* [oe][meta-oe][blacksail][PATCH 2/44] udisks2: patch CVE-2026-7867
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 3/44] tmate: patch CVE-2026-4751 ankur.tyagi85
` (41 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport commits from the PR[1].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-7867
[1]https://github.com/storaged-project/udisks/pull/1530
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../udisks/udisks2/CVE-2026-7867-1.patch | 249 +++++++++++++
.../udisks/udisks2/CVE-2026-7867-2.patch | 208 +++++++++++
.../udisks/udisks2/CVE-2026-7867-3.patch | 53 +++
.../udisks/udisks2/CVE-2026-7867-4.patch | 40 ++
.../udisks/udisks2/CVE-2026-7867-5.patch | 348 ++++++++++++++++++
.../recipes-support/udisks/udisks2_2.10.2.bb | 9 +-
6 files changed, 905 insertions(+), 2 deletions(-)
create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch
create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch
create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch
create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch
create mode 100644 meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch
new file mode 100644
index 0000000000..e7a5704f6c
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-1.patch
@@ -0,0 +1,249 @@
+From 1b417fd9a69e7141927a03bfb39d4d5a78b891b4 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Tue, 28 Apr 2026 19:10:09 +0200
+Subject: [PATCH] udiskslinuxfilesystem: Separate real caller identity from
+ as-user target
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When the 'as-user' option is specified in Filesystem.Mount(), the code
+previously overwrote caller_uid/caller_gid with the target user's identity.
+This meant downstream functions received a uid they believed was the
+D-Bus caller's, but was actually the target's.
+
+Introduce effective_uid/effective_gid/effective_user_name to hold the
+as-user target identity (or the caller's identity when as-user is not
+set). The real D-Bus caller identity is now always resolved into
+caller_uid/caller_gid and used for authorization-related decisions
+(setup_by_user, on_user_seat checks), while effective_* is used for
+mount point calculation, run_as_uid/run_as_gid, and state tracking.
+
+Reported-by: Azizcan Daştan <azizcan.dastan5@gmail.com>
+Reported-by: Özlem Ozan <oozan1725@gmail.com>
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 397eea88d58f77f6e02d537c4c961201b9245943)
+(cherry picked from commit 2d97818f41fbeb645fbb7b0373ed448bd26503f6)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/2d97818f41fbeb645fbb7b0373ed448bd26503f6]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/udiskslinuxfilesystem.c | 93 +++++++++++++++++++++----------------
+ 1 file changed, 53 insertions(+), 40 deletions(-)
+
+diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
+index 9f4880ad..ebdd2e05 100644
+--- a/src/udiskslinuxfilesystem.c
++++ b/src/udiskslinuxfilesystem.c
+@@ -905,7 +905,8 @@ handle_mount_fstab (UDisksDaemon *daemon,
+ UDisksObject *object,
+ uid_t caller_uid,
+ gid_t caller_gid,
+- gboolean mount_other_user,
++ uid_t effective_uid,
++ gid_t effective_gid,
+ const gchar *mount_point_to_use,
+ const gchar *fstab_mount_options,
+ GDBusMethodInvocation *invocation,
+@@ -936,7 +937,7 @@ handle_mount_fstab (UDisksDaemon *daemon,
+ * will be replaced by the name of the drive/device in question
+ */
+ message = N_("Authentication is required to mount $(drive)");
+- if (mount_other_user)
++ if (caller_uid != effective_uid)
+ {
+ action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
+ }
+@@ -981,14 +982,14 @@ handle_mount_fstab (UDisksDaemon *daemon,
+ job = udisks_daemon_launch_simple_job (daemon,
+ UDISKS_OBJECT (object),
+ "filesystem-mount",
+- mount_fstab_as_root ? 0 : caller_uid,
++ mount_fstab_as_root ? 0 : effective_uid,
+ NULL /* cancellable */);
+
+ /* XXX: using run_as_uid for root doesn't work even if the caller is already root */
+- if (!mount_fstab_as_root && caller_uid != 0)
++ if (!mount_fstab_as_root && effective_uid != 0)
+ {
+- BDExtraArg uid_arg = { g_strdup ("run_as_uid"), g_strdup_printf ("%d", caller_uid) };
+- BDExtraArg gid_arg = { g_strdup ("run_as_gid"), g_strdup_printf ("%d", caller_gid) };
++ BDExtraArg uid_arg = { g_strdup ("run_as_uid"), g_strdup_printf ("%d", effective_uid) };
++ BDExtraArg gid_arg = { g_strdup ("run_as_gid"), g_strdup_printf ("%d", effective_gid) };
+ const BDExtraArg *extra_args[3] = { &uid_arg, &gid_arg, NULL };
+
+ success = bd_fs_mount (NULL, mount_point_to_use, NULL, NULL, extra_args, &error);
+@@ -1066,8 +1067,9 @@ handle_mount_dynamic (UDisksDaemon *daemon,
+ UDisksObject *object,
+ uid_t caller_uid,
+ gid_t caller_gid,
+- const gchar *caller_user_name,
+- gboolean mount_other_user,
++ uid_t effective_uid,
++ gid_t effective_gid,
++ const gchar *effective_user_name,
+ gchar **mount_point_to_use,
+ gboolean *mpoint_persistent,
+ GDBusMethodInvocation *invocation,
+@@ -1127,7 +1129,7 @@ handle_mount_dynamic (UDisksDaemon *daemon,
+ * will be replaced by the name of the drive/device in question
+ */
+ message = N_("Authentication is required to mount $(drive)");
+- if (mount_other_user)
++ if (caller_uid != effective_uid)
+ {
+ action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
+ }
+@@ -1161,9 +1163,9 @@ handle_mount_dynamic (UDisksDaemon *daemon,
+ /* Calculate mount point (guaranteed to be valid UTF-8) */
+ *mount_point_to_use = calculate_mount_point (daemon,
+ block,
+- caller_uid,
+- caller_gid,
+- caller_user_name,
++ effective_uid,
++ effective_gid,
++ effective_user_name,
+ fs_type_to_use,
+ mpoint_persistent,
+ &error);
+@@ -1178,7 +1180,7 @@ handle_mount_dynamic (UDisksDaemon *daemon,
+ /* Calculate mount options (guaranteed to be valid UTF-8) */
+ mount_options = udisks_linux_calculate_mount_options (daemon,
+ block,
+- caller_uid,
++ effective_uid,
+ fs_signature,
+ fs_type_to_use,
+ options,
+@@ -1258,14 +1260,16 @@ handle_mount (UDisksFilesystem *filesystem,
+ UDisksBlock *block;
+ UDisksDaemon *daemon;
+ UDisksState *state = NULL;
+- gchar *opt_as_user = NULL;
++ const gchar *opt_as_user = NULL;
+ uid_t caller_uid;
+ gid_t caller_gid;
++ uid_t effective_uid = 0;
++ gid_t effective_gid = 0;
++ gchar *effective_user_name = NULL;
+ const gchar * const *existing_mount_points;
+ gchar *mount_point_to_use = NULL;
+ gboolean mpoint_persistent = TRUE;
+ gchar *fstab_mount_options = NULL;
+- gchar *caller_user_name = NULL;
+ GError *error = NULL;
+ gboolean system_managed = FALSE;
+ gchar *device = NULL;
+@@ -1323,35 +1327,42 @@ handle_mount (UDisksFilesystem *filesystem,
+ goto out;
+ }
+
++ /* Always resolve the real D-Bus caller identity */
++ if (!udisks_daemon_util_get_caller_uid_sync (daemon,
++ invocation,
++ NULL /* GCancellable */,
++ &caller_uid,
++ &error))
++ {
++ g_dbus_method_invocation_return_gerror (invocation, error);
++ g_clear_error (&error);
++ goto out;
++ }
++
++ if (!udisks_daemon_util_get_user_info (caller_uid,
++ &caller_gid,
++ opt_as_user ? NULL : &effective_user_name,
++ &error))
++ {
++ g_dbus_method_invocation_return_gerror (invocation, error);
++ g_clear_error (&error);
++ goto out;
++ }
++
+ if (opt_as_user)
+ {
+- if (!udisks_daemon_util_get_user_info_by_name (opt_as_user, &caller_uid, &caller_gid, &error))
++ if (!udisks_daemon_util_get_user_info_by_name (opt_as_user, &effective_uid, &effective_gid, &error))
+ {
+ g_dbus_method_invocation_return_gerror (invocation, error);
+ g_clear_error (&error);
+ goto out;
+ }
+- caller_user_name = g_strdup (opt_as_user);
++ effective_user_name = g_strdup (opt_as_user);
+ }
+ else
+ {
+- if (!udisks_daemon_util_get_caller_uid_sync (daemon,
+- invocation,
+- NULL /* GCancellable */,
+- &caller_uid,
+- &error))
+- {
+- g_dbus_method_invocation_return_gerror (invocation, error);
+- g_clear_error (&error);
+- goto out;
+- }
+-
+- if (!udisks_daemon_util_get_user_info (caller_uid, &caller_gid, &caller_user_name, &error))
+- {
+- g_dbus_method_invocation_return_gerror (invocation, error);
+- g_clear_error (&error);
+- goto out;
+- }
++ effective_uid = caller_uid;
++ effective_gid = caller_gid;
+ }
+
+ /* Mount it */
+@@ -1361,7 +1372,8 @@ handle_mount (UDisksFilesystem *filesystem,
+ object,
+ caller_uid,
+ caller_gid,
+- opt_as_user != NULL,
++ effective_uid,
++ effective_gid,
+ mount_point_to_use,
+ fstab_mount_options,
+ invocation,
+@@ -1374,8 +1386,9 @@ handle_mount (UDisksFilesystem *filesystem,
+ object,
+ caller_uid,
+ caller_gid,
+- caller_user_name,
+- opt_as_user != NULL,
++ effective_uid,
++ effective_gid,
++ effective_user_name,
+ &mount_point_to_use,
+ &mpoint_persistent,
+ invocation,
+@@ -1387,7 +1400,7 @@ handle_mount (UDisksFilesystem *filesystem,
+ udisks_state_add_mounted_fs (state,
+ mount_point_to_use,
+ udisks_block_get_device_number (block),
+- caller_uid,
++ effective_uid,
+ system_managed,
+ system_managed ? FALSE : mpoint_persistent);
+
+@@ -1395,7 +1408,7 @@ handle_mount (UDisksFilesystem *filesystem,
+ device,
+ system_managed ? " (system)" : "",
+ mount_point_to_use,
+- caller_uid);
++ effective_uid);
+
+ udisks_linux_block_object_trigger_uevent_sync (UDISKS_LINUX_BLOCK_OBJECT (object),
+ UDISKS_DEFAULT_WAIT_TIMEOUT);
+@@ -1409,7 +1422,7 @@ handle_mount (UDisksFilesystem *filesystem,
+ udisks_state_check (state);
+ g_free (mount_point_to_use);
+ g_free (fstab_mount_options);
+- g_free (caller_user_name);
++ g_free (effective_user_name);
+ g_free (device);
+ g_clear_object (&object);
+
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch
new file mode 100644
index 0000000000..dff53c87d8
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-2.patch
@@ -0,0 +1,208 @@
+From 53a3e81a90fa6d71cfb59d63ffffa22bbe071886 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Tue, 28 Apr 2026 19:29:14 +0200
+Subject: [PATCH] udiskslinuxfilesystem: Rework fstab mount authorization for
+ as-user
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The polkit authorization logic in handle_mount_fstab() had two problems
+when 'as-user' was combined with fstab entries containing 'user',
+'users' or 'x-udisks-auth' mount options:
+
+1. The 'filesystem-mount-other-user' polkit check was inside the code
+ block that is skipped when 'user'/'users'/'x-udisks-auth' options
+ are present, allowing an unprivileged caller to mount on behalf of
+ another user without any authorization.
+
+2. When 'user' or 'users' fstab options were present and the initial
+ mount attempt failed with a permission error, the code would fall
+ back to mounting as root. This fallback should only be available
+ when 'x-udisks-auth' is explicitly specified.
+
+Restructure the authorization flow so that:
+ - The 'filesystem-mount-other-user' check is evaluated first,
+ independently of fstab mount options, and is always enforced
+ when caller_uid != effective_uid.
+ - The root fallback on BD_FS_ERROR_AUTH is gated on 'x-udisks-auth'
+ being present, not just any of the user-level mount options.
+ - When root uses 'as-user' without 'user'/'users' fstab options,
+ the root fallback is implicitly enabled.
+ - Regular polkit checks (filesystem-mount, mount-system,
+ mount-other-seat) only apply for same-user mounts without
+ 'user'/'users'/'x-udisks-auth'.
+
+Update the D-Bus API documentation to reflect the new behavior.
+
+Reported-by: Azizcan Daştan <azizcan.dastan5@gmail.com>
+Reported-by: Özlem Ozan <oozan1725@gmail.com>
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 68108081aa9049cf3bb2fb0044cb4de83f962390)
+(cherry picked from commit 0050f51d40e468f6a3197ccdc77b5bd59c923a37)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/0050f51d40e468f6a3197ccdc77b5bd59c923a37]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ data/org.freedesktop.UDisks2.xml | 24 ++++++-----
+ src/udiskslinuxfilesystem.c | 73 ++++++++++++++++++++++++--------
+ 2 files changed, 70 insertions(+), 27 deletions(-)
+
+diff --git a/data/org.freedesktop.UDisks2.xml b/data/org.freedesktop.UDisks2.xml
+index 53194c70..f7201adc 100644
+--- a/data/org.freedesktop.UDisks2.xml
++++ b/data/org.freedesktop.UDisks2.xml
+@@ -2654,7 +2654,8 @@
+ filesystem is mounted on behalf of the specified user instead
+ of the calling one. This has usually an effect on the returned
+ @mount_path and it also allows that user to unmount the
+- filesystem later. This option expects a user name, not a UID.
++ filesystem later. This option expects a user name, not a UID
++ and always performs an authorization check.
+
+ If the device in question is referenced in the
+ <filename>/etc/fstab</filename> file, the
+@@ -2662,15 +2663,18 @@
+ and the given options or filesystem type given in @options are
+ ignored.
+
+- If <literal>x-udisks-auth</literal> is specified as an option
+- for the device in the <filename>/etc/fstab</filename> file,
+- then the <command>mount</command> command is run as the
+- calling user, without performing any authorization check
+- mentioned above. If this fails because of insufficient
+- permissions, an authorization check is performed (which
+- typically results in the user having to authenticate as an
+- administrator). If authorized, the <command>mount</command>
+- command is then run as root.
++ If <literal>x-udisks-auth</literal>, <literal>user</literal> or
++ <literal>users</literal> are specified as options for the
++ device in the <filename>/etc/fstab</filename> file, then the
++ <command>mount</command> command is run as the calling user
++ (or the effective user of the <parameter>as-user</parameter>
++ option respectively), without performing any authorization check
++ mentioned above. If this fails because of insufficient permissions
++ and <literal>x-udisks-auth</literal> is specified, an
++ authorization check is performed (which typically results in
++ the user having to authenticate as an administrator). If
++ authorized, the <command>mount</command> command is then run
++ as root.
+
+ The filesystem should be unmounted using the
+ org.freedesktop.UDisks2.Filesystem.Unmount() method.
+diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
+index ebdd2e05..eb2a3f21 100644
+--- a/src/udiskslinuxfilesystem.c
++++ b/src/udiskslinuxfilesystem.c
+@@ -918,30 +918,60 @@ handle_mount_fstab (UDisksDaemon *daemon,
+ const gchar *message = NULL;
+ gboolean success = FALSE;
+ gboolean mount_fstab_as_root = FALSE;
++ gboolean x_udisks_auth = FALSE;
++ gboolean user_mount = FALSE;
+ UDisksBaseJob *job = NULL;
+ GError *error = NULL;
+
+ block = udisks_object_peek_block (object);
+ device = udisks_block_get_device (block);
+
+- if (!has_option (fstab_mount_options, "x-udisks-auth") &&
+- !has_option (fstab_mount_options, "user") &&
+- !has_option (fstab_mount_options, "users"))
++ x_udisks_auth = has_option (fstab_mount_options, "x-udisks-auth");
++ user_mount = x_udisks_auth ||
++ has_option (fstab_mount_options, "user") ||
++ has_option (fstab_mount_options, "users");
++
++ /* 'as-user' rules:
++ * - when caller is root:
++ * - if 'user'/'users' present, do not fall back to mounting as root, unless 'x-udisks-auth' is specified
++ * - if 'user'/'users' not present, try as effective user first and allow fallback to mounting as root (implies 'x-udisks-auth')
++ * - when caller is unprivileged:
++ * - always require polkit auth to prevent identity spoofing
++ * - do not fall back to mounting as root, unless 'x-udisks-auth' is specified
++ * - if neither 'user'/'users'/'x-udisks-auth' present, failure is expected by nature (unless 'as-user=root')
++ *
++ * general fstab mounting rules:
++ * - when caller is root, mount as root, allow anything
++ * - when caller is unprivileged:
++ * - if 'user'/'users' present, do not fall back to mounting as root, unless 'x-udisks-auth' is specified
++ * - if only 'x-udisks-auth' present, mount as user and fall back to mounting as root if not successful
++ * - if neither 'user'/'users'/'x-udisks-auth' present, require polkit auth and mount as root
++ *
++ * Further assumptions:
++ * - when 'user'/'users' not present and mounting as unprivileged, this typically fails but it is still beneficial to try that e.g. for FUSE mounts
++ * - assuming libblockdev mount error code mapping works reliably (for the BD_FS_ERROR_AUTH check)
++ */
++
++ if (caller_uid != effective_uid)
++ {
++ /* Always require authorization when mounting on behalf of another user,
++ * regardless of fstab mount options.
++ */
++ action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
++
++ /* When 'user'/'users' not present and the caller is root, allow
++ * fallback mounting as root.
++ */
++ if (caller_uid == 0 && !user_mount)
++ x_udisks_auth = TRUE;
++ }
++ else
++ if (!user_mount)
+ {
+ mount_fstab_as_root = TRUE;
++
+ action_id = "org.freedesktop.udisks2.filesystem-mount";
+- /* Translators: Shown in authentication dialog when the user
+- * requests mounting a filesystem.
+- *
+- * Do not translate $(drive), it's a placeholder and
+- * will be replaced by the name of the drive/device in question
+- */
+- message = N_("Authentication is required to mount $(drive)");
+- if (caller_uid != effective_uid)
+- {
+- action_id = "org.freedesktop.udisks2.filesystem-mount-other-user";
+- }
+- else if (!udisks_daemon_util_setup_by_user (daemon, object, caller_uid))
++ if (!udisks_daemon_util_setup_by_user (daemon, object, caller_uid))
+ {
+ if (udisks_block_get_hint_system (block))
+ {
+@@ -952,7 +982,17 @@ handle_mount_fstab (UDisksDaemon *daemon,
+ action_id = "org.freedesktop.udisks2.filesystem-mount-other-seat";
+ }
+ }
++ }
+
++ if (action_id)
++ {
++ /* Translators: Shown in authentication dialog when the user
++ * requests mounting a filesystem.
++ *
++ * Do not translate $(drive), it's a placeholder and
++ * will be replaced by the name of the drive/device in question
++ */
++ message = N_("Authentication is required to mount $(drive)");
+ if (!udisks_daemon_util_check_authorization_sync (daemon,
+ object,
+ action_id,
+@@ -962,7 +1002,6 @@ handle_mount_fstab (UDisksDaemon *daemon,
+ return FALSE;
+ }
+
+-
+ if (!g_file_test (mount_point_to_use, G_FILE_TEST_IS_DIR))
+ {
+ if (g_mkdir_with_parents (mount_point_to_use, 0755) != 0)
+@@ -1011,7 +1050,7 @@ handle_mount_fstab (UDisksDaemon *daemon,
+
+ if (!success)
+ {
+- if (!mount_fstab_as_root && g_error_matches (error, BD_FS_ERROR, BD_FS_ERROR_AUTH))
++ if (!mount_fstab_as_root && g_error_matches (error, BD_FS_ERROR, BD_FS_ERROR_AUTH) && x_udisks_auth)
+ {
+ g_clear_error (&error);
+ action_id = "org.freedesktop.udisks2.filesystem-fstab";
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch
new file mode 100644
index 0000000000..245e46ac00
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-3.patch
@@ -0,0 +1,53 @@
+From 68a82f2afb3a5ca0da207cdd5bbd55e777940e12 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Sun, 3 May 2026 14:00:01 +0200
+Subject: [PATCH] udiskslinuxfilesystem: Log real caller uid for as-user mounts
+
+When a mount is performed with the as-user option targeting a different
+user, log both the effective (target) uid and the real caller uid to
+provide an audit trail of who authorized the operation.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 98e5a76c155640d155280cdb642791f00def736a)
+(cherry picked from commit 132ebab4a196f7fbd01fa28283627b2227eb399b)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/132ebab4a196f7fbd01fa28283627b2227eb399b]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/udiskslinuxfilesystem.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/udiskslinuxfilesystem.c b/src/udiskslinuxfilesystem.c
+index eb2a3f21..5e2508cc 100644
+--- a/src/udiskslinuxfilesystem.c
++++ b/src/udiskslinuxfilesystem.c
+@@ -1443,11 +1443,23 @@ handle_mount (UDisksFilesystem *filesystem,
+ system_managed,
+ system_managed ? FALSE : mpoint_persistent);
+
+- udisks_notice ("Mounted %s%s at %s on behalf of uid %u",
+- device,
+- system_managed ? " (system)" : "",
+- mount_point_to_use,
+- effective_uid);
++ if (effective_uid != caller_uid)
++ {
++ udisks_notice ("Mounted %s%s at %s on behalf of uid %u (requested by uid %u)",
++ device,
++ system_managed ? " (system)" : "",
++ mount_point_to_use,
++ effective_uid,
++ caller_uid);
++ }
++ else
++ {
++ udisks_notice ("Mounted %s%s at %s on behalf of uid %u",
++ device,
++ system_managed ? " (system)" : "",
++ mount_point_to_use,
++ effective_uid);
++ }
+
+ udisks_linux_block_object_trigger_uevent_sync (UDISKS_LINUX_BLOCK_OBJECT (object),
+ UDISKS_DEFAULT_WAIT_TIMEOUT);
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch
new file mode 100644
index 0000000000..726f3271dc
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-4.patch
@@ -0,0 +1,40 @@
+From a17202ed591f07109ce978e5abb999c67de9b3f1 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Tue, 28 Apr 2026 19:10:38 +0200
+Subject: [PATCH] udisksdaemonutil: Pass as-user target to polkit details
+
+When the 'as-user' D-Bus method option is present, propagate the
+target username to polkit details as 'mount.as-user'. This allows
+polkit rules to make fine-grained authorization decisions based on
+who the mount is being performed for.
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 681d58a76f6aaa5045eb43e665c65f497d35b810)
+(cherry picked from commit 3b016cc881b1d3c3d843ec13e35102beaaac7023)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/3b016cc881b1d3c3d843ec13e35102beaaac7023]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/udisksdaemonutil.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/udisksdaemonutil.c b/src/udisksdaemonutil.c
+index 3db92f58..36e3184b 100644
+--- a/src/udisksdaemonutil.c
++++ b/src/udisksdaemonutil.c
+@@ -797,6 +797,14 @@ udisks_daemon_util_check_authorization_sync_with_error (UDisksDaemon *
+ polkit_details_insert (details, "polkit.message", message);
+ polkit_details_insert (details, "polkit.gettext_domain", "udisks2");
+
++ if (options != NULL &&
++ g_strcmp0 (action_id, "org.freedesktop.udisks2.filesystem-mount-other-user") == 0)
++ {
++ const gchar *as_user = NULL;
++ g_variant_lookup (options, "as-user", "&s", &as_user);
++ _safe_polkit_details_insert (details, "mount.as-user", as_user);
++ }
++
+ /* Find drive associated with the block device, if any */
+ if (object != NULL)
+ {
diff --git a/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch
new file mode 100644
index 0000000000..6901e71d37
--- /dev/null
+++ b/meta-oe/recipes-support/udisks/udisks2/CVE-2026-7867-5.patch
@@ -0,0 +1,348 @@
+From 7e77f3cb5c6658f5522d8d56e882e8df02978d76 Mon Sep 17 00:00:00 2001
+From: Tomas Bzatek <tbzatek@redhat.com>
+Date: Wed, 29 Apr 2026 16:36:45 +0200
+Subject: [PATCH] tests: Add security tests for as-user mount authorization
+
+Add tests verifying that an unprivileged D-Bus caller cannot exploit
+the 'as-user' option in Filesystem.Mount() to mount on behalf of
+another user without polkit authorization. Use a dedicated
+'udisks_test_target' user instead of 'nobody' to avoid OS-level
+special treatment of system users that could mask real behavior.
+
+Dynamic mount tests (in UdisksFSTestCase, inherited by all FS types):
+- test_mount_as_user_denied: as-user=<another_user> is denied
+- test_mount_as_user_root_denied: as-user=root is denied
+- test_mount_as_user_self: as-user=<self> behaves like plain mount
+
+Fstab mount tests (in NonPOSIXTestCase, inherited by VFAT/EXFAT):
+- test_mount_fstab_{users,user,x-udisks-auth}_as_user_denied:
+ fstab entries that normally allow unprivileged mounting must still
+ require authorization when as-user is specified
+- test_mount_fstab_{users,user,x-udisks-auth}_as_root_denied:
+ same but with as-user=root
+- test_mount_fstab_defaults_as_user_from_root: root can mount
+ fstab 'defaults' device with as-user targeting a non-root user
+- test_mount_fstab_defaults_as_user_denied: unprivileged user
+ cannot mount fstab 'defaults' device with as-user
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+(cherry picked from commit 5ec20c9d5719ead510d800bc3eb5a731e5712f39)
+(cherry picked from commit 36231768dde088c8b4d4796ff2d311d089d84052)
+
+CVE: CVE-2026-7867
+Upstream-Status: Backport [https://github.com/storaged-project/udisks/commit/36231768dde088c8b4d4796ff2d311d089d84052]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/tests/dbus-tests/test_80_filesystem.py | 278 +++++++++++++++++++++
+ 1 file changed, 278 insertions(+)
+
+diff --git a/src/tests/dbus-tests/test_80_filesystem.py b/src/tests/dbus-tests/test_80_filesystem.py
+index 1f375ac6..03336512 100644
+--- a/src/tests/dbus-tests/test_80_filesystem.py
++++ b/src/tests/dbus-tests/test_80_filesystem.py
+@@ -30,6 +30,8 @@ class UdisksFSTestCase(udiskstestcase.UdisksTestCase):
+ _can_query_size = False
+
+ username = 'udisks_test_user'
++ # a separate target user used for 'as-user' mount tests
++ target_username = 'udisks_test_target'
+
+ requested_plugins = BlockDev.plugin_specs_from_names(("fs",))
+
+@@ -1037,6 +1039,174 @@ class UdisksFSTestCase(udiskstestcase.UdisksTestCase):
+ pipe.send([True, ''])
+ pipe.close()
+
++ def _mount_with_as_user_fail(self, pipe, uid, gid, device, target_user):
++ """ Try to mount @device as user with given @uid and @gid using the
++ 'as-user' option set to @target_user. This is expected to fail
++ with a NotAuthorized error.
++ """
++ os.setresgid(gid, gid, gid)
++ os.setresuid(uid, uid, uid)
++
++ try:
++ safe_dbus.call_sync(self.iface_prefix,
++ self.path_prefix + '/block_devices/' + os.path.basename(device),
++ self.iface_prefix + '.Filesystem',
++ 'Mount',
++ GLib.Variant('(a{sv})', ({'as-user': GLib.Variant('s', target_user)},)))
++ except Exception as e:
++ msg = str(e)
++ if 'org.freedesktop.UDisks2.Error.NotAuthorized' in msg and \
++ 'Not authorized to perform operation' in msg:
++ pipe.send([True, ''])
++ pipe.close()
++ return
++ else:
++ pipe.send([False, 'Mount DBus call failed with unexpected exception: %s' % msg])
++ pipe.close()
++ return
++
++ pipe.send([False, 'Mount with as-user=%s unexpectedly succeeded for uid %d' % (target_user, uid)])
++ pipe.close()
++
++ def _test_mount_as_user_denied(self, target_user):
++ """ Test that an unprivileged user cannot use as-user to mount on
++ behalf of @target_user without polkit authorization.
++ """
++ self._check_can_create()
++
++ if not self._can_mount:
++ self.skipTest('Cannot mount %s filesystem' % self._fs_signature)
++
++ disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++ self.assertIsNotNone(disk)
++
++ disk.Format(self._fs_signature, self.no_options, dbus_interface=self.iface_prefix + '.Block')
++ self.addCleanup(self.wipe_fs, self.vdevs[0])
++ self.addCleanup(self.try_unmount, self.vdevs[0])
++
++ self.addCleanup(self._remove_user, self.username)
++ uid, gid = self._add_user(self.username)
++
++ if target_user != 'root':
++ self.addCleanup(self._remove_user, target_user)
++ self._add_user(target_user)
++
++ parent_conn, child_conn = Pipe()
++ proc = Process(target=self._mount_with_as_user_fail,
++ args=(child_conn, int(uid), int(gid), self.vdevs[0], target_user))
++ proc.start()
++ res = parent_conn.recv()
++ parent_conn.close()
++ proc.join()
++
++ if not res[0]:
++ self.fail(res[1])
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_as_user_denied(self):
++ """ Test that an unprivileged user cannot use as-user to mount on
++ behalf of another user without authorization.
++ """
++ self._test_mount_as_user_denied(self.target_username)
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_as_user_root_denied(self):
++ """ Test that an unprivileged user cannot use as-user=root to mount
++ without authorization.
++ """
++ self._test_mount_as_user_denied('root')
++
++ def _mount_as_user_result(self, pipe, uid, gid, device, options):
++ """ Try to mount @device as user with given @uid and @gid using
++ the given @options dict. Returns [True, error_string] on D-Bus
++ error or [True, ''] on success.
++ """
++ os.setresgid(gid, gid, gid)
++ os.setresuid(uid, uid, uid)
++
++ try:
++ safe_dbus.call_sync(self.iface_prefix,
++ self.path_prefix + '/block_devices/' + os.path.basename(device),
++ self.iface_prefix + '.Filesystem',
++ 'Mount',
++ GLib.Variant('(a{sv})', (options,)))
++ except Exception as e:
++ pipe.send([True, str(e)])
++ pipe.close()
++ return
++
++ pipe.send([True, ''])
++ pipe.close()
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_as_user_self(self):
++ """ Test that as-user targeting the caller's own username behaves
++ identically to mounting without as-user (no extra mount-other-user
++ authorization required).
++ """
++ self._check_can_create()
++
++ if not self._can_mount:
++ self.skipTest('Cannot mount %s filesystem' % self._fs_signature)
++
++ disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++ self.assertIsNotNone(disk)
++
++ disk.Format(self._fs_signature, self.no_options, dbus_interface=self.iface_prefix + '.Block')
++ self.addCleanup(self.wipe_fs, self.vdevs[0])
++ self.addCleanup(self.try_unmount, self.vdevs[0])
++
++ self.addCleanup(self._remove_user, self.username)
++ uid, gid = self._add_user(self.username)
++
++ # first try a plain mount without as-user
++ parent_conn, child_conn = Pipe()
++ proc = Process(target=self._mount_as_user_result,
++ args=(child_conn, int(uid), int(gid), self.vdevs[0], {}))
++ proc.start()
++ res_plain = parent_conn.recv()
++ parent_conn.close()
++ proc.join()
++
++ self.assertTrue(res_plain[0])
++ plain_error = res_plain[1]
++
++ # unmount if the plain mount succeeded
++ if not plain_error:
++ self.try_unmount(self.vdevs[0])
++
++ # now try with as-user=<self>
++ parent_conn, child_conn = Pipe()
++ proc = Process(target=self._mount_as_user_result,
++ args=(child_conn, int(uid), int(gid), self.vdevs[0],
++ {'as-user': GLib.Variant('s', self.username)}))
++ proc.start()
++ res_as_user = parent_conn.recv()
++ parent_conn.close()
++ proc.join()
++
++ self.assertTrue(res_as_user[0])
++ as_user_error = res_as_user[1]
++
++ if not plain_error and not as_user_error:
++ return
++ if plain_error and as_user_error:
++ # extract the GDBus error name (e.g. 'org.freedesktop.UDisks2.Error.NotAuthorizedCanObtain')
++ dbus_err_re = re.compile(r'GDBus\.Error:([\w.]+):')
++ plain_match = dbus_err_re.search(plain_error)
++ as_user_match = dbus_err_re.search(as_user_error)
++ plain_err_name = plain_match.group(1) if plain_match else plain_error
++ as_user_err_name = as_user_match.group(1) if as_user_match else as_user_error
++ self.assertEqual(plain_err_name, as_user_err_name,
++ 'as-user=<self> produced a different error than plain mount: '
++ 'plain=%s, as-user=%s' % (plain_error, as_user_error))
++ return
++
++ if plain_error:
++ self.fail('Plain mount failed (%s) but as-user=<self> succeeded' % plain_error)
++ else:
++ self.fail('Plain mount succeeded but as-user=<self> failed: %s' % as_user_error)
++
+ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
+ def test_mount_as_user(self):
+ """ Test mounting a filesystem on behalf of a different user."""
+@@ -1550,6 +1720,108 @@ class NonPOSIXTestCase(UdisksFSTestCase):
+ self.fail(res[1])
+
+
++ def _test_mount_fstab_as_user_denied(self, fstab_options, target_user):
++ """ Test that an unprivileged user cannot use 'as-user' option to mount
++ a device listed in /etc/fstab with @fstab_options on behalf of
++ @target_user without polkit authorization.
++ """
++ disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++ self.assertIsNotNone(disk)
++
++ self.addCleanup(self._remove_user, self.username)
++ uid, gid = self._add_user(self.username)
++
++ if target_user != 'root':
++ self.addCleanup(self._remove_user, target_user)
++ self._add_user(target_user)
++
++ self.addCleanup(self.try_unmount, self.vdevs[0])
++ self._prepare_mount_test(disk, True, fstab_options)
++
++ parent_conn, child_conn = Pipe()
++ proc = Process(target=self._mount_with_as_user_fail,
++ args=(child_conn, int(uid), int(gid), self.vdevs[0], target_user))
++ proc.start()
++ res = parent_conn.recv()
++ parent_conn.close()
++ proc.join()
++
++ if not res[0]:
++ self.fail(res[1])
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_as_user_denied(self):
++ """ Test that user cannot use as-user to mount fstab 'users' device
++ on behalf of another user without authorization.
++ """
++ self._test_mount_fstab_as_user_denied('users', self.target_username)
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_user_as_user_denied(self):
++ """ Test that user cannot use as-user to mount fstab 'user' device
++ on behalf of another user without authorization.
++ """
++ self._test_mount_fstab_as_user_denied('user', self.target_username)
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_x_udisks_auth_as_user_denied(self):
++ """ Test that user cannot use as-user to mount fstab 'x-udisks-auth'
++ device on behalf of another user without authorization.
++ """
++ self._test_mount_fstab_as_user_denied('x-udisks-auth', self.target_username)
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_as_root_denied(self):
++ """ Test that user cannot use as-user=root to mount fstab 'users'
++ device without authorization.
++ """
++ self._test_mount_fstab_as_user_denied('users', 'root')
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_user_as_root_denied(self):
++ """ Test that user cannot use as-user=root to mount fstab 'user'
++ device without authorization.
++ """
++ self._test_mount_fstab_as_user_denied('user', 'root')
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_x_udisks_auth_as_root_denied(self):
++ """ Test that user cannot use as-user=root to mount fstab
++ 'x-udisks-auth' device without authorization.
++ """
++ self._test_mount_fstab_as_user_denied('x-udisks-auth', 'root')
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_defaults_as_user_from_root(self):
++ """ Test that root can mount a device listed in /etc/fstab with
++ 'defaults' (no 'user', 'users' or 'x-udisks-auth' options)
++ using the 'as-user' option targeting a non-root user.
++ """
++ disk = self.get_object('/block_devices/' + os.path.basename(self.vdevs[0]))
++ self.assertIsNotNone(disk)
++
++ self.addCleanup(self._remove_user, self.target_username)
++ self._add_user(self.target_username)
++
++ self.addCleanup(self.try_unmount, self.vdevs[0])
++ self._prepare_mount_test(disk, True, 'defaults')
++
++ d = dbus.Dictionary(signature='sv')
++ d['as-user'] = self.target_username
++ mnt_path = disk.Mount(d, dbus_interface=self.iface_prefix + '.Filesystem')
++ self.assertIsNotNone(mnt_path)
++ self.assertTrue(os.path.ismount(mnt_path))
++
++ @udiskstestcase.tag_test(udiskstestcase.TestTags.UNSAFE)
++ def test_mount_fstab_defaults_as_user_denied(self):
++ """ Test that an unprivileged user cannot use 'as-user' option to
++ mount a device listed in /etc/fstab with 'defaults' (no 'user',
++ 'users' or 'x-udisks-auth') on behalf of another user without
++ polkit authorization.
++ """
++ self._test_mount_fstab_as_user_denied('defaults', self.target_username)
++
++
+ class VFATTestCase(NonPOSIXTestCase):
+ _fs_signature = 'vfat'
+ _can_mount = True
+@@ -1691,6 +1963,12 @@ class UDFTestCase(UdisksFSTestCase):
+ def test_mount_fstab_complex_label_bad(self):
+ super(UDFTestCase, self).test_mount_fstab_complex_label_bad()
+
++ def test_mount_as_user_denied(self):
++ self.skipTest('Skipping as-user authorization test for UDF')
++
++ def test_mount_as_user_root_denied(self):
++ self.skipTest('Skipping as-user authorization test for UDF')
++
+
+ class FailsystemTestCase(UdisksFSTestCase):
+ # test that not supported operations fail 'nicely'
diff --git a/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb b/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb
index d4c5385ae0..776b5c5043 100644
--- a/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb
+++ b/meta-oe/recipes-support/udisks/udisks2_2.10.2.bb
@@ -18,8 +18,13 @@ DEPENDS += "${@bb.utils.filter('DISTRO_FEATURES', 'systemd', d)}"
RDEPENDS:${PN} = "acl"
SRC_URI = " \
- git://github.com/storaged-project/udisks.git;branch=2.10.x-branch;protocol=https \
- file://0001-Makefile.am-Dont-include-buildpath.patch \
+ git://github.com/storaged-project/udisks.git;branch=2.10.x-branch;protocol=https \
+ file://0001-Makefile.am-Dont-include-buildpath.patch \
+ file://CVE-2026-7867-1.patch \
+ file://CVE-2026-7867-2.patch \
+ file://CVE-2026-7867-3.patch \
+ file://CVE-2026-7867-4.patch \
+ file://CVE-2026-7867-5.patch \
"
SRCREV = "bc623acf9e7488dc105e4b00069d57e303e2616b"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 3/44] tmate: patch CVE-2026-4751
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 2/44] udisks2: patch CVE-2026-7867 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 4/44] tinyproxy: patch CVE-2026-54388 ankur.tyagi85
` (40 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-4751
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tmate/files/CVE-2026-4751.patch | 75 +++++++++++++++++++
meta-oe/recipes-extended/tmate/tmate_2.4.0.bb | 1 +
2 files changed, 76 insertions(+)
create mode 100644 meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch
diff --git a/meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch b/meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch
new file mode 100644
index 0000000000..faf3d2a3ae
--- /dev/null
+++ b/meta-oe/recipes-extended/tmate/files/CVE-2026-4751.patch
@@ -0,0 +1,75 @@
+From 27f07d414949259f17aebc02a61f103629d547f1 Mon Sep 17 00:00:00 2001
+From: npt-1707 <npthanh132@gmail.com>
+Date: Tue, 10 Mar 2026 00:19:33 +0800
+Subject: [PATCH] Fix CVE-2018-19387
+
+(cherry picked from commit 3e12f558c7b71b7135403cdd2df77d38538a695c)
+
+CVE: CVE-2026-4751
+Upstream-Status: Backport [https://github.com/tmate-io/tmate/commit/3e12f558c7b71b7135403cdd2df77d38538a695c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ format.c | 2 ++
+ input.c | 2 ++
+ server-client.c | 6 ++++++
+ window.c | 2 ++
+ 4 files changed, 12 insertions(+)
+
+diff --git a/format.c b/format.c
+index f771c85f..3bbb8cf1 100644
+--- a/format.c
++++ b/format.c
+@@ -468,6 +468,8 @@ format_cb_pane_tabs(struct format_tree *ft, struct format_entry *fe)
+ return;
+
+ buffer = evbuffer_new();
++ if (buffer == NULL)
++ fatalx("out of memory");
+ for (i = 0; i < wp->base.grid->sx; i++) {
+ if (!bit_test(wp->base.tabs, i))
+ continue;
+diff --git a/input.c b/input.c
+index 18c8eb9a..8a66d89e 100644
+--- a/input.c
++++ b/input.c
+@@ -766,6 +766,8 @@ input_init(struct window_pane *wp)
+ ictx->input_buf = xmalloc(INPUT_BUF_START);
+
+ ictx->since_ground = evbuffer_new();
++ if (ictx->since_ground == NULL)
++ fatalx("out of memory");
+
+ input_reset(wp, 0);
+ }
+diff --git a/server-client.c b/server-client.c
+index 21cccc85..e8614d40 100644
+--- a/server-client.c
++++ b/server-client.c
+@@ -121,8 +121,14 @@ server_client_create(int fd)
+ c->cmdq->client_exit = 1;
+
+ c->stdin_data = evbuffer_new();
++ if (c->stdin_data == NULL)
++ fatalx("out of memory");
+ c->stdout_data = evbuffer_new();
++ if (c->stdout_data == NULL)
++ fatalx("out of memory");
+ c->stderr_data = evbuffer_new();
++ if (c->stderr_data == NULL)
++ fatalx("out of memory");
+
+ c->tty.fd = -1;
+ c->title = NULL;
+diff --git a/window.c b/window.c
+index 45ec7790..9d95bb77 100644
+--- a/window.c
++++ b/window.c
+@@ -945,6 +945,8 @@ window_pane_spawn(struct window_pane *wp, int argc, char **argv,
+
+ wp->event = bufferevent_new(wp->fd, window_pane_read_callback, NULL,
+ window_pane_error_callback, wp);
++ if (wp->event == NULL)
++ fatalx("out of memory");
+
+ bufferevent_setwatermark(wp->event, EV_READ, 0, READ_SIZE);
+ bufferevent_enable(wp->event, EV_READ|EV_WRITE);
diff --git a/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb b/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb
index 5fb28b0085..9027826ea6 100644
--- a/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb
+++ b/meta-oe/recipes-extended/tmate/tmate_2.4.0.bb
@@ -8,6 +8,7 @@ DEPENDS:append = " libevent libssh msgpack-c ncurses"
SRC_URI = "\
git://github.com/tmate-io/tmate.git;protocol=https;branch=master \
file://0001-fix-finding-msgpack.patch \
+ file://CVE-2026-4751.patch \
"
SRCREV = "5e00bfa5e137e76c81888727712ced2b3fd99f5b"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-networking][blacksail][PATCH 4/44] tinyproxy: patch CVE-2026-54388
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 2/44] udisks2: patch CVE-2026-7867 ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 3/44] tmate: patch CVE-2026-4751 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 5/44] flatpak: upgrade 1.18.0 -> 1.18.4 ankur.tyagi85
` (39 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54388
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tinyproxy/tinyproxy/CVE-2026-54388.patch | 32 +++++++++++++++++++
.../tinyproxy/tinyproxy_1.11.3.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch
new file mode 100644
index 0000000000..4dc7f88310
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54388.patch
@@ -0,0 +1,32 @@
+From 2639058707dd9d199196b167823ba1865a60ea08 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Thu, 7 May 2026 16:39:48 +0000
+Subject: [PATCH] reqs: prevent multiple content-lengths getting emitted
+
+addressing point 2 of #609
+
+(cherry picked from commit 364cdb67e0ea00a8e4a7037e2693e0711e816adb)
+
+CVE: CVE-2026-54388
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/reqs.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/reqs.c b/src/reqs.c
+index d5037cf..117d755 100644
+--- a/src/reqs.c
++++ b/src/reqs.c
+@@ -681,6 +681,11 @@ add_header_to_connection (pseudomap *hashofheaders, char *header, size_t len)
+ /* Calculate the new length of just the data */
+ len -= sep - header - 1;
+
++ /* prevent multiple content-length headers from being inserted */
++ if (!strcasecmp(header, "content-length") &&
++ pseudomap_find (hashofheaders, "content-length"))
++ return 0;
++
+ return pseudomap_append (hashofheaders, header, sep);
+ }
+
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
index 25df44301b..46d3a4d7c6 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
@@ -12,6 +12,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
file://CVE-2026-31842.patch \
file://CVE-2026-54387.patch \
file://CVE-2026-55202.patch \
+ file://CVE-2026-54388.patch \
"
SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 5/44] flatpak: upgrade 1.18.0 -> 1.18.4
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (2 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 4/44] tinyproxy: patch CVE-2026-54388 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 6/44] xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9 ankur.tyagi85
` (38 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/flatpak/flatpak/blob/1.18.4/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../flatpak/{flatpak_1.18.0.bb => flatpak_1.18.4.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta-oe/recipes-extended/flatpak/{flatpak_1.18.0.bb => flatpak_1.18.4.bb} (94%)
diff --git a/meta-oe/recipes-extended/flatpak/flatpak_1.18.0.bb b/meta-oe/recipes-extended/flatpak/flatpak_1.18.4.bb
similarity index 94%
rename from meta-oe/recipes-extended/flatpak/flatpak_1.18.0.bb
rename to meta-oe/recipes-extended/flatpak/flatpak_1.18.4.bb
index 879455f63c..74bfb89e62 100644
--- a/meta-oe/recipes-extended/flatpak/flatpak_1.18.0.bb
+++ b/meta-oe/recipes-extended/flatpak/flatpak_1.18.4.bb
@@ -4,11 +4,11 @@ LICENSE = "LGPL-2.1-only"
LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
SRC_URI = " \
- git://github.com/flatpak/flatpak;protocol=https;branch=main;tag=${PV} \
+ git://github.com/flatpak/flatpak;protocol=https;branch=flatpak-1.18.x;tag=${PV} \
file://0001-flatpak-pc-add-pc_sysrootdir.patch \
"
-SRCREV = "5de2b58bdafde88515d9d6b9189bd1cfd3b88c46"
+SRCREV = "a02d0ba48abe9aacc377de15699e5d8c024b5669"
inherit meson pkgconfig gettext systemd gtk-doc gobject-introspection python3native mime features_check useradd
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 6/44] xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (3 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 5/44] flatpak: upgrade 1.18.0 -> 1.18.4 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 7/44] swagger-ui: upgrade 5.33.1 -> 5.33.2 ankur.tyagi85
` (37 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/flatpak/xdg-dbus-proxy/blob/0.1.9/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../{xdg-dbus-proxy_0.1.7.bb => xdg-dbus-proxy_0.1.9.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-oe/recipes-support/xdg-dbus-proxy/{xdg-dbus-proxy_0.1.7.bb => xdg-dbus-proxy_0.1.9.bb} (93%)
diff --git a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.9.bb
similarity index 93%
rename from meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb
rename to meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.9.bb
index eb21f701d6..1a65874155 100644
--- a/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.7.bb
+++ b/meta-oe/recipes-support/xdg-dbus-proxy/xdg-dbus-proxy_0.1.9.bb
@@ -16,7 +16,7 @@ SRC_URI = " \
file://run-ptest \
"
-SRCREV = "6a170fa77e3cbecb48f9dd2478fe5c0a119eb467"
+SRCREV = "72b40c8f6d9d585cfbdb249690724f740d207087"
CVE_STATUS[CVE-2026-34080] = "fixed-version: fixed in 0.1.7"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-webserver][blacksail][PATCH 7/44] swagger-ui: upgrade 5.33.1 -> 5.33.2
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (4 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 6/44] xdg-dbus-proxy: upgrade 0.1.7 -> 0.1.9 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 8/44] freerdp3: upgrade 3.32.1 -> 3.32.2 ankur.tyagi85
` (36 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../swagger-ui/{swagger-ui_5.33.1.bb => swagger-ui_5.33.2.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.1.bb => swagger-ui_5.33.2.bb} (94%)
diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
similarity index 94%
rename from meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb
rename to meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
index db2bb498a8..aeee9e4da6 100644
--- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb
+++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=main;protocol=https;tag=v${PV}"
-SRCREV = "cac3d136b5e37bfbe3288c8591f6f4fcf9870599"
+SRCREV = "e89a91f13cdee432d97ca9d3d1ac1969ff797036"
CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 8/44] freerdp3: upgrade 3.32.1 -> 3.32.2
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (5 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 7/44] swagger-ui: upgrade 5.33.1 -> 5.33.2 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 9/44] spitools: upgrade 1.1.0 -> 1.1.1 ankur.tyagi85
` (35 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Dropped patch that is part of the upstream version.
Changelog:
https://github.com/FreeRDP/FreeRDP/releases/tag/3.32.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
...1-winpr-tools-link-only-winpr-public.patch | 76 -------------------
...{freerdp3_3.32.1.bb => freerdp3_3.32.2.bb} | 3 +-
2 files changed, 1 insertion(+), 78 deletions(-)
delete mode 100644 meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch
rename meta-oe/recipes-support/freerdp/{freerdp3_3.32.1.bb => freerdp3_3.32.2.bb} (98%)
diff --git a/meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch b/meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch
deleted file mode 100644
index 2dea69c3c4..0000000000
--- a/meta-oe/recipes-support/freerdp/freerdp3/0001-winpr-tools-link-only-winpr-public.patch
+++ /dev/null
@@ -1,76 +0,0 @@
-From 6682e9ca667271b8ba148a301b4a2f9ac78be2b9 Mon Sep 17 00:00:00 2001
-From: Armin Novak <armin.novak@thincast.com>
-Date: Mon, 28 Sep 2026 11:57:22 +0200
-Subject: [PATCH] [winpr,tools] link only winpr public
-
-Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/6682e9ca667271b8ba148a301b4a2f9ac78be2b9]
-Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
----
- winpr/tools/CMakeLists.txt | 18 +++++++++++++-----
- winpr/tools/makecert/CMakeLists.txt | 6 +++---
- 2 files changed, 16 insertions(+), 8 deletions(-)
-
-diff --git a/winpr/tools/CMakeLists.txt b/winpr/tools/CMakeLists.txt
-index 5719c1c65..225b70744 100644
---- a/winpr/tools/CMakeLists.txt
-+++ b/winpr/tools/CMakeLists.txt
-@@ -28,7 +28,8 @@ set(WINPR_TOOLS_API_VERSION "${WINPR_TOOLS_VERSION_MAJOR}")
-
- set(WINPR_TOOLS_DIR ${CMAKE_CURRENT_SOURCE_DIR})
- set(WINPR_TOOLS_SRCS "")
--set(WINPR_TOOLS_LIBS "")
-+set(WINPR_TOOLS_PUBLIC_LIBS "")
-+set(WINPR_TOOLS_PRIVATE_LIBS "")
- set(WINPR_TOOLS_INCLUDES "")
- set(WINPR_TOOLS_DEFINITIONS "")
-
-@@ -64,11 +65,18 @@ macro(winpr_tools_include_directory_add)
- endif()
- endmacro()
-
--macro(winpr_tools_library_add)
-+macro(winpr_tools_library_public_add)
- foreach(_lib ${ARGN})
-- list(APPEND WINPR_TOOLS_LIBS "${_lib}")
-+ list(APPEND WINPR_TOOLS_PUBLIC_LIBS "${_lib}")
- endforeach()
-- set(WINPR_TOOLS_LIBS ${WINPR_TOOLS_LIBS} PARENT_SCOPE)
-+ set(WINPR_TOOLS_PUBLIC_LIBS ${WINPR_TOOLS_PUBLIC_LIBS} PARENT_SCOPE)
-+endmacro()
-+
-+macro(winpr_tools_library_private_add)
-+ foreach(_lib ${ARGN})
-+ list(APPEND WINPR_TOOLS_PRIVATE_LIBS "${_lib}")
-+ endforeach()
-+ set(WINPR_TOOLS_PRIVATE_LIBS ${WINPR_TOOLS_PRIVATE_LIBS} PARENT_SCOPE)
- endmacro()
-
- macro(winpr_tools_definition_add)
-@@ -89,7 +97,7 @@ addtargetwithresourcefile(${MODULE_NAME} FALSE "${WINPR_VERSION}" WINPR_TOOLS_SR
-
- add_compile_definitions(${WINPR_DEFINITIONS})
- target_include_directories(${MODULE_NAME} INTERFACE $<INSTALL_INTERFACE:include/winpr${WINPR_VERSION_MAJOR}>)
--target_link_libraries(${MODULE_NAME} PUBLIC ${WINPR_TOOLS_LIBS})
-+target_link_libraries(${MODULE_NAME} PRIVATE ${WINPR_TOOLS_PRIVATE_LIBS} PUBLIC ${WINPR_TOOLS_PUBLIC_LIBS})
-
- installwithrpath(
- TARGETS
-diff --git a/winpr/tools/makecert/CMakeLists.txt b/winpr/tools/makecert/CMakeLists.txt
-index 37b831125..0af1fcc08 100644
---- a/winpr/tools/makecert/CMakeLists.txt
-+++ b/winpr/tools/makecert/CMakeLists.txt
-@@ -31,11 +31,11 @@ endif()
- winpr_tools_module_add(${${MODULE_PREFIX}_SRCS})
-
- if(OPENSSL_FOUND)
-- list(APPEND ${MODULE_PREFIX}_LIBS ${OPENSSL_LIBRARIES})
-+ winpr_tools_library_private_add(${OPENSSL_LIBRARIES})
- endif()
-
- if(MBEDTLS_FOUND)
-- list(APPEND ${MODULE_PREFIX}_LIBS ${MBEDTLS_LIBRARIES})
-+ winpr_tools_library_private_add(${MBEDTLS_LIBRARIES})
- endif()
-
--winpr_tools_library_add(${${MODULE_PREFIX}_LIBS} winpr)
-+winpr_tools_library_public_add(winpr)
diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.32.1.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.32.2.bb
similarity index 98%
rename from meta-oe/recipes-support/freerdp/freerdp3_3.32.1.bb
rename to meta-oe/recipes-support/freerdp/freerdp3_3.32.2.bb
index f43c8cc7d2..2a985522c0 100644
--- a/meta-oe/recipes-support/freerdp/freerdp3_3.32.1.bb
+++ b/meta-oe/recipes-support/freerdp/freerdp3_3.32.2.bb
@@ -8,9 +8,8 @@ RDEPENDS:${PN}-ptest += "cmake coreutils"
inherit pkgconfig cmake ptest
-SRCREV = "bf217a504e54cc719880c228e82353382cd7d4fa"
+SRCREV = "97eff6ddfbbfaa8e42a126d362686bd001ff8bdc"
SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${PV} \
- file://0001-winpr-tools-link-only-winpr-public.patch \
file://run-ptest"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 9/44] spitools: upgrade 1.1.0 -> 1.1.1
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (6 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 8/44] freerdp3: upgrade 3.32.1 -> 3.32.2 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 10/44] libspdm: upgrade 3.8.2 -> 3.8.3 ankur.tyagi85
` (34 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../spitools/{spitools_1.1.0.bb => spitools_1.1.1.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-oe/recipes-support/spitools/{spitools_1.1.0.bb => spitools_1.1.1.bb} (87%)
diff --git a/meta-oe/recipes-support/spitools/spitools_1.1.0.bb b/meta-oe/recipes-support/spitools/spitools_1.1.1.bb
similarity index 87%
rename from meta-oe/recipes-support/spitools/spitools_1.1.0.bb
rename to meta-oe/recipes-support/spitools/spitools_1.1.1.bb
index 69f527a6eb..e2ab0a5d11 100644
--- a/meta-oe/recipes-support/spitools/spitools_1.1.0.bb
+++ b/meta-oe/recipes-support/spitools/spitools_1.1.1.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/cpb-/spi-tools"
LICENSE = "GPL-2.0-only"
LIC_FILES_CHKSUM = "file://LICENSE;md5=8c16666ae6c159876a0ba63099614381"
-SRCREV = "a19dffe44fee857124a993598caae0c85894f914"
+SRCREV = "74ba65b19e0cf9d1eabd52d17d842200ef901d61"
SRC_URI = "git://github.com/cpb-/spi-tools.git;protocol=https;branch=master;tag=${PV}"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 10/44] libspdm: upgrade 3.8.2 -> 3.8.3
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (7 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 9/44] spitools: upgrade 1.1.0 -> 1.1.1 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 11/44] libmikmod: upgrade 3.3.14 -> 3.3.15 ankur.tyagi85
` (33 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/DMTF/libspdm/releases/tag/3.8.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libspdm/{libspdm_3.8.2.bb => libspdm_3.8.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-oe/recipes-support/libspdm/{libspdm_3.8.2.bb => libspdm_3.8.3.bb} (98%)
diff --git a/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb b/meta-oe/recipes-support/libspdm/libspdm_3.8.3.bb
similarity index 98%
rename from meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb
rename to meta-oe/recipes-support/libspdm/libspdm_3.8.3.bb
index f77057d9fd..3ab77a5cfe 100644
--- a/meta-oe/recipes-support/libspdm/libspdm_3.8.2.bb
+++ b/meta-oe/recipes-support/libspdm/libspdm_3.8.3.bb
@@ -10,7 +10,7 @@ LIC_FILES_CHKSUM = "file://LICENSE.md;md5=8f9b59a81a88da8e812af43728b72dd7"
DEPENDS = "openssl"
SRC_URI = "git://github.com/DMTF/libspdm.git;branch=release-3.8;protocol=https;tag=${PV}"
-SRCREV = "f55cf6d48ec69b4ac60a63903e9c6a2cb0fd155d"
+SRCREV = "98253fee253c9e0b4313e64b373af3c7614c90e5"
inherit cmake
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 11/44] libmikmod: upgrade 3.3.14 -> 3.3.15
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (8 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 10/44] libspdm: upgrade 3.8.2 -> 3.8.3 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 12/44] libxmp: upgrade 4.7.3 -> 4.7.4 ankur.tyagi85
` (32 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://sourceforge.net/p/mikmod/mikmod/ci/libmikmod-3.3.15/tree/libmikmod/NEWS
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../mikmod/{libmikmod_3.3.14.bb => libmikmod_3.3.15.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-oe/recipes-multimedia/mikmod/{libmikmod_3.3.14.bb => libmikmod_3.3.15.bb} (90%)
diff --git a/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.14.bb b/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.15.bb
similarity index 90%
rename from meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.14.bb
rename to meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.15.bb
index 2468943349..bfd15cabe1 100644
--- a/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.14.bb
+++ b/meta-oe/recipes-multimedia/mikmod/libmikmod_3.3.15.bb
@@ -8,7 +8,7 @@ DEPENDS = "alsa-lib texinfo"
SRC_URI = "\
${SOURCEFORGE_MIRROR}/project/mikmod/${BPN}/${PV}/${BPN}-${PV}.tar.gz \
"
-SRC_URI[sha256sum] = "dffd82b8f254c3489c32098da831f33eac7136843d1e7ccb802f1254ad5b4219"
+SRC_URI[sha256sum] = "dc27b338154b8f88dc9e6317196d42c6abc13bf63c4e055257a18d4e38e1afa2"
UPSTREAM_CHECK_URI = "https://sourceforge.net/projects/mikmod/files/libmikmod/"
UPSTREAM_CHECK_REGEX = "/(?P<pver>\d+(\.\d+)+)/"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 12/44] libxmp: upgrade 4.7.3 -> 4.7.4
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (9 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 11/44] libmikmod: upgrade 3.3.14 -> 3.3.15 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-python][blacksail][PATCH 13/44] python3-pyjwt: upgrade 2.13.0 -> 2.14.0 ankur.tyagi85
` (31 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/libxmp/libxmp/releases/tag/libxmp-4.7.4
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libxmp/{libxmp_4.7.3.bb => libxmp_4.7.4.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-oe/recipes-multimedia/libxmp/{libxmp_4.7.3.bb => libxmp_4.7.4.bb} (85%)
diff --git a/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.3.bb b/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.4.bb
similarity index 85%
rename from meta-oe/recipes-multimedia/libxmp/libxmp_4.7.3.bb
rename to meta-oe/recipes-multimedia/libxmp/libxmp_4.7.4.bb
index 1600686229..a287124801 100644
--- a/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.3.bb
+++ b/meta-oe/recipes-multimedia/libxmp/libxmp_4.7.4.bb
@@ -6,5 +6,5 @@ LIC_FILES_CHKSUM = "file://README;beginline=59;md5=b25470e2863502c9ac9886f09c21a
inherit cmake pkgconfig
SRC_URI = "git://github.com/libxmp/libxmp.git;protocol=https;branch=master;tag=libxmp-${PV}"
-SRCREV = "1e0812137e4f9e15cc026c0c75af82d71d3cb5ad"
+SRCREV = "5d4f6aa2c7dcdf8e9cd8129fe579d45b36a302da"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-python][blacksail][PATCH 13/44] python3-pyjwt: upgrade 2.13.0 -> 2.14.0
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (10 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 12/44] libxmp: upgrade 4.7.3 -> 4.7.4 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-python][blacksail][PATCH 14/44] python3-cbor2: upgrade 6.1.4 -> 6.1.5 ankur.tyagi85
` (30 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/jpadilla/pyjwt/blob/2.14.0/CHANGELOG.rst
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../python/{python3-pyjwt_2.13.0.bb => python3-pyjwt_2.14.0.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-pyjwt_2.13.0.bb => python3-pyjwt_2.14.0.bb} (84%)
diff --git a/meta-python/recipes-devtools/python/python3-pyjwt_2.13.0.bb b/meta-python/recipes-devtools/python/python3-pyjwt_2.14.0.bb
similarity index 84%
rename from meta-python/recipes-devtools/python/python3-pyjwt_2.13.0.bb
rename to meta-python/recipes-devtools/python/python3-pyjwt_2.14.0.bb
index 1b018f605b..a2cb84587b 100644
--- a/meta-python/recipes-devtools/python/python3-pyjwt_2.13.0.bb
+++ b/meta-python/recipes-devtools/python/python3-pyjwt_2.14.0.bb
@@ -5,7 +5,7 @@ HOMEPAGE = "https://github.com/jpadilla/pyjwt"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE;md5=e4b56d2c9973d8cf54655555be06e551"
-SRC_URI[sha256sum] = "41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423"
+SRC_URI[sha256sum] = "77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86"
CVE_PRODUCT = "pyjwt"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-python][blacksail][PATCH 14/44] python3-cbor2: upgrade 6.1.4 -> 6.1.5
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (11 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-python][blacksail][PATCH 13/44] python3-pyjwt: upgrade 2.13.0 -> 2.14.0 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 15/44] samba: ignore CVE-2026-2340 ankur.tyagi85
` (29 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/agronholm/cbor2/releases/tag/6.1.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../python/{python3-cbor2_6.1.4.bb => python3-cbor2_6.1.5.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-cbor2_6.1.4.bb => python3-cbor2_6.1.5.bb} (87%)
diff --git a/meta-python/recipes-devtools/python/python3-cbor2_6.1.4.bb b/meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb
similarity index 87%
rename from meta-python/recipes-devtools/python/python3-cbor2_6.1.4.bb
rename to meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb
index 6a894848d6..94d3f30dbb 100644
--- a/meta-python/recipes-devtools/python/python3-cbor2_6.1.4.bb
+++ b/meta-python/recipes-devtools/python/python3-cbor2_6.1.5.bb
@@ -3,7 +3,7 @@ LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=a79e64179819c7ce293372c059f1dbd8"
DEPENDS += "python3-setuptools-scm-native"
-SRC_URI[sha256sum] = "01ecc79a28f33d17331943ce508fc1e21f4b06553c73f874f4c77120d72b2ef9"
+SRC_URI[sha256sum] = "6eb06160c42315ac0c4ded461c7d84d92fa18c69d13d17fc1dfc1fae96580c95"
inherit pypi python_setuptools3_rust cargo-update-recipe-crates ptest-python-pytest
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-networking][blacksail][PATCH 15/44] samba: ignore CVE-2026-2340
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (12 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-python][blacksail][PATCH 14/44] python3-cbor2: upgrade 6.1.4 -> 6.1.5 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 16/44] rapidjson: mark CVE-2024-38517 fixed ankur.tyagi85
` (28 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Also confirmed in the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-2340
[1]https://www.samba.org/samba/history/samba-4.23.8.html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-connectivity/samba/samba_4.23.11.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb b/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb
index e498b30bcb..c0d8fe4a00 100644
--- a/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb
+++ b/meta-networking/recipes-connectivity/samba/samba_4.23.11.bb
@@ -46,6 +46,7 @@ UPSTREAM_CHECK_REGEX = "samba\-(?P<pver>\d+\.\d+(\.\d+)+).tar.gz"
inherit systemd waf-samba cpan-base perlnative update-rc.d perl-version pkgconfig
CVE_STATUS[CVE-2011-2411] = "not-applicable-platform: vulnerable only on HP NonStop Servers"
+CVE_STATUS[CVE-2026-2340] = "fixed-version: fixed since v4.23.8"
# remove default added RDEPENDS on perl
RDEPENDS:${PN}:remove = "perl"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 16/44] rapidjson: mark CVE-2024-38517 fixed
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (13 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 15/44] samba: ignore CVE-2026-2340 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 17/44] psqlodbc: patch CVE-2026-109448 ankur.tyagi85
` (27 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Commit mentioned in the NVD is part of the current version:
$ git log HEAD --oneline | grep 8269bc2b
8269bc2b Prevent int underflow when parsing exponents
Details:
https://nvd.nist.gov/vuln/detail/cve-2024-38517
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb b/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb
index fa20b4d448..f565f0a175 100644
--- a/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb
+++ b/meta-oe/recipes-devtools/rapidjson/rapidjson_git.bb
@@ -21,3 +21,5 @@ EXTRA_OECMAKE += "-DLIB_INSTALL_DIR=${libdir}"
ALLOW_EMPTY:${PN} = "1"
BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2024-38517] = "fixed-version: fixed in the current v1.1.0"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 17/44] psqlodbc: patch CVE-2026-109448
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (14 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 16/44] rapidjson: mark CVE-2024-38517 fixed ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 18/44] proftpd: mark CVE-2026-53994 fixed ankur.tyagi85
` (26 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport the commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-109448
[1]https://security-tracker.debian.org/tracker/CVE-2026-109448
PTEST pass:
root@qemuarm64:~# ptest-runner psqlodbc
START: ptest-runner
2026-10-17T09:22
BEGIN: /usr/lib/psqlodbc/ptest
...
DURATION: 43
END: /usr/lib/psqlodbc/ptest
2026-10-17T09:23
STOP: ptest-runner
TOTAL: 1 FAIL: 0
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../psqlodbc/files/CVE-2026-109448.patch | 243 ++++++++++++++++++
.../psqlodbc/psqlodbc_18.00.0002.bb | 1 +
2 files changed, 244 insertions(+)
create mode 100644 meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch
diff --git a/meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch b/meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch
new file mode 100644
index 0000000000..12f6cdd1d8
--- /dev/null
+++ b/meta-oe/recipes-dbs/psqlodbc/files/CVE-2026-109448.patch
@@ -0,0 +1,243 @@
+From 5c9443fb0c8c0e263e1f8d0298987e91c4f5ccea Mon Sep 17 00:00:00 2001
+From: Dave Cramer <davecramer@gmail.com>
+Date: Mon, 12 Oct 2026 11:47:08 -0400
+Subject: [PATCH] Merge commit from fork
+
+The APD, IPD and put-data binding counts are SQLSMALLINT. Binding
+parameter 32768 wrapped the count to -32768, so execution failed with
+07002 even though every parameter was bound; binding parameter 32769
+then extended the arrays with a memset starting at index -32768,
+writing zeros up to 1.25 MiB before the start of the APD array (and
+likewise for the IPD and put-data arrays), which corrupts the heap.
+
+SQLNumParams and SQL_DESC_COUNT are SQLSMALLINT too, so 32767 is the
+largest parameter count ODBC can describe. PGAPI_BindParameter now
+returns 07009 for parameter numbers outside 1..32767, which also covers
+parameter number 0 for applications that call the driver without a
+driver manager.
+
+New param-count-limit test binds 32767, 32768 and 32769 parameters.
+
+Assisted-By: Claude
+(cherry picked from commit 86e4418e9553aa0891315db7531f8cd31eb1575e)
+
+CVE: CVE-2026-109448
+Upstream-Status: Backport [https://github.com/postgresql-interfaces/psqlodbc/commit/86e4418e9553aa0891315db7531f8cd31eb1575e]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ bind.c | 12 +++
+ test/expected/param-count-limit.out | 12 +++
+ test/src/param-count-limit-test.c | 142 ++++++++++++++++++++++++++++
+ test/tests | 1 +
+ 4 files changed, 167 insertions(+)
+ create mode 100644 test/expected/param-count-limit.out
+ create mode 100644 test/src/param-count-limit-test.c
+
+diff --git a/bind.c b/bind.c
+index 3b566ec..b3e5ca3 100644
+--- a/bind.c
++++ b/bind.c
+@@ -16,6 +16,7 @@
+ /* #include <stdlib.h> */
+ #include <string.h>
+ #include <ctype.h>
++#include <limits.h>
+ #include "bind.h"
+ #include "misc.h"
+
+@@ -57,6 +58,17 @@ PGAPI_BindParameter(HSTMT hstmt,
+ }
+ SC_clear_error(stmt);
+
++ /*
++ * The APD, IPD and put-data counts are SQLSMALLINT, like SQLNumParams
++ * and SQL_DESC_COUNT, so a larger parameter number would wrap the count
++ * negative and the next binding would write before the bindings array.
++ */
++ if (ipar < 1 || ipar > SHRT_MAX)
++ {
++ SC_set_error(stmt, STMT_BAD_PARAMETER_NUMBER_ERROR, "Invalid parameter number for PGAPI_BindParameter.", func);
++ return SQL_ERROR;
++ }
++
+ apdopts = SC_get_APDF(stmt);
+ if (apdopts->allocated < ipar)
+ extend_parameter_bindings(apdopts, ipar);
+diff --git a/test/expected/param-count-limit.out b/test/expected/param-count-limit.out
+new file mode 100644
+index 0000000..623bcbf
+--- /dev/null
++++ b/test/expected/param-count-limit.out
+@@ -0,0 +1,12 @@
++connected
++APD SQL_DESC_COUNT=-1: error SQLSTATE=07009
++APD bind 1 after SQL_DESC_COUNT=-1: ok
++IPD SQL_DESC_COUNT=-1: error SQLSTATE=07009
++IPD bind 1 after SQL_DESC_COUNT=-1: ok
++bind 0: error SQLSTATE=07009
++32767 params, bind 32767: ok
++32767 params, execute: ok
++32767 params, result 1
++32768 params, bind 32768: error SQLSTATE=07009
++32769 params, bind 32768: error SQLSTATE=07009
++disconnecting
+diff --git a/test/src/param-count-limit-test.c b/test/src/param-count-limit-test.c
+new file mode 100644
+index 0000000..e9554cd
+--- /dev/null
++++ b/test/src/param-count-limit-test.c
+@@ -0,0 +1,142 @@
++/*
++ * Test the limits on parameter numbers and descriptor counts. The driver
++ * keeps parameter binding counts in SQLSMALLINT, so SQLBindParameter with a
++ * parameter number above 32767, or SQL_DESC_COUNT set negative, used to
++ * wrap the count negative and make the next binding write zeros before the
++ * start of the bindings array.
++ */
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++
++#include "common.h"
++
++#define MAX_PARAMS 32767
++
++static void
++print_state(const char *what, SQLRETURN rc, SQLSMALLINT htype, SQLHANDLE h)
++{
++ SQLCHAR state[6] = "";
++ SQLINTEGER native;
++ SQLCHAR msg[256];
++ SQLSMALLINT len;
++
++ printf("%s: ", what);
++ if (SQL_SUCCEEDED(rc))
++ {
++ printf("ok\n");
++ return;
++ }
++ SQLGetDiagRec(htype, h, 1, state, &native, msg, sizeof(msg), &len);
++ printf("error SQLSTATE=%s\n", (char *) state);
++}
++
++/* SELECT 1 WHERE 1 IN (?, ?, ..., ?) with nparams markers, all bound to 1 */
++static void
++run_with_params(int nparams)
++{
++ SQLRETURN rc;
++ HSTMT hstmt = SQL_NULL_HSTMT;
++ SQLINTEGER one = 1;
++ SQLINTEGER result = 0;
++ char *sql, *p;
++ char what[64];
++ int i;
++
++ rc = SQLAllocHandle(SQL_HANDLE_STMT, conn, &hstmt);
++ CHECK_CONN_RESULT(rc, "SQLAllocHandle failed", conn);
++
++ sql = malloc(32 + 2 * nparams);
++ p = sql + sprintf(sql, "SELECT 1 WHERE 1 IN (");
++ for (i = 0; i < nparams; i++)
++ {
++ if (i > 0)
++ *p++ = ',';
++ *p++ = '?';
++ }
++ strcpy(p, ")");
++
++ for (i = 1; i <= nparams; i++)
++ {
++ rc = SQLBindParameter(hstmt, (SQLUSMALLINT) i, SQL_PARAM_INPUT,
++ SQL_C_SLONG, SQL_INTEGER, 0, 0, &one, 0, NULL);
++ if (!SQL_SUCCEEDED(rc))
++ break;
++ }
++ snprintf(what, sizeof(what), "%d params, bind %d", nparams, i <= nparams ? i : nparams);
++ print_state(what, rc, SQL_HANDLE_STMT, hstmt);
++
++ if (SQL_SUCCEEDED(rc))
++ {
++ rc = SQLExecDirect(hstmt, (SQLCHAR *) sql, SQL_NTS);
++ snprintf(what, sizeof(what), "%d params, execute", nparams);
++ print_state(what, rc, SQL_HANDLE_STMT, hstmt);
++ }
++ if (SQL_SUCCEEDED(rc))
++ {
++ rc = SQLBindCol(hstmt, 1, SQL_C_SLONG, &result, 0, NULL);
++ CHECK_STMT_RESULT(rc, "SQLBindCol failed", hstmt);
++ rc = SQLFetch(hstmt);
++ CHECK_STMT_RESULT(rc, "SQLFetch failed", hstmt);
++ printf("%d params, result %d\n", nparams, (int) result);
++ }
++
++ free(sql);
++ SQLFreeHandle(SQL_HANDLE_STMT, hstmt);
++}
++
++/* Set SQL_DESC_COUNT of the statement's APD or IPD to -1, then bind */
++static void
++negative_desc_count(SQLINTEGER desc_attr, const char *desc_name)
++{
++ SQLRETURN rc;
++ HSTMT hstmt = SQL_NULL_HSTMT;
++ SQLHDESC hdesc;
++ SQLINTEGER one = 1;
++ char what[64];
++
++ rc = SQLAllocHandle(SQL_HANDLE_STMT, conn, &hstmt);
++ CHECK_CONN_RESULT(rc, "SQLAllocHandle failed", conn);
++
++ rc = SQLGetStmtAttr(hstmt, desc_attr, &hdesc, 0, NULL);
++ CHECK_STMT_RESULT(rc, "SQLGetStmtAttr failed", hstmt);
++
++ rc = SQLSetDescField(hdesc, 0, SQL_DESC_COUNT, (SQLPOINTER) (SQLLEN) -1, 0);
++ snprintf(what, sizeof(what), "%s SQL_DESC_COUNT=-1", desc_name);
++ print_state(what, rc, SQL_HANDLE_DESC, hdesc);
++
++ rc = SQLBindParameter(hstmt, 1, SQL_PARAM_INPUT, SQL_C_SLONG,
++ SQL_INTEGER, 0, 0, &one, 0, NULL);
++ snprintf(what, sizeof(what), "%s bind 1 after SQL_DESC_COUNT=-1", desc_name);
++ print_state(what, rc, SQL_HANDLE_STMT, hstmt);
++
++ SQLFreeHandle(SQL_HANDLE_STMT, hstmt);
++}
++
++int
++main(int argc, char **argv)
++{
++ SQLRETURN rc;
++ HSTMT hstmt = SQL_NULL_HSTMT;
++ SQLINTEGER one = 1;
++
++ test_connect();
++
++ negative_desc_count(SQL_ATTR_APP_PARAM_DESC, "APD");
++ negative_desc_count(SQL_ATTR_IMP_PARAM_DESC, "IPD");
++
++ rc = SQLAllocHandle(SQL_HANDLE_STMT, conn, &hstmt);
++ CHECK_CONN_RESULT(rc, "SQLAllocHandle failed", conn);
++ rc = SQLBindParameter(hstmt, 0, SQL_PARAM_INPUT, SQL_C_SLONG,
++ SQL_INTEGER, 0, 0, &one, 0, NULL);
++ print_state("bind 0", rc, SQL_HANDLE_STMT, hstmt);
++ SQLFreeHandle(SQL_HANDLE_STMT, hstmt);
++
++ run_with_params(MAX_PARAMS);
++ run_with_params(MAX_PARAMS + 1);
++ run_with_params(MAX_PARAMS + 2);
++
++ test_disconnect();
++
++ return 0;
++}
+diff --git a/test/tests b/test/tests
+index 5074bca..c8af1ab 100644
+--- a/test/tests
++++ b/test/tests
+@@ -63,6 +63,7 @@ TESTBINS = exe/connect-test \
+ exe/descriptors-free-test \
+ exe/primarykeys-include-test \
+ exe/interval-overflow-test \
++ exe/param-count-limit-test \
+ exe/conn-settings-test \
+ exe/percent-decode-test \
+ exe/dbms-version-test \
diff --git a/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb b/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb
index ae1d603e1d..9756bcfad2 100644
--- a/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb
+++ b/meta-oe/recipes-dbs/psqlodbc/psqlodbc_18.00.0002.bb
@@ -23,6 +23,7 @@ SRC_URI = "git://github.com/postgresql-interfaces/psqlodbc.git;protocol=https;br
file://psqlodbc-remove-some-checks-for-cross-compiling.patch \
file://psqlodbc-donot-use-the-hardcode-libdir.patch \
file://psqlodbc-fix-for-ptest-support.patch \
+ file://CVE-2026-109448.patch \
file://run-ptest \
"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-networking][blacksail][PATCH 18/44] proftpd: mark CVE-2026-53994 fixed
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (15 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 17/44] psqlodbc: patch CVE-2026-109448 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 19/44] postfix: ignore CVE-2023-32182 ankur.tyagi85
` (25 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Debian[1] identified the issue[2] associated with this CVE.
Changelog[3] confirms the resolution.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53994
[]https://security-tracker.debian.org/tracker/CVE-2026-53994
[]https://github.com/proftpd/proftpd/issues/2115
[]https://github.com/proftpd/proftpd/blob/v1.3.9b/NEWS#L35
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb
index 81a7094359..5c194ebb23 100644
--- a/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb
+++ b/meta-networking/recipes-daemons/proftpd/proftpd_1.3.9d.bb
@@ -26,6 +26,7 @@ CVE_VERSION_SUFFIX = "alphabetical"
CVE_STATUS[CVE-2001-0027] = "fixed-version: version 1.2.0rc3 removed affected module"
CVE_STATUS[CVE-2021-47865] = "upstream-wontfix: it is not a vulnerability but inproper configuration"
+CVE_STATUS[CVE-2026-53994] = "fixed-version: fixed since v1.3.9b"
EXTRA_OECONF += "--enable-largefile INSTALL=install"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-networking][blacksail][PATCH 19/44] postfix: ignore CVE-2023-32182
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (16 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 18/44] proftpd: mark CVE-2026-53994 fixed ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 20/44] poppler: patch CVE-2026-102621 ankur.tyagi85
` (24 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2023-32182
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb b/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb
index 99a77dd6c3..fe0dd95994 100644
--- a/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb
+++ b/meta-networking/recipes-daemons/postfix/postfix_3.11.7.bb
@@ -249,3 +249,5 @@ FILES:${PN}-bin += "${localstatedir} ${bindir}/* ${sbindir}/* \
FILES:${PN}-cfg = "${sysconfdir}"
FILES:${PN}-dbg += "${libexecdir}/postfix/.debug"
ALLOW_EMPTY:${PN} = "1"
+
+CVE_STATUS[CVE-2023-32182] = "not-applicable-platform: this vulnerability is Suse specific"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 20/44] poppler: patch CVE-2026-102621
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (17 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 19/44] postfix: ignore CVE-2023-32182 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 21/44] poppler: patch CVE-2026-102620 ankur.tyagi85
` (23 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102621
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../poppler/poppler/CVE-2026-102621.patch | 40 +++++++++++++++++++
.../poppler/poppler_26.08.0.bb | 1 +
2 files changed, 41 insertions(+)
create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch
diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch
new file mode 100644
index 0000000000..823c3a33db
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102621.patch
@@ -0,0 +1,40 @@
+From eaeeb2fe58aad490bc82aa33d75217dead0dd0de Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:02:27 +0200
+Subject: [PATCH] Fix integer overflow in SplashClip::clipToPath
+
+Issue #1763
+
+(cherry picked from commit 323c91036d99926a8b90dc14329f7b40aece22f8)
+
+CVE: CVE-2026-102621
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ splash/SplashClip.cc | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/splash/SplashClip.cc b/splash/SplashClip.cc
+index 78249652c..b096beebd 100644
+--- a/splash/SplashClip.cc
++++ b/splash/SplashClip.cc
+@@ -23,6 +23,8 @@
+ #include <config.h>
+
+ #include <algorithm>
++#include "goo/GooCheckedOps.h"
++#include "goo/GooLikely.h"
+ #include "SplashErrorCodes.h"
+ #include "SplashMath.h"
+ #include "SplashPath.h"
+@@ -211,7 +213,9 @@ SplashError SplashClip::clipToPath(const SplashPath &path, const std::array<doub
+ } else {
+ if (antialias) {
+ xPath.aaScale();
+- yMinAA = yMinI * splashAASize;
++ if (unlikely(checkedMultiply(yMinI, splashAASize, &yMinAA))) {
++ return SplashError::Generic;
++ }
+ yMaxAA = (yMaxI + 1) * splashAASize - 1;
+ } else {
+ yMinAA = yMinI;
diff --git a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
index 8b0783d001..f24ca34366 100644
--- a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
+++ b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
@@ -8,6 +8,7 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
file://basename-include.patch \
file://0001-cmake-Do-not-use-isystem.patch \
file://0001-workaround-build-racing.patch \
+ file://CVE-2026-102621.patch \
"
SRC_URI[sha256sum] = "dc906e68cea698109706ac6aa3d2c9d4512fcfcac42d90b8afcda486d1b9abd0"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 21/44] poppler: patch CVE-2026-102620
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (18 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 20/44] poppler: patch CVE-2026-102621 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 22/44] opensc: patch CVE-2026-103531 ankur.tyagi85
` (22 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Also backport commit[1] to allow cherry-pick of the commit fixing the CVE.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-102620
[1]https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../poppler/poppler/CVE-2026-102620-1.patch | 145 ++++++++++++++++++
.../poppler/poppler/CVE-2026-102620-2.patch | 34 ++++
.../poppler/poppler_26.08.0.bb | 2 +
3 files changed, 181 insertions(+)
create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch
create mode 100644 meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch
diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch
new file mode 100644
index 0000000000..e85866eddf
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-1.patch
@@ -0,0 +1,145 @@
+From b8ce8bb5df02fd3a70f4b34f3d64c88df7089409 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:30:32 +0200
+Subject: [PATCH] FoFiTrueType::cvtSfnts: Move variables closer to where they
+ are used
+
+(cherry picked from commit 786b06dac87dbe28e85ec7ea3d340810f151c25b)
+
+CVE: CVE-2026-102620
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/786b06dac87dbe28e85ec7ea3d340810f151c25b]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ fofi/FoFiTrueType.cc | 42 +++++++++++++++++++-----------------------
+ 1 file changed, 19 insertions(+), 23 deletions(-)
+
+diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
+index 133fbc45e..e15cfc576 100644
+--- a/fofi/FoFiTrueType.cc
++++ b/fofi/FoFiTrueType.cc
+@@ -1058,9 +1058,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ TrueTypeTable newTables[nT42Tables];
+ unsigned char tableDir[12 + nT42Tables * 16];
+ bool ok;
+- unsigned int checksum;
+- int nNewTables;
+- int glyfTableLen, length, glyfPos, j, k;
+ std::array<unsigned char, 36> vheaTab = {
+ 0, 1, 0, 0, // table version number
+ 0, 0, // ascent
+@@ -1081,8 +1078,6 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ 0, 1 // number of advance heights in vmtx table
+ };
+ std::vector<unsigned char> vmtxTab;
+- bool needVhea, needVmtx;
+- int advance;
+
+ *maxUsedGlyph = -1;
+
+@@ -1116,7 +1111,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ i = seekTable("loca");
+ pos = tables[i].offset;
+ i = seekTable("glyf");
+- glyfTableLen = tables[i].len;
++ const int glyfTableLen = tables[i].len;
+ ok = true;
+ for (i = 0; i <= nGlyphs; ++i) {
+ locaTable[i].idx = i;
+@@ -1169,16 +1164,16 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ }
+
+ // count the number of tables
+- nNewTables = 0;
++ int nNewTables = 0;
+ for (i = 0; i < nT42Tables; ++i) {
+ if (t42Tables[i].required || seekTable(t42Tables[i].tag) >= 0) {
+ ++nNewTables;
+ }
+ }
+- advance = 0; // make gcc happy
++ int advance = 0; // make gcc happy
+ if (needVerticalMetrics) {
+- needVhea = seekTable("vhea") < 0;
+- needVmtx = seekTable("vmtx") < 0;
++ const bool needVhea = seekTable("vhea") < 0;
++ const bool needVmtx = seekTable("vmtx") < 0;
+ if (needVhea || needVmtx) {
+ i = seekTable("head");
+ advance = getU16BE(tables[i].offset + 18, &ok); // units per em
+@@ -1194,10 +1189,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ // construct the new table headers, including table checksums
+ // (pad each table out to a multiple of 4 bytes)
+ pos = 12 + nNewTables * 16;
+- k = 0;
++ int k = 0;
+ for (i = 0; i < nT42Tables; ++i) {
+- length = -1;
+- checksum = 0; // make gcc happy
++ int length = -1;
++ unsigned int checksum = 0; // make gcc happy
+ if (i == t42HeadTable) {
+ length = 54;
+ checksum = computeTableChecksum(headData);
+@@ -1207,8 +1202,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ } else if (i == t42GlyfTable) {
+ length = 0;
+ checksum = 0;
+- glyfPos = tables[seekTable("glyf")].offset;
+- for (j = 0; j < nGlyphs; ++j) {
++ const int glyfPos = tables[seekTable("glyf")].offset;
++ for (int j = 0; j < nGlyphs; ++j) {
+ length += locaTable[j].len;
+ if (length & 3) {
+ length += 4 - (length & 3);
+@@ -1218,7 +1213,8 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ }
+ }
+ } else {
+- if ((j = seekTable(t42Tables[i].tag)) >= 0) {
++ const int j = seekTable(t42Tables[i].tag);
++ if (j >= 0) {
+ length = tables[j].len;
+ if (checkRegion(tables[j].offset, length)) {
+ checksum = computeTableChecksum(std::span(file.data() + tables[j].offset, length));
+@@ -1298,7 +1294,7 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ }
+
+ // compute the font checksum and store it in the head table
+- checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
++ unsigned int checksum = computeTableChecksum(std::span(tableDir, 12 + nNewTables * 16));
+ for (i = 0; i < nNewTables; ++i) {
+ checksum += newTables[i].checksum;
+ }
+@@ -1325,11 +1321,10 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ if (i == t42HeadTable) {
+ dumpString(headData, outputFunc, outputStream);
+ } else if (i == t42LocaTable) {
+- length = (nGlyphs + 1) * (locaFmt ? 4 : 2);
+ dumpString(locaData, outputFunc, outputStream);
+ } else if (i == t42GlyfTable) {
+- glyfPos = tables[seekTable("glyf")].offset;
+- for (j = 0; j < nGlyphs; ++j) {
++ const int glyfPos = tables[seekTable("glyf")].offset;
++ for (int j = 0; j < nGlyphs; ++j) {
+ if (locaTable[j].len > 0 && checkRegion(glyfPos + locaTable[j].origOffset, locaTable[j].len)) {
+ dumpString(std::span(file.data() + glyfPos + locaTable[j].origOffset, locaTable[j].len), outputFunc, outputStream);
+ }
+@@ -1338,13 +1333,14 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ // length == 0 means the table is missing and the error was
+ // already reported during the construction of the table
+ // headers
+- if ((length = newTables[i].len) > 0) {
+- if ((j = seekTable(t42Tables[i].tag)) >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
++ const int length = newTables[i].len;
++ if (length > 0) {
++ const int j = seekTable(t42Tables[i].tag);
++ if (j >= 0 && checkRegion(tables[j].offset, tables[j].len)) {
+ dumpString(std::span(file.data() + tables[j].offset, tables[j].len), outputFunc, outputStream);
+ } else if (needVerticalMetrics && i == t42VheaTable) {
+ if (unlikely(static_cast<size_t>(length) > sizeof(vheaTab))) {
+ error(errSyntaxWarning, -1, "length bigger than vheaTab size");
+- length = sizeof(vheaTab);
+ }
+ dumpString(vheaTab, outputFunc, outputStream);
+ } else if (needVerticalMetrics && i == t42VmtxTable) {
diff --git a/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch
new file mode 100644
index 0000000000..e41e65ffd9
--- /dev/null
+++ b/meta-oe/recipes-support/poppler/poppler/CVE-2026-102620-2.patch
@@ -0,0 +1,34 @@
+From ac82c990768a4cb3dd4fd15edb92af97b4ac6589 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Sat, 8 Aug 2026 15:47:43 +0200
+Subject: [PATCH] Fix integer overflow in FoFiTrueType::cvtSfnts
+
+Issue #1762
+
+(cherry picked from commit 245d3c6823377755f2c1d5fdddd010279c6ed94d)
+
+CVE: CVE-2026-102620
+Upstream-Status: Backport [https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ fofi/FoFiTrueType.cc | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/fofi/FoFiTrueType.cc b/fofi/FoFiTrueType.cc
+index e15cfc576..9e280fe89 100644
+--- a/fofi/FoFiTrueType.cc
++++ b/fofi/FoFiTrueType.cc
+@@ -1204,7 +1204,11 @@ void FoFiTrueType::cvtSfnts(FoFiOutputFunc outputFunc, void *outputStream, const
+ checksum = 0;
+ const int glyfPos = tables[seekTable("glyf")].offset;
+ for (int j = 0; j < nGlyphs; ++j) {
+- length += locaTable[j].len;
++ if (unlikely(checkedAdd(length, locaTable[j].len, &length))) {
++ error(errSyntaxError, -1, "Integer overflow in glyph table length calculation");
++ ok = false;
++ break;
++ }
+ if (length & 3) {
+ length += 4 - (length & 3);
+ }
diff --git a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
index f24ca34366..6cfcf3cf0f 100644
--- a/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
+++ b/meta-oe/recipes-support/poppler/poppler_26.08.0.bb
@@ -9,6 +9,8 @@ SRC_URI = "http://poppler.freedesktop.org/${BP}.tar.xz \
file://0001-cmake-Do-not-use-isystem.patch \
file://0001-workaround-build-racing.patch \
file://CVE-2026-102621.patch \
+ file://CVE-2026-102620-1.patch \
+ file://CVE-2026-102620-2.patch \
"
SRC_URI[sha256sum] = "dc906e68cea698109706ac6aa3d2c9d4512fcfcac42d90b8afcda486d1b9abd0"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 22/44] opensc: patch CVE-2026-103531
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (19 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 21/44] poppler: patch CVE-2026-102620 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 23/44] pjproject: mark CVE-2026-26967 fixed ankur.tyagi85
` (21 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-103531
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../opensc/opensc/CVE-2026-103531.patch | 54 +++++++++++++++++++
.../recipes-support/opensc/opensc_0.27.1.bb | 1 +
2 files changed, 55 insertions(+)
create mode 100644 meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch
diff --git a/meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch b/meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch
new file mode 100644
index 0000000000..22776e525b
--- /dev/null
+++ b/meta-oe/recipes-support/opensc/opensc/CVE-2026-103531.patch
@@ -0,0 +1,54 @@
+From 4b0f46d922866d9453e3631ff5e0a24900fae8dd Mon Sep 17 00:00:00 2001
+From: wanglanlan <wanglanlan@users.noreply.github.com>
+Date: Wed, 2 Sep 2026 08:36:47 +0000
+Subject: [PATCH] setcos: Fix buffer overflow in setcos_construct_fci_44
+
+The FCI construction copied type_attr, sec_attr and prop_attr of the
+file into a fixed 64-byte stack buffer without checking the length.
+Malicious or corrupted attribute lengths (e.g. prop_attr_len > 64,
+reachable through fuzz_pkcs15init and attacker-controlled card
+responses) caused a stack buffer overflow (write).
+
+Return SC_ERROR_INVALID_DATA if any attribute exceeds the buffer size.
+
+Found with the fuzz_pkcs15init fuzzer.
+
+Co-Authored-By: Claude <noreply@anthropic.com>
+(cherry picked from commit ad730304052937c32b4eb489a06835ac6123632c)
+
+CVE: CVE-2026-103531
+Upstream-Status: Backport [https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libopensc/card-setcos.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/libopensc/card-setcos.c b/src/libopensc/card-setcos.c
+index 0ebe7c34f..8c7baa3e4 100644
+--- a/src/libopensc/card-setcos.c
++++ b/src/libopensc/card-setcos.c
+@@ -218,6 +218,8 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
+
+ /* Type */
+ if (file->type_attr_len) {
++ if (file->type_attr_len > sizeof(buf))
++ LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ memcpy(buf, file->type_attr, file->type_attr_len);
+ sc_asn1_put_tag(0x82, buf, file->type_attr_len, p, *outlen - (p - out), &p);
+ } else {
+@@ -271,11 +273,15 @@ static int setcos_construct_fci_44(sc_card_t *card, const sc_file_t *file, u8 *o
+ }
+
+ /* Security Attributes */
++ if (file->sec_attr_len > sizeof(buf))
++ LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ memcpy(buf, file->sec_attr, file->sec_attr_len);
+ sc_asn1_put_tag(0x86, buf, file->sec_attr_len, p, *outlen - (p - out), &p);
+
+ /* Life cycle status */
+ if (file->prop_attr_len) {
++ if (file->prop_attr_len > sizeof(buf))
++ LOG_FUNC_RETURN(card->ctx, SC_ERROR_INVALID_DATA);
+ memcpy(buf, file->prop_attr, file->prop_attr_len);
+ sc_asn1_put_tag(0x8A, buf, file->prop_attr_len, p, *outlen - (p - out), &p);
+ }
diff --git a/meta-oe/recipes-support/opensc/opensc_0.27.1.bb b/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
index a1930744ea..bcd94dfb90 100644
--- a/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
+++ b/meta-oe/recipes-support/opensc/opensc_0.27.1.bb
@@ -14,6 +14,7 @@ DEPENDS = "openssl"
SRCREV = "19868984dc4dc697af6a86d65ab32a1f19a43ea4"
SRC_URI = "git://github.com/OpenSC/OpenSC;branch=master;protocol=https \
file://0001-Changes-for-OpenSSL-4.0.0.patch \
+ file://CVE-2026-103531.patch \
"
CVE_STATUS[CVE-2024-8443] = "fixed-version: this is fixed since 0.26.0"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 23/44] pjproject: mark CVE-2026-26967 fixed
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (20 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 22/44] opensc: patch CVE-2026-103531 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 24/44] pjproject: patch CVE-2026-57160 ankur.tyagi85
` (20 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-26967
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 8aa7775205..59684ac7c7 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -118,3 +118,5 @@ RDEPENDS:python3-pjsua2 = "python3-core"
# and ${PN}-staticdev (the .a files) by bitbake's own default FILES
# patterns - ${PN} itself ships nothing.
ALLOW_EMPTY:${PN} = "1"
+
+CVE_STATUS[CVE-2026-26967] = "fixed-version: fixed in v2.17"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 24/44] pjproject: patch CVE-2026-57160
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (21 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 23/44] pjproject: mark CVE-2026-26967 fixed ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 25/44] pjproject: patch CVE-2026-57161 ankur.tyagi85
` (19 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57160
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-57160.patch | 42 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 43 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
new file mode 100644
index 0000000000..a25ed5a28e
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57160.patch
@@ -0,0 +1,42 @@
+From b14ebbccf5c228ca298ad11ecae2cedde792edae Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:43:46 +0700
+Subject: [PATCH] Merge commit from fork
+
+When printing a generic array header (e.g. Allow, Require, Supported,
+Unsupported), the ": " delimiter following the header name was written
+with two unchecked stores. copy_advance() only guarantees that the
+header name itself fits, leaving as little as one byte before the end
+of the buffer. The colon then consumed the last byte and the trailing
+space was written one byte past the buffer end.
+
+Use copy_advance_char_check() for both delimiter bytes, matching the
+boundary-checked pattern already used by every other header printer in
+this file.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit d6a0e7f76611c3a6f530ee051e3e7a622bb1748c)
+
+CVE: CVE-2026-57160
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/d6a0e7f76611c3a6f530ee051e3e7a622bb1748c]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjsip/src/pjsip/sip_msg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pjsip/src/pjsip/sip_msg.c b/pjsip/src/pjsip/sip_msg.c
+index 06c8cce86..cdc99ff9e 100644
+--- a/pjsip/src/pjsip/sip_msg.c
++++ b/pjsip/src/pjsip/sip_msg.c
+@@ -964,8 +964,8 @@ static int pjsip_generic_array_hdr_print( pjsip_generic_array_hdr *hdr,
+ &hdr->sname : &hdr->name;
+
+ copy_advance(p, (*hname));
+- *p++ = ':';
+- *p++ = ' ';
++ copy_advance_char_check(p, ':');
++ copy_advance_char_check(p, ' ');
+
+ if (hdr->count > 0) {
+ unsigned i;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 59684ac7c7..254a2952a2 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -14,6 +14,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag=${PV} \
file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
+ file://CVE-2026-57160.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 25/44] pjproject: patch CVE-2026-57161
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (22 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 24/44] pjproject: patch CVE-2026-57160 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 26/44] pjproject: patch CVE-2026-57162 ankur.tyagi85
` (18 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57161
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-57161.patch | 49 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
new file mode 100644
index 0000000000..3296013efd
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57161.patch
@@ -0,0 +1,49 @@
+From 656cd5ec76f0178448053a9ca44ce075cd7a27f9 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:44:40 +0700
+Subject: [PATCH] Merge commit from fork
+
+Bound the number of Service-Route URIs stored in the fixed-size uri[]
+array by checking uri_cnt against PJ_ARRAY_SIZE(uri) before each write.
+Previously the count was only checked as the do/while continuation
+condition, which does not catch accumulation across multiple
+single-URI Service-Route headers, allowing a registrar response with
+more than PJSUA_ACC_MAX_PROXIES headers to write past the array.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit acc03b57cef7a7d31b8e1f5b9117437d7e87c591)
+
+CVE: CVE-2026-57161
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/acc03b57cef7a7d31b8e1f5b9117437d7e87c591]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjsip/src/pjsua-lib/pjsua_acc.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/pjsip/src/pjsua-lib/pjsua_acc.c b/pjsip/src/pjsua-lib/pjsua_acc.c
+index f52518a2a..08c5efced 100644
+--- a/pjsip/src/pjsua-lib/pjsua_acc.c
++++ b/pjsip/src/pjsua-lib/pjsua_acc.c
+@@ -2278,14 +2278,14 @@ static void update_service_route(pjsua_acc *acc, pjsip_rx_data *rdata)
+ return;
+ }
+
++ if (uri_cnt >= PJ_ARRAY_SIZE(uri)) {
++ PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
++ return;
++ }
++
+ uri[uri_cnt++] = h->name_addr.uri;
+ h = h->next;
+- } while (h != hr && uri_cnt != PJ_ARRAY_SIZE(uri));
+-
+- if (h != hr) {
+- PJ_LOG(1,(THIS_FILE, "Error: too many Service-Route headers"));
+- return;
+- }
++ } while (h != hr);
+
+ /* Prepare to find next Service-Route header */
+ hsr = hsr->next;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 254a2952a2..4c00c4215c 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -15,6 +15,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag=${PV} \
file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
file://CVE-2026-57160.patch \
+ file://CVE-2026-57161.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 26/44] pjproject: patch CVE-2026-57162
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (23 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 25/44] pjproject: patch CVE-2026-57161 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 27/44] pjproject: patch CVE-2026-57163 ankur.tyagi85
` (17 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57162
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-57162.patch | 43 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 44 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch
new file mode 100644
index 0000000000..85a9394e25
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57162.patch
@@ -0,0 +1,43 @@
+From 1b64bfb240731bbf0fc194dec68bb9d9b08a20b2 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:45:33 +0700
+Subject: [PATCH] Merge commit from fork
+
+sdes_encode_sdp() in transport_srtp_sdes.c wrote each parsed crypto tag
+into the fixed int tags[64] array without bounding the count, while the
+SDP parser allows up to PJMEDIA_MAX_SDP_ATTR (68) attributes. Reject
+the SDP with PJMEDIA_SRTP_ESDPINCRYPTO once the array capacity is
+reached, before the out-of-bounds write.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9)
+
+CVE: CVE-2026-57162
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/a1b707c0c9b0506faf2a8a438b60f11ffd6a6fd9]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjmedia/src/pjmedia/transport_srtp_sdes.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/pjmedia/src/pjmedia/transport_srtp_sdes.c b/pjmedia/src/pjmedia/transport_srtp_sdes.c
+index 8f98292ba..45038e585 100644
+--- a/pjmedia/src/pjmedia/transport_srtp_sdes.c
++++ b/pjmedia/src/pjmedia/transport_srtp_sdes.c
+@@ -478,6 +478,15 @@ static pj_status_t sdes_encode_sdp( pjmedia_transport *tp,
+
+ has_crypto_attr = PJ_TRUE;
+
++ /* Bound writes to tags[] by its capacity. m_rem->attr_count
++ * is capped by the SDP parser at PJMEDIA_MAX_SDP_ATTR, which
++ * can exceed PJ_ARRAY_SIZE(tags); without this guard a remote
++ * peer can overflow the stack array by sending more than
++ * PJ_ARRAY_SIZE(tags) a=crypto attributes.
++ */
++ if (cr_attr_count >= PJ_ARRAY_SIZE(tags))
++ return PJMEDIA_SRTP_ESDPINCRYPTO;
++
+ status = parse_attr_crypto(srtp->pool, m_rem->attr[i],
+ &tmp_rx_crypto,
+ &tags[cr_attr_count]);
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 4c00c4215c..f47d661400 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -16,6 +16,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://0001-ssl_sock_ossl-fix-OpenSSL-4.0-compatibility.patch \
file://CVE-2026-57160.patch \
file://CVE-2026-57161.patch \
+ file://CVE-2026-57162.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 27/44] pjproject: patch CVE-2026-57163
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (24 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 26/44] pjproject: patch CVE-2026-57162 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 28/44] pjproject: patch CVE-2026-57164 ankur.tyagi85
` (16 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57163
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-57163.patch | 52 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 53 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
new file mode 100644
index 0000000000..7b3c681cb9
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57163.patch
@@ -0,0 +1,52 @@
+From 2276d5ff1fe185a6bb51ab741dd5d88e45dbaa47 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:46:16 +0700
+Subject: [PATCH] Merge commit from fork
+
+The SAN-counting loop in tls_cert_get_info() (ssl_sock_gtls.c) called
+gnutls_x509_crt_get_subject_alt_name() with len still holding
+sizeof(buf) (512) from an earlier getter, while the output buffer is
+only 256 bytes, so an oversized SAN entry overflowed the stack. Set len
+to the true capacity (sizeof(out) - 1, matching the populate loop) on
+every iteration.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit c4a151af86fadd16d9480b2603eeb2abf4fb4f78)
+
+CVE: CVE-2026-57163
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/c4a151af86fadd16d9480b2603eeb2abf4fb4f78]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib/src/pj/ssl_sock_gtls.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index de3d5e99e..68ceea3f3 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1018,12 +1018,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+ if (ci->version >= 3) {
+ char out[256] = { 0 };
+ /* Get the number of all alternate names so that we can allocate
+- * the correct number of bytes in subj_alt_name */
++ * the correct number of bytes in subj_alt_name.
++ *
++ * Pass the true capacity of 'out' as the in/out size argument on
++ * every iteration. 'len' otherwise still holds sizeof(buf) (512)
++ * from an earlier getter, which would let GnuTLS copy an oversized
++ * SubjectAltName entry past the end of the 256-byte 'out' buffer.
++ * Use sizeof(out) - 1 to match the populate loop below, leaving
++ * room for the NUL terminator GnuTLS appends to string names.
++ */
++ len = sizeof(out) - 1;
+ while (gnutls_x509_crt_get_subject_alt_name(cert, seq, out, &len,
+ NULL) !=
+ GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+ {
+ seq++;
++ len = sizeof(out) - 1;
+ }
+
+ ci->subj_alt_name.entry = pj_pool_calloc(pool, seq,
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index f47d661400..de8c847271 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -17,6 +17,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57160.patch \
file://CVE-2026-57161.patch \
file://CVE-2026-57162.patch \
+ file://CVE-2026-57163.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 28/44] pjproject: patch CVE-2026-57164
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (25 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 27/44] pjproject: patch CVE-2026-57163 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 29/44] pjproject: patch CVE-2026-57165 ankur.tyagi85
` (15 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57164
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-57164.patch | 66 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 67 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
new file mode 100644
index 0000000000..0686d681c3
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57164.patch
@@ -0,0 +1,66 @@
+From 1160ff3c15cfa79f50d4bc6ce8066854f656066c Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:46:48 +0700
+Subject: [PATCH] Merge commit from fork
+
+http_on_data_read() in http_client.c grew the response buffer by a
+single doubling, which is insufficient when the server sends a body
+larger than twice the (attacker-supplied) Content-Length used for the
+initial allocation. Loop the doubling until the buffer fits, with a
+floor for the size==0 case to avoid an infinite loop.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 8d5956afab2ede95ddb199078dc19a8ac0114f3d)
+
+CVE: CVE-2026-57164
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/8d5956afab2ede95ddb199078dc19a8ac0114f3d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/http_client.c | 27 ++++++++++++++++++-------
+ 1 file changed, 20 insertions(+), 7 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/http_client.c b/pjlib-util/src/pjlib-util/http_client.c
+index bd441acb9..d2771d240 100644
+--- a/pjlib-util/src/pjlib-util/http_client.c
++++ b/pjlib-util/src/pjlib-util/http_client.c
+@@ -432,18 +432,31 @@ static pj_bool_t http_on_data_read(pj_activesock_t *asock,
+ hreq->response.size);
+ }
+
+- /* If the size of data received exceeds its current size,
+- * grow the buffer by a factor of 2.
++ /* If the size of data received exceeds its current size, grow the
++ * buffer by a factor of 2 repeatedly, until it can actually hold
++ * everything received so far. A single doubling is not sufficient
++ * when the server delivers a body chunk larger than twice the
++ * (possibly undersized) Content-Length used for the initial
++ * allocation, which would otherwise overflow the buffer in the
++ * pj_memcpy() below.
+ */
+- if (hreq->tcp_state.current_read_size + size >
+- hreq->response.size)
++ if (hreq->tcp_state.current_read_size + size >
++ hreq->response.size)
+ {
+ void *olddata = hreq->response.data;
++ pj_size_t new_size = hreq->response.size;
+
+- hreq->response.data = pj_pool_alloc(hreq->pool,
+- hreq->response.size << 1);
++ /* Guard against size==0 (Content-Length: 0 with a body), which
++ * would make the doubling loop below spin forever.
++ */
++ if (new_size == 0)
++ new_size = INITIAL_DATA_BUF_SIZE;
++ while (hreq->tcp_state.current_read_size + size > new_size)
++ new_size <<= 1;
++
++ hreq->response.data = pj_pool_alloc(hreq->pool, new_size);
+ pj_memcpy(hreq->response.data, olddata, hreq->response.size);
+- hreq->response.size <<= 1;
++ hreq->response.size = new_size;
+ }
+
+ /* Append the response data. */
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index de8c847271..8e0b358ffe 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -18,6 +18,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57161.patch \
file://CVE-2026-57162.patch \
file://CVE-2026-57163.patch \
+ file://CVE-2026-57164.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 29/44] pjproject: patch CVE-2026-57165
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (26 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 28/44] pjproject: patch CVE-2026-57164 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 30/44] pjproject: patch CVE-2026-57166 ankur.tyagi85
` (14 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57165
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-57165.patch | 85 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 86 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch
new file mode 100644
index 0000000000..e2d62b0eef
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57165.patch
@@ -0,0 +1,85 @@
+From 5776ee452296d5277d71e2bb011709adec80a533 Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:47:29 +0700
+Subject: [PATCH] Merge commit from fork
+
+handle_up_down() in cli_telnet.c accumulated cur_pos + 2*rcmd->len +
+history->slen bytes into a fixed PJ_CLI_MAX_CMDBUF stack buffer with no
+bound check. Size the buffer for the worst case, clamp each term to
+PJ_CLI_MAX_CMDBUF, and replace the trailing unchecked pj_strcat with a
+bounded pj_memcpy.
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 628b71638465bacf66e767959e6acbab822eccd6)
+
+CVE: CVE-2026-57165
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/628b71638465bacf66e767959e6acbab822eccd6]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/cli_telnet.c | 33 ++++++++++++++++++++------
+ 1 file changed, 26 insertions(+), 7 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/cli_telnet.c b/pjlib-util/src/pjlib-util/cli_telnet.c
+index 150727bb5..0a2954bd4 100644
+--- a/pjlib-util/src/pjlib-util/cli_telnet.c
++++ b/pjlib-util/src/pjlib-util/cli_telnet.c
+@@ -1141,7 +1141,14 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+ history = get_prev_history(sess, is_up);
+ if (history) {
+ pj_str_t send_data;
+- char str[PJ_CLI_MAX_CMDBUF];
++ /* The redraw sequence can accumulate up to
++ * cur_pos + 2 * rcmd->len + history->slen
++ * bytes, each term bounded by PJ_CLI_MAX_CMDBUF, so size the
++ * local buffer for the worst case and clamp each term below.
++ */
++ char str[PJ_CLI_MAX_CMDBUF * 4];
++ unsigned cur_pos, buf_len;
++ pj_size_t hist_len;
+ enum {
+ MOVE_CURSOR_LEFT = 0x08,
+ CLEAR_CHAR = 0x20
+@@ -1149,15 +1156,24 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+ send_data.ptr = str;
+ send_data.slen = 0;
+
++ cur_pos = sess->rcmd->cur_pos;
++ buf_len = sess->rcmd->len;
++ hist_len = history->slen;
++ if (cur_pos > PJ_CLI_MAX_CMDBUF)
++ cur_pos = PJ_CLI_MAX_CMDBUF;
++ if (buf_len > PJ_CLI_MAX_CMDBUF)
++ buf_len = PJ_CLI_MAX_CMDBUF;
++ if (hist_len > PJ_CLI_MAX_CMDBUF)
++ hist_len = PJ_CLI_MAX_CMDBUF;
++
+ /* Move cursor position to the beginning of line */
+- if (sess->rcmd->cur_pos > 0) {
+- pj_memset(send_data.ptr, MOVE_CURSOR_LEFT, sess->rcmd->cur_pos);
+- send_data.slen = sess->rcmd->cur_pos;
++ if (cur_pos > 0) {
++ pj_memset(send_data.ptr, MOVE_CURSOR_LEFT, cur_pos);
++ send_data.slen = cur_pos;
+ }
+
+- if (sess->rcmd->len > (unsigned)history->slen) {
++ if (buf_len > (unsigned)hist_len) {
+ /* Clear the command currently shown*/
+- unsigned buf_len = sess->rcmd->len;
+ pj_memset(&send_data.ptr[send_data.slen], CLEAR_CHAR, buf_len);
+ send_data.slen += buf_len;
+
+@@ -1167,7 +1183,10 @@ static pj_bool_t handle_up_down(cli_telnet_sess *sess, pj_bool_t is_up)
+ send_data.slen += buf_len;
+ }
+ /* Send data */
+- pj_strcat(&send_data, history);
++ if (hist_len > 0) {
++ pj_memcpy(&send_data.ptr[send_data.slen], history->ptr, hist_len);
++ send_data.slen += hist_len;
++ }
+ telnet_sess_send(sess, &send_data);
+ pj_ansi_strxcpy2((char*)sess->rcmd->rbuf, history,
+ sizeof(sess->rcmd->rbuf));
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 8e0b358ffe..e7cae469ed 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -19,6 +19,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57162.patch \
file://CVE-2026-57163.patch \
file://CVE-2026-57164.patch \
+ file://CVE-2026-57165.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 30/44] pjproject: patch CVE-2026-57166
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (27 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 29/44] pjproject: patch CVE-2026-57165 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 31/44] pjproject: patch CVE-2026-77396 ankur.tyagi85
` (13 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57166
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-57166.patch | 228 ++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 229 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch
new file mode 100644
index 0000000000..8311d4c36d
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-57166.patch
@@ -0,0 +1,228 @@
+From d0b42b902bb6ca8a0a1393799db487642d3bf8ae Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Wed, 17 Jun 2026 15:55:53 +0700
+Subject: [PATCH] Merge commit from fork
+
+* Fix pre-auth stack overflow formatting telnet CLI error indicator
+
+send_err_arg() in cli_telnet.c rendered the error caret into a fixed
+256-byte stack buffer using unchecked pj_strcat2; info->err_pos is
+bounded only by PJ_CLI_MAX_CMDBUF, so a long command line overflowed
+the buffer. Stream the spaces in bounded chunks via telnet_sess_send2,
+clamp the caret offset to PJ_CLI_MAX_CMDBUF, and send the message,
+prompt and echoed command separately, removing the stack buffer.
+
+Co-Authored-By Claude Code
+
+* Apply the same overflow fix to send_ambi_arg()
+
+Per review, send_ambi_arg() has the same issue as send_err_arg(): it
+renders an attacker-influenced number of caret spaces and appends the
+last command into a fixed 1028-byte stack buffer with unchecked
+pj_strcat2. info->err_pos and sess->rcmd->rbuf are bounded only by
+PJ_CLI_MAX_CMDBUF, so a long ambiguous command line could overflow it.
+
+Stream the caret offset in bounded chunks (clamped to PJ_CLI_MAX_CMDBUF)
+and stream the clamped last command separately, mirroring the
+send_err_arg() fix, instead of writing them into the fixed buffer. The
+shared SPACES constant is hoisted to file scope.
+
+Co-Authored-By Claude Code
+
+* Bound completion append in handle_tab()
+
+handle_tab() appended the matched command name into the fixed-size
+sess->rcmd->rbuf at offset len (the current command length) without
+checking that len + name length fits the buffer. len is bounded by the
+receive path, but the completion suffix is added on top, so a long
+completable command line could write past rbuf and its NUL terminator.
+
+Clamp the appended length to the space remaining in rbuf, leaving room
+for the terminator. Found while auditing the telnet CLI for the same
+fixed-buffer overflow pattern as send_err_arg()/send_ambi_arg().
+
+Co-Authored-By Claude Code
+
+(cherry picked from commit 4472a31d77a7506ff175dad5abef490f4e31bed1)
+
+CVE: CVE-2026-57166
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/4472a31d77a7506ff175dad5abef490f4e31bed1]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib-util/src/pjlib-util/cli_telnet.c | 116 ++++++++++++++++++-------
+ 1 file changed, 84 insertions(+), 32 deletions(-)
+
+diff --git a/pjlib-util/src/pjlib-util/cli_telnet.c b/pjlib-util/src/pjlib-util/cli_telnet.c
+index 0a2954bd4..67898fdd8 100644
+--- a/pjlib-util/src/pjlib-util/cli_telnet.c
++++ b/pjlib-util/src/pjlib-util/cli_telnet.c
+@@ -680,6 +680,13 @@ static void send_prompt_str(cli_telnet_sess *sess)
+ telnet_sess_send(sess, &send_data);
+ }
+
++/* Buffer of spaces, used to stream the caret offset in bounded chunks
++ * instead of writing an attacker-influenced number of spaces into a
++ * fixed-size stack buffer. Shared by send_err_arg() and send_ambi_arg().
++ */
++static const unsigned char SPACES[64] =
++ " ";
++
+ /*
+ * This method is used to send error message to client, including
+ * the error position of the source command.
+@@ -690,32 +697,45 @@ static void send_err_arg(cli_telnet_sess *sess,
+ pj_bool_t with_return,
+ pj_bool_t with_last_cmd)
+ {
+- pj_str_t send_data;
+- char data_str[256];
+- pj_size_t len;
+- unsigned i;
++ pj_size_t len, remaining;
+ cli_telnet_fe *fe = (cli_telnet_fe *)sess->base.fe;
+
+- send_data.ptr = data_str;
+- send_data.slen = 0;
+-
+ if (with_return)
+- pj_strcat2(&send_data, "\r\n");
++ telnet_sess_send2(sess, (const unsigned char*)"\r\n", 2);
+
++ /* Compute the caret offset. info->err_pos is derived from
++ * attacker-supplied input (pj_cli_sess_parse) and is bounded only by
++ * PJ_CLI_MAX_CMDBUF, so clamp it before emitting spaces. Otherwise a
++ * ~500-byte command line would overflow the fixed-size stack buffer
++ * this function previously used.
++ */
+ len = fe->cfg.prompt_str.slen + info->err_pos;
+-
+- /* Set the error pointer mark */
+- for (i=0;i<len;++i) {
+- pj_strcat2(&send_data, " ");
++ if (len > PJ_CLI_MAX_CMDBUF)
++ len = PJ_CLI_MAX_CMDBUF;
++
++ remaining = len;
++ while (remaining > 0) {
++ pj_size_t chunk = (remaining > sizeof(SPACES)) ? sizeof(SPACES)
++ : remaining;
++ telnet_sess_send2(sess, SPACES, (int)chunk);
++ remaining -= chunk;
+ }
+- pj_strcat2(&send_data, "^");
+- pj_strcat2(&send_data, "\r\n");
+- pj_strcat(&send_data, msg);
+- pj_strcat(&send_data, &fe->cfg.prompt_str);
+- if (with_last_cmd)
+- pj_strcat2(&send_data, (char *)sess->rcmd->rbuf);
+
+- telnet_sess_send(sess, &send_data);
++ telnet_sess_send2(sess, (const unsigned char*)"^\r\n", 3);
++
++ if (msg && msg->slen > 0)
++ telnet_sess_send(sess, msg);
++ if (fe->cfg.prompt_str.slen > 0)
++ telnet_sess_send(sess, &fe->cfg.prompt_str);
++ if (with_last_cmd) {
++ pj_str_t last;
++ last.ptr = (char *)sess->rcmd->rbuf;
++ last.slen = (pj_ssize_t)pj_ansi_strlen((const char *)sess->rcmd->rbuf);
++ if (last.slen > PJ_CLI_MAX_CMDBUF)
++ last.slen = PJ_CLI_MAX_CMDBUF;
++ if (last.slen > 0)
++ telnet_sess_send(sess, &last);
++ }
+ }
+
+ static void send_inv_arg(cli_telnet_sess *sess,
+@@ -765,7 +785,7 @@ static void send_ambi_arg(cli_telnet_sess *sess,
+ pj_bool_t with_last_cmd)
+ {
+ unsigned i;
+- pj_size_t len;
++ pj_size_t len, remaining;
+ pj_str_t send_data;
+ char data[1028];
+ cli_telnet_fe *fe = (cli_telnet_fe *)sess->base.fe;
+@@ -779,14 +799,25 @@ static void send_ambi_arg(cli_telnet_sess *sess,
+ send_data.slen = 0;
+
+ if (with_return)
+- pj_strcat2(&send_data, "\r\n");
++ telnet_sess_send2(sess, (const unsigned char*)"\r\n", 2);
+
++ /* Compute and clamp the caret offset, then stream the spaces, like
++ * send_err_arg(). info->err_pos is attacker-bounded only by
++ * PJ_CLI_MAX_CMDBUF, so it must not drive writes into data[].
++ */
+ len = fe->cfg.prompt_str.slen + info->err_pos;
+-
+- for (i=0;i<len;++i) {
+- pj_strcat2(&send_data, " ");
++ if (len > PJ_CLI_MAX_CMDBUF)
++ len = PJ_CLI_MAX_CMDBUF;
++
++ remaining = len;
++ while (remaining > 0) {
++ pj_size_t chunk = (remaining > sizeof(SPACES)) ? sizeof(SPACES)
++ : remaining;
++ telnet_sess_send2(sess, SPACES, (int)chunk);
++ remaining -= chunk;
+ }
+- pj_strcat2(&send_data, "^");
++ telnet_sess_send2(sess, (const unsigned char*)"^", 1);
++
+ /* Get the max length of the command name */
+ for (i=0;i<info->hint_cnt;++i) {
+ if (hint[i].type.slen > 0) {
+@@ -874,10 +905,21 @@ static void send_ambi_arg(cli_telnet_sess *sess,
+ }
+ pj_strcat2(&send_data, "\r\n");
+ pj_strcat(&send_data, &fe->cfg.prompt_str);
+- if (with_last_cmd)
+- pj_strcat2(&send_data, (char *)sess->rcmd->rbuf);
+-
+ telnet_sess_send(sess, &send_data);
++
++ /* Stream the last command separately with a clamp; sess->rcmd->rbuf
++ * is attacker-bounded only by PJ_CLI_MAX_CMDBUF, so appending it into
++ * data[] could overflow the fixed-size buffer.
++ */
++ if (with_last_cmd) {
++ pj_str_t last;
++ last.ptr = (char *)sess->rcmd->rbuf;
++ last.slen = (pj_ssize_t)pj_ansi_strlen((const char *)sess->rcmd->rbuf);
++ if (last.slen > PJ_CLI_MAX_CMDBUF)
++ last.slen = PJ_CLI_MAX_CMDBUF;
++ if (last.slen > 0)
++ telnet_sess_send(sess, &last);
++ }
+ }
+
+ /*
+@@ -1035,10 +1077,20 @@ static pj_bool_t handle_tab(cli_telnet_sess *sess)
+ }
+ send_comp_arg(sess, &info);
+
+- pj_memcpy(&sess->rcmd->rbuf[len], info.hint[0].name.ptr,
+- info.hint[0].name.slen);
+-
+- len += (unsigned)info.hint[0].name.slen;
++ /* Append the matched name into the fixed-size rbuf. len is
++ * attacker-influenced (the typed command length), so clamp
++ * the copy to leave room for the NUL terminator and avoid
++ * overflowing rbuf.
++ */
++ if (len < sizeof(sess->rcmd->rbuf) - 1) {
++ pj_size_t avail = sizeof(sess->rcmd->rbuf) - 1 - len;
++ pj_size_t cplen = (pj_size_t)info.hint[0].name.slen;
++ if (cplen > avail)
++ cplen = avail;
++ pj_memcpy(&sess->rcmd->rbuf[len],
++ info.hint[0].name.ptr, cplen);
++ len += (unsigned)cplen;
++ }
+ sess->rcmd->rbuf[len] = 0;
+ }
+ } else {
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index e7cae469ed..9d1e6af253 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -20,6 +20,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57163.patch \
file://CVE-2026-57164.patch \
file://CVE-2026-57165.patch \
+ file://CVE-2026-57166.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 31/44] pjproject: patch CVE-2026-77396
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (28 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 30/44] pjproject: patch CVE-2026-57166 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 32/44] pjproject: patch CVE-2026-84975 ankur.tyagi85
` (12 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-77396
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-77396.patch | 74 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 75 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
new file mode 100644
index 0000000000..a02268bf11
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-77396.patch
@@ -0,0 +1,74 @@
+From a927a964d462e9966864b7b2c432942b61038d6b Mon Sep 17 00:00:00 2001
+From: Nanang Izzuddin <nanang@teluu.com>
+Date: Mon, 13 Jul 2026 09:27:02 +0700
+Subject: [PATCH] Merge commit from fork
+
+The AVI player used a chunk length taken from the input file as the
+number of bytes to read into the video frame buffer, whose capacity is
+derived from the (also file-supplied) declared dimensions, without
+reconciling the two. A crafted file could therefore cause a write past
+the end of the buffer. The only guard was an assertion, which is a
+no-op in release builds.
+
+Clamp the read to the frame buffer capacity, skip any remaining chunk
+bytes so the file position stays aligned, and remove the reliance on
+the assertion for validating a file-supplied length.
+
+Ref: GHSA-6p2p-5wf8-h5hr
+(cherry picked from commit 7ecc6584969a923c4190b6912afbf5952b5a4b9f)
+
+CVE: CVE-2026-77396
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/7ecc6584969a923c4190b6912afbf5952b5a4b9f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjmedia/src/pjmedia/avi_player.c | 34 +++++++++++++++++++++++++++++---
+ 1 file changed, 31 insertions(+), 3 deletions(-)
+
+diff --git a/pjmedia/src/pjmedia/avi_player.c b/pjmedia/src/pjmedia/avi_player.c
+index dc87b8a41..8b4b94d16 100644
+--- a/pjmedia/src/pjmedia/avi_player.c
++++ b/pjmedia/src/pjmedia/avi_player.c
+@@ -1199,12 +1199,40 @@ static pj_status_t avi_get_frame(pjmedia_port *this_port,
+ goto on_error2;
+ fport->size_left -= size_to_read;
+ } else {
+- pj_assert(frame->size >= ch.len);
+- status = file_read3(fport->fd, frame->buf, ch.len,
++ pj_uint32_t read_len = ch.len;
++
++ /* Clamp the read to the frame buffer capacity. A crafted
++ * file may declare a chunk larger than the buffer, whose
++ * size is derived from the (also file-supplied) video
++ * dimensions; never write past frame->buf (frame->size
++ * bytes). Do not rely on pj_assert() here, as it is a no-op
++ * in release builds.
++ */
++ if (read_len > frame->size) {
++ PJ_LOG(3, (THIS_FILE,
++ "AVI video chunk (%u) exceeds frame buffer "
++ "(%u), truncating",
++ (unsigned)ch.len, (unsigned)frame->size));
++ read_len = (pj_uint32_t)frame->size;
++ }
++
++ status = file_read3(fport->fd, frame->buf, read_len,
+ 0, &size_read);
+ if (status != PJ_SUCCESS)
+ goto on_error2;
+- frame->size = ch.len;
++
++ /* Skip any remaining chunk bytes that did not fit, so the
++ * file position stays aligned to the next chunk.
++ */
++ if (ch.len > read_len) {
++ status = pj_file_setpos(fport->fd,
++ (pj_off_t)ch.len - read_len,
++ PJ_SEEK_CUR);
++ if (status != PJ_SUCCESS)
++ goto on_error2;
++ }
++
++ frame->size = read_len;
+ fport->size_left = 0;
+ }
+
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 9d1e6af253..89763b3011 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -21,6 +21,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57164.patch \
file://CVE-2026-57165.patch \
file://CVE-2026-57166.patch \
+ file://CVE-2026-77396.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-multimedia][blacksail][PATCH 32/44] pjproject: patch CVE-2026-84975
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (29 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 31/44] pjproject: patch CVE-2026-77396 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 33/44] nmap: patch CVE-2026-58058 ankur.tyagi85
` (11 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84975
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pjproject/pjproject/CVE-2026-84975.patch | 87 +++++++++++++++++++
.../pjproject/pjproject_2.17.bb | 1 +
2 files changed, 88 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch
new file mode 100644
index 0000000000..007096a6ff
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject/CVE-2026-84975.patch
@@ -0,0 +1,87 @@
+From f00f023079d0f9a74477da47056bfce76374b2a7 Mon Sep 17 00:00:00 2001
+From: sauwming <ming@teluu.com>
+Date: Fri, 17 Jul 2026 16:46:33 +0800
+Subject: [PATCH] Merge commit from fork
+
+SubjectAltName entries from the OpenSSL and GnuTLS backends were copied
+with pj_strdup2(), which re-derives the length with strlen() and thus
+discards the length already returned by ASN1_STRING_to_UTF8() /
+gnutls_x509_crt_get_subject_alt_name(). A DNS SAN such as
+"victim.example\0.attacker" was therefore truncated to "victim.example".
+
+sip_transport_tls.c disables socket-layer verification and performs its
+own length-aware identity match against subj_alt_name, so the truncated
+prefix compared equal to the target host and a crafted certificate was
+accepted for the prefix hostname (server identity / hostname verification
+bypass; OpenSSL's own X509_check_host() rejects the same certificate).
+
+Copy the SAN using its explicit length via pj_strset()/pj_strdup_with_null()
+so embedded NULs are preserved and no longer truncated. The mbedTLS backend
+already copied with a length-bearing pj_str_t and was not affected.
+
+Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
+(cherry picked from commit 43d3bd77bb6833eab4c493503b8d564a754ddfdd)
+
+CVE: CVE-2026-84975
+Upstream-Status: Backport [https://github.com/pjsip/pjproject/commit/43d3bd77bb6833eab4c493503b8d564a754ddfdd]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ pjlib/src/pj/ssl_sock_gtls.c | 17 +++++++++++++++--
+ pjlib/src/pj/ssl_sock_ossl.c | 14 +++++++++++---
+ 2 files changed, 26 insertions(+), 5 deletions(-)
+
+diff --git a/pjlib/src/pj/ssl_sock_gtls.c b/pjlib/src/pj/ssl_sock_gtls.c
+index 68ceea3f3..ee977116b 100644
+--- a/pjlib/src/pj/ssl_sock_gtls.c
++++ b/pjlib/src/pj/ssl_sock_gtls.c
+@@ -1072,9 +1072,22 @@ static void tls_cert_get_info(pj_pool_t *pool, pj_ssl_cert_info *ci,
+
+ if (len && type != PJ_SSL_CERT_NAME_UNKNOWN) {
+ ci->subj_alt_name.entry[ci->subj_alt_name.cnt].type = type;
+- pj_strdup2(pool,
++ if (type == PJ_SSL_CERT_NAME_IP) {
++ pj_strdup2(pool,
+ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+- type == PJ_SSL_CERT_NAME_IP ? buf : out);
++ buf);
++ } else {
++ /* Preserve the reported length instead of using strlen(),
++ * so a DNS SAN containing an embedded NUL is not truncated
++ * at the NUL (which would allow a crafted cert to be
++ * accepted for the prefix hostname; identity bypass).
++ */
++ pj_str_t tmp;
++ pj_strset(&tmp, out, len);
++ pj_strdup_with_null(pool,
++ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++ &tmp);
++ }
+ ci->subj_alt_name.cnt++;
+ }
+ }
+diff --git a/pjlib/src/pj/ssl_sock_ossl.c b/pjlib/src/pj/ssl_sock_ossl.c
+index 30b4eeaee..ceb6bca5b 100644
+--- a/pjlib/src/pj/ssl_sock_ossl.c
++++ b/pjlib/src/pj/ssl_sock_ossl.c
+@@ -2270,9 +2270,17 @@ static void get_cert_info(pj_pool_t *pool, pj_ssl_cert_info *ci, X509 *x,
+ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+ buf);
+ } else {
+- pj_strdup2(pool,
+- &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
+- (char*)p);
++ /* Preserve the explicit ASN.1 string length instead of
++ * treating the data as a NUL-terminated C string. A DNS
++ * SAN such as "host.example\0.attacker" would otherwise be
++ * truncated at the embedded NUL, letting a crafted cert be
++ * accepted for the prefix hostname (identity bypass).
++ */
++ pj_str_t tmp;
++ pj_strset(&tmp, (char*)p, len);
++ pj_strdup_with_null(pool,
++ &ci->subj_alt_name.entry[ci->subj_alt_name.cnt].name,
++ &tmp);
+ OPENSSL_free(p);
+ }
+ ci->subj_alt_name.cnt++;
diff --git a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
index 89763b3011..893559090f 100644
--- a/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
+++ b/meta-multimedia/recipes-multimedia/pjproject/pjproject_2.17.bb
@@ -22,6 +22,7 @@ SRC_URI = "git://github.com/pjsip/pjproject.git;protocol=https;branch=master;tag
file://CVE-2026-57165.patch \
file://CVE-2026-57166.patch \
file://CVE-2026-77396.patch \
+ file://CVE-2026-84975.patch \
"
SRCREV = "5a457451fa2712ba18e12b01738e8ff3af2b26fd"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 33/44] nmap: patch CVE-2026-58058
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (30 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-multimedia][blacksail][PATCH 32/44] pjproject: patch CVE-2026-84975 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 34/44] nmap: patch CVE-2026-72712 ankur.tyagi85
` (10 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58058
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../nmap/files/CVE-2026-58058.patch | 34 +++++++++++++++++++
meta-oe/recipes-security/nmap/nmap_7.99.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch
diff --git a/meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch b/meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch
new file mode 100644
index 0000000000..3717d37b5d
--- /dev/null
+++ b/meta-oe/recipes-security/nmap/files/CVE-2026-58058.patch
@@ -0,0 +1,34 @@
+From 63815f6a8865d8c99a1f3abb9d7383a2be0ea67e Mon Sep 17 00:00:00 2001
+From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date: Thu, 25 Jun 2026 21:58:49 +0000
+Subject: [PATCH] Fix extension header parsing. Credit: Himanshu Anand
+
+(cherry picked from commit bb6754e76bb1686315008e1aa1c40202a513fb83)
+
+CVE: CVE-2026-58058
+Upstream-Status: Backport [https://github.com/nmap/nmap/commit/bb6754e76bb1686315008e1aa1c40202a513fb83]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libnetutil/netutil.cc | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/libnetutil/netutil.cc b/libnetutil/netutil.cc
+index 6e81f558c..0adf18b8e 100644
+--- a/libnetutil/netutil.cc
++++ b/libnetutil/netutil.cc
+@@ -615,11 +615,13 @@ static const void *ipv6_get_data_primitive(const struct ip6_hdr *ip6,
+ *nxt = ip6->ip6_nxt;
+ p += sizeof(*ip6);
+ while (p < end && ipv6_is_extension_header(*nxt)) {
+- if (p + 2 > end)
++ if (p + 8 > end)
+ return NULL;
+ *nxt = *p;
+ p += (*(p + 1) + 1) * 8;
+ }
++ if (p >= end)
++ return NULL;
+
+ *len = end - p;
+ if (upperlayer_only && !ipv6_is_upperlayer(*nxt))
diff --git a/meta-oe/recipes-security/nmap/nmap_7.99.bb b/meta-oe/recipes-security/nmap/nmap_7.99.bb
index ea792d30f6..515623d63d 100644
--- a/meta-oe/recipes-security/nmap/nmap_7.99.bb
+++ b/meta-oe/recipes-security/nmap/nmap_7.99.bb
@@ -11,6 +11,7 @@ SRC_URI = "http://nmap.org/dist/${BP}.tar.bz2 \
file://0002-Fix-building-with-libc.patch \
file://0001-fix-racing-between-build-ncat-and-build-lua.patch \
file://0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch \
+ file://CVE-2026-58058.patch \
"
SRC_URI[sha256sum] = "df512492ffd108e53a27a06f26d8635bbe89e0e569455dc8ffef058c035d51b2"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 34/44] nmap: patch CVE-2026-72712
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (31 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 33/44] nmap: patch CVE-2026-58058 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 35/44] netdata: mark CVE-2026-83602 fixed ankur.tyagi85
` (9 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-72712
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../nmap/files/CVE-2026-72712.patch | 46 +++++++++++++++++++
meta-oe/recipes-security/nmap/nmap_7.99.bb | 1 +
2 files changed, 47 insertions(+)
create mode 100644 meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
diff --git a/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch b/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
new file mode 100644
index 0000000000..f5e81aac0e
--- /dev/null
+++ b/meta-oe/recipes-security/nmap/files/CVE-2026-72712.patch
@@ -0,0 +1,46 @@
+From 120d13b8aca52ec306e50eae9a74fb1bfe49540a Mon Sep 17 00:00:00 2001
+From: dmiller <dmiller@e0a8ed71-7df4-0310-8962-fdc924857419>
+Date: Thu, 11 Jun 2026 18:31:31 +0000
+Subject: [PATCH] Stop parsing on a zero-length packet option
+
+Fixes #3368. Closes #3373.
+
+(cherry picked from commit 7ef4ee030a0023fe22616387a000032e1a678b6a)
+
+CVE: CVE-2026-72712
+Upstream-Status: Backport [https://github.com/nmap/nmap/commit/7ef4ee030a0023fe22616387a000032e1a678b6a]
+
+Dropped changes to the CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ nselib/packet.lua | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/nselib/packet.lua b/nselib/packet.lua
+index ec6db40a2..e17972d88 100644
+--- a/nselib/packet.lua
++++ b/nselib/packet.lua
+@@ -686,10 +686,7 @@ function Packet:parse_options(offset, length)
+ local opt_ptr = 0
+ while opt_ptr < length do
+ local t, l, d
+- options[op] = {}
+-
+ t = self:u8(offset + opt_ptr)
+- options[op].type = t
+ if t==0 or t==1 then
+ l = 1
+ d = nil
+@@ -699,6 +696,11 @@ function Packet:parse_options(offset, length)
+ d = self:raw(offset + opt_ptr + 2, l-2)
+ end
+ end
++ if l==0 then
++ break
++ end
++ options[op] = {}
++ options[op].type = t
+ options[op].len = l
+ options[op].data = d
+ opt_ptr = opt_ptr + l
diff --git a/meta-oe/recipes-security/nmap/nmap_7.99.bb b/meta-oe/recipes-security/nmap/nmap_7.99.bb
index 515623d63d..0cbef990cb 100644
--- a/meta-oe/recipes-security/nmap/nmap_7.99.bb
+++ b/meta-oe/recipes-security/nmap/nmap_7.99.bb
@@ -12,6 +12,7 @@ SRC_URI = "http://nmap.org/dist/${BP}.tar.bz2 \
file://0001-fix-racing-between-build-ncat-and-build-lua.patch \
file://0004-libdnet-fix-PF_PACKET-conftest-nested-function.patch \
file://CVE-2026-58058.patch \
+ file://CVE-2026-72712.patch \
"
SRC_URI[sha256sum] = "df512492ffd108e53a27a06f26d8635bbe89e0e569455dc8ffef058c035d51b2"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-webserver][blacksail][PATCH 35/44] netdata: mark CVE-2026-83602 fixed
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (32 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 34/44] nmap: patch CVE-2026-72712 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 36/44] nginx: upgrade 1.30.5 -> 1.30.6 ankur.tyagi85
` (8 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Fix identified by NVD is included in the patch release[1] v2.10.4
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-83602
[1]https://github.com/netdata/netdata/pull/22825
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb b/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
index ed4c54fbe4..9df846cec9 100644
--- a/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
+++ b/meta-webserver/recipes-webadmin/netdata/netdata_2.10.4.bb
@@ -167,3 +167,5 @@ FILES:${PN} += "\
"
RDEPENDS:${PN} = "bash python3-core zlib"
+
+CVE_STATUS[CVE-2026-83602] = "fixed-version: fixed in v2.10.4"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-webserver][blacksail][PATCH 36/44] nginx: upgrade 1.30.5 -> 1.30.6
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (33 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 35/44] netdata: mark CVE-2026-83602 fixed ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 37/44] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629 ankur.tyagi85
` (7 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Peter Marko, Khem Raj, Ankur Tyagi
From: Peter Marko <peter.marko@siemens.com>
2026-10-14 nginx-1.30.6 stable and nginx-1.31.7 mainline versions have
been released, with fixes for buffer overflow vulnerability when using
alias with rewrite (CVE-2026-15176), buffer overflow vulnerability when
evaluating string expressions with variables (CVE-2026-93479), request
body injection vulnerability in HTTP/3 (CVE-2026-95101), session forgery
vulnerability when using TLS session ticket key rotation
(CVE-2026-97629), and use-after-free vulnerability when using
ngx_http_ssi_module with AIO (CVE-2026-97205).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 6cdd413248db5aed93c6cc138cbfe0f83ed81f56)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../recipes-httpd/nginx/{nginx_1.30.5.bb => nginx_1.30.6.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-webserver/recipes-httpd/nginx/{nginx_1.30.5.bb => nginx_1.30.6.bb} (81%)
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
similarity index 81%
rename from meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
rename to meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
index 6b638cdd96..5d699e63ce 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
@@ -2,7 +2,7 @@ require nginx.inc
LIC_FILES_CHKSUM = "file://LICENSE;md5=79da1c70d587d3a199af9255ad393f99"
-SRC_URI[sha256sum] = "6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11c4906d"
+SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9b8b6c8"
inherit upstream-version-is-even
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-webserver][blacksail][PATCH 37/44] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (34 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 36/44] nginx: upgrade 1.30.5 -> 1.30.6 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-23 21:15 ` [meta-webserver][blacksail][PATCH " mominux
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 38/44] mtr: patch CVE-2026-14461 ankur.tyagi85
` (6 subsequent siblings)
42 siblings, 1 reply; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Peter Marko, Khem Raj, Ankur Tyagi
From: Peter Marko <peter.marko@siemens.com>
These CVEs are fixed in latest release however still show-up in open
CVE reports. Reason is that the DB contains entries:
{
"lessThan": "*",
"status": "affected",
"version": "1.23.3",
"versionType": "custom"
}
Which should mean that the first affected release is 1.23.3, however
without the upper limit it will match all higher releases.
The entry with >= 1.30.0 && < 1.30.6 cannot change the result as it
works by flagging CVEs where at least one version match is present.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 959f4c8f098a90c24a818831a5e3dd8090cee641)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
index 5d699e63ce..73204da558 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.6.bb
@@ -6,6 +6,9 @@ SRC_URI[sha256sum] = "3cf46f5ed7504d460125866b7bea99fb357f31d887e2e63b35503310e9
inherit upstream-version-is-even
+CVE_STATUS[CVE-2026-95101] = "fixed-version: Fixed since 1.30.6"
+CVE_STATUS[CVE-2026-97629] = "fixed-version: Fixed since 1.30.6"
+
# Remove following entries when upgrading recipe to 1.32
CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3"
CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-networking][blacksail][PATCH 38/44] mtr: patch CVE-2026-14461
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (35 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 37/44] nginx: set CVE_STATUS for CVE-2026-95101 and CVE-2026-97629 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 39/44] ncp: ignore CVE-2025-14577 and CVE-2026-35087 ankur.tyagi85
` (5 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-14461
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../mtr/mtr/CVE-2026-14461.patch | 32 +++++++++++++++++++
.../recipes-support/mtr/mtr_0.96.bb | 4 ++-
2 files changed, 35 insertions(+), 1 deletion(-)
create mode 100644 meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch
diff --git a/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch b/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch
new file mode 100644
index 0000000000..6628d9d7be
--- /dev/null
+++ b/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch
@@ -0,0 +1,32 @@
+From 4c75fae93d9515f3ecdfecc966b8c6471efb7ea5 Mon Sep 17 00:00:00 2001
+From: "R.E. Wolff" <R.E.Wolff@BitWizard.nl>
+Date: Tue, 16 Jun 2026 11:03:39 +0200
+Subject: [PATCH] =?UTF-8?q?Fixed=20possible=20buffer=20overrun=20in=20asn?=
+ =?UTF-8?q?=20code--=20Micha=C5=82=20Majchrowicz?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(cherry picked from commit 48e1794414d338ce47abc0f27c25ade8788af9c3)
+
+CVE: CVE-2026-14461
+Upstream-Status: Backport [https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ ui/asn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ui/asn.c b/ui/asn.c
+index 111c394..487d9e8 100644
+--- a/ui/asn.c
++++ b/ui/asn.c
+@@ -94,6 +94,8 @@ static char *ipinfo_lookup(
+ DEB_syslog(LOG_INFO, "Malloc-txt: %s", UNKN);
+ return xstrdup(UNKN);
+ }
++ // Clip len to PACKETSZ. -- Michał Majchrowicz
++ if (len > PACKETSZ) len = PACKETSZ;
+
+ pt = answer + sizeof(HEADER);
+
diff --git a/meta-networking/recipes-support/mtr/mtr_0.96.bb b/meta-networking/recipes-support/mtr/mtr_0.96.bb
index 9008223264..2716ca92aa 100644
--- a/meta-networking/recipes-support/mtr/mtr_0.96.bb
+++ b/meta-networking/recipes-support/mtr/mtr_0.96.bb
@@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
file://ui/mtr.c;beginline=5;endline=16;md5=00a894a39d53726a27386534d1c4e468"
SRCREV = "f392168771570b0fdc104c38dea6bbc2ce585710"
-SRC_URI = "git://github.com/traviscross/mtr;branch=master;protocol=https;tag=v${PV}"
+SRC_URI = "git://github.com/traviscross/mtr;branch=master;protocol=https;tag=v${PV} \
+ file://CVE-2026-14461.patch \
+"
inherit autotools pkgconfig
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-networking][blacksail][PATCH 39/44] ncp: ignore CVE-2025-14577 and CVE-2026-35087
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (36 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 38/44] mtr: patch CVE-2026-14461 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 40/44] libvncserver: patch CVE-2026-44988 ankur.tyagi85
` (4 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14577
https://nvd.nist.gov/vuln/detail/cve-2026-35087
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-support/ncp/ncp_1.2.4.bb | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta-networking/recipes-support/ncp/ncp_1.2.4.bb b/meta-networking/recipes-support/ncp/ncp_1.2.4.bb
index ec6d918744..19fb258aec 100644
--- a/meta-networking/recipes-support/ncp/ncp_1.2.4.bb
+++ b/meta-networking/recipes-support/ncp/ncp_1.2.4.bb
@@ -29,3 +29,6 @@ do_install() {
}
BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2025-14577] = "cpe-incorrect: This vulnerability is for Slican NCP"
+CVE_STATUS[CVE-2026-35087] = "cpe-incorrect: This vulnerability is for Slican NCP"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 40/44] libvncserver: patch CVE-2026-44988
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (37 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-networking][blacksail][PATCH 39/44] ncp: ignore CVE-2025-14577 and CVE-2026-35087 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 41/44] libvncserver: patch CVE-2026-32854 ankur.tyagi85
` (3 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-44988
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libvncserver/CVE-2026-44988.patch | 71 +++++++++++++++++++
.../libvncserver/libvncserver_0.9.15.bb | 1 +
2 files changed, 72 insertions(+)
create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch
new file mode 100644
index 0000000000..e26abc9db7
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-44988.patch
@@ -0,0 +1,71 @@
+From db5779f2bec717f577fb66321b3b079ff156da95 Mon Sep 17 00:00:00 2001
+From: Kang Hee chan <24s101h0659@sonline20.sen.go.kr>
+Date: Wed, 6 May 2026 21:48:54 +0900
+Subject: [PATCH] libvncclient: fix Tight gradient decoding overflow
+
+(cherry picked from commit 5b270544b85233668b98161323297d418a8f5fd1)
+
+CVE: CVE-2026-44988
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/5b270544b85233668b98161323297d418a8f5fd1]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ include/rfb/rfbclient.h | 3 ++-
+ src/libvncclient/tight.c | 10 +++++++---
+ 2 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/include/rfb/rfbclient.h b/include/rfb/rfbclient.h
+index a974ff5f..666dcb90 100644
+--- a/include/rfb/rfbclient.h
++++ b/include/rfb/rfbclient.h
+@@ -314,10 +314,11 @@ typedef struct _rfbClient {
+ rfbBool zlibStreamActive[4];
+
+ /* Filter stuff. Should be initialized by filter initialization code. */
++#define TIGHT_GRADIENT_MAX_WIDTH 2048
+ rfbBool cutZeros;
+ int rectWidth, rectColors;
+ char tightPalette[256*4];
+- uint8_t tightPrevRow[2048*3*sizeof(uint16_t)];
++ uint8_t tightPrevRow[TIGHT_GRADIENT_MAX_WIDTH*3*sizeof(uint16_t)];
+
+ #ifdef LIBVNCSERVER_HAVE_LIBJPEG
+ /** JPEG decoder state (obsolete-- do not use). */
+diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c
+index 57a3715b..dad5514f 100644
+--- a/src/libvncclient/tight.c
++++ b/src/libvncclient/tight.c
+@@ -229,6 +229,11 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+ bitsPixel = InitFilterPaletteBPP(client, rw, rh);
+ break;
+ case rfbTightFilterGradient:
++ if (rw > TIGHT_GRADIENT_MAX_WIDTH) {
++ rfbClientLog("Tight Gradient rectangle width %d exceeds maximum %d.\n",
++ rw, TIGHT_GRADIENT_MAX_WIDTH);
++ return FALSE;
++ }
+ filterFn = FilterGradientBPP;
+ bitsPixel = InitFilterGradientBPP(client, rw, rh);
+ break;
+@@ -430,7 +435,7 @@ FilterGradient24 (rfbClient* client, int srcx, int srcy, int numRows)
+ CARDBPP *dst =
+ (CARDBPP *)&client->frameBuffer[(srcy * client->width + srcx) * BPP / 8];
+ int x, y, c;
+- uint8_t thisRow[2048*3];
++ uint8_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3];
+ uint8_t pix[3];
+ int est[3];
+
+@@ -473,7 +478,7 @@ FilterGradientBPP (rfbClient* client, int srcx, int srcy, int numRows)
+ int x, y, c;
+ CARDBPP *src = (CARDBPP *)client->buffer;
+ uint16_t *thatRow = (uint16_t *)client->tightPrevRow;
+- uint16_t thisRow[2048*3];
++ uint16_t thisRow[TIGHT_GRADIENT_MAX_WIDTH*3];
+ uint16_t pix[3];
+ uint16_t max[3];
+ int shift[3];
+@@ -705,4 +710,3 @@ ReadCompactLen (rfbClient* client)
+ /* LIBVNCSERVER_HAVE_LIBZ and LIBVNCSERVER_HAVE_LIBJPEG */
+ #endif
+ #endif
+-
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index 77612e1626..47e42cd094 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -46,6 +46,7 @@ inherit cmake pkgconfig
SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \
file://0001-CMake-require-at-least-CMake-3.5.patch \
+ file://CVE-2026-44988.patch \
"
SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 41/44] libvncserver: patch CVE-2026-32854
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (38 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 40/44] libvncserver: patch CVE-2026-44988 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 42/44] libvncserver: patch CVE-2026-32853 ankur.tyagi85
` (2 subsequent siblings)
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32854
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libvncserver/CVE-2026-32854.patch | 66 +++++++++++++++++++
.../libvncserver/libvncserver_0.9.15.bb | 1 +
2 files changed, 67 insertions(+)
create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch
new file mode 100644
index 0000000000..85adf3eba2
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32854.patch
@@ -0,0 +1,66 @@
+From bf01ccc67bc8181568af2d1f6e1f6f6888b51bde Mon Sep 17 00:00:00 2001
+From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com>
+Date: Thu, 19 Mar 2026 17:42:00 +0900
+Subject: [PATCH] libvncserver: fix NULL pointer dereferences in httpd proxy
+ handlers
+
+httpProcessInput() passes the return value of strchr() to atoi()
+and strncmp() without checking for NULL. If a CONNECT request
+contains no colon, or a GET request contains no slash, strchr()
+returns NULL, leading to a segmentation fault.
+
+Add NULL checks before using the strchr() return values.
+
+(cherry picked from commit dc78dee51a7e270e537a541a17befdf2073f5314)
+
+CVE: CVE-2026-32854
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libvncserver/httpd.c | 24 ++++++++++++++----------
+ 1 file changed, 14 insertions(+), 10 deletions(-)
+
+diff --git a/src/libvncserver/httpd.c b/src/libvncserver/httpd.c
+index 2186ae54..604e5bf9 100644
+--- a/src/libvncserver/httpd.c
++++ b/src/libvncserver/httpd.c
+@@ -337,10 +337,11 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen)
+
+
+ /* Process the request. */
+- if(rfbScreen->httpEnableProxyConnect) {
++if(rfbScreen->httpEnableProxyConnect) {
+ const static char* PROXY_OK_STR = "HTTP/1.0 200 OK\r\nContent-Type: octet-stream\r\nPragma: no-cache\r\n\r\n";
+ if(!strncmp(buf, "CONNECT ", 8)) {
+- if(atoi(strchr(buf, ':')+1)!=rfbScreen->port) {
++ char *colon = strchr(buf, ':');
++ if(colon == NULL || atoi(colon+1)!=rfbScreen->port) {
+ rfbErr("httpd: CONNECT format invalid.\n");
+ rfbWriteExact(&cl,INVALID_REQUEST_STR, strlen(INVALID_REQUEST_STR));
+ httpCloseSock(rfbScreen);
+@@ -353,14 +354,17 @@ httpProcessInput(rfbScreenInfoPtr rfbScreen)
+ rfbScreen->httpSock = RFB_INVALID_SOCKET;
+ return;
+ }
+- if (!strncmp(buf, "GET ",4) && !strncmp(strchr(buf,'/'),"/proxied.connection HTTP/1.", 27)) {
+- /* proxy connection */
+- rfbLog("httpd: client asked for /proxied.connection\n");
+- rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR));
+- rfbNewClientConnection(rfbScreen,rfbScreen->httpSock);
+- rfbScreen->httpSock = RFB_INVALID_SOCKET;
+- return;
+- }
++ if (!strncmp(buf, "GET ",4)) {
++ char *slash = strchr(buf, '/');
++ if (slash != NULL && !strncmp(slash,"/proxied.connection HTTP/1.", 27)) {
++ /* proxy connection */
++ rfbLog("httpd: client asked for /proxied.connection\n");
++ rfbWriteExact(&cl,PROXY_OK_STR,strlen(PROXY_OK_STR));
++ rfbNewClientConnection(rfbScreen,rfbScreen->httpSock);
++ rfbScreen->httpSock = RFB_INVALID_SOCKET;
++ return;
++ }
++ }
+ }
+
+ if (strncmp(buf, "GET ", 4)) {
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index 47e42cd094..9fbec58c72 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -47,6 +47,7 @@ inherit cmake pkgconfig
SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag=LibVNCServer-${PV} \
file://0001-CMake-require-at-least-CMake-3.5.patch \
file://CVE-2026-44988.patch \
+ file://CVE-2026-32854.patch \
"
SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 42/44] libvncserver: patch CVE-2026-32853
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (39 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 41/44] libvncserver: patch CVE-2026-32854 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 43/44] libvncserver: patch CVE-2026-50538 ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 44/44] swagger-ui: upgrade 5.33.2 -> 5.33.3 ankur.tyagi85
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-32853
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libvncserver/CVE-2026-32853.patch | 76 +++++++++++++++++++
.../libvncserver/libvncserver_0.9.15.bb | 1 +
2 files changed, 77 insertions(+)
create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch
new file mode 100644
index 0000000000..23d6a3df1f
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-32853.patch
@@ -0,0 +1,76 @@
+From 4d5c0ea960e4a22cd8b8fb3c6e18b5a1b1797783 Mon Sep 17 00:00:00 2001
+From: Kazuma Matsumoto <269371721+y637F9QQ2x@users.noreply.github.com>
+Date: Sun, 22 Mar 2026 20:35:49 +0100
+Subject: [PATCH] libvncclient: add bounds checks to UltraZip subrectangle
+ parsing
+
+HandleUltraZipBPP() iterates over sub-rectangles using numCacheRects
+(derived from the attacker-controlled rect.r.x) without validating
+that the pointer stays within the decompressed data buffer. A malicious
+server can set a large numCacheRects value, causing heap out-of-bounds
+reads via the memcpy calls in the parsing loop.
+
+Add bounds checks before reading the 12-byte subrect header and before
+advancing the pointer by the raw pixel data size. Use uint64_t for the
+raw data size calculation to prevent integer overflow on 32-bit platforms.
+
+(cherry picked from commit 009008e2f4d5a54dd71f422070df3af7b3dbc931)
+
+CVE: CVE-2026-32853
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libvncclient/ultra.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/src/libvncclient/ultra.c b/src/libvncclient/ultra.c
+index 1d3aaba6..5633b8cb 100644
+--- a/src/libvncclient/ultra.c
++++ b/src/libvncclient/ultra.c
+@@ -126,6 +126,7 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+ int toRead=0;
+ int inflateResult=0;
+ unsigned char *ptr=NULL;
++ unsigned char *ptr_end=NULL;
+ lzo_uint uncompressedBytes = ry + (rw * 65535);
+ unsigned int numCacheRects = rx;
+
+@@ -194,11 +195,18 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+
+ /* Put the uncompressed contents of the update on the screen. */
+ ptr = (unsigned char *)client->raw_buffer;
++ ptr_end = ptr + uncompressedBytes;
+ for (i=0; i<numCacheRects; i++)
+ {
+ unsigned short sx, sy, sw, sh;
+ unsigned int se;
+
++ /* subrect header: sx(2) + sy(2) + sw(2) + sh(2) + se(4) = 12 bytes */
++ if (ptr + 12 > ptr_end) {
++ rfbClientLog("UltraZip: subrect %d header exceeds decompressed data bounds\n", i);
++ return FALSE;
++ }
++
+ memcpy((char *)&sx, ptr, 2); ptr += 2;
+ memcpy((char *)&sy, ptr, 2); ptr += 2;
+ memcpy((char *)&sw, ptr, 2); ptr += 2;
+@@ -213,8 +221,13 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+
+ if (se == rfbEncodingRaw)
+ {
++ uint64_t rawBytes = (uint64_t)sw * sh * (BPP / 8);
++ if (rawBytes > (size_t)(ptr_end - ptr)) {
++ rfbClientLog("UltraZip: subrect %d raw data exceeds decompressed data bounds\n", i);
++ return FALSE;
++ }
+ client->GotBitmap(client, (unsigned char *)ptr, sx, sy, sw, sh);
+- ptr += ((sw * sh) * (BPP / 8));
++ ptr += (size_t)rawBytes;
+ }
+ }
+
+@@ -222,3 +235,4 @@ HandleUltraZipBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+ }
+
+ #undef CARDBPP
++
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index 9fbec58c72..e2f995947f 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -48,6 +48,7 @@ SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag
file://0001-CMake-require-at-least-CMake-3.5.patch \
file://CVE-2026-44988.patch \
file://CVE-2026-32854.patch \
+ file://CVE-2026-32853.patch \
"
SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-oe][blacksail][PATCH 43/44] libvncserver: patch CVE-2026-50538
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (40 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 42/44] libvncserver: patch CVE-2026-32853 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
2026-10-21 9:28 ` [oe][meta-webserver][blacksail][PATCH 44/44] swagger-ui: upgrade 5.33.2 -> 5.33.3 ankur.tyagi85
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50538
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libvncserver/CVE-2026-50538.patch | 49 +++++++++++++++++++
.../libvncserver/libvncserver_0.9.15.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch
new file mode 100644
index 0000000000..da01736323
--- /dev/null
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver/CVE-2026-50538.patch
@@ -0,0 +1,49 @@
+From e824e7d8ea71feccb81aeb34771eb83e052c3fe2 Mon Sep 17 00:00:00 2001
+From: "Bas.Levering" <45083161+Bazskillz@users.noreply.github.com>
+Date: Fri, 29 May 2026 09:08:28 +0200
+Subject: [PATCH] Merge commit from fork
+
+HandleTightBPP's basic-compression loop wrote each batch of decompressed
+rows straight into client->frameBuffer (via FilterCopy/Palette/Gradient)
+and only compared the running total against the rectangle height rh after
+the loop. A malicious or man-in-the-middle server can send a zlib stream
+that decompresses to more rows than rh, so the writes run past the end of
+the framebuffer allocation: an attacker-controlled heap out-of-bounds
+write reachable in a default build (Tight is advertised when built with
+libz+libjpeg), pre-authentication, from one FramebufferUpdate.
+
+Clamp numRows to the remaining height before calling filterFn, matching
+the existing house style (trle.c and the Tight JPEG path already clamp to
+the rectangle height).
+
+Co-authored-by: Bas Levering <basdaniel3@gmail.com>
+(cherry picked from commit 540332be3e0acc566fa64da6f1b4680c72c724dd)
+
+CVE: CVE-2026-50538
+Upstream-Status: Backport [https://github.com/LibVNC/libvncserver/commit/540332be3e0acc566fa64da6f1b4680c72c724dd]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libvncclient/tight.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/libvncclient/tight.c b/src/libvncclient/tight.c
+index dad5514f..3ee0d5e0 100644
+--- a/src/libvncclient/tight.c
++++ b/src/libvncclient/tight.c
+@@ -341,6 +341,16 @@ HandleTightBPP (rfbClient* client, int rx, int ry, int rw, int rh)
+
+ numRows = (bufferSize - zs->avail_out) / rowSize;
+
++ /* The decompressed stream is server-controlled and may yield more rows
++ than the rectangle's declared height. filterFn() writes directly into
++ client->frameBuffer, so clamp here before writing to avoid running past
++ the framebuffer (heap out-of-bounds write). The post-loop
++ "rowsProcessed != rh" check happens too late. */
++ if (numRows > rh - rowsProcessed) {
++ rfbClientLog("Tight: too many scan lines after decompression.\n");
++ return FALSE;
++ }
++
+ filterFn(client, rx, ry+rowsProcessed, numRows);
+
+ extraBytes = bufferSize - zs->avail_out - numRows * rowSize;
diff --git a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
index e2f995947f..ff7327c6cf 100644
--- a/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
+++ b/meta-oe/recipes-graphics/libvncserver/libvncserver_0.9.15.bb
@@ -49,6 +49,7 @@ SRC_URI = "git://github.com/LibVNC/libvncserver;branch=master;protocol=https;tag
file://CVE-2026-44988.patch \
file://CVE-2026-32854.patch \
file://CVE-2026-32853.patch \
+ file://CVE-2026-50538.patch \
"
SRCREV = "9b54b1ec32731bd23158ca014dc18014db4194c3"
^ permalink raw reply related [flat|nested] 47+ messages in thread* [oe][meta-webserver][blacksail][PATCH 44/44] swagger-ui: upgrade 5.33.2 -> 5.33.3
2026-10-21 9:28 [oe][meta-networking][blacksail][PATCH 1/44] zeroconf: ignore CVEs ankur.tyagi85
` (41 preceding siblings ...)
2026-10-21 9:28 ` [oe][meta-oe][blacksail][PATCH 43/44] libvncserver: patch CVE-2026-50538 ankur.tyagi85
@ 2026-10-21 9:28 ` ankur.tyagi85
42 siblings, 0 replies; 47+ messages in thread
From: ankur.tyagi85 @ 2026-10-21 9:28 UTC (permalink / raw)
To: openembedded-devel; +Cc: Ankur Tyagi, Khem Raj
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 67b4387a4d9f2fbc111b52ec6cd3b7620116c6d1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../swagger-ui/{swagger-ui_5.33.2.bb => swagger-ui_5.33.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.2.bb => swagger-ui_5.33.3.bb} (94%)
diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.3.bb
similarity index 94%
rename from meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
rename to meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.3.bb
index aeee9e4da6..6f69070033 100644
--- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.2.bb
+++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.3.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=main;protocol=https;tag=v${PV}"
-SRCREV = "e89a91f13cdee432d97ca9d3d1ac1969ff797036"
+SRCREV = "38ca10e1867a66525751590d8d51011973107ad1"
CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1"
^ permalink raw reply related [flat|nested] 47+ messages in thread