* [OE-core][kirkstone 00/10] Patch review
@ 2023-08-03 14:04 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2023-08-03 14:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Saturday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5680
The following changes since commit dc2e760591c5ed3c999222f235484829426c71a7:
util-linux: add alternative links for ipcs,ipcrm (2023-07-31 08:12:27 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (3):
qemu: fix CVE-2023-3301
qemu: fix CVE-2023-3255
qemu: fix CVE-2023-2861
Peter Marko (3):
libpcre2: patch CVE-2022-41409
libarchive: ignore CVE-2023-30571
openssl: Upgrade 3.0.9 -> 3.0.10
Sakib Sajal (2):
go: fix CVE-2023-24536
go: fix CVE-2023-24531
Sundeep KOKKONDA (1):
gcc : upgrade to v11.4
Yuta Hayama (1):
cve-update-nvd2-native: always pass str for json.loads()
meta/conf/distro/include/maintainers.inc | 2 +-
.../{openssl_3.0.9.bb => openssl_3.0.10.bb} | 2 +-
.../meta/cve-update-nvd2-native.bb | 2 +-
.../gcc/{gcc-11.3.inc => gcc-11.4.inc} | 6 +-
...ian_11.3.bb => gcc-cross-canadian_11.4.bb} | 0
.../{gcc-cross_11.3.bb => gcc-cross_11.4.bb} | 0
...-crosssdk_11.3.bb => gcc-crosssdk_11.4.bb} | 0
...cc-runtime_11.3.bb => gcc-runtime_11.4.bb} | 0
...itizers_11.3.bb => gcc-sanitizers_11.4.bb} | 0
...{gcc-source_11.3.bb => gcc-source_11.4.bb} | 0
...rch64-Update-Neoverse-N2-core-defini.patch | 20 +-
...rm-add-armv9-a-architecture-to-march.patch | 54 +--
...AMIC_LINKER-and-UCLIBC_DYNAMIC_LINKE.patch | 102 ++---
...s-fix-v4bx-to-linker-to-support-EABI.patch | 6 +-
.../gcc/{gcc_11.3.bb => gcc_11.4.bb} | 0
...initial_11.3.bb => libgcc-initial_11.4.bb} | 0
.../gcc/{libgcc_11.3.bb => libgcc_11.4.bb} | 0
...ibgfortran_11.3.bb => libgfortran_11.4.bb} | 0
meta/recipes-devtools/go/go-1.17.13.inc | 7 +-
.../go/go-1.19/CVE-2023-24536_1.patch | 137 +++++++
.../go/go-1.19/CVE-2023-24536_2.patch | 187 ++++++++++
.../go/go-1.19/CVE-2023-24536_3.patch | 349 ++++++++++++++++++
.../go/go-1.21/CVE-2023-24531_1.patch | 252 +++++++++++++
.../go/go-1.21/CVE-2023-24531_2.patch | 47 +++
meta/recipes-devtools/qemu/qemu.inc | 3 +
.../qemu/qemu/CVE-2023-2861.patch | 172 +++++++++
.../qemu/qemu/CVE-2023-3255.patch | 64 ++++
.../qemu/qemu/CVE-2023-3301.patch | 60 +++
.../libarchive/libarchive_3.6.2.bb | 3 +
.../libpcre/libpcre2/CVE-2022-41409.patch | 75 ++++
.../recipes-support/libpcre/libpcre2_10.40.bb | 1 +
31 files changed, 1451 insertions(+), 100 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl_3.0.9.bb => openssl_3.0.10.bb} (99%)
rename meta/recipes-devtools/gcc/{gcc-11.3.inc => gcc-11.4.inc} (97%)
rename meta/recipes-devtools/gcc/{gcc-cross-canadian_11.3.bb => gcc-cross-canadian_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-cross_11.3.bb => gcc-cross_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-crosssdk_11.3.bb => gcc-crosssdk_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-runtime_11.3.bb => gcc-runtime_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-sanitizers_11.3.bb => gcc-sanitizers_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc-source_11.3.bb => gcc-source_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{gcc_11.3.bb => gcc_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc-initial_11.3.bb => libgcc-initial_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{libgcc_11.3.bb => libgcc_11.4.bb} (100%)
rename meta/recipes-devtools/gcc/{libgfortran_11.3.bb => libgfortran_11.4.bb} (100%)
create mode 100644 meta/recipes-devtools/go/go-1.19/CVE-2023-24536_1.patch
create mode 100644 meta/recipes-devtools/go/go-1.19/CVE-2023-24536_2.patch
create mode 100644 meta/recipes-devtools/go/go-1.19/CVE-2023-24536_3.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2023-24531_1.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2023-24531_2.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-2861.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-3255.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2023-3301.patch
create mode 100644 meta/recipes-support/libpcre/libpcre2/CVE-2022-41409.patch
--
2.34.1
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2023-10-03 19:36 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2023-10-03 19:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for kirkstone and have comments back by
end of day Thursday, October 5
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5984
except for the meta-aws test, which breaks due to recent commits there. Maintainer notified.
The following changes since commit 7e177848f97eb9958619c28b5e5dadee12f67507:
kernel.bbclass: Add force flag to rm calls (2023-09-27 06:09:46 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Bruce Ashfield (5):
linux-yocto/5.10: update to v5.10.189
linux-yocto/5.10: update to v5.10.191
linux-yocto/5.10: update to v5.10.192
linux-yocto/5.10: update to v5.10.194
linux-yocto/5.10: update to v5.10.197
Martin Jansa (2):
ccache: fix build with gcc-13
fontcache.bbclass: avoid native recipes depending on target fontconfig
Narpat Mali (1):
python3-jinja2: fix for the ptest result format
Peter Marko (1):
json-c: define CVE_VERSION
Shubham Kulkarni (1):
go: Update fix for CVE-2023-24538 & CVE-2023-39318
meta/classes/fontcache.bbclass | 1 +
...x-FTBFS-with-not-yet-released-GCC-13.patch | 92 +++
meta/recipes-devtools/ccache/ccache_4.6.bb | 4 +-
meta/recipes-devtools/go/go-1.17.13.inc | 3 +-
.../go/go-1.18/CVE-2023-24538_1.patch | 597 ++++++++++++++++++
...023-24538.patch => CVE-2023-24538_2.patch} | 175 ++++-
.../go/go-1.21/CVE-2023-39318.patch | 44 +-
meta/recipes-devtools/json-c/json-c_0.15.bb | 3 +
.../python/python3-jinja2/run-ptest | 2 +-
.../linux/linux-yocto-rt_5.10.bb | 6 +-
.../linux/linux-yocto-tiny_5.10.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.10.bb | 24 +-
12 files changed, 921 insertions(+), 38 deletions(-)
create mode 100644 meta/recipes-devtools/ccache/ccache/0001-build-Fix-FTBFS-with-not-yet-released-GCC-13.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2023-24538_1.patch
rename meta/recipes-devtools/go/go-1.18/{CVE-2023-24538.patch => CVE-2023-24538_2.patch} (53%)
--
2.34.1
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2023-10-18 15:48 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2023-10-18 15:48 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, October 20
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6064
with the exception of a known vim reproducibilty error in the vim-common
package where depending on worker we are seeing either:
"Content-Type:·text/plain;·charset=CP1251\n"
or
"Content-Type:·text/plain;·charset=cp1251\n"
The issue is still under investigation, but is unrelated to this patch set.
The following changes since commit 2572b32e729831762790ebfbf930a1140657faea:
apt: add missing <cstdint> for uint16_t (2023-10-13 05:32:41 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Armin Kuster (1):
binutils: CVE-2022-48063
Chaitanya Vadrevu (3):
binutils: Fix CVE-2022-47695
binutils: Mark CVE-2022-47673 as patched
binutils: Mark CVE-2022-47696 as patched
Deepthi Hemraj (2):
binutils: Fix CVE-2022-47008
binutils: Fix CVE-2022-47011
Hitendra Prajapati (1):
libtiff: Add fix for tiffcrop CVE-2023-1916
Quentin Schulz (1):
uboot-extlinux-config.bbclass: fix missed override syntax migration
Siddharth Doshi (2):
tiff: Security fix for CVE-2023-40745
libxpm: upgrade to 3.5.17
meta/classes/uboot-extlinux-config.bbclass | 2 +-
.../binutils/binutils-2.38.inc | 4 +
.../binutils/0022-CVE-2023-25584-3.patch | 2 +
.../binutils/0025-CVE-2023-25588.patch | 2 +
.../binutils/0027-CVE-2022-47008.patch | 67 +++++++++++++
.../binutils/0028-CVE-2022-47011.patch | 35 +++++++
.../binutils/0031-CVE-2022-47695.patch | 58 +++++++++++
.../binutils/binutils/CVE-2022-48063.patch | 48 +++++++++
.../{libxpm_3.5.16.bb => libxpm_3.5.17.bb} | 2 +-
.../libtiff/tiff/CVE-2023-1916.patch | 99 +++++++++++++++++++
.../libtiff/tiff/CVE-2023-40745.patch | 34 +++++++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 2 +
12 files changed, 353 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0027-CVE-2022-47008.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0028-CVE-2022-47011.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0031-CVE-2022-47695.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2022-48063.patch
rename meta/recipes-graphics/xorg-lib/{libxpm_3.5.16.bb => libxpm_3.5.17.bb} (88%)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-1916.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-40745.patch
--
2.34.1
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2024-04-16 12:06 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2024-04-16 12:06 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, April 18
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6811
The following changes since commit 26a878cbfbb3bc7a6e892e105577ebf8138ce150:
common-licenses: Backport missing license (2024-04-02 08:04:42 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alex Stewart (1):
perl: ignore CVE-2023-47100
Jonathan GUILLOT (1):
cups: fix typo in CVE-2023-32360 backport patch
Khem Raj (1):
tcl: Add a way to skip ptests
Peter Marko (2):
openssl: patch CVE-2024-2511
ncurses: patch CVE-2023-50495
Ross Burton (2):
tcl: skip timing-dependent tests in run-ptest
tcl: skip async and event tests in run-ptest
Sana Kazi (1):
openssh: Add CVE-2023-51767 to CVE_CHECK_IGNORE
Steve Sakoman (1):
Revert "expat: fix CVE-2023-52425"
Vijay Anusuri (1):
xserver-xorg: Fix for CVE-2024-31080 and CVE-2024-31081
.../openssh/openssh_8.9p1.bb | 5 +
.../openssl/openssl/CVE-2024-2511.patch | 122 ++++++++++
.../openssl/openssl_3.0.13.bb | 1 +
.../expat/expat/CVE-2023-52425-0001.patch | 40 ----
.../expat/expat/CVE-2023-52425-0002.patch | 87 -------
.../expat/expat/CVE-2023-52425-0003.patch | 222 ------------------
.../expat/expat/CVE-2023-52425-0004.patch | 42 ----
.../expat/expat/CVE-2023-52425-0005.patch | 69 ------
.../expat/expat/CVE-2023-52425-0006.patch | 67 ------
.../expat/expat/CVE-2023-52425-0007.patch | 159 -------------
.../expat/expat/CVE-2023-52425-0008.patch | 95 --------
.../expat/expat/CVE-2023-52425-0009.patch | 52 ----
.../expat/expat/CVE-2023-52425-0010.patch | 111 ---------
.../expat/expat/CVE-2023-52425-0011.patch | 89 -------
.../expat/expat/CVE-2023-52425-0012.patch | 87 -------
meta/recipes-core/expat/expat_2.5.0.bb | 12 -
.../ncurses/files/CVE-2023-50495.patch | 81 +++++++
.../ncurses/ncurses_6.3+20220423.bb | 1 +
meta/recipes-devtools/perl/perl_5.34.3.bb | 3 +
meta/recipes-devtools/tcltk/tcl/run-ptest | 6 +-
meta/recipes-devtools/tcltk/tcl_8.6.11.bb | 5 +
.../cups/cups/CVE-2023-32360.patch | 2 +-
.../xserver-xorg/CVE-2024-31080.patch | 49 ++++
.../xserver-xorg/CVE-2024-31081.patch | 47 ++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 2 +
25 files changed, 322 insertions(+), 1134 deletions(-)
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2024-2511.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0001.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0002.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0003.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0004.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0005.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0006.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0007.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0008.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0009.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0010.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0011.patch
delete mode 100644 meta/recipes-core/expat/expat/CVE-2023-52425-0012.patch
create mode 100644 meta/recipes-core/ncurses/files/CVE-2023-50495.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31080.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31081.patch
--
2.34.1
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2025-04-08 20:50 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-04-08 20:50 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, April 10
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1367
The following changes since commit 1efbe1004bc82e7c14c1e8bd4ce644f5015c3346:
build-appliance-image: Update to kirkstone head revision (2025-04-04 08:43:24 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Haixiao Yan (1):
glibc: Add single-threaded fast path to rand()
Peter Marko (2):
ofono: patch CVE-2024-7537
qemu: ignore CVE-2023-1386
Vijay Anusuri (6):
ghostscript: Fix CVE-2025-27830
ghostscript: Fix CVE-2025-27831
ghostscript: Fix CVE-2025-27832
ghostscript: Fix CVE-2025-27834
ghostscript: Fix CVE-2025-27835
ghostscript: Fix CVE-2025-27836
Yogita Urade (1):
curl: ignore CVE-2025-0725
.../ofono/ofono/CVE-2024-7537.patch | 59 +++++++++++++
meta/recipes-connectivity/ofono/ofono_1.34.bb | 1 +
...dd-single-threaded-fast-path-to-rand.patch | 47 +++++++++++
meta/recipes-core/glibc/glibc_2.35.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 3 +
.../ghostscript/CVE-2025-27830.patch | 79 +++++++++++++++++
.../ghostscript/CVE-2025-27831-pre1.patch | 50 +++++++++++
.../ghostscript/CVE-2025-27831.patch | 84 +++++++++++++++++++
.../ghostscript/CVE-2025-27832.patch | 45 ++++++++++
.../ghostscript/CVE-2025-27834.patch | 57 +++++++++++++
.../ghostscript/CVE-2025-27835.patch | 34 ++++++++
.../ghostscript/CVE-2025-27836-1.patch | 64 ++++++++++++++
.../ghostscript/CVE-2025-27836-2.patch | 46 ++++++++++
.../ghostscript/ghostscript_9.55.0.bb | 8 ++
meta/recipes-support/curl/curl_7.82.0.bb | 2 +
15 files changed, 580 insertions(+)
create mode 100644 meta/recipes-connectivity/ofono/ofono/CVE-2024-7537.patch
create mode 100644 meta/recipes-core/glibc/glibc/0001-stdlib-Add-single-threaded-fast-path-to-rand.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27830.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27831-pre1.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27831.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27832.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27834.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27835.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27836-1.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2025-27836-2.patch
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2025-05-30 15:39 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-05-30 15:39 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, June 3
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1684
The following changes since commit a99a65632116955dc69809a14bf536b22582de72:
gcc: AArch64 - Fix strict-align cpymem/setmem (2025-05-23 08:27:24 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Bruce Ashfield (5):
linux-yocto/5.15: update to v5.15.180
linux-yocto/5.15: update to v5.15.181
linux-yocto/5.15: update to v5.15.182
linux-yocto/5.15: update to v5.15.183
linux-yocto/5.15: update to v5.15.184
Guocai He (1):
sysstat: correct the SRC_URI
Harish Sadineni (2):
binutils: Fix CVE-2025-1182
binutils: fix CVE-2025-1180
Hitendra Prajapati (1):
screen: Fix CVE-2025-46805
NeilBrown (1):
nfs-utils: don't use signals to shut down nfs server.
.../nfs-utils/nfs-utils/nfsserver | 28 +--
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0040-CVE-2025-1180.patch | 164 ++++++++++++++++++
.../binutils/0040-CVE-2025-1182.patch | 31 ++++
.../screen/screen/CVE-2025-46805.patch | 121 +++++++++++++
meta/recipes-extended/screen/screen_4.9.0.bb | 1 +
meta/recipes-extended/sysstat/sysstat.inc | 6 +-
.../linux/linux-yocto-rt_5.15.bb | 6 +-
.../linux/linux-yocto-tiny_5.15.bb | 6 +-
meta/recipes-kernel/linux/linux-yocto_5.15.bb | 26 +--
10 files changed, 344 insertions(+), 46 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0040-CVE-2025-1180.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0040-CVE-2025-1182.patch
create mode 100644 meta/recipes-extended/screen/screen/CVE-2025-46805.patch
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2025-07-27 20:04 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-07-27 20:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, July 29
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2092
The following changes since commit d9f424921179a52ffe053411c44f20e44e7deba1:
tcf-agent: correct the SRC_URI (2025-07-15 06:42:30 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Aleksandar Nikolic (1):
scripts/install-buildtools: Update to 4.0.28
Daniel Díaz (1):
ffmpeg: Ignore two CVEs fixed in 5.0.3
Deepesh Varatharajan (1):
glibc: stable 2.35 branch updates
Hitendra Prajapati (1):
libpam: fix CVE-2025-6020
Martin Jansa (1):
db: ignore implicit-int and implicit-function-declaration issues fatal
with gcc-14
Peter Marko (2):
orc: set CVE_PRODUCT
ncurses: patch CVE-2025-6141
Rob Woolley (1):
ruby: correct fix for CVE-2024-43398
Yash Shinde (1):
binutils: Fix CVE-2025-7546
Yogita Urade (1):
gnupg: fix CVE-2025-30258
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../glibc/glibc/0025-CVE-2025-4802.patch | 3 +-
meta/recipes-core/glibc/glibc_2.35.bb | 2 +-
.../ncurses/files/CVE-2025-6141.patch | 25 +
.../ncurses/ncurses_6.3+20220423.bb | 1 +
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0043-CVE-2025-7546.patch | 44 +
meta/recipes-devtools/orc/orc_0.4.40.bb | 3 +
.../ruby/ruby/CVE-2024-43398-0001.patch | 212 +++
.../ruby/ruby/CVE-2024-43398-0002.patch | 130 ++
...-43398.patch => CVE-2024-43398-0003.patch} | 23 +-
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 4 +-
...001-pam_inline-introduce-pam_asprint.patch | 102 ++
.../0001-pam_namespace-include-stdint-h.patch | 42 +
.../pam/libpam/CVE-2025-6020-01.patch | 1588 +++++++++++++++++
.../pam/libpam/CVE-2025-6020-02.patch | 187 ++
.../pam/libpam/CVE-2025-6020-03.patch | 35 +
meta/recipes-extended/pam/libpam_1.5.2.bb | 5 +
.../recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb | 6 +
meta/recipes-support/db/db_5.3.28.bb | 4 +
.../gnupg/gnupg/CVE-2025-30258-0001.patch | 141 ++
.../gnupg/gnupg/CVE-2025-30258-0002.patch | 131 ++
.../gnupg/gnupg/CVE-2025-30258-0003.patch | 624 +++++++
.../gnupg/gnupg/CVE-2025-30258-0004.patch | 193 ++
.../gnupg/gnupg/CVE-2025-30258-0005.patch | 36 +
meta/recipes-support/gnupg/gnupg_2.3.7.bb | 5 +
scripts/install-buildtools | 4 +-
27 files changed, 3534 insertions(+), 19 deletions(-)
create mode 100644 meta/recipes-core/ncurses/files/CVE-2025-6141.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7546.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-43398-0001.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-43398-0002.patch
rename meta/recipes-devtools/ruby/ruby/{CVE-2024-43398.patch => CVE-2024-43398-0003.patch} (87%)
create mode 100644 meta/recipes-extended/pam/libpam/0001-pam_inline-introduce-pam_asprint.patch
create mode 100644 meta/recipes-extended/pam/libpam/0001-pam_namespace-include-stdint-h.patch
create mode 100644 meta/recipes-extended/pam/libpam/CVE-2025-6020-01.patch
create mode 100644 meta/recipes-extended/pam/libpam/CVE-2025-6020-02.patch
create mode 100644 meta/recipes-extended/pam/libpam/CVE-2025-6020-03.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2025-30258-0001.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2025-30258-0002.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2025-30258-0003.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2025-30258-0004.patch
create mode 100644 meta/recipes-support/gnupg/gnupg/CVE-2025-30258-0005.patch
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2025-07-30 19:05 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-07-30 19:05 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, August 1
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2113
The following changes since commit 277b5ec3c0212ca8600dd89d0a33f784a060131f:
db: ignore implicit-int and implicit-function-declaration issues fatal with gcc-14 (2025-07-25 08:37:09 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Deepesh Varatharajan (1):
binutils: Fix CVE-2025-7545
Peter Marko (8):
dropbear: patch CVE-2025-47203
gnutls: patch CVE-2025-32989
gnutls: patch read buffer overrun in the "pre_shared_key" extension
gnutls: patch reject zero-length version in certificate request
gnutls: patch CVE-2025-32988
gnutls: patch CVE-2025-32990
gnutls: patch CVE-2025-6395
libxml2: patch CVE-2025-6170
Vijay Anusuri (1):
sqlite3: Fix CVE-2025-6965
meta/recipes-core/dropbear/dropbear.inc | 3 +
..._snprintf-that-won-t-return-negative.patch | 48 +
...-length-paths-and-commands-in-multih.patch | 126 +
.../dropbear/dropbear/CVE-2025-47203.patch | 344 +++
.../libxml/libxml2/CVE-2025-6170.patch | 103 +
meta/recipes-core/libxml/libxml2_2.9.14.bb | 1 +
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0043-CVE-2025-7545.patch | 39 +
...fer-overrun-in-the-pre_shared_key-ex.patch | 34 +
...-length-version-in-certificate-reque.patch | 37 +
.../04939b75417cc95b7372c6f208c4bda4579bdc34 | Bin 0 -> 1782 bytes
.../3e94dcdff862ef5d6db8b5cc8e59310b5f0cdfe2 | Bin 0 -> 830 bytes
.../5477db1bb507a35e8833c758ce344f4b5b246d8e | Bin 0 -> 111 bytes
.../gnutls/gnutls/CVE-2025-32988.patch | 58 +
.../gnutls/gnutls/CVE-2025-32989.patch | 50 +
.../gnutls/gnutls/CVE-2025-32990.patch | 2109 +++++++++++++++++
.../gnutls/gnutls/CVE-2025-6395.patch | 299 +++
meta/recipes-support/gnutls/gnutls_3.7.4.bb | 15 +
.../sqlite/files/CVE-2025-6965.patch | 115 +
meta/recipes-support/sqlite/sqlite3_3.38.5.bb | 1 +
20 files changed, 3383 insertions(+)
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Add-m_snprintf-that-won-t-return-negative.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/0001-Handle-arbitrary-length-paths-and-commands-in-multih.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2025-47203.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2025-6170.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0043-CVE-2025-7545.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/0001-psk-fix-read-buffer-overrun-in-the-pre_shared_key-ex.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/0001-x509-reject-zero-length-version-in-certificate-reque.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/04939b75417cc95b7372c6f208c4bda4579bdc34
create mode 100644 meta/recipes-support/gnutls/gnutls/3e94dcdff862ef5d6db8b5cc8e59310b5f0cdfe2
create mode 100644 meta/recipes-support/gnutls/gnutls/5477db1bb507a35e8833c758ce344f4b5b246d8e
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-32988.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-32989.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-32990.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-6395.patch
create mode 100644 meta/recipes-support/sqlite/files/CVE-2025-6965.patch
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2025-11-13 21:47 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 01/10] curl: ignore CVE-2025-10966 Steve Sakoman
` (9 more replies)
0 siblings, 10 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Monday, November 17
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2720
The following changes since commit 1e1993b72f2b6109ce3d0ef950553b74b2b37b27:
Don't use ftp.gnome.org (2025-11-03 09:18:14 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (2):
xf86-video-intel: correct SRC_URI as freedesktop anongit is down
goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task
signatures
Gyorgy Sarvari (2):
efibootmgr: update SRC_URI branch
babeltrace2: fetch with https protocol
Peter Marko (1):
curl: ignore CVE-2025-10966
Saquib Iltaf (1):
rust-cross-canadian: Ignore CVE-2024-43402
Soumya Sambu (1):
python3-urllib3: Upgrade 1.26.18 -> 1.26.20
Vijay Anusuri (3):
xserver-xorg: Fix for CVE-2025-62229
xserver-xorg: Fix for CVE-2025-62230
xserver-xorg: Fix for CVE-2025-62231
meta/classes/goarch.bbclass | 3 +
meta/recipes-bsp/efibootmgr/efibootmgr_17.bb | 2 +-
..._1.26.18.bb => python3-urllib3_1.26.20.bb} | 2 +-
.../rust/rust-cross-canadian.inc | 2 +
.../xorg-driver/xf86-video-intel_git.bb | 3 +-
.../xserver-xorg/CVE-2025-62229.patch | 89 ++++++++++++++++++
.../xserver-xorg/CVE-2025-62230-1.patch | 63 +++++++++++++
.../xserver-xorg/CVE-2025-62230-2.patch | 92 +++++++++++++++++++
.../xserver-xorg/CVE-2025-62231.patch | 53 +++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 4 +
.../recipes-kernel/lttng/babeltrace2_2.0.5.bb | 2 +-
meta/recipes-support/curl/curl_7.82.0.bb | 2 +
12 files changed, 312 insertions(+), 5 deletions(-)
rename meta/recipes-devtools/python/{python3-urllib3_1.26.18.bb => python3-urllib3_1.26.20.bb} (87%)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62229.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-1.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-2.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62231.patch
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 01/10] curl: ignore CVE-2025-10966
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 02/10] rust-cross-canadian: Ignore CVE-2024-43402 Steve Sakoman
` (8 subsequent siblings)
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Per [1] this CVE applies only when wolfssl backed is used.
8.17.0 removed WolfSSL support completely.
[1] https://curl.se/docs/CVE-2025-10966.html
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/curl/curl_7.82.0.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index 54362e6978..2326392a4f 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -79,6 +79,8 @@ CVE_CHECK_IGNORE += "CVE-2023-42915"
CVE_CHECK_IGNORE += "CVE-2024-32928"
# ignored: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older
CVE_CHECK_IGNORE += "CVE-2025-0725"
+# not-applicable-config: applicable only with wolfssl
+CVE_CHECK_IGNORE += "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'CVE-2025-10966','',d)}"
inherit autotools pkgconfig binconfig multilib_header
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 02/10] rust-cross-canadian: Ignore CVE-2024-43402
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 01/10] curl: ignore CVE-2025-10966 Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 03/10] xserver-xorg: Fix for CVE-2025-62229 Steve Sakoman
` (7 subsequent siblings)
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Saquib Iltaf <saquibiltaf@gmail.com>
Ignore CVE-2024-43402 as its not applicable.
CVEs are specific to Microsoft Windows.
Signed-off-by: Saquib Iltaf <saquib.iltaf@kpit.com>
---
meta/recipes-devtools/rust/rust-cross-canadian.inc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/rust/rust-cross-canadian.inc b/meta/recipes-devtools/rust/rust-cross-canadian.inc
index 8bbbd61bdc..044df5123a 100644
--- a/meta/recipes-devtools/rust/rust-cross-canadian.inc
+++ b/meta/recipes-devtools/rust/rust-cross-canadian.inc
@@ -76,3 +76,5 @@ SUMMARY:${RUSTLIB_HOST_PN} = "Rust cross canadian libaries for ${HOST_SYS}"
SUMMARY:${RUSTLIB_SRC_PN} = "Rust standard library sources for cross canadian toolchain"
SUMMARY:${PN} = "Rust crost canadian compiler"
+# These CVEs are specific to Microsoft Windows
+CVE_CHECK_IGNORE += "CVE-2024-43402"
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 03/10] xserver-xorg: Fix for CVE-2025-62229
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 01/10] curl: ignore CVE-2025-10966 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 02/10] rust-cross-canadian: Ignore CVE-2024-43402 Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 04/10] xserver-xorg: Fix for CVE-2025-62230 Steve Sakoman
` (6 subsequent siblings)
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/5a4286b13f631b66c20f5bc8db7b68211dcbd1d0
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../xserver-xorg/CVE-2025-62229.patch | 89 +++++++++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 1 +
2 files changed, 90 insertions(+)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62229.patch
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62229.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62229.patch
new file mode 100644
index 0000000000..634e8d44f1
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62229.patch
@@ -0,0 +1,89 @@
+From 5a4286b13f631b66c20f5bc8db7b68211dcbd1d0 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 2 Jul 2025 09:46:22 +0200
+Subject: [PATCH] present: Fix use-after-free in present_create_notifies()
+
+Using the Present extension, if an error occurs while processing and
+adding the notifications after presenting a pixmap, the function
+present_create_notifies() will clean up and remove the notifications
+it added.
+
+However, there are two different code paths that can lead to an error
+creating the notify, one being before the notify is being added to the
+list, and another one after the notify is added.
+
+When the error occurs before it's been added, it removes the elements up
+to the last added element, instead of the actual number of elements
+which were added.
+
+As a result, in case of error, as with an invalid window for example, it
+leaves a dangling pointer to the last element, leading to a use after
+free case later:
+
+ | Invalid write of size 8
+ | at 0x5361D5: present_clear_window_notifies (present_notify.c:42)
+ | by 0x534A56: present_destroy_window (present_screen.c:107)
+ | by 0x41E441: xwl_destroy_window (xwayland-window.c:1959)
+ | by 0x4F9EC9: compDestroyWindow (compwindow.c:622)
+ | by 0x51EAC4: damageDestroyWindow (damage.c:1592)
+ | by 0x4FDC29: DbeDestroyWindow (dbe.c:1291)
+ | by 0x4EAC55: FreeWindowResources (window.c:1023)
+ | by 0x4EAF59: DeleteWindow (window.c:1091)
+ | by 0x4DE59A: doFreeResource (resource.c:890)
+ | by 0x4DEFB2: FreeClientResources (resource.c:1156)
+ | by 0x4A9AFB: CloseDownClient (dispatch.c:3567)
+ | by 0x5DCC78: ClientReady (connection.c:603)
+ | Address 0x16126200 is 16 bytes inside a block of size 2,048 free'd
+ | at 0x4841E43: free (vg_replace_malloc.c:989)
+ | by 0x5363DD: present_destroy_notifies (present_notify.c:111)
+ | by 0x53638D: present_create_notifies (present_notify.c:100)
+ | by 0x5368E9: proc_present_pixmap_common (present_request.c:164)
+ | by 0x536A7D: proc_present_pixmap (present_request.c:189)
+ | by 0x536FA9: proc_present_dispatch (present_request.c:337)
+ | by 0x4A1E4E: Dispatch (dispatch.c:561)
+ | by 0x4B00F1: dix_main (main.c:284)
+ | by 0x42879D: main (stubmain.c:34)
+ | Block was alloc'd at
+ | at 0x48463F3: calloc (vg_replace_malloc.c:1675)
+ | by 0x5362A1: present_create_notifies (present_notify.c:81)
+ | by 0x5368E9: proc_present_pixmap_common (present_request.c:164)
+ | by 0x536A7D: proc_present_pixmap (present_request.c:189)
+ | by 0x536FA9: proc_present_dispatch (present_request.c:337)
+ | by 0x4A1E4E: Dispatch (dispatch.c:561)
+ | by 0x4B00F1: dix_main (main.c:284)
+ | by 0x42879D: main (stubmain.c:34)
+
+To fix the issue, count and remove the actual number of notify elements
+added in case of error.
+
+CVE-2025-62229, ZDI-CAN-27238
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2086>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/5a4286b13f631b66c20f5bc8db7b68211dcbd1d0]
+CVE: CVE-2025-62229
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ present/present_notify.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/present/present_notify.c b/present/present_notify.c
+index 7d19d9cfe1..fe84d1f070 100644
+--- a/present/present_notify.c
++++ b/present/present_notify.c
+@@ -92,7 +92,7 @@ present_create_notifies(ClientPtr client, int num_notifies, xPresentNotify *x_no
+ if (status != Success)
+ goto bail;
+
+- added = i;
++ added++;
+ }
+ return Success;
+
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
index a15669a260..1ec5a195f9 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
@@ -44,6 +44,7 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat
file://CVE-2025-49179.patch \
file://CVE-2025-49180-1.patch \
file://CVE-2025-49180-2.patch \
+ file://CVE-2025-62229.patch \
"
SRC_URI[sha256sum] = "38aadb735650c8024ee25211c190bf8aad844c5f59632761ab1ef4c4d5aeb152"
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 04/10] xserver-xorg: Fix for CVE-2025-62230
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
` (2 preceding siblings ...)
2025-11-13 21:47 ` [OE-core][kirkstone 03/10] xserver-xorg: Fix for CVE-2025-62229 Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 05/10] xserver-xorg: Fix for CVE-2025-62231 Steve Sakoman
` (5 subsequent siblings)
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://gitlab.freedesktop.org/xorg/xserver/-/commit/865089ca70840c0f13a61df135f7b44a9782a175
& https://gitlab.freedesktop.org/xorg/xserver/-/commit/87fe2553937a99fd914ad0cde999376a3adc3839
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../xserver-xorg/CVE-2025-62230-1.patch | 63 +++++++++++++
.../xserver-xorg/CVE-2025-62230-2.patch | 92 +++++++++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 2 +
3 files changed, 157 insertions(+)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-1.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-2.patch
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-1.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-1.patch
new file mode 100644
index 0000000000..a3a0bae2d5
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-1.patch
@@ -0,0 +1,63 @@
+From 865089ca70840c0f13a61df135f7b44a9782a175 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 10 Sep 2025 15:55:06 +0200
+Subject: [PATCH] xkb: Make the RT_XKBCLIENT resource private
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Currently, the resource in only available to the xkb.c source file.
+
+In preparation for the next commit, to be able to free the resources
+from XkbRemoveResourceClient(), make that variable private instead.
+
+This is related to:
+
+CVE-2025-62230, ZDI-CAN-27545
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit 99790a2c9205a52fbbec01f21a92c9b7f4ed1d8f)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2087>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/865089ca70840c0f13a61df135f7b44a9782a175]
+CVE: CVE-2025-62230
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ include/xkbsrv.h | 2 ++
+ xkb/xkb.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/xkbsrv.h b/include/xkbsrv.h
+index fbb5427e1c..b2766277cf 100644
+--- a/include/xkbsrv.h
++++ b/include/xkbsrv.h
+@@ -58,6 +58,8 @@ THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ #include "inputstr.h"
+ #include "events.h"
+
++extern RESTYPE RT_XKBCLIENT;
++
+ typedef struct _XkbInterest {
+ DeviceIntPtr dev;
+ ClientPtr client;
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 5131bfcdf7..26d965d482 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -51,7 +51,7 @@ int XkbKeyboardErrorCode;
+ CARD32 xkbDebugFlags = 0;
+ static CARD32 xkbDebugCtrls = 0;
+
+-static RESTYPE RT_XKBCLIENT;
++RESTYPE RT_XKBCLIENT = 0;
+
+ /***====================================================================***/
+
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-2.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-2.patch
new file mode 100644
index 0000000000..0e4a69c64e
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62230-2.patch
@@ -0,0 +1,92 @@
+From 87fe2553937a99fd914ad0cde999376a3adc3839 Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 10 Sep 2025 15:58:57 +0200
+Subject: [PATCH] xkb: Free the XKB resource when freeing XkbInterest
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+XkbRemoveResourceClient() would free the XkbInterest data associated
+with the device, but not the resource associated with it.
+
+As a result, when the client terminates, the resource delete function
+gets called and accesses already freed memory:
+
+ | Invalid read of size 8
+ | at 0x5BC0C0: XkbRemoveResourceClient (xkbEvents.c:1047)
+ | by 0x5B3391: XkbClientGone (xkb.c:7094)
+ | by 0x4DF138: doFreeResource (resource.c:890)
+ | by 0x4DFB50: FreeClientResources (resource.c:1156)
+ | by 0x4A9A59: CloseDownClient (dispatch.c:3550)
+ | by 0x5E0A53: ClientReady (connection.c:601)
+ | by 0x5E4FEF: ospoll_wait (ospoll.c:657)
+ | by 0x5DC834: WaitForSomething (WaitFor.c:206)
+ | by 0x4A1BA5: Dispatch (dispatch.c:491)
+ | by 0x4B0070: dix_main (main.c:277)
+ | by 0x4285E7: main (stubmain.c:34)
+ | Address 0x1893e278 is 184 bytes inside a block of size 928 free'd
+ | at 0x4842E43: free (vg_replace_malloc.c:989)
+ | by 0x49C1A6: CloseDevice (devices.c:1067)
+ | by 0x49C522: CloseOneDevice (devices.c:1193)
+ | by 0x49C6E4: RemoveDevice (devices.c:1244)
+ | by 0x5873D4: remove_master (xichangehierarchy.c:348)
+ | by 0x587921: ProcXIChangeHierarchy (xichangehierarchy.c:504)
+ | by 0x579BF1: ProcIDispatch (extinit.c:390)
+ | by 0x4A1D85: Dispatch (dispatch.c:551)
+ | by 0x4B0070: dix_main (main.c:277)
+ | by 0x4285E7: main (stubmain.c:34)
+ | Block was alloc'd at
+ | at 0x48473F3: calloc (vg_replace_malloc.c:1675)
+ | by 0x49A118: AddInputDevice (devices.c:262)
+ | by 0x4A0E58: AllocDevicePair (devices.c:2846)
+ | by 0x5866EE: add_master (xichangehierarchy.c:153)
+ | by 0x5878C2: ProcXIChangeHierarchy (xichangehierarchy.c:493)
+ | by 0x579BF1: ProcIDispatch (extinit.c:390)
+ | by 0x4A1D85: Dispatch (dispatch.c:551)
+ | by 0x4B0070: dix_main (main.c:277)
+ | by 0x4285E7: main (stubmain.c:34)
+
+To avoid that issue, make sure to free the resources when freeing the
+device XkbInterest data.
+
+CVE-2025-62230, ZDI-CAN-27545
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit 10c94238bdad17c11707e0bdaaa3a9cd54c504be)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2087>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/87fe2553937a99fd914ad0cde999376a3adc3839]
+CVE: CVE-2025-62230
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkbEvents.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/xkb/xkbEvents.c b/xkb/xkbEvents.c
+index 0bbd661867..3d04ecf0c4 100644
+--- a/xkb/xkbEvents.c
++++ b/xkb/xkbEvents.c
+@@ -1056,6 +1056,7 @@ XkbRemoveResourceClient(DevicePtr inDev, XID id)
+ autoCtrls = interest->autoCtrls;
+ autoValues = interest->autoCtrlValues;
+ client = interest->client;
++ FreeResource(interest->resource, RT_XKBCLIENT);
+ free(interest);
+ found = TRUE;
+ }
+@@ -1067,6 +1068,7 @@ XkbRemoveResourceClient(DevicePtr inDev, XID id)
+ autoCtrls = victim->autoCtrls;
+ autoValues = victim->autoCtrlValues;
+ client = victim->client;
++ FreeResource(victim->resource, RT_XKBCLIENT);
+ free(victim);
+ found = TRUE;
+ }
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
index 1ec5a195f9..ed543f6270 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
@@ -45,6 +45,8 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat
file://CVE-2025-49180-1.patch \
file://CVE-2025-49180-2.patch \
file://CVE-2025-62229.patch \
+ file://CVE-2025-62230-1.patch \
+ file://CVE-2025-62230-2.patch \
"
SRC_URI[sha256sum] = "38aadb735650c8024ee25211c190bf8aad844c5f59632761ab1ef4c4d5aeb152"
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 05/10] xserver-xorg: Fix for CVE-2025-62231
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
` (3 preceding siblings ...)
2025-11-13 21:47 ` [OE-core][kirkstone 04/10] xserver-xorg: Fix for CVE-2025-62230 Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 06/10] python3-urllib3: Upgrade 1.26.18 -> 1.26.20 Steve Sakoman
` (4 subsequent siblings)
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from https://gitlab.freedesktop.org/xorg/xserver/-/commit/3baad99f9c15028ed8c3e3d8408e5ec35db155aa
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
---
.../xserver-xorg/CVE-2025-62231.patch | 53 +++++++++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62231.patch
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62231.patch b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62231.patch
new file mode 100644
index 0000000000..4bcf362531
--- /dev/null
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2025-62231.patch
@@ -0,0 +1,53 @@
+From 3baad99f9c15028ed8c3e3d8408e5ec35db155aa Mon Sep 17 00:00:00 2001
+From: Olivier Fourdan <ofourdan@redhat.com>
+Date: Wed, 10 Sep 2025 16:30:29 +0200
+Subject: [PATCH] xkb: Prevent overflow in XkbSetCompatMap()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The XkbCompatMap structure stores its "num_si" and "size_si" fields
+using an unsigned short.
+
+However, the function _XkbSetCompatMap() will store the sum of the
+input data "firstSI" and "nSI" in both XkbCompatMap's "num_si" and
+"size_si" without first checking if the sum overflows the maximum
+unsigned short value, leading to a possible overflow.
+
+To avoid the issue, check whether the sum does not exceed the maximum
+unsigned short value, or return a "BadValue" error otherwise.
+
+CVE-2025-62231, ZDI-CAN-27560
+
+This vulnerability was discovered by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
+Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>
+(cherry picked from commit 475d9f49acd0e55bc0b089ed77f732ad18585470)
+
+Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2087>
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/3baad99f9c15028ed8c3e3d8408e5ec35db155aa]
+CVE: CVE-2025-62231
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ xkb/xkb.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/xkb/xkb.c b/xkb/xkb.c
+index 26d965d482..137d70da27 100644
+--- a/xkb/xkb.c
++++ b/xkb/xkb.c
+@@ -2992,6 +2992,8 @@ _XkbSetCompatMap(ClientPtr client, DeviceIntPtr dev,
+ XkbSymInterpretPtr sym;
+ unsigned int skipped = 0;
+
++ if ((unsigned) (req->firstSI + req->nSI) > USHRT_MAX)
++ return BadValue;
+ if ((unsigned) (req->firstSI + req->nSI) > compat->size_si) {
+ compat->num_si = compat->size_si = req->firstSI + req->nSI;
+ compat->sym_interpret = reallocarray(compat->sym_interpret,
+--
+GitLab
+
diff --git a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
index ed543f6270..1d486fc0bc 100644
--- a/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
+++ b/meta/recipes-graphics/xorg-xserver/xserver-xorg_21.1.8.bb
@@ -47,6 +47,7 @@ SRC_URI += "file://0001-xf86pciBus.c-use-Intel-ddx-only-for-pre-gen4-hardwar.pat
file://CVE-2025-62229.patch \
file://CVE-2025-62230-1.patch \
file://CVE-2025-62230-2.patch \
+ file://CVE-2025-62231.patch \
"
SRC_URI[sha256sum] = "38aadb735650c8024ee25211c190bf8aad844c5f59632761ab1ef4c4d5aeb152"
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 06/10] python3-urllib3: Upgrade 1.26.18 -> 1.26.20
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
` (4 preceding siblings ...)
2025-11-13 21:47 ` [OE-core][kirkstone 05/10] xserver-xorg: Fix for CVE-2025-62231 Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 07/10] efibootmgr: update SRC_URI branch Steve Sakoman
` (3 subsequent siblings)
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Soumya Sambu <soumya.sambu@windriver.com>
Includes fix for CVE-2024-37891
Changelog:
----------
https://github.com/urllib3/urllib3/blob/1.26.20/CHANGES.rst
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../{python3-urllib3_1.26.18.bb => python3-urllib3_1.26.20.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-devtools/python/{python3-urllib3_1.26.18.bb => python3-urllib3_1.26.20.bb} (87%)
diff --git a/meta/recipes-devtools/python/python3-urllib3_1.26.18.bb b/meta/recipes-devtools/python/python3-urllib3_1.26.20.bb
similarity index 87%
rename from meta/recipes-devtools/python/python3-urllib3_1.26.18.bb
rename to meta/recipes-devtools/python/python3-urllib3_1.26.20.bb
index b26c9ad2fa..58988e4205 100644
--- a/meta/recipes-devtools/python/python3-urllib3_1.26.18.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_1.26.20.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/shazow/urllib3"
LICENSE = "MIT"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=c2823cb995439c984fd62a973d79815c"
-SRC_URI[sha256sum] = "f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0"
+SRC_URI[sha256sum] = "40c2dc0c681e47eb8f90e7e27bf6ff7df2e677421fd46756da1161c39ca70d32"
inherit pypi setuptools3
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 07/10] efibootmgr: update SRC_URI branch
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
` (5 preceding siblings ...)
2025-11-13 21:47 ` [OE-core][kirkstone 06/10] python3-urllib3: Upgrade 1.26.18 -> 1.26.20 Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 08/10] xf86-video-intel: correct SRC_URI as freedesktop anongit is down Steve Sakoman
` (2 subsequent siblings)
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Gyorgy Sarvari <skandigraun@gmail.com>
master branch was renamed to main
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
meta/recipes-bsp/efibootmgr/efibootmgr_17.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-bsp/efibootmgr/efibootmgr_17.bb b/meta/recipes-bsp/efibootmgr/efibootmgr_17.bb
index be6571b3fa..b6d3dadadf 100644
--- a/meta/recipes-bsp/efibootmgr/efibootmgr_17.bb
+++ b/meta/recipes-bsp/efibootmgr/efibootmgr_17.bb
@@ -10,7 +10,7 @@ DEPENDS = "efivar popt"
COMPATIBLE_HOST = "(i.86|x86_64|arm|aarch64).*-linux"
-SRC_URI = "git://github.com/rhinstaller/efibootmgr.git;protocol=https;branch=master \
+SRC_URI = "git://github.com/rhinstaller/efibootmgr.git;protocol=https;branch=main \
file://0001-remove-extra-decl.patch \
file://97668ae0bce776a36ea2001dea63d376be8274ac.patch \
file://0001-src-make-compatible-with-efivar-38.patch \
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 08/10] xf86-video-intel: correct SRC_URI as freedesktop anongit is down
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
` (6 preceding siblings ...)
2025-11-13 21:47 ` [OE-core][kirkstone 07/10] efibootmgr: update SRC_URI branch Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 09/10] babeltrace2: fetch with https protocol Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 10/10] goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task signatures Steve Sakoman
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
(From OE-Core rev: 04037a14e1431c4a51f5d51885974732a6108368)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9649bec517996558e01d668d2b59e68306a3a647)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb b/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb
index 74ec57aa66..e747d2046f 100644
--- a/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb
+++ b/meta/recipes-graphics/xorg-driver/xf86-video-intel_git.bb
@@ -13,8 +13,7 @@ SRCREV = "31486f40f8e8f8923ca0799aea84b58799754564"
PV = "2.99.917+git${SRCPV}"
S = "${WORKDIR}/git"
-SRC_URI = "git://anongit.freedesktop.org/xorg/driver/xf86-video-intel;branch=master \
-"
+SRC_URI = "git://gitlab.freedesktop.org/xorg/driver/xf86-video-intel.git;protocol=https;branch=master"
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>\d+(\.\d+)+)"
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 09/10] babeltrace2: fetch with https protocol
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
` (7 preceding siblings ...)
2025-11-13 21:47 ` [OE-core][kirkstone 08/10] xf86-video-intel: correct SRC_URI as freedesktop anongit is down Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 10/10] goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task signatures Steve Sakoman
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Gyorgy Sarvari <skandigraun@gmail.com>
The source doesn't support the default "git" protocol anymore for
anonymous download, causing fetching failures.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
meta/recipes-kernel/lttng/babeltrace2_2.0.5.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-kernel/lttng/babeltrace2_2.0.5.bb b/meta/recipes-kernel/lttng/babeltrace2_2.0.5.bb
index 7ece3140f7..8fa0f9f20d 100644
--- a/meta/recipes-kernel/lttng/babeltrace2_2.0.5.bb
+++ b/meta/recipes-kernel/lttng/babeltrace2_2.0.5.bb
@@ -7,7 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a6a458c13f18385b7bc5069a6d7b176e"
DEPENDS = "glib-2.0 util-linux popt bison-native flex-native"
-SRC_URI = "git://git.efficios.com/babeltrace.git;branch=stable-2.0 \
+SRC_URI = "git://git.efficios.com/babeltrace.git;branch=stable-2.0;protocol=https \
file://run-ptest \
file://0001-tests-do-not-run-test-applications-from-.libs.patch \
file://0001-Make-manpages-multilib-identical.patch \
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 10/10] goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task signatures
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
` (8 preceding siblings ...)
2025-11-13 21:47 ` [OE-core][kirkstone 09/10] babeltrace2: fetch with https protocol Steve Sakoman
@ 2025-11-13 21:47 ` Steve Sakoman
9 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-11-13 21:47 UTC (permalink / raw)
To: openembedded-core
From: Alexander Kanavin <alex@linutronix.de>
The default assignments look like this:
TARGET_GO386 = "${@go_map_386(d.getVar('TARGET_ARCH'), d.getVar('TUNE_FEATURES'), d)}"
TUNE_FEATURES is a target-specific variable, and so should be used
only for target builds. The change is similar to what is already done
for native packages.
(From OE-Core rev: cfff8e968257c44880caa3605e158764ed5c6a2a)
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Peter Marko <peter.marko@siemens.com>
---
meta/classes/goarch.bbclass | 3 +++
1 file changed, 3 insertions(+)
diff --git a/meta/classes/goarch.bbclass b/meta/classes/goarch.bbclass
index 394c0c5d84..5996bf1805 100644
--- a/meta/classes/goarch.bbclass
+++ b/meta/classes/goarch.bbclass
@@ -18,6 +18,9 @@ TARGET_GOMIPS = "${@go_map_mips(d.getVar('TARGET_ARCH'), d.getVar('TUNE_FEATURES
TARGET_GOARM:class-native = "7"
TARGET_GO386:class-native = "sse2"
TARGET_GOMIPS:class-native = "hardfloat"
+TARGET_GOARM:class-crosssdk = "7"
+TARGET_GO386:class-crosssdk = "sse2"
+TARGET_GOMIPS:class-crosssdk = "hardfloat"
TARGET_GOTUPLE = "${TARGET_GOOS}_${TARGET_GOARCH}"
GO_BUILD_BINDIR = "${@['bin/${HOST_GOTUPLE}','bin'][d.getVar('BUILD_GOTUPLE') == d.getVar('HOST_GOTUPLE')]}"
--
2.43.0
^ permalink raw reply related [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2025-12-02 15:09 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-12-02 15:09 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Thursday, December 4
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/2808
The following changes since commit ceef3cde9b761b7b5de6f7b6b1fb8e99663af9ca:
flac: patch seeking bug (2025-11-24 07:34:36 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (4):
go: fix CVE-2025-58187
go: fix CVE-2025-58189
go: fix CVE-2025-61723
go: fix CVE-2025-61724
Gyorgy Sarvari (1):
systemd-bootchart: update SRC_URI branch
Peter Marko (5):
gnutls: patch CVE-2025-9820
libpng: patch CVE-2025-64505
libpng: patch CVE-2025-64506
libpng: patch CVE-2025-64720
libpng: patch CVE-2025-65018
meta/recipes-devtools/go/go-1.17.13.inc | 4 +
.../go/go-1.18/CVE-2025-58187.patch | 349 ++++++++++++++++++
.../go/go-1.18/CVE-2025-58189.patch | 51 +++
.../go/go-1.18/CVE-2025-61723.patch | 221 +++++++++++
.../go/go-1.18/CVE-2025-61724.patch | 74 ++++
.../systemd-bootchart_234.bb | 2 +-
.../libpng/files/CVE-2025-64505-01.patch | 111 ++++++
.../libpng/files/CVE-2025-64505-02.patch | 163 ++++++++
.../libpng/files/CVE-2025-64505-03.patch | 52 +++
.../libpng/files/CVE-2025-64506.patch | 57 +++
.../libpng/files/CVE-2025-64720.patch | 103 ++++++
.../libpng/files/CVE-2025-65018-01.patch | 60 +++
.../libpng/files/CVE-2025-65018-02.patch | 163 ++++++++
.../libpng/libpng_1.6.39.bb | 7 +
.../gnutls/gnutls/CVE-2025-9820.patch | 250 +++++++++++++
meta/recipes-support/gnutls/gnutls_3.7.4.bb | 1 +
16 files changed, 1667 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-58187.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-58189.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61723.patch
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2025-61724.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64505-01.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64505-02.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64505-03.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64506.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-64720.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-65018-01.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2025-65018-02.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2025-9820.patch
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread
* [OE-core][kirkstone 00/10] Patch review
@ 2025-12-23 21:25 Steve Sakoman
0 siblings, 0 replies; 21+ messages in thread
From: Steve Sakoman @ 2025-12-23 21:25 UTC (permalink / raw)
To: openembedded-core
Please review this set of hcanges for kirkstone and have comments back by
end of day Tuesday, December 30
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/2920
The following changes since commit 2ed3f8b938579dbbb804e04c45a968cc57761db7:
build-appliance-image: Update to kirkstone head revision (2025-12-12 08:52:06 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Aleksandar Nikolic (1):
scripts/install-buildtools: Update to 4.0.31
Changqing Li (1):
libsoup: fix CVE-2025-12105
Deepesh Varatharajan (1):
binutils: Fix CVE-2025-11494
Kai Kang (1):
qemu: fix CVE-2025-12464
Libo Chen (1):
go: Fix CVE-2023-39323
Liyin Zhang (1):
rsync: fix CVE-2025-10158
Martin Jansa (1):
cross.bbclass: Propagate dependencies to outhash
Mingli Yu (1):
libxslt: Fix CVE-2025-11731
Yash Shinde (2):
binutils: fix CVE-2025-11839
binutils: fix CVE-2025-11840
meta/classes/cross.bbclass | 36 ++++++++++
.../binutils/binutils-2.38.inc | 3 +
.../binutils/0048-CVE-2025-11494.patch | 43 ++++++++++++
.../binutils/0049-CVE-2025-11839.patch | 32 +++++++++
.../binutils/0050-CVE-2025-11840.patch | 37 ++++++++++
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.21/CVE-2023-39323.patch | 55 +++++++++++++++
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2025-12464.patch | 70 +++++++++++++++++++
.../rsync/files/CVE-2025-10158.patch | 36 ++++++++++
meta/recipes-devtools/rsync/rsync_3.2.7.bb | 1 +
.../libsoup/libsoup/CVE-2025-12105.patch | 34 +++++++++
meta/recipes-support/libsoup/libsoup_3.0.7.bb | 1 +
.../libxslt/libxslt/CVE-2025-11731.patch | 42 +++++++++++
.../recipes-support/libxslt/libxslt_1.1.35.bb | 1 +
scripts/install-buildtools | 4 +-
16 files changed, 395 insertions(+), 2 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/0048-CVE-2025-11494.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0049-CVE-2025-11839.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0050-CVE-2025-11840.patch
create mode 100644 meta/recipes-devtools/go/go-1.21/CVE-2023-39323.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2025-12464.patch
create mode 100644 meta/recipes-devtools/rsync/files/CVE-2025-10158.patch
create mode 100644 meta/recipes-support/libsoup/libsoup/CVE-2025-12105.patch
create mode 100644 meta/recipes-support/libxslt/libxslt/CVE-2025-11731.patch
--
2.43.0
^ permalink raw reply [flat|nested] 21+ messages in thread
end of thread, other threads:[~2025-12-23 21:26 UTC | newest]
Thread overview: 21+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-13 21:47 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 01/10] curl: ignore CVE-2025-10966 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 02/10] rust-cross-canadian: Ignore CVE-2024-43402 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 03/10] xserver-xorg: Fix for CVE-2025-62229 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 04/10] xserver-xorg: Fix for CVE-2025-62230 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 05/10] xserver-xorg: Fix for CVE-2025-62231 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 06/10] python3-urllib3: Upgrade 1.26.18 -> 1.26.20 Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 07/10] efibootmgr: update SRC_URI branch Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 08/10] xf86-video-intel: correct SRC_URI as freedesktop anongit is down Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 09/10] babeltrace2: fetch with https protocol Steve Sakoman
2025-11-13 21:47 ` [OE-core][kirkstone 10/10] goarch.bbclass: do not leak TUNE_FEATURES into crosssdk task signatures Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-12-23 21:25 [OE-core][kirkstone 00/10] Patch review Steve Sakoman
2025-12-02 15:09 Steve Sakoman
2025-07-30 19:05 Steve Sakoman
2025-07-27 20:04 Steve Sakoman
2025-05-30 15:39 Steve Sakoman
2025-04-08 20:50 Steve Sakoman
2024-04-16 12:06 Steve Sakoman
2023-10-18 15:48 Steve Sakoman
2023-10-03 19:36 Steve Sakoman
2023-08-03 14:04 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox