without
+reconciling the two. A crafted file could therefore cause a write past
+the end of the buffer. The only guard was an assertion, which is a
+no-op in release builds.
+
+Clamp the read to the frame buffer capacity, skip any remaining chunk
+bytes so the file position stays aligned, and remove the reliance on
+the assertion for validating a file-supplied length.
+
+Ref: GHSA-6p2p-5wf8-h5hr
+(cherry picked from commit 7ecc6584969a923c4190b6912afbf5952b5a4b9f)
+
+CVE: CVE-2026-77396
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjmedia/src/pjmedia/avi_player.c | 34 +++++++++++++++++++++++++++++---
+ 1 file changed, 31 insertions(+), 3 deletions(-)
+
+diff --git a/pjmedia/src/pjmedia/avi_player.c b/pjmedia/src/pjmedia/avi_player.c
+index dc87b8a41..8b4b94d16 100644
+--- a/pjmedia/src/pjmedia/avi_player.c
++++ b/pjmedia/src/pjmedia/avi_player.c
+@@ -1199,12 +1199,40 @@ static pj_status_t avi_get_frame(pjmedia_port *this_port,
+                 goto on_error2;
+             fport->size_left -= size_to_read;
+         } else {
+-            pj_assert(frame->size >= ch.len);
+-            status = file_read3(fport->fd, frame->buf, ch.len,
++            pj_uint32_t read_len = ch.len;
++
++            /* Clamp the read to the frame buffer capacity. A crafted
++             * file may declare a chunk larger than the buffer, whose
++             * size is derived from the (also file-supplied) video
++             * dimensions; never write past frame->buf (frame->size
++             * bytes). Do not rely on pj_assert() here, as it is a no-op
++             * in release builds.
++             */
++            if (read_len > frame->size) {
++                PJ_LOG(3, (THIS_FILE,
++                           "AVI video chunk (%u) exceeds frame buffer "
++                           "(%u), truncating",
++                           (unsigned)ch.len, (unsigned)frame->size));
++                read_len = (pj_uint32_t)frame->size;
++            }
++
++            status = file_read3(fport->fd, frame->buf, read_len,
+                                 0, &size_read);
+             if (status != PJ_SUCCESS)
+                 goto on_error2;
+-            frame->size = ch.len;
++
++            /* Skip any remaining chunk bytes that did not fit, so the
++             * file position stays aligned to the next chunk.
++             */
++            if (ch.len > read_len) {
++                status = pj_file_setpos(fport->fd,
++                                        (pj_off_t)ch.len - read_len,
++                                        PJ_SEEK_CUR);
++                if (status != PJ_SUCCESS)
++                    goto on_error2;
++            }
++
++            frame->size = read_len;
+             fport->size_left = 0;
+         }
+ 
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 9d1e6af253..89763b3011 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -21,6 +21,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57164.patch \
            file://CVE-2026-57165.patch \
            file://CVE-2026-57166.patch \
+           file://CVE-2026-77396.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-multimedia][blacksail][PATCH 32/44] pjproject: patch CVE-2026-84975

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84975

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../pjproject/pjproject/CVE-2026-84975.patch  | 87 +++++++++++++++++++
 .../pjproject/pjproject_2.17.bb               |  1 +
 2 files changed, 88 insertions(+)
 create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch

diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch
new file mode 100644
index 0000000000..007096a6ff
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch
@@ -0,0 +1,87 @@
+From f00f023079d0f9a74477da47056bfce76374b2a7 Mon Sep 17 00:00:00 2001
+From: sauwming <ming@teluu.com>
+Date: Fri, 17 Jul 2026 16:46:33 +0800
+Subject: [PATCH] Merge commit from fork
+
+SubjectAltName entries from the OpenSSL and GnuTLS backends were copied
+with pj_strdup2(), which re-derives the length with strlen() and thus
+discards the length already returned by ASN1_STRING_to_UTF8() /
+gnutls_x509_crt_get_subject_alt_name(). A DNS SAN such as
+"victim.example\0.attacker" was therefore truncated to "victim.example".
+
+sip_transport_tls.c disables socket-layer verification and performs its
+own length-aware identity match against subj_alt_name, so the truncated
+prefix compared equal to the target host and a crafted certificate was
+accepted for the prefix hostname (server identity / hostname verification
+bypass; OpenSSL's own X509_check_host() rejects the same certificate).
+
+Copy the SAN using its explicit length via pj_strset()/pj_strdup_with_null()
+so embedded NULs are preserved and no longer truncated. The mbedTLS backend
+already copied with a length-bearing pj_str_t and was not affected.
+
+Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
+(cherry picked from commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd)
+
+CVE: CVE-2026-84975
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib/src/pj/ssl_sock_gtls.c | 17 +++++++++++++++--
+ pjlib/src/pj/ssl_sock_ossl.c | 14 +++++++++++---
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index 68ceea3f3..ee977116b 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1072,9 +1072,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+ 
+             if (len && type != PJ_SSL_CERT_NAME_UNKNOWN) {
+                 ci->subj_alt_name.entry[ci->subj_alt_name.cnt].type = type;
+-                pj_strdup2(pool,
++                if (type == PJ_SSL_CERT_NAME_IP) {
++                    pj_strdup2(pool,
+                         &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+-                        type == PJ_SSL_CERT_NAME_IP ? buf : out);
++                        buf);
++                } else {
++                    /* Preserve the reported length instead of using strlen(),
++                     * so a DNS SAN containing an embedded NUL is not truncated
++                     * at the NUL (which would allow a crafted cert to be
++                     * accepted for the prefix hostname; identity bypass).
++                     */
++                    pj_str_t tmp;
++                    pj_strset(&tmp, out, len);
++                    pj_strdup_with_null(pool,
++                        &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++                        &tmp);
++                }
+                 ci->subj_alt_name.cnt++;
+             }
+         }
+diff --git a/pjlib/src/pj/ssl_sock_ossl.c b/pjlib/src/pj/ssl_sock_ossl.c
+index 30b4eeaee..ceb6bca5b 100644
+--- a/pjlib/src/pj/ssl_sock_ossl.c
++++ b/pjlib/src/pj/ssl_sock_ossl.c
+@@ -2270,9 +2270,17 @@ static void get_cert_info(pj_pool_t *pool, pj_ssl_cert_info *ci, X509 *x,
+                           &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+                           buf);
+                 } else {
+-                    pj_strdup2(pool, 
+-                          &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name, 
+-                          (char*)p);
++                    /* Preserve the explicit ASN.1 string length instead of
++                     * treating the data as a NUL-terminated C string. A DNS
++                     * SAN such as "host.example\0.attacker" would otherwise be
++                     * truncated at the embedded NUL, letting a crafted cert be
++                     * accepted for the prefix hostname (identity bypass).
++                     */
++                    pj_str_t tmp;
++                    pj_strset(&tmp, (char*)p, len);
++                    pj_strdup_with_null(pool,
++                          &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++                          &tmp);
+                     OPENSSL_free(p);
+                 }
+                 ci->subj_alt_name.cnt++;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 89763b3011..893559090f 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -22,6 +22,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
            file://CVE-2026-57165.patch \
            file://CVE-2026-57166.patch \
            file://CVE-2026-77396.patch \
+           file://CVE-2026-84975.patch \
            "
 SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
 

[oe][meta-oe][blacksail][PATCH 33/44] nmap: patch CVE-2026-58058

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58058

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../nmap/files/CVE-2026-58058.patch           | 34 +++++++++++++++++++
 meta-oe/recipes-security/nmap/nmap_7.99.bb    |  1 +
 2 files changed, 35 insertions(+)
 create mode 100644 meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch

diff --git a/meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch b/meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch
new file mode 100644
index 0000000000..3717d37b5d
--- /dev/null
+++ b/meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch
@@ -0,0 +1,34 @@
+From 63815f6a8865d8c99a1f3abb9d7383a2be0ea67e Mon Sep 17 00:00:00 2001
+From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date: Thu, 25 Jun 2026 21:58:49 +0000
+Subject: [PATCH] Fix extension header parsing. Credit: Himanshu Anand
+
+(cherry picked from commit bb6754e76bb1686315008e1aa1c40202a513fb83)
+
+CVE: CVE-2026-58058
+Upstream-Status: Backport [https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libnetutil/netutil.cc | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc
+index 6e81f558c..0adf18b8e 100644
+--- a/libnetutil/netutil.cc
++++ b/libnetutil/netutil.cc
+@@ -615,11 +615,13 @@ static const void *ipv6_get_data_primitive(const struct ip6_hdr *ip6,
+   *nxt = ip6->ip6_nxt;
+   p += sizeof(*ip6);
+   while (p < end && ipv6_is_extension_header(*nxt)) {
+-    if (p + 2 > end)
++    if (p + 8 > end)
+       return NULL;
+     *nxt = *p;
+     p += (*(p + 1) + 1) * 8;
+   }
++  if (p >= end)
++    return NULL;
+ 
+   *len = end - p;
+   if (upperlayer_only && !ipv6_is_upperlayer(*nxt))
diff --git a/meta-oe/recipes-security/nmap/nmap_7.99.bb b/meta-oe/recipes-security/nmap/nmap_7.99.bb
index ea792d30f6..515623d63d 100644
--- a/meta-oe/recipes-security/nmap/nmap_7.99.bb
+++ b/meta-oe/recipes-security/nmap/nmap_7.99.bb
@@ -11,6 +11,7 @@ SRC_URI = "http://nmap.org/dist/${BP}.tar.bz2 \
            file://0002-Fix-building-with-libc.patch \
            file://0001-fix-racing-between-build-ncat-and-build-lua.patch \
            file://0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch \
+           file://CVE-2026-58058.patch \
            "
 SRC_URI[sha256sum] = "df512492ffd108e53a27a06f26d8635bbe89e0e569455dc8ffef058c035d51b2"
 

[oe][meta-oe][blacksail][PATCH 34/44] nmap: patch CVE-2026-72712

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-72712

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../nmap/files/CVE-2026-72712.patch           | 46 +++++++++++++++++++
 meta-oe/recipes-security/nmap/nmap_7.99.bb    |  1 +
 2 files changed, 47 insertions(+)
 create mode 100644 meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch

diff --git a/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch b/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
new file mode 100644
index 0000000000..f5e81aac0e
--- /dev/null
+++ b/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
@@ -0,0 +1,46 @@
+From 120d13b8aca52ec306e50eae9a74fb1bfe49540a Mon Sep 17 00:00:00 2001
+From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date: Thu, 11 Jun 2026 18:31:31 +0000
+Subject: [PATCH] Stop parsing on a zero-length packet option
+
+Fixes #3368. Closes #3373.
+
+(cherry picked from commit 7ef4ee030a0023fe22616387a000032e1a678b6a)
+
+CVE: CVE-2026-72712
+Upstream-Status: Backport [https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a]
+
+Dropped changes to the CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ nselib/packet.lua | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/nselib/packet.lua b/nselib/packet.lua
+index ec6db40a2..e17972d88 100644
+--- a/nselib/packet.lua
++++ b/nselib/packet.lua
+@@ -686,10 +686,7 @@ function Packet:parse_options(offset, length)
+   local opt_ptr = 0
+   while opt_ptr < length do
+     local t, l, d
+-    options[op] = {}
+-
+     t = self:u8(offset + opt_ptr)
+-    options[op].type = t
+     if t==0 or t==1 then
+       l = 1
+       d = nil
+@@ -699,6 +696,11 @@ function Packet:parse_options(offset, length)
+         d = self:raw(offset + opt_ptr + 2, l-2)
+       end
+     end
++    if l==0 then
++      break
++    end
++    options[op] = {}
++    options[op].type = t
+     options[op].len  = l
+     options[op].data = d
+     opt_ptr = opt_ptr + l
diff --git a/meta-oe/recipes-security/nmap/nmap_7.99.bb b/meta-oe/recipes-security/nmap/nmap_7.99.bb
index 515623d63d..0cbef990cb 100644
--- a/meta-oe/recipes-security/nmap/nmap_7.99.bb
+++ b/meta-oe/recipes-security/nmap/nmap_7.99.bb
@@ -12,6 +12,7 @@ SRC_URI = "http://nmap.org/dist/${BP}.tar.bz2 \
            file://0001-fix-racing-between-build-ncat-and-build-lua.patch \
            file://0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch \
            file://CVE-2026-58058.patch \
+           file://CVE-2026-72712.patch \
            "
 SRC_URI[sha256sum] = "df512492ffd108e53a27a06f26d8635bbe89e0e569455dc8ffef058c035d51b2"
 

[oe][meta-webserver][blacksail][PATCH 35/44] netdata: mark CVE-2026-83602 fixed

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Fix identified by NVD is included in the patch release[1] v2.10.4

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-83602

[1]https://github.com/netdata/netdata/pull/22825

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb b/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
index ed4c54fbe4..9df846cec9 100644
--- a/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
+++ b/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
@@ -167,3 +167,5 @@ FILES:${PN} += "\
     "
 
 RDEPENDS:${PN} = "bash python3-core zlib"
+
+CVE_STATUS[CVE-2026-83602] = "fixed-version: fixed in v2.10.4"

[oe][meta-webserver][blacksail][PATCH 36/44] nginx: upgrade 1.30.5 -> 1.30.6

[ankur.tyagi85]

From: Peter Marko <peter.marko@siemens.com>

2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have
been released, with fixes for buffer overflow vulnerability when using
alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when
evaluating string expressions with variables (CVE-2026-93479), request
body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery
vulnerability when using TLS session ticket key rotation
(CVE-2026-97629), and use-after-free vulnerability when using
ngx_http_ssi_module with AIO (CVE-2026-97205).

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6cdd413248db5aed93c6cc138cbfe0f83ed81f56)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../recipes-httpd/nginx/{nginx_1.30.5.bb => nginx_1.30.6.bb}    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-webserver/recipes-httpd/nginx/{nginx_1.30.5.bb => nginx_1.30.6.bb} (81%)

diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
similarity index 81%
rename from meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
rename to meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
index 6b638cdd96..5d699e63ce 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
@@ -2,7 +2,7 @@ require nginx.inc
 
 LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99"
 
-SRC_URI[sha256sum] = "6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11c4906d"
+SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9b8b6c8"
 
 inherit upstream-version-is-even
 

[oe][meta-webserver][blacksail][PATCH 37/44] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629

[ankur.tyagi85]

From: Peter Marko <peter.marko@siemens.com>

These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
  {
    "lessThan": "*",
    "status": "affected",
    "version": "1.23.3",
    "versionType": "custom"
  }

Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 959f4c8f098a90c24a818831a5e3dd8090cee641)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
index 5d699e63ce..73204da558 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
@@ -6,6 +6,9 @@ SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9
 
 inherit upstream-version-is-even
 
+CVE_STATUS[CVE-2026-95101] = "fixed-version: Fixed since 1.30.6"
+CVE_STATUS[CVE-2026-97629] = "fixed-version: Fixed since 1.30.6"
+
 # Remove following entries when upgrading recipe to 1.32
 CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3"
 CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"

[oe][meta-networking][blacksail][PATCH 38/44] mtr: patch CVE-2026-14461

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-14461

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../mtr/mtr/CVE-2026-14461.patch              | 32 +++++++++++++++++++
 .../recipes-support/mtr/mtr_0.96.bb           |  4 ++-
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch

diff --git a/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch b/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch
new file mode 100644
index 0000000000..6628d9d7be
--- /dev/null
+++ b/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch
@@ -0,0 +1,32 @@
+From 4c75fae93d9515f3ecdfecc966b8c6471efb7ea5 Mon Sep 17 00:00:00 2001
+From: "R.E. Wolff" <R.E.Wolff@BitWizard.nl>
+Date: Tue, 16 Jun 2026 11:03:39 +0200
+Subject: [PATCH] =?UTF-8?q?Fixed=20possible=20buffer=20overrun=20in=20asn?=
+ =?UTF-8?q?=20code--=20Micha=C5=82=20Majchrowicz?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(cherry picked from commit 48e1794414d338ce47abc0f27c25ade8788af9c3)
+
+CVE: CVE-2026-14461
+Upstream-Status: Backport [https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ ui/asn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ui/asn.c b/ui/asn.c
+index 111c394..487d9e8 100644
+--- a/ui/asn.c
++++ b/ui/asn.c
+@@ -94,6 +94,8 @@ static char *ipinfo_lookup(
+             DEB_syslog(LOG_INFO, "Malloc-txt: %s", UNKN);
+         return xstrdup(UNKN);
+     }
++    // Clip len to PACKETSZ. -- Michał Majchrowicz
++    if (len > PACKETSZ) len = PACKETSZ;
+ 
+     pt = answer + sizeof(HEADER);
+ 
diff --git a/meta-networking/recipes-support/mtr/mtr_0.96.bb b/meta-networking/recipes-support/mtr/mtr_0.96.bb
index 9008223264..2716ca92aa 100644
--- a/meta-networking/recipes-support/mtr/mtr_0.96.bb
+++ b/meta-networking/recipes-support/mtr/mtr_0.96.bb
@@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
                     file://ui/mtr.c;beginline=5;endline=16;md5=00a894a39d53726a27386534d1c4e468"
 
 SRCREV = "f392168771570b0fdc104c38dea6bbc2ce585710"
-SRC_URI = "git://github.com/traviscross/mtr;branch=master;protocol=https;tag=v${PV}"
+SRC_URI = "git://github.com/traviscross/mtr;branch=master;protocol=https;tag=v${PV} \
+           file://CVE-2026-14461.patch \
+"
 
 
 inherit autotools pkgconfig

[oe][meta-networking][blacksail][PATCH 39/44] ncp: ignore CVE-2025-14577 and CVE-2026-35087

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14577
https://nvd.nist.gov/vuln/detail/cve-2026-35087

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 meta-networking/recipes-support/ncp/ncp_1.2.4.bb | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/meta-networking/recipes-support/ncp/ncp_1.2.4.bb b/meta-networking/recipes-support/ncp/ncp_1.2.4.bb
index ec6d918744..19fb258aec 100644
--- a/meta-networking/recipes-support/ncp/ncp_1.2.4.bb
+++ b/meta-networking/recipes-support/ncp/ncp_1.2.4.bb
@@ -29,3 +29,6 @@ do_install() {
 }
 
 BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2025-14577] = "cpe-incorrect: This vulnerability is for Slican NCP"
+CVE_STATUS[CVE-2026-35087] = "cpe-incorrect: This vulnerability is for Slican NCP"

[oe][meta-oe][blacksail][PATCH 40/44] libvncserver: patch CVE-2026-44988

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44988

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libvncserver/CVE-2026-44988.patch         | 71 +++++++++++++++++++
 .../libvncserver/libvncserver_0.9.15.bb       |  1 +
 2 files changed, 72 insertions(+)
 create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch

diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch
new file mode 100644
index 0000000000..e26abc9db7
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch
@@ -0,0 +1,71 @@
+From db5779f2bec717f577fb66321b3b079ff156da95 Mon Sep 17 00:00:00 2001
+From: Kang Hee chan <24s101h0659@sonline20.sen.go.kr>
+Date: Wed, 6 May 2026 21:48:54 +0900
+Subject: [PATCH] libvncclient: fix Tight gradient decoding overflow
+
+(cherry picked from commit 5b270544b85233668b98161323297d418a8f5fd1)
+
+CVE: CVE-2026-44988
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ include/rfb/rfbclient.h  |  3 ++-
+ src/libvncclient/tight.c | 10 +++++++---
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/include/rfb/rfbclient.h b/include/rfb/rfbclient.h
+index a974ff5f..666dcb90 100644
+--- a/include/rfb/rfbclient.h
++++ b/include/rfb/rfbclient.h
+@@ -314,10 +314,11 @@ typedef struct _rfbClient {
+ 	rfbBool zlibStreamActive[4];
+ 
+ 	/* Filter stuff. Should be initialized by filter initialization code. */
++#define TIGHT_GRADIENT_MAX_WIDTH 2048
+ 	rfbBool cutZeros;
+ 	int rectWidth, rectColors;
+ 	char tightPalette[256*4];
+-	uint8_t tightPrevRow[2048*3*sizeof(uint16_t)];
++	uint8_t tightPrevRow[TIGHT_GRADIENT_MAX_WIDTH*3*sizeof(uint16_t)];
+ 
+ #ifdef LIBVNCSERVER_HAVE_LIBJPEG
+ 	/** JPEG decoder state (obsolete-- do not use). */
+diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c
+index 57a3715b..dad5514f 100644
+--- a/src/libvncclient/tight.c
++++ b/src/libvncclient/tight.c
+@@ -229,6 +229,11 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+       bitsPixel = InitFilterPaletteBPP(client, rw, rh);
+       break;
+     case rfbTightFilterGradient:
++      if (rw > TIGHT_GRADIENT_MAX_WIDTH) {
++	rfbClientLog("Tight Gradient rectangle width %d exceeds maximum %d.\n",
++		     rw, TIGHT_GRADIENT_MAX_WIDTH);
++	return FALSE;
++      }
+       filterFn = FilterGradientBPP;
+       bitsPixel = InitFilterGradientBPP(client, rw, rh);
+       break;
+@@ -430,7 +435,7 @@ FilterGradient24 (rfbClient* client, int srcx, int srcy, int numRows)
+   CARDBPP *dst =
+     (CARDBPP *)&client->frameBuffer[(srcy * client->width + srcx) * BPP / 8];
+   int x, y, c;
+-  uint8_t thisRow[2048*3];
++  uint8_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3];
+   uint8_t pix[3];
+   int est[3];
+ 
+@@ -473,7 +478,7 @@ FilterGradientBPP (rfbClient* client, int srcx, int srcy, int numRows)
+   int x, y, c;
+   CARDBPP *src = (CARDBPP *)client->buffer;
+   uint16_t *thatRow = (uint16_t *)client->tightPrevRow;
+-  uint16_t thisRow[2048*3];
++  uint16_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3];
+   uint16_t pix[3];
+   uint16_t max[3];
+   int shift[3];
+@@ -705,4 +710,3 @@ ReadCompactLen (rfbClient* client)
+ /* LIBVNCSERVER_HAVE_LIBZ and LIBVNCSERVER_HAVE_LIBJPEG */
+ #endif
+ #endif
+-
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index 77612e1626..47e42cd094 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -46,6 +46,7 @@ inherit cmake pkgconfig
 
 SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \
            file://0001-CMake-require-at-least-CMake-3.5.patch \
+           file://CVE-2026-44988.patch \
 "
 SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
 

[oe][meta-oe][blacksail][PATCH 41/44] libvncserver: patch CVE-2026-32854

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32854

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libvncserver/CVE-2026-32854.patch         | 66 +++++++++++++++++++
 .../libvncserver/libvncserver_0.9.15.bb       |  1 +
 2 files changed, 67 insertions(+)
 create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch

diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch
new file mode 100644
index 0000000000..85adf3eba2
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch
@@ -0,0 +1,66 @@
+From bf01ccc67bc8181568af2d1f6e1f6f6888b51bde Mon Sep 17 00:00:00 2001
+From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com>
+Date: Thu, 19 Mar 2026 17:42:00 +0900
+Subject: [PATCH] libvncserver: fix NULL pointer dereferences in httpd proxy
+ handlers
+
+httpProcessInput() passes the return value of strchr() to atoi()
+and strncmp() without checking for NULL. If a CONNECT request
+contains no colon, or a GET request contains no slash, strchr()
+returns NULL, leading to a segmentation fault.
+
+Add NULL checks before using the strchr() return values.
+
+(cherry picked from commit dc78dee51a7e270e537a541a17befdf2073f5314)
+
+CVE: CVE-2026-32854
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libvncserver/httpd.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/src/libvncserver/httpd.c b/src/libvncserver/httpd.c
+index 2186ae54..604e5bf9 100644
+--- a/src/libvncserver/httpd.c
++++ b/src/libvncserver/httpd.c
+@@ -337,10 +337,11 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen)
+ 
+ 
+     /* Process the request. */
+-    if(rfbScreen->httpEnableProxyConnect) {
++if(rfbScreen->httpEnableProxyConnect) {
+ 	const static char* PROXY_OK_STR = "HTTP/1.0 200 OK\r\nContent-Type: octet-stream\r\nPragma: no-cache\r\n\r\n";
+ 	if(!strncmp(buf, "CONNECT ", 8)) {
+-	    if(atoi(strchr(buf, ':')+1)!=rfbScreen->port) {
++	    char *colon = strchr(buf, ':');
++	    if(colon == NULL || atoi(colon+1)!=rfbScreen->port) {
+ 		rfbErr("httpd: CONNECT format invalid.\n");
+ 		rfbWriteExact(&cl,INVALID_REQUEST_STR, strlen(INVALID_REQUEST_STR));
+ 		httpCloseSock(rfbScreen);
+@@ -353,14 +354,17 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen)
+ 	    rfbScreen->httpSock = RFB_INVALID_SOCKET;
+ 	    return;
+ 	}
+-	if (!strncmp(buf, "GET ",4) && !strncmp(strchr(buf,'/'),"/proxied.connection HTTP/1.", 27)) {
+-	    /* proxy connection */
+-	    rfbLog("httpd: client asked for /proxied.connection\n");
+-	    rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR));
+-	    rfbNewClientConnection(rfbScreen,rfbScreen->httpSock);
+-	    rfbScreen->httpSock = RFB_INVALID_SOCKET;
+-	    return;
+-	}	   
++	if (!strncmp(buf, "GET ",4)) {
++	    char *slash = strchr(buf, '/');
++	    if (slash != NULL && !strncmp(slash,"/proxied.connection HTTP/1.", 27)) {
++		/* proxy connection */
++		rfbLog("httpd: client asked for /proxied.connection\n");
++		rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR));
++		rfbNewClientConnection(rfbScreen,rfbScreen->httpSock);
++		rfbScreen->httpSock = RFB_INVALID_SOCKET;
++		return;
++	    }
++	}
+     }
+ 
+     if (strncmp(buf, "GET ", 4)) {
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index 47e42cd094..9fbec58c72 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -47,6 +47,7 @@ inherit cmake pkgconfig
 SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \
            file://0001-CMake-require-at-least-CMake-3.5.patch \
            file://CVE-2026-44988.patch \
+           file://CVE-2026-32854.patch \
 "
 SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
 

[oe][meta-oe][blacksail][PATCH 42/44] libvncserver: patch CVE-2026-32853

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32853

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libvncserver/CVE-2026-32853.patch         | 76 +++++++++++++++++++
 .../libvncserver/libvncserver_0.9.15.bb       |  1 +
 2 files changed, 77 insertions(+)
 create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch

diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch
new file mode 100644
index 0000000000..23d6a3df1f
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch
@@ -0,0 +1,76 @@
+From 4d5c0ea960e4a22cd8b8fb3c6e18b5a1b1797783 Mon Sep 17 00:00:00 2001
+From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com>
+Date: Sun, 22 Mar 2026 20:35:49 +0100
+Subject: [PATCH] libvncclient: add bounds checks to UltraZip subrectangle
+ parsing
+
+HandleUltraZipBPP() iterates over sub-rectangles using numCacheRects
+(derived from the attacker-controlled rect.r.x) without validating
+that the pointer stays within the decompressed data buffer. A malicious
+server can set a large numCacheRects value, causing heap out-of-bounds
+reads via the memcpy calls in the parsing loop.
+
+Add bounds checks before reading the 12-byte subrect header and before
+advancing the pointer by the raw pixel data size. Use uint64_t for the
+raw data size calculation to prevent integer overflow on 32-bit platforms.
+
+(cherry picked from commit 009008e2f4d5a54dd71f422070df3af7b3dbc931)
+
+CVE: CVE-2026-32853
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libvncclient/ultra.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/src/libvncclient/ultra.c b/src/libvncclient/ultra.c
+index 1d3aaba6..5633b8cb 100644
+--- a/src/libvncclient/ultra.c
++++ b/src/libvncclient/ultra.c
+@@ -126,6 +126,7 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+   int toRead=0;
+   int inflateResult=0;
+   unsigned char *ptr=NULL;
++  unsigned char *ptr_end=NULL;
+   lzo_uint uncompressedBytes = ry + (rw * 65535);
+   unsigned int numCacheRects = rx;
+ 
+@@ -194,11 +195,18 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+   
+   /* Put the uncompressed contents of the update on the screen. */
+   ptr = (unsigned char *)client->raw_buffer;
++  ptr_end = ptr + uncompressedBytes;
+   for (i=0; i<numCacheRects; i++)
+   {
+     unsigned short sx, sy, sw, sh;
+     unsigned int se;
+ 
++    /* subrect header: sx(2) + sy(2) + sw(2) + sh(2) + se(4) = 12 bytes */
++    if (ptr + 12 > ptr_end) {
++      rfbClientLog("UltraZip: subrect %d header exceeds decompressed data bounds\n", i);
++      return FALSE;
++    }
++
+     memcpy((char *)&sx, ptr, 2); ptr += 2;
+     memcpy((char *)&sy, ptr, 2); ptr += 2;
+     memcpy((char *)&sw, ptr, 2); ptr += 2;
+@@ -213,8 +221,13 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+ 
+     if (se == rfbEncodingRaw)
+     {
++        uint64_t rawBytes = (uint64_t)sw * sh * (BPP / 8);
++        if (rawBytes > (size_t)(ptr_end - ptr)) {
++          rfbClientLog("UltraZip: subrect %d raw data exceeds decompressed data bounds\n", i);
++          return FALSE;
++        }
+         client->GotBitmap(client, (unsigned char *)ptr, sx, sy, sw, sh);
+-        ptr += ((sw * sh) * (BPP / 8));
++        ptr += (size_t)rawBytes;
+     }
+   }  
+ 
+@@ -222,3 +235,4 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+ }
+ 
+ #undef CARDBPP
++
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index 9fbec58c72..e2f995947f 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -48,6 +48,7 @@ SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag
            file://0001-CMake-require-at-least-CMake-3.5.patch \
            file://CVE-2026-44988.patch \
            file://CVE-2026-32854.patch \
+           file://CVE-2026-32853.patch \
 "
 SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
 

[oe][meta-oe][blacksail][PATCH 43/44] libvncserver: patch CVE-2026-50538

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50538

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../libvncserver/CVE-2026-50538.patch         | 49 +++++++++++++++++++
 .../libvncserver/libvncserver_0.9.15.bb       |  1 +
 2 files changed, 50 insertions(+)
 create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch

diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch
new file mode 100644
index 0000000000..da01736323
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch
@@ -0,0 +1,49 @@
+From e824e7d8ea71feccb81aeb34771eb83e052c3fe2 Mon Sep 17 00:00:00 2001
+From: "Bas.Levering" <45083161+Bazskillz@users.noreply.github.com>
+Date: Fri, 29 May 2026 09:08:28 +0200
+Subject: [PATCH] Merge commit from fork
+
+HandleTightBPP's basic-compression loop wrote each batch of decompressed
+rows straight into client->frameBuffer (via FilterCopy/Palette/Gradient)
+and only compared the running total against the rectangle height rh after
+the loop. A malicious or man-in-the-middle server can send a zlib stream
+that decompresses to more rows than rh, so the writes run past the end of
+the framebuffer allocation: an attacker-controlled heap out-of-bounds
+write reachable in a default build (Tight is advertised when built with
+libz+libjpeg), pre-authentication, from one FramebufferUpdate.
+
+Clamp numRows to the remaining height before calling filterFn, matching
+the existing house style (trle.c and the Tight JPEG path already clamp to
+the rectangle height).
+
+Co-authored-by: Bas Levering <basdaniel3@gmail.com>
+(cherry picked from commit 540332be3e0acc566fa64da6f1b4680c72c724dd)
+
+CVE: CVE-2026-50538
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/540332be3e0acc566fa64da6f1b4680c72c724dd]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libvncclient/tight.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c
+index dad5514f..3ee0d5e0 100644
+--- a/src/libvncclient/tight.c
++++ b/src/libvncclient/tight.c
+@@ -341,6 +341,16 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+ 
+       numRows = (bufferSize - zs->avail_out) / rowSize;
+ 
++      /* The decompressed stream is server-controlled and may yield more rows
++         than the rectangle's declared height.  filterFn() writes directly into
++         client->frameBuffer, so clamp here before writing to avoid running past
++         the framebuffer (heap out-of-bounds write).  The post-loop
++         "rowsProcessed != rh" check happens too late. */
++      if (numRows > rh - rowsProcessed) {
++	rfbClientLog("Tight: too many scan lines after decompression.\n");
++	return FALSE;
++      }
++
+       filterFn(client, rx, ry+rowsProcessed, numRows);
+ 
+       extraBytes = bufferSize - zs->avail_out - numRows * rowSize;
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index e2f995947f..ff7327c6cf 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -49,6 +49,7 @@ SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag
            file://CVE-2026-44988.patch \
            file://CVE-2026-32854.patch \
            file://CVE-2026-32853.patch \
+           file://CVE-2026-50538.patch \
 "
 SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
 

[oe][meta-webserver][blacksail][PATCH 44/44] swagger-ui: upgrade 5.33.2 -> 5.33.3

[ankur.tyagi85]

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.3

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 67b4387a4d9f2fbc111b52ec6cd3b7620116c6d1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../swagger-ui/{swagger-ui_5.33.2.bb => swagger-ui_5.33.3.bb}   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.2.bb => swagger-ui_5.33.3.bb} (94%)

diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.3.bb
similarity index 94%
rename from meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
rename to meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.3.bb
index aeee9e4da6..6f69070033 100644
--- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
+++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.3.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
 
 SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=main;protocol=https;tag=v${PV}"
 
-SRCREV = "e89a91f13cdee432d97ca9d3d1ac1969ff797036"
+SRCREV = "38ca10e1867a66525751590d8d51011973107ad1"
 
 CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1"
 

Re: [meta-webserver][blacksail][PATCH 37/44] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629

[mominux]

[-- Attachment #1: Type: text/plain, Size: 957 bytes --]

Hi Ankur,

Thanks for the patch! I reviewed and tested it on the *Blacksail* branch. Here are the test results:

*Test environment:*

* 

Machine: *qemux86-64*

* 

BitBake: *2.20.0*

* 

Nginx: *1.30.6*

* 

CVE List: *c6bdd03cb90deb06783a7890a54d1dde9d4359da*

* 

NVD: *3c3c8ced48705560aebecd7e539f50ad7fc3654d*

*Results:*

* 

Before applying the patch, both *CVE-2026-95101* and *CVE-2026-97629* were reported as Unpatched ( version-in-range ).

* 

After applying the patch, both were correctly reported as Patched ( fixed-version: Fixed since 1.30.6 ).

* 

I repeated the tests with pinned CVE database revisions and confirmed that no other Nginx CVE classifications changed.

* 

Nginx *1.30.6* also built successfully using bitbake nginx.

All tests passed. I haven't performed any runtime testing.

Tested by: Mohammad Abdoli <mominux@gmail.com>

Have a great weekend!

Best regards,
Mohammad

[-- Attachment #2: Type: text/html, Size: 1784 bytes --]

Re: [meta-webserver][blacksail][PATCH 37/44] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629

[mominux]

[-- Attachment #1: Type: text/plain, Size: 105 bytes --]

Small correction to the trailer in my previous email:

Tested-by: Mohammad Abdoli <mominux@gmail.com>

[-- Attachment #2: Type: text/html, Size: 159 bytes --]

Re: [oe] [meta-webserver][blacksail][PATCH 37/44] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629

[Ankur Tyagi]

Thanks Mohammad

On Sat, Oct 24, 2026 at 10:26 AM mominux via lists.openembedded.org
<mominux=gmail.com@lists.openembedded.org> wrote:
>
> Small correction to the trailer in my previous email:
>
> Tested-by: Mohammad Abdoli <mominux@gmail.com>
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#131390): https://lists.openembedded.org/g/openembedded-devel/message/131390
> Mute This Topic: https://lists.openembedded.org/mt/121863982/3619737
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [ankur.tyagi85@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>