* [OE-core][scarthgap 00/25] Patch review
@ 2025-01-04 13:41 Steve Sakoman
0 siblings, 0 replies; 33+ messages in thread
From: Steve Sakoman @ 2025-01-04 13:41 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, January 7
Passed a-full on autobuilder:
https://valkyrie.yoctoproject.org/#/builders/29/builds/737
The following changes since commit 01423828248b75e1f5afe2e5959ccd971df875cd:
rust: add reproducibility patch to eliminate host leakage (2024-12-19 05:36:59 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Changqing Li (1):
sanity.bbclass: skip check_userns for non-local uid
Divya Chellam (1):
libxml2: Upgrade 2.12.8 -> 2.12.9
Guðni Már Gilbert (2):
python3: upgrade 3.12.6 -> 3.12.7
python3: upgrade 3.12.7 -> 3.12.8
Mark Hatle (1):
populate_sdk_ext: write_local_conf add shutil import
Mikko Rapeli (1):
ovmf-native: remove .pyc files from install
Peter Marko (16):
gstreamer1.0-plugins-good: fix several CVEs
gstreamer1.0-plugins-base: patch CVE-2024-47538
gstreamer1.0-plugins-base: patch CVE-2024-47607
gstreamer1.0-plugins-base: patch CVE-2024-47615
gstreamer1.0-plugins-good: patch CVE-2024-47613
gstreamer1.0-plugins-good: patch several CVEs
gstreamer1.0-plugins-base: patch CVE-2024-47541
gstreamer1.0-plugins-base: patch CVE-2024-47542
gstreamer1.0-plugins-good: patch CVE-2024-47599
gstreamer1.0-plugins-base: patch CVE-2024-47600
gstreamer1.0-plugins-good: patch CVE-2024-47606
gstreamer1.0-plugins-good: patch CVE-2024-47606
gstreamer1.0-plugins-good: patch CVE-2024-47774
gstreamer1.0-plugins-good: patch several CVEs
gstreamer1.0-plugins-base: patch CVE-2024-47835
gstreamer1.0: ignore CVEs fixed in plugins recipes
Soumya Sambu (1):
python3-requests: upgrade 2.32.0 -> 2.32.3
Xiangyu Chen (1):
lttng-modules: fix sched_stat_runtime changed in Linux 6.6.66
aszh07 (1):
libarchive: Fix CVE-2024-20696
meta/classes-global/sanity.bbclass | 2 +
meta/classes-recipe/populate_sdk_ext.bbclass | 2 +
.../{libxml2_2.12.8.bb => libxml2_2.12.9.bb} | 2 +-
meta/recipes-core/ovmf/ovmf_git.bb | 1 +
...s_2.32.0.bb => python3-requests_2.32.3.bb} | 4 +-
...shebang-overflow-on-python-config.py.patch | 6 +-
...e-stdin-I-O-errors-same-way-as-maste.patch | 3 +-
...-use-prefix-value-from-build-configu.patch | 5 +-
...-qemu-wrapper-when-gathering-profile.patch | 6 +-
...sts-due-to-load-variability-on-YP-AB.patch | 16 +-
...est_sysconfig-for-posix_user-purelib.patch | 7 +-
...e-treat-overflow-in-UID-GID-as-failu.patch | 9 +-
...asename-to-replace-CC-for-checking-c.patch | 20 +-
..._fileno-test-due-to-load-variability.patch | 6 +-
...g.py-use-platlibdir-also-for-purelib.patch | 5 +-
...ctive_children-skip-problematic-test.patch | 9 +-
...pes.test_find-skip-without-tools-sdk.patch | 5 +-
...-test_deadlock-skip-problematic-test.patch | 9 +-
...le.py-correct-the-test-output-format.patch | 7 +-
...t_readline-skip-limited-history-test.patch | 14 +-
...-test_shutdown-skip-problematic-test.patch | 11 +-
...orlines-skip-due-to-load-variability.patch | 5 +-
...up.py-do-not-add-a-curses-include-pa.patch | 6 +-
.../python/python3/cgi_py.patch | 3 +-
.../python/python3/crosspythonpath.patch | 5 +-
.../python3/deterministic_imports.patch | 5 +-
.../python/python3/makerace.patch | 6 +-
.../{python3_3.12.6.bb => python3_3.12.8.bb} | 2 +-
.../libarchive/CVE-2024-20696.patch | 115 +++++
.../libarchive/libarchive_3.7.4.bb | 3 +-
...stat_runtime-changed-in-Linux-6.6.66.patch | 51 ++
.../lttng/lttng-modules_2.13.12.bb | 1 +
...at-most-64-channels-to-NONE-position.patch | 35 ++
...at-most-64-channels-to-NONE-position.patch | 41 ++
...ck-writes-to-GstOggStream.vorbis_mod.patch | 80 ++++
...w-and-fix-per-format-min_packet_size.patch | 168 +++++++
...for-closing-brace-after-opening-brac.patch | 38 ++
...se-strstr-on-strings-that-are-potent.patch | 99 ++++
...parsing-extended-header-if-not-enoug.patch | 64 +++
...-print-channel-layout-for-more-than-.patch | 38 ++
...or-NULL-return-of-strchr-when-parsin.patch | 39 ++
.../gstreamer1.0-plugins-base_1.22.12.bb | 9 +
...o-sized-boxes-instead-of-stopping-to.patch | 124 +++++
...ger-overflow-when-allocating-the-sam.patch | 63 +++
...Fix-debug-output-during-trun-parsing.patch | 72 +++
...erate-over-all-trun-entries-if-none-.patch | 35 ++
...zes-of-stsc-stco-stts-before-trying-.patch | 63 +++
...e-only-an-even-number-of-bytes-is-pr.patch | 44 ++
...e-enough-data-is-available-before-re.patch | 120 +++++
...th-checks-and-offsets-in-stsd-entry-.patch | 450 ++++++++++++++++++
...r-handling-when-parsing-cenc-sample-.patch | 56 +++
...e-there-are-enough-offsets-to-read-w.patch | 49 ++
...-handle-errors-returns-from-various-.patch | 97 ++++
...r-invalid-atom-length-when-extractin.patch | 36 ++
...size-check-for-parsing-SMI-SEQH-atom.patch | 37 ++
...ck-if-initializing-the-video-info-ac.patch | 53 +++
...ly-unmap-GstMapInfo-in-WavPack-heade.patch | 60 +++
...x-off-by-one-when-parsing-multi-chan.patch | 35 ++
...eck-for-big-enough-WavPack-codec-pri.patch | 43 ++
...n-t-take-data-out-of-an-empty-adapte.patch | 51 ++
...ip-over-laces-directly-when-postproc.patch | 52 ++
...ip-over-zero-sized-Xiph-stream-heade.patch | 43 ++
...t-a-copy-of-the-codec-data-into-the-.patch | 44 ++
...ly-error-out-on-negotiation-failures.patch | 99 ++++
...teger-overflow-when-parsing-Theora-e.patch | 44 ++
...size-checks-and-avoid-overflows-when.patch | 46 ++
...or-short-reads-when-parsing-headers-.patch | 174 +++++++
...re-enough-data-for-the-tag-list-tag-.patch | 41 ++
...7-wavparse-Fix-parsing-of-acid-chunk.patch | 65 +++
...hat-at-least-4-bytes-are-available-b.patch | 37 ++
...hat-at-least-32-bytes-are-available-.patch | 40 ++
...ix-clipping-of-size-to-the-file-size.patch | 47 ++
...Check-size-before-reading-ds64-chunk.patch | 41 ++
.../gstreamer1.0-plugins-good_1.22.12.bb | 34 +-
...integer-overflow-when-allocating-sys.patch | 56 +++
.../gstreamer/gstreamer1.0_1.22.12.bb | 14 +
76 files changed, 3226 insertions(+), 101 deletions(-)
rename meta/recipes-core/libxml/{libxml2_2.12.8.bb => libxml2_2.12.9.bb} (97%)
rename meta/recipes-devtools/python/{python3-requests_2.32.0.bb => python3-requests_2.32.3.bb} (78%)
rename meta/recipes-devtools/python/{python3_3.12.6.bb => python3_3.12.8.bb} (99%)
create mode 100644 meta/recipes-extended/libarchive/libarchive/CVE-2024-20696.patch
create mode 100644 meta/recipes-kernel/lttng/lttng-modules/0001-Fix-sched_stat_runtime-changed-in-Linux-6.6.66.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0004-vorbisdec-Set-at-most-64-channels-to-NONE-position.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0005-opusdec-Set-at-most-64-channels-to-NONE-position.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0006-vorbis_parse-check-writes-to-GstOggStream.vorbis_mod.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0007-oggstream-review-and-fix-per-format-min_packet_size.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0008-ssaparse-Search-for-closing-brace-after-opening-brac.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0009-ssaparse-Don-t-use-strstr-on-strings-that-are-potent.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0010-id3v2-Don-t-try-parsing-extended-header-if-not-enoug.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0011-discoverer-Don-t-print-channel-layout-for-more-than-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-base/0012-subparse-Check-for-NULL-return-of-strchr-when-parsin.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0001-qtdemux-Skip-zero-sized-boxes-instead-of-stopping-to.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0002-qtdemux-Fix-integer-overflow-when-allocating-the-sam.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0003-qtdemux-Fix-debug-output-during-trun-parsing.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0004-qtdemux-Don-t-iterate-over-all-trun-entries-if-none-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0005-qtdemux-Check-sizes-of-stsc-stco-stts-before-trying-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0006-qtdemux-Make-sure-only-an-even-number-of-bytes-is-pr.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0007-qtdemux-Make-sure-enough-data-is-available-before-re.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0008-qtdemux-Fix-length-checks-and-offsets-in-stsd-entry-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0009-qtdemux-Fix-error-handling-when-parsing-cenc-sample-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0010-qtdemux-Make-sure-there-are-enough-offsets-to-read-w.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0011-qtdemux-Actually-handle-errors-returns-from-various-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0012-qtdemux-Check-for-invalid-atom-length-when-extractin.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0013-qtdemux-Add-size-check-for-parsing-SMI-SEQH-atom.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0014-gdkpixbufdec-Check-if-initializing-the-video-info-ac.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0015-matroskademux-Only-unmap-GstMapInfo-in-WavPack-heade.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0016-matroskademux-Fix-off-by-one-when-parsing-multi-chan.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0017-matroskademux-Check-for-big-enough-WavPack-codec-pri.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0018-matroskademux-Don-t-take-data-out-of-an-empty-adapte.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0019-matroskademux-Skip-over-laces-directly-when-postproc.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0020-matroskademux-Skip-over-zero-sized-Xiph-stream-heade.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0021-matroskademux-Put-a-copy-of-the-codec-data-into-the-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0022-jpegdec-Directly-error-out-on-negotiation-failures.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0023-qtdemux-Avoid-integer-overflow-when-parsing-Theora-e.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0024-avisubtitle-Fix-size-checks-and-avoid-overflows-when.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0025-wavparse-Check-for-short-reads-when-parsing-headers-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0026-wavparse-Make-sure-enough-data-for-the-tag-list-tag-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0027-wavparse-Fix-parsing-of-acid-chunk.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0028-wavparse-Check-that-at-least-4-bytes-are-available-b.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0029-wavparse-Check-that-at-least-32-bytes-are-available-.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0030-wavparse-Fix-clipping-of-size-to-the-file-size.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-good/0031-wavparse-Check-size-before-reading-ds64-chunk.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0/0005-allocator-Avoid-integer-overflow-when-allocating-sys.patch
--
2.43.0
^ permalink raw reply [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 00/25] Patch review
@ 2026-02-09 9:28 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 01/25] curl: fix CVE-2025-10148 Yoann Congal
` (24 more replies)
0 siblings, 25 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for scarthgap and have comments back by
end of day Wednesday, February 11.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/3183
The following changes since commit d50e4680ed6f930582d907b37c9ed545a89f5c27:
build-appliance-image: Update to scarthgap head revision (2026-01-26 09:50:47 +0000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
Adarsh Jagadish Kamini (1):
python-urllib3: Backport fix for CVE-2026-21441
Amaury Couderc (1):
curl: patch CVE-2025-14524
Ankur Tyagi (2):
ffmpeg: upgrade 6.1.3 -> 6.1.4
ffmpeg: ignore CVE-2025-25469
Benjamin Robin (Schneider Electric) (1):
meta/classes: fix missing vardeps for CVE status variables
Daniel Turull (1):
improve_kernel_cve_report: add script for postprocesing of kernel CVE
data
Fred Bacon (1):
lighttpd: Fix trailing slash on files in mod_dirlisting
Hitendra Prajapati (1):
curl: fix CVE-2025-10148
Hugo SIMELIERE (1):
libtasn1: Fix CVE-2025-13151
Ken Kurematsu (1):
libtheora: set CVE_PRODUCT
Khai Dang (1):
docbook-xml-dtd4: fix the fetching failure
Peter Marko (12):
expat: patch CVE-2026-24515
expat: patch CVE-2026-25210
glib-2.0: patch CVE-2026-0988
libpng: patch CVE-2026-22695
libpng: patch CVE-2026-22801
libxml2: patch CVE-2026-0989
libxml2: patch CVE-2026-0990
libxml2: patch CVE-2026-0992
libxml2: add follow-up patch for CVE-2026-0992
python3: patch CVE-2025-13837
zlib: ignore CVE-2026-22184
glibc: stable 2.39 branch updates
Richard Purdie (1):
pseudo: Update to 1.9.3 release
Vijay Anusuri (1):
inetutils: Fix CVE-2026-24061
meta/classes/create-spdx-2.2.bbclass | 1 +
meta/classes/create-spdx-3.0.bbclass | 2 +
meta/classes/cve-check.bbclass | 1 +
meta/classes/vex.bbclass | 1 +
.../inetutils/CVE-2026-24061-1.patch | 41 ++
.../inetutils/CVE-2026-24061-2.patch | 85 ++++
.../inetutils/inetutils_2.5.bb | 2 +
.../expat/expat/CVE-2026-24515-01.patch | 43 ++
.../expat/expat/CVE-2026-24515-02.patch | 117 +++++
.../expat/expat/CVE-2026-25210-01.patch | 27 +
.../expat/expat/CVE-2026-25210-02.patch | 38 ++
.../expat/expat/CVE-2026-25210-03.patch | 28 ++
meta/recipes-core/expat/expat_2.6.4.bb | 5 +
.../glib-2.0/glib-2.0/CVE-2026-0988.patch | 58 +++
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 1 +
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.39.bb | 2 +-
.../libxml/libxml2/CVE-2026-0989.patch | 309 ++++++++++++
.../libxml/libxml2/CVE-2026-0990.patch | 76 +++
.../libxml/libxml2/CVE-2026-0992-01.patch | 49 ++
.../libxml/libxml2/CVE-2026-0992-02.patch | 323 ++++++++++++
.../libxml/libxml2/CVE-2026-0992-03.patch | 33 ++
meta/recipes-core/libxml/libxml2_2.12.10.bb | 5 +
meta/recipes-core/zlib/zlib_1.3.1.bb | 1 +
.../docbook-xml/docbook-xml-dtd4_4.5.bb | 10 +-
meta/recipes-devtools/pseudo/pseudo_git.bb | 4 +-
.../python3-urllib3/CVE-2026-21441.patch | 105 ++++
.../python/python3-urllib3_2.2.2.bb | 1 +
.../python/python3/CVE-2025-13837.patch | 162 ++++++
.../python/python3_3.12.12.bb | 1 +
.../lighttpd/0001-mod_dirlisting.patch | 48 ++
.../lighttpd/lighttpd_1.4.74.bb | 1 +
.../ffmpeg/ffmpeg/CVE-2024-35365.patch | 62 ---
.../ffmpeg/ffmpeg/CVE-2024-36618.patch | 36 --
.../ffmpeg/ffmpeg/CVE-2025-1594.patch | 105 ----
.../{ffmpeg_6.1.3.bb => ffmpeg_6.1.4.bb} | 7 +-
.../libpng/files/CVE-2026-22695.patch | 77 +++
.../libpng/files/CVE-2026-22801.patch | 173 +++++++
.../libpng/libpng_1.6.42.bb | 2 +
.../libtheora/libtheora_1.1.1.bb | 2 +
.../curl/curl/CVE-2025-10148.patch | 57 +++
.../curl/curl/CVE-2025-14524.patch | 44 ++
meta/recipes-support/curl/curl_8.7.1.bb | 2 +
.../gnutls/libtasn1/CVE-2025-13151.patch | 30 ++
.../recipes-support/gnutls/libtasn1_4.20.0.bb | 1 +
scripts/contrib/improve_kernel_cve_report.py | 467 ++++++++++++++++++
46 files changed, 2431 insertions(+), 216 deletions(-)
create mode 100644 meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-1.patch
create mode 100644 meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-24515-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-24515-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-03.patch
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-0988.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0989.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0992-01.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0992-02.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0992-03.patch
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-21441.patch
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-13837.patch
create mode 100644 meta/recipes-extended/lighttpd/lighttpd/0001-mod_dirlisting.patch
delete mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35365.patch
delete mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36618.patch
delete mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-1594.patch
rename meta/recipes-multimedia/ffmpeg/{ffmpeg_6.1.3.bb => ffmpeg_6.1.4.bb} (98%)
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-22695.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-22801.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2025-10148.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2025-14524.patch
create mode 100644 meta/recipes-support/gnutls/libtasn1/CVE-2025-13151.patch
create mode 100755 scripts/contrib/improve_kernel_cve_report.py
^ permalink raw reply [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 01/25] curl: fix CVE-2025-10148
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 02/25] curl: patch CVE-2025-14524 Yoann Congal
` (23 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Hitendra Prajapati <hprajapati@mvista.com>
curl's websocket code did not update the 32 bit mask pattern
for each new outgoing frame as the specification says. Instead
it used a fixed mask that persisted and was used throughout
the entire connection.
A predictable mask pattern allows for a malicious server to induce
traffic between the two communicating parties that could be
interpreted by an involved proxy (configured or transparent) as
genuine, real, HTTP traffic with content and thereby poison its
cache. That cached poisoned content could then be served to all
users of that proxy.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-10148
Upstream patch:
https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../curl/curl/CVE-2025-10148.patch | 57 +++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 58 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2025-10148.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2025-10148.patch b/meta/recipes-support/curl/curl/CVE-2025-10148.patch
new file mode 100644
index 00000000000..d37497febe9
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2025-10148.patch
@@ -0,0 +1,57 @@
+From 84db7a9eae8468c0445b15aa806fa7fa806fa0f2 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 8 Sep 2025 14:14:15 +0200
+Subject: [PATCH] ws: get a new mask for each new outgoing frame
+
+Reported-by: Calvin Ruocco
+Closes #18496
+
+CVE: CVE-2025-10148
+Upstream-Status: Backport [https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa]
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ lib/ws.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+diff --git a/lib/ws.c b/lib/ws.c
+index 5bc5ecc..02e0ef0 100644
+--- a/lib/ws.c
++++ b/lib/ws.c
+@@ -614,6 +614,18 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data,
+ enc->payload_remain = enc->payload_len = payload_len;
+ ws_enc_info(enc, data, "sending");
+
++ /* 4 bytes random */
++
++ result = Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask));
++ if(result)
++ return result;
++
++#ifdef DEBUGBUILD
++ if(getenv("CURL_WS_FORCE_ZERO_MASK"))
++ /* force the bit mask to 0x00000000, effectively disabling masking */
++ memset(&enc->mask, 0, sizeof(enc->mask));
++#endif
++
+ /* add 4 bytes mask */
+ memcpy(&head[hlen], &enc->mask, 4);
+ hlen += 4;
+@@ -802,14 +814,7 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
+ subprotocol not requested by the client), the client MUST Fail
+ the WebSocket Connection. */
+
+- /* 4 bytes random */
+-
+- result = Curl_rand(data, (unsigned char *)&ws->enc.mask,
+- sizeof(ws->enc.mask));
+- if(result)
+- return result;
+- infof(data, "Received 101, switch to WebSocket; mask %02x%02x%02x%02x",
+- ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]);
++ infof(data, "Received 101, switch to WebSocket");
+
+ /* Install our client writer that decodes WS frames payload */
+ result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,
+--
+2.50.1
+
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index ecda13a04e1..0d7aea0978b 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -25,6 +25,7 @@ SRC_URI = " \
file://CVE-2024-11053-0003.patch \
file://CVE-2025-0167.patch \
file://CVE-2025-9086.patch \
+ file://CVE-2025-10148.patch \
file://CVE-2025-14017.patch \
file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \
file://CVE-2025-14819.patch \
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 02/25] curl: patch CVE-2025-14524
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 01/25] curl: fix CVE-2025-10148 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 03/25] expat: patch CVE-2026-24515 Yoann Congal
` (22 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Amaury Couderc <amaury.couderc@est.tech>
Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../curl/curl/CVE-2025-14524.patch | 44 +++++++++++++++++++
meta/recipes-support/curl/curl_8.7.1.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2025-14524.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2025-14524.patch b/meta/recipes-support/curl/curl/CVE-2025-14524.patch
new file mode 100644
index 00000000000..7692130f6e9
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2025-14524.patch
@@ -0,0 +1,44 @@
+From 0bccd8d29c89d70120444088d3893af59f3772bf Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 10 Dec 2025 11:40:47 +0100
+Subject: [PATCH] curl_sasl: if redirected, require permission to use bearer
+
+Closes #19933
+
+CVE: CVE-2025-14524
+Upstream-Status: Backport [https://github.com/curl/curl/commit/1a822275d333dc6da6043497160fd04c8fa48640]
+
+Signed-off-by: Amaury Couderc <amaury.couderc@est.tech>
+---
+ lib/curl_sasl.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c
+index 66639cbacc..fe646548a8 100644
+--- a/lib/curl_sasl.c
++++ b/lib/curl_sasl.c
+@@ -357,7 +357,9 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
+ data->set.str[STRING_SERVICE_NAME] :
+ sasl->params->service;
+ #endif
+- const char *oauth_bearer = data->set.str[STRING_BEARER];
++ const char *oauth_bearer =
++ (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
++ data->set.str[STRING_BEARER] : NULL;
+ struct bufref nullmsg;
+
+ Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
+@@ -544,7 +546,9 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
+ data->set.str[STRING_SERVICE_NAME] :
+ sasl->params->service;
+ #endif
+- const char *oauth_bearer = data->set.str[STRING_BEARER];
++ const char *oauth_bearer =
++ (!data->state.this_is_a_follow || data->set.allow_auth_to_other_hosts) ?
++ data->set.str[STRING_BEARER] : NULL;
+ struct bufref serverdata;
+
+ Curl_conn_get_host(data, FIRSTSOCKET, &hostname, &disp_hostname, &port);
+--
+2.43.0
+
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 0d7aea0978b..9e37684b2cc 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -27,6 +27,7 @@ SRC_URI = " \
file://CVE-2025-9086.patch \
file://CVE-2025-10148.patch \
file://CVE-2025-14017.patch \
+ file://CVE-2025-14524.patch \
file://0001-build-enable-Wcast-qual-fix-or-silence-compiler-warn.patch \
file://CVE-2025-14819.patch \
file://CVE-2025-15079.patch \
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 03/25] expat: patch CVE-2026-24515
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 01/25] curl: fix CVE-2025-10148 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 02/25] curl: patch CVE-2025-14524 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 04/25] expat: patch CVE-2026-25210 Yoann Congal
` (21 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick commits from PR linked in NVD report.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-24515-01.patch | 43 +++++++
.../expat/expat/CVE-2026-24515-02.patch | 117 ++++++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 2 +
3 files changed, 162 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-24515-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-24515-02.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-24515-01.patch b/meta/recipes-core/expat/expat/CVE-2026-24515-01.patch
new file mode 100644
index 00000000000..0250374c76b
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-24515-01.patch
@@ -0,0 +1,43 @@
+From 86fc914a7acc49246d5fde0ab6ed97eb8a0f15f9 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 18 Jan 2026 17:53:37 +0100
+Subject: [PATCH] lib: Make XML_ExternalEntityParserCreate copy unknown
+ encoding handler user data
+
+Patch suggested by Artiphishell Inc.
+
+CVE: CVE-2026-24515
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/86fc914a7acc49246d5fde0ab6ed97eb8a0f15f9]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 593cd90d..18577ee3 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -1749,6 +1749,7 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
+ XML_ExternalEntityRefHandler oldExternalEntityRefHandler;
+ XML_SkippedEntityHandler oldSkippedEntityHandler;
+ XML_UnknownEncodingHandler oldUnknownEncodingHandler;
++ void *oldUnknownEncodingHandlerData;
+ XML_ElementDeclHandler oldElementDeclHandler;
+ XML_AttlistDeclHandler oldAttlistDeclHandler;
+ XML_EntityDeclHandler oldEntityDeclHandler;
+@@ -1794,6 +1795,7 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
+ oldExternalEntityRefHandler = parser->m_externalEntityRefHandler;
+ oldSkippedEntityHandler = parser->m_skippedEntityHandler;
+ oldUnknownEncodingHandler = parser->m_unknownEncodingHandler;
++ oldUnknownEncodingHandlerData = parser->m_unknownEncodingHandlerData;
+ oldElementDeclHandler = parser->m_elementDeclHandler;
+ oldAttlistDeclHandler = parser->m_attlistDeclHandler;
+ oldEntityDeclHandler = parser->m_entityDeclHandler;
+@@ -1854,6 +1856,7 @@ XML_ExternalEntityParserCreate(XML_Parser oldParser, const XML_Char *context,
+ parser->m_externalEntityRefHandler = oldExternalEntityRefHandler;
+ parser->m_skippedEntityHandler = oldSkippedEntityHandler;
+ parser->m_unknownEncodingHandler = oldUnknownEncodingHandler;
++ parser->m_unknownEncodingHandlerData = oldUnknownEncodingHandlerData;
+ parser->m_elementDeclHandler = oldElementDeclHandler;
+ parser->m_attlistDeclHandler = oldAttlistDeclHandler;
+ parser->m_entityDeclHandler = oldEntityDeclHandler;
diff --git a/meta/recipes-core/expat/expat/CVE-2026-24515-02.patch b/meta/recipes-core/expat/expat/CVE-2026-24515-02.patch
new file mode 100644
index 00000000000..7d6758fe095
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-24515-02.patch
@@ -0,0 +1,117 @@
+From 8efea3e255d55c7e0a5b70b226f4652ab00e1a27 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 18 Jan 2026 17:26:31 +0100
+Subject: [PATCH] tests: Cover effect of XML_SetUnknownEncodingHandler user
+ data
+
+CVE: CVE-2026-24515
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/8efea3e255d55c7e0a5b70b226f4652ab00e1a27]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ tests/basic_tests.c | 42 +++++++++++++++++++++++++++++++++++++++
+ tests/handlers.c | 10 ++++++++++
+ tests/handlers.h | 3 +++
+ 3 files changed, 55 insertions(+)
+
+diff --git a/tests/basic_tests.c b/tests/basic_tests.c
+index 0231e094..0ed98d86 100644
+--- a/tests/basic_tests.c
++++ b/tests/basic_tests.c
+@@ -4527,6 +4527,46 @@ START_TEST(test_unknown_encoding_invalid_attr_value) {
+ }
+ END_TEST
+
++START_TEST(test_unknown_encoding_user_data_primary) {
++ // This test is based on ideas contributed by Artiphishell Inc.
++ const char *const text = "<?xml version='1.0' encoding='x-unk'?>\n"
++ "<root />\n";
++ XML_Parser parser = XML_ParserCreate(NULL);
++ XML_SetUnknownEncodingHandler(parser,
++ user_data_checking_unknown_encoding_handler,
++ (void *)(intptr_t)0xC0FFEE);
++
++ assert_true(_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ == XML_STATUS_OK);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
++START_TEST(test_unknown_encoding_user_data_secondary) {
++ // This test is based on ideas contributed by Artiphishell Inc.
++ const char *const text_main = "<!DOCTYPE r [\n"
++ " <!ENTITY ext SYSTEM 'ext.ent'>\n"
++ "]>\n"
++ "<r>&ext;</r>\n";
++ const char *const text_external = "<?xml version='1.0' encoding='x-unk'?>\n"
++ "<e>data</e>";
++ ExtTest2 test_data = {text_external, (int)strlen(text_external), NULL, NULL};
++ XML_Parser parser = XML_ParserCreate(NULL);
++ XML_SetExternalEntityRefHandler(parser, external_entity_loader2);
++ XML_SetUnknownEncodingHandler(parser,
++ user_data_checking_unknown_encoding_handler,
++ (void *)(intptr_t)0xC0FFEE);
++ XML_SetUserData(parser, &test_data);
++
++ assert_true(_XML_Parse_SINGLE_BYTES(parser, text_main, (int)strlen(text_main),
++ XML_TRUE)
++ == XML_STATUS_OK);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ /* Test an external entity parser set to use latin-1 detects UTF-16
+ * BOMs correctly.
+ */
+@@ -6372,6 +6412,8 @@ make_basic_test_case(Suite *s) {
+ tcase_add_test(tc_basic, test_unknown_encoding_invalid_surrogate);
+ tcase_add_test(tc_basic, test_unknown_encoding_invalid_high);
+ tcase_add_test(tc_basic, test_unknown_encoding_invalid_attr_value);
++ tcase_add_test(tc_basic, test_unknown_encoding_user_data_primary);
++ tcase_add_test(tc_basic, test_unknown_encoding_user_data_secondary);
+ tcase_add_test__if_xml_ge(tc_basic, test_ext_entity_latin1_utf16le_bom);
+ tcase_add_test__if_xml_ge(tc_basic, test_ext_entity_latin1_utf16be_bom);
+ tcase_add_test__if_xml_ge(tc_basic, test_ext_entity_latin1_utf16le_bom2);
+diff --git a/tests/handlers.c b/tests/handlers.c
+index 5bca2b1f..d077f688 100644
+--- a/tests/handlers.c
++++ b/tests/handlers.c
+@@ -45,6 +45,7 @@
+ # undef NDEBUG /* because test suite relies on assert(...) at the moment */
+ #endif
+
++#include <stdint.h>
+ #include <stdio.h>
+ #include <string.h>
+ #include <assert.h>
+@@ -407,6 +408,15 @@ long_encoding_handler(void *userData, const XML_Char *encoding,
+ return XML_STATUS_OK;
+ }
+
++int XMLCALL
++user_data_checking_unknown_encoding_handler(void *userData,
++ const XML_Char *encoding,
++ XML_Encoding *info) {
++ const intptr_t number = (intptr_t)userData;
++ assert_true(number == 0xC0FFEE);
++ return long_encoding_handler(userData, encoding, info);
++}
++
+ /* External Entity Handlers */
+
+ int XMLCALL
+diff --git a/tests/handlers.h b/tests/handlers.h
+index fa6267fb..915040e5 100644
+--- a/tests/handlers.h
++++ b/tests/handlers.h
+@@ -159,6 +159,9 @@ extern int XMLCALL long_encoding_handler(void *userData,
+ const XML_Char *encoding,
+ XML_Encoding *info);
+
++extern int XMLCALL user_data_checking_unknown_encoding_handler(
++ void *userData, const XML_Char *encoding, XML_Encoding *info);
++
+ /* External Entity Handlers */
+
+ typedef struct ExtOption {
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index 1d2d818ecf7..a61357e6c14 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -41,6 +41,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2025-59375-22.patch \
file://CVE-2025-59375-23.patch \
file://CVE-2025-59375-24.patch \
+ file://CVE-2026-24515-01.patch \
+ file://CVE-2026-24515-02.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 04/25] expat: patch CVE-2026-25210
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (2 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 03/25] expat: patch CVE-2026-24515 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 05/25] glib-2.0: patch CVE-2026-0988 Yoann Congal
` (20 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patches from [1].
[1] https://github.com/libexpat/libexpat/pull/1075
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-25210-01.patch | 27 +++++++++++++
.../expat/expat/CVE-2026-25210-02.patch | 38 +++++++++++++++++++
.../expat/expat/CVE-2026-25210-03.patch | 28 ++++++++++++++
meta/recipes-core/expat/expat_2.6.4.bb | 3 ++
4 files changed, 96 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-01.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-02.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-25210-03.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-25210-01.patch b/meta/recipes-core/expat/expat/CVE-2026-25210-01.patch
new file mode 100644
index 00000000000..d56e8811915
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-25210-01.patch
@@ -0,0 +1,27 @@
+From 7ddea353ad3795f7222441274d4d9a155b523cba Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 2 Oct 2025 17:15:15 -0700
+Subject: [PATCH] lib: Make a doubling more readable
+
+Suggested-by: Sebastian Pipping <sebastian@pipping.org>
+
+CVE: CVE-2026-25210
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/7ddea353ad3795f7222441274d4d9a155b523cba]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 8cf29257..2f9adffc 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3499,7 +3499,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ tag->name.strLen = convLen;
+ break;
+ }
+- bufSize = (int)(tag->bufEnd - tag->buf) << 1;
++ bufSize = (int)(tag->bufEnd - tag->buf) * 2;
+ {
+ char *temp = REALLOC(parser, tag->buf, bufSize);
+ if (temp == NULL)
diff --git a/meta/recipes-core/expat/expat/CVE-2026-25210-02.patch b/meta/recipes-core/expat/expat/CVE-2026-25210-02.patch
new file mode 100644
index 00000000000..21bd6e4fd0e
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-25210-02.patch
@@ -0,0 +1,38 @@
+From 8855346359a475c022ec8c28484a76c852f144d9 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 2 Oct 2025 17:15:15 -0700
+Subject: [PATCH] lib: Realign a size with the `REALLOC` type signature it is
+ passed into
+
+Note that this implicitly assumes `tag->bufEnd >= tag->buf`, which should
+already be guaranteed true.
+
+CVE: CVE-2026-25210
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/8855346359a475c022ec8c28484a76c852f144d9]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+---
+ lib/xmlparse.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index 2f9adffc..ee18a87f 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3488,7 +3488,6 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ const char *fromPtr = tag->rawName;
+ toPtr = (XML_Char *)tag->buf;
+ for (;;) {
+- int bufSize;
+ int convLen;
+ const enum XML_Convert_Result convert_res
+ = XmlConvert(enc, &fromPtr, rawNameEnd, (ICHAR **)&toPtr,
+@@ -3499,7 +3498,7 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ tag->name.strLen = convLen;
+ break;
+ }
+- bufSize = (int)(tag->bufEnd - tag->buf) * 2;
++ const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2;
+ {
+ char *temp = REALLOC(parser, tag->buf, bufSize);
+ if (temp == NULL)
diff --git a/meta/recipes-core/expat/expat/CVE-2026-25210-03.patch b/meta/recipes-core/expat/expat/CVE-2026-25210-03.patch
new file mode 100644
index 00000000000..46a1618e040
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-25210-03.patch
@@ -0,0 +1,28 @@
+From 9c2d990389e6abe2e44527eeaa8b39f16fe859c7 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 2 Oct 2025 17:15:15 -0700
+Subject: [PATCH] lib: Introduce an integer overflow check for tag buffer
+ reallocation
+
+Suggested-by: Sebastian Pipping <sebastian@pipping.org>
+
+CVE: CVE-2026-25210
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/9c2d990389e6abe2e44527eeaa8b39f16fe859c7]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/xmlparse.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/xmlparse.c b/lib/xmlparse.c
+index ee18a87f..d8c54c38 100644
+--- a/lib/xmlparse.c
++++ b/lib/xmlparse.c
+@@ -3498,6 +3498,8 @@ doContent(XML_Parser parser, int startTagLevel, const ENCODING *enc,
+ tag->name.strLen = convLen;
+ break;
+ }
++ if (SIZE_MAX / 2 < (size_t)(tag->bufEnd - tag->buf))
++ return XML_ERROR_NO_MEMORY;
+ const size_t bufSize = (size_t)(tag->bufEnd - tag->buf) * 2;
+ {
+ char *temp = REALLOC(parser, tag->buf, bufSize);
diff --git a/meta/recipes-core/expat/expat_2.6.4.bb b/meta/recipes-core/expat/expat_2.6.4.bb
index a61357e6c14..048093f010d 100644
--- a/meta/recipes-core/expat/expat_2.6.4.bb
+++ b/meta/recipes-core/expat/expat_2.6.4.bb
@@ -43,6 +43,9 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2025-59375-24.patch \
file://CVE-2026-24515-01.patch \
file://CVE-2026-24515-02.patch \
+ file://CVE-2026-25210-01.patch \
+ file://CVE-2026-25210-02.patch \
+ file://CVE-2026-25210-03.patch \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 05/25] glib-2.0: patch CVE-2026-0988
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (3 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 04/25] expat: patch CVE-2026-25210 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 06/25] inetutils: Fix CVE-2026-24061 Yoann Congal
` (19 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick relevant commit from [2] linked from [1].
[1] https://gitlab.gnome.org/GNOME/glib/-/issues/3851
[2] https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4944
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../glib-2.0/glib-2.0/CVE-2026-0988.patch | 58 +++++++++++++++++++
meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb | 1 +
2 files changed, 59 insertions(+)
create mode 100644 meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-0988.patch
diff --git a/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-0988.patch b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-0988.patch
new file mode 100644
index 00000000000..daf86224d5d
--- /dev/null
+++ b/meta/recipes-core/glib-2.0/glib-2.0/CVE-2026-0988.patch
@@ -0,0 +1,58 @@
+From c5766cff61ffce0b8e787eae09908ac348338e5f Mon Sep 17 00:00:00 2001
+From: Philip Withnall <pwithnall@gnome.org>
+Date: Thu, 18 Dec 2025 23:12:18 +0000
+Subject: [PATCH] gbufferedinputstream: Fix a potential integer overflow in
+ peek()
+
+If the caller provides `offset` and `count` arguments which overflow,
+their sum will overflow and could lead to `memcpy()` reading out more
+memory than expected.
+
+Spotted by Codean Labs.
+
+Signed-off-by: Philip Withnall <pwithnall@gnome.org>
+
+Fixes: #3851
+
+CVE: CVE-2026-0988
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/glib/-/commit/c5766cff61ffce0b8e787eae09908ac348338e5f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ gio/gbufferedinputstream.c | 2 +-
+ gio/tests/buffered-input-stream.c | 10 ++++++++++
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/gio/gbufferedinputstream.c b/gio/gbufferedinputstream.c
+index 9e6bacc62..56d656be0 100644
+--- a/gio/gbufferedinputstream.c
++++ b/gio/gbufferedinputstream.c
+@@ -590,7 +590,7 @@ g_buffered_input_stream_peek (GBufferedInputStream *stream,
+
+ available = g_buffered_input_stream_get_available (stream);
+
+- if (offset > available)
++ if (offset > available || offset > G_MAXSIZE - count)
+ return 0;
+
+ end = MIN (offset + count, available);
+diff --git a/gio/tests/buffered-input-stream.c b/gio/tests/buffered-input-stream.c
+index a1af4eeff..2b2a0d9aa 100644
+--- a/gio/tests/buffered-input-stream.c
++++ b/gio/tests/buffered-input-stream.c
+@@ -60,6 +60,16 @@ test_peek (void)
+ g_assert_cmpint (npeek, ==, 0);
+ g_free (buffer);
+
++ buffer = g_new0 (char, 64);
++ npeek = g_buffered_input_stream_peek (G_BUFFERED_INPUT_STREAM (in), buffer, 8, 0);
++ g_assert_cmpint (npeek, ==, 0);
++ g_free (buffer);
++
++ buffer = g_new0 (char, 64);
++ npeek = g_buffered_input_stream_peek (G_BUFFERED_INPUT_STREAM (in), buffer, 5, G_MAXSIZE);
++ g_assert_cmpint (npeek, ==, 0);
++ g_free (buffer);
++
+ g_object_unref (in);
+ g_object_unref (base);
+ }
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
index c7e18c7bc41..97618d1d40b 100644
--- a/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
+++ b/meta/recipes-core/glib-2.0/glib-2.0_2.78.6.bb
@@ -39,6 +39,7 @@ SRC_URI = "${GNOME_MIRROR}/glib/${SHRT_VER}/glib-${PV}.tar.xz \
file://CVE-2025-14087-02.patch \
file://CVE-2025-14087-03.patch \
file://CVE-2025-14512.patch \
+ file://CVE-2026-0988.patch \
"
SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 06/25] inetutils: Fix CVE-2026-24061
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (4 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 05/25] glib-2.0: patch CVE-2026-0988 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 07/25] libpng: patch CVE-2026-22695 Yoann Congal
` (18 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Vijay Anusuri <vanusuri@mvista.com>
Upstream-Status: Backport from
https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=ccba9f748aa8d50a38d7748e2e60362edd6a32cc
& https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=fd702c02497b2f398e739e3119bed0b23dd7aa7b
Ref: https://lists.gnu.org/archive/html/bug-inetutils/2026-01/msg00004.html
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../inetutils/CVE-2026-24061-1.patch | 41 +++++++++
.../inetutils/CVE-2026-24061-2.patch | 85 +++++++++++++++++++
.../inetutils/inetutils_2.5.bb | 2 +
3 files changed, 128 insertions(+)
create mode 100644 meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-1.patch
create mode 100644 meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-2.patch
diff --git a/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-1.patch b/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-1.patch
new file mode 100644
index 00000000000..f19cb5d18b8
--- /dev/null
+++ b/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-1.patch
@@ -0,0 +1,41 @@
+From fd702c02497b2f398e739e3119bed0b23dd7aa7b Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Tue, 20 Jan 2026 01:10:36 -0800
+Subject: Fix injection bug with bogus user names
+
+Problem reported by Kyu Neushwaistein.
+* telnetd/utility.c (_var_short_name):
+Ignore user names that start with '-' or contain shell metacharacters.
+
+Signed-off-by: Simon Josefsson <simon@josefsson.org>
+
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=fd702c02497b2f398e739e3119bed0b23dd7aa7b]
+CVE: CVE-2026-24061
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ telnetd/utility.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/telnetd/utility.c b/telnetd/utility.c
+index b486226e..c02cd0e6 100644
+--- a/telnetd/utility.c
++++ b/telnetd/utility.c
+@@ -1733,7 +1733,14 @@ _var_short_name (struct line_expander *exp)
+ return user_name ? xstrdup (user_name) : NULL;
+
+ case 'U':
+- return getenv ("USER") ? xstrdup (getenv ("USER")) : xstrdup ("");
++ {
++ /* Ignore user names starting with '-' or containing shell
++ metachars, as they can cause trouble. */
++ char const *u = getenv ("USER");
++ return xstrdup ((u && *u != '-'
++ && !u[strcspn (u, "\t\n !\"#$&'()*;<=>?[\\^`{|}~")])
++ ? u : "");
++ }
+
+ default:
+ exp->state = EXP_STATE_ERROR;
+--
+cgit v1.2.3
+
diff --git a/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-2.patch b/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-2.patch
new file mode 100644
index 00000000000..2a572941904
--- /dev/null
+++ b/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-24061-2.patch
@@ -0,0 +1,85 @@
+From ccba9f748aa8d50a38d7748e2e60362edd6a32cc Mon Sep 17 00:00:00 2001
+From: Simon Josefsson <simon@josefsson.org>
+Date: Tue, 20 Jan 2026 14:02:39 +0100
+Subject: telnetd: Sanitize all variable expansions
+
+* telnetd/utility.c (sanitize): New function.
+(_var_short_name): Use it for all variables.
+
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=ccba9f748aa8d50a38d7748e2e60362edd6a32cc]
+CVE: CVE-2026-24061
+Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
+---
+ telnetd/utility.c | 32 ++++++++++++++++++--------------
+ 1 file changed, 18 insertions(+), 14 deletions(-)
+
+diff --git a/telnetd/utility.c b/telnetd/utility.c
+index c02cd0e6..b21ad961 100644
+--- a/telnetd/utility.c
++++ b/telnetd/utility.c
+@@ -1684,6 +1684,17 @@ static void _expand_cond (struct line_expander *exp);
+ static void _skip_block (struct line_expander *exp);
+ static void _expand_block (struct line_expander *exp);
+
++static char *
++sanitize (const char *u)
++{
++ /* Ignore values starting with '-' or containing shell metachars, as
++ they can cause trouble. */
++ if (u && *u != '-' && !u[strcspn (u, "\t\n !\"#$&'()*;<=>?[\\^`{|}~")])
++ return u;
++ else
++ return "";
++}
++
+ /* Expand a variable referenced by its short one-symbol name.
+ Input: exp->cp points to the variable name.
+ FIXME: not implemented */
+@@ -1710,13 +1721,13 @@ _var_short_name (struct line_expander *exp)
+ return xstrdup (timebuf);
+
+ case 'h':
+- return xstrdup (remote_hostname);
++ return xstrdup (sanitize (remote_hostname));
+
+ case 'l':
+- return xstrdup (local_hostname);
++ return xstrdup (sanitize (local_hostname));
+
+ case 'L':
+- return xstrdup (line);
++ return xstrdup (sanitize (line));
+
+ case 't':
+ q = strchr (line + 1, '/');
+@@ -1724,23 +1735,16 @@ _var_short_name (struct line_expander *exp)
+ q++;
+ else
+ q = line;
+- return xstrdup (q);
++ return xstrdup (sanitize (q));
+
+ case 'T':
+- return terminaltype ? xstrdup (terminaltype) : NULL;
++ return terminaltype ? xstrdup (sanitize (terminaltype)) : NULL;
+
+ case 'u':
+- return user_name ? xstrdup (user_name) : NULL;
++ return user_name ? xstrdup (sanitize (user_name)) : NULL;
+
+ case 'U':
+- {
+- /* Ignore user names starting with '-' or containing shell
+- metachars, as they can cause trouble. */
+- char const *u = getenv ("USER");
+- return xstrdup ((u && *u != '-'
+- && !u[strcspn (u, "\t\n !\"#$&'()*;<=>?[\\^`{|}~")])
+- ? u : "");
+- }
++ return xstrdup (sanitize (getenv ("USER")));
+
+ default:
+ exp->state = EXP_STATE_ERROR;
+--
+cgit v1.2.3
+
diff --git a/meta/recipes-connectivity/inetutils/inetutils_2.5.bb b/meta/recipes-connectivity/inetutils/inetutils_2.5.bb
index 0f1a0736bd4..486878022f0 100644
--- a/meta/recipes-connectivity/inetutils/inetutils_2.5.bb
+++ b/meta/recipes-connectivity/inetutils/inetutils_2.5.bb
@@ -18,6 +18,8 @@ SRC_URI = "${GNU_MIRROR}/inetutils/inetutils-${PV}.tar.xz \
file://rsh.xinetd.inetutils \
file://telnet.xinetd.inetutils \
file://tftpd.xinetd.inetutils \
+ file://CVE-2026-24061-1.patch \
+ file://CVE-2026-24061-2.patch \
"
inherit autotools gettext update-alternatives texinfo
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 07/25] libpng: patch CVE-2026-22695
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (5 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 06/25] inetutils: Fix CVE-2026-24061 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 08/25] libpng: patch CVE-2026-22801 Yoann Congal
` (17 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick commit per [1].
This CVE is regression of fix for CVE-2025-65018.
[1] https://security-tracker.debian.org/tracker/CVE-2026-22695
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libpng/files/CVE-2026-22695.patch | 77 +++++++++++++++++++
.../libpng/libpng_1.6.42.bb | 1 +
2 files changed, 78 insertions(+)
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-22695.patch
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-22695.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-22695.patch
new file mode 100644
index 00000000000..6456b6c4917
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2026-22695.patch
@@ -0,0 +1,77 @@
+From e4f7ad4ea2a471776c81dda4846b7691925d9786 Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Fri, 9 Jan 2026 20:51:53 +0200
+Subject: [PATCH] Fix a heap buffer over-read in `png_image_read_direct_scaled`
+
+Fix a regression from commit 218612ddd6b17944e21eda56caf8b4bf7779d1ea.
+
+The function `png_image_read_direct_scaled`, introduced by the fix for
+CVE-2025-65018, copies transformed row data from an intermediate buffer
+(`local_row`) to the user's output buffer. The copy incorrectly used
+`row_bytes` (the caller's stride) as the size parameter to memcpy, even
+though `local_row` is only `png_get_rowbytes()` bytes long.
+
+This causes a heap buffer over-read when:
+
+1. The caller provides a padded stride (e.g., for memory alignment):
+ memcpy reads past the end of `local_row` by `stride - row_width`
+ bytes.
+
+2. The caller provides a negative stride (for bottom-up layouts):
+ casting ptrdiff_t to size_t produces ~2^64, causing memcpy to
+ attempt reading exabytes, resulting in an immediate crash.
+
+The fix consists in using the size of the row buffer for the copy and
+using the stride for pointer advancement only.
+
+Reported-by: Petr Simecek <simecek@users.noreply.github.com>
+Analyzed-by: Stanislav Fort
+Analyzed-by: Pavel Kohout
+Co-authored-by: Petr Simecek <simecek@users.noreply.github.com>
+Signed-off-by: Cosmin Truta <ctruta@gmail.com>
+
+CVE: CVE-2026-22695
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/e4f7ad4ea2a471776c81dda4846b7691925d9786]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ AUTHORS | 1 +
+ pngread.c | 4 +++-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/AUTHORS b/AUTHORS
+index 26b7bb50f..b9c0fffcf 100644
+--- a/AUTHORS
++++ b/AUTHORS
+@@ -23,6 +23,7 @@ Authors, for copyright and licensing purposes.
+ * Mike Klein
+ * Pascal Massimino
+ * Paul Schmidt
++ * Petr Simecek
+ * Philippe Antoine
+ * Qiang Zhou
+ * Sam Bushell
+diff --git a/pngread.c b/pngread.c
+index e3426292b..9d86b01dc 100644
+--- a/pngread.c
++++ b/pngread.c
+@@ -3270,9 +3270,11 @@ png_image_read_direct_scaled(png_voidp argument)
+ argument);
+ png_imagep image = display->image;
+ png_structrp png_ptr = image->opaque->png_ptr;
++ png_inforp info_ptr = image->opaque->info_ptr;
+ png_bytep local_row = png_voidcast(png_bytep, display->local_row);
+ png_bytep first_row = png_voidcast(png_bytep, display->first_row);
+ ptrdiff_t row_bytes = display->row_bytes;
++ size_t copy_bytes = png_get_rowbytes(png_ptr, info_ptr);
+ int passes;
+
+ /* Handle interlacing. */
+@@ -3302,7 +3304,7 @@ png_image_read_direct_scaled(png_voidp argument)
+ png_read_row(png_ptr, local_row, NULL);
+
+ /* Copy from local_row to user buffer. */
+- memcpy(output_row, local_row, (size_t)row_bytes);
++ memcpy(output_row, local_row, copy_bytes);
+ output_row += row_bytes;
+ }
+ }
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
index 6dc7ffe2722..fe99e5df092 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
@@ -21,6 +21,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz
file://CVE-2025-65018-02.patch \
file://CVE-2025-66293-01.patch \
file://CVE-2025-66293-02.patch \
+ file://CVE-2026-22695.patch \
"
SRC_URI[sha256sum] = "c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 08/25] libpng: patch CVE-2026-22801
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (6 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 07/25] libpng: patch CVE-2026-22695 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 09/25] libtasn1: Fix CVE-2025-13151 Yoann Congal
` (16 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick comit per [1].
[1] https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libpng/files/CVE-2026-22801.patch | 173 ++++++++++++++++++
.../libpng/libpng_1.6.42.bb | 1 +
2 files changed, 174 insertions(+)
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-22801.patch
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-22801.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-22801.patch
new file mode 100644
index 00000000000..8a611ac7494
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2026-22801.patch
@@ -0,0 +1,173 @@
+From cf155de014fc6c5cb199dd681dd5c8fb70429072 Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Sat, 10 Jan 2026 15:20:18 +0200
+Subject: [PATCH] fix: Remove incorrect truncation casts from
+ `png_write_image_*`
+
+The type of the row stride (`display->row_bytes`) is ptrdiff_t. Casting
+to png_uint_16 before division will truncate large strides, causing
+incorrect pointer arithmetic for images exceeding 65535 bytes per row.
+For bottom-up images (negative stride), the truncation also corrupts
+the sign, advancing the row pointer forward instead of backward.
+
+Remove the erroneous casts and let the compiler handle the pointer
+arithmetic correctly. Also replace `sizeof (png_uint_16)` with 2.
+
+Add regression test via `pngstest --stride-extra N` where N > 32767
+triggers the affected code paths.
+
+A NOTE ABOUT HISTORY:
+The original code in libpng 1.5.6 (2011) had no such casts. They were
+introduced in libpng 1.6.26 (2016), likely to silence compiler warnings
+on 16-bit systems where the cast would be a no-op. On 32/64-bit systems
+the cast truncates the strides above 65535 and corrupts the negative
+strides.
+
+CVE: CVE-2026-22801
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/cf155de014fc6c5cb199dd681dd5c8fb70429072]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ CMakeLists.txt | 9 ++++++++-
+ contrib/libtests/pngstest.c | 29 ++++++++++++++++++++++++++++-
+ pngwrite.c | 10 +++++-----
+ tests/pngstest-large-stride | 8 ++++++++
+ 4 files changed, 49 insertions(+), 7 deletions(-)
+ create mode 100755 tests/pngstest-large-stride
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index a8cd82402..a595ed91d 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1,7 +1,7 @@
+
+ # CMakeLists.txt - CMake lists for libpng
+ #
+-# Copyright (c) 2018-2024 Cosmin Truta.
++# Copyright (c) 2018-2026 Cosmin Truta
+ # Copyright (c) 2007-2018 Glenn Randers-Pehrson.
+ # Originally written by Christian Ehrlicher, 2007.
+ #
+@@ -859,6 +859,13 @@ if(PNG_TESTS AND PNG_SHARED)
+ endforeach()
+ endforeach()
+
++ # Regression test:
++ # Use stride_extra > 32767 to trigger row_bytes > 65535 for linear images.
++ png_add_test(NAME pngstest-large-stride
++ COMMAND pngstest
++ OPTIONS --stride-extra 33000 --tmpfile "large-stride-" --log
++ FILES "${CMAKE_CURRENT_SOURCE_DIR}/contrib/testpngs/rgb-alpha-16-linear.png")
++
+ add_executable(pngunknown ${pngunknown_sources})
+ target_link_libraries(pngunknown PRIVATE png_shared)
+
+diff --git a/contrib/libtests/pngstest.c b/contrib/libtests/pngstest.c
+index ff4c2b24a..2f29afee2 100644
+--- a/contrib/libtests/pngstest.c
++++ b/contrib/libtests/pngstest.c
+@@ -1,7 +1,7 @@
+
+ /* pngstest.c
+ *
+- * Copyright (c) 2021 Cosmin Truta
++ * Copyright (c) 2021-2026 Cosmin Truta
+ * Copyright (c) 2013-2017 John Cunningham Bowler
+ *
+ * This code is released under the libpng license.
+@@ -3571,6 +3571,33 @@ main(int argc, char **argv)
+ opts |= NO_RESEED;
+ else if (strcmp(arg, "--fault-gbg-warning") == 0)
+ opts |= GBG_ERROR;
++ else if (strcmp(arg, "--stride-extra") == 0)
++ {
++ if (c+1 < argc)
++ {
++ char *ep;
++ unsigned long val = strtoul(argv[++c], &ep, 0);
++
++ if (ep > argv[c] && *ep == 0 && val <= 65535)
++ stride_extra = (int)val;
++
++ else
++ {
++ fflush(stdout);
++ fprintf(stderr, "%s: bad argument for --stride-extra: %s\n",
++ argv[0], argv[c]);
++ exit(99);
++ }
++ }
++
++ else
++ {
++ fflush(stdout);
++ fprintf(stderr, "%s: missing argument for --stride-extra\n",
++ argv[0]);
++ exit(99);
++ }
++ }
+ else if (strcmp(arg, "--tmpfile") == 0)
+ {
+ if (c+1 < argc)
+diff --git a/pngwrite.c b/pngwrite.c
+index 08066bcc4..a95b846c8 100644
+--- a/pngwrite.c
++++ b/pngwrite.c
+@@ -1,7 +1,7 @@
+
+ /* pngwrite.c - general routines to write a PNG file
+ *
+- * Copyright (c) 2018-2024 Cosmin Truta
++ * Copyright (c) 2018-2026 Cosmin Truta
+ * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
+ * Copyright (c) 1996-1997 Andreas Dilger
+ * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
+@@ -1645,7 +1645,7 @@ png_write_image_16bit(png_voidp argument)
+ }
+
+ png_write_row(png_ptr, png_voidcast(png_const_bytep, display->local_row));
+- input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
++ input_row += display->row_bytes / 2;
+ }
+
+ return 1;
+@@ -1771,7 +1771,7 @@ png_write_image_8bit(png_voidp argument)
+
+ png_write_row(png_ptr, png_voidcast(png_const_bytep,
+ display->local_row));
+- input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
++ input_row += display->row_bytes / 2;
+ } /* while y */
+ }
+
+@@ -1796,7 +1796,7 @@ png_write_image_8bit(png_voidp argument)
+ }
+
+ png_write_row(png_ptr, output_row);
+- input_row += (png_uint_16)display->row_bytes/(sizeof (png_uint_16));
++ input_row += display->row_bytes / 2;
+ }
+ }
+
+@@ -2115,7 +2115,7 @@ png_image_write_main(png_voidp argument)
+ ptrdiff_t row_bytes = display->row_stride;
+
+ if (linear != 0)
+- row_bytes *= (sizeof (png_uint_16));
++ row_bytes *= 2;
+
+ if (row_bytes < 0)
+ row += (image->height-1) * (-row_bytes);
+diff --git a/tests/pngstest-large-stride b/tests/pngstest-large-stride
+new file mode 100755
+index 000000000..7958c5b42
+--- /dev/null
++++ b/tests/pngstest-large-stride
+@@ -0,0 +1,8 @@
++#!/bin/sh
++
++# Regression test:
++# Use stride_extra > 32767 to trigger row_bytes > 65535 for linear images.
++exec ./pngstest \
++ --stride-extra 33000 \
++ --tmpfile "large-stride-" \
++ --log "${srcdir}/contrib/testpngs/rgb-alpha-16-linear.png"
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
index fe99e5df092..0e375a0ce84 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.42.bb
@@ -22,6 +22,7 @@ SRC_URI = "${SOURCEFORGE_MIRROR}/project/${BPN}/${BPN}${LIBV}/${PV}/${BP}.tar.xz
file://CVE-2025-66293-01.patch \
file://CVE-2025-66293-02.patch \
file://CVE-2026-22695.patch \
+ file://CVE-2026-22801.patch \
"
SRC_URI[sha256sum] = "c919dbc11f4c03b05aba3f8884d8eb7adfe3572ad228af972bb60057bdb48450"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 09/25] libtasn1: Fix CVE-2025-13151
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (7 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 08/25] libpng: patch CVE-2026-22801 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 10/25] libxml2: patch CVE-2026-0989 Yoann Congal
` (15 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Upstream-Status: Backport from https://gitlab.com/gnutls/libtasn1/-/commit/d276cc495a2a32b182c3c39851f1ba58f2d9f9b8
Signed-off-by: Bruno VERNAY <bruno.vernay@se.com>
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gnutls/libtasn1/CVE-2025-13151.patch | 30 +++++++++++++++++++
.../recipes-support/gnutls/libtasn1_4.20.0.bb | 1 +
2 files changed, 31 insertions(+)
create mode 100644 meta/recipes-support/gnutls/libtasn1/CVE-2025-13151.patch
diff --git a/meta/recipes-support/gnutls/libtasn1/CVE-2025-13151.patch b/meta/recipes-support/gnutls/libtasn1/CVE-2025-13151.patch
new file mode 100644
index 00000000000..5047d679840
--- /dev/null
+++ b/meta/recipes-support/gnutls/libtasn1/CVE-2025-13151.patch
@@ -0,0 +1,30 @@
+From ff7aa7ef2b9ba41df8f2d1e71b05bf2c2ad868dd Mon Sep 17 00:00:00 2001
+From: Vijay Sarvepalli <vssarvepalli@cert.org>
+Date: Mon, 22 Dec 2025 12:24:27 -0500
+Subject: [PATCH] Fix for CVE-2025-13151 Buffer overflow
+
+Upstream-Status: Backport [https://gitlab.com/gnutls/libtasn1/-/commit/d276cc495a2a32b182c3c39851f1ba58f2d9f9b8]
+CVE: CVE-2025-13151
+
+Signed-off-by: Simon Josefsson <simon@josefsson.org>
+Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
+---
+ lib/decoding.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/decoding.c b/lib/decoding.c
+index 1e0fcb3..abcb49f 100644
+--- a/lib/decoding.c
++++ b/lib/decoding.c
+@@ -1983,7 +1983,7 @@ int
+ asn1_expand_octet_string (asn1_node_const definitions, asn1_node *element,
+ const char *octetName, const char *objectName)
+ {
+- char name[2 * ASN1_MAX_NAME_SIZE + 1], value[ASN1_MAX_NAME_SIZE];
++ char name[2 * ASN1_MAX_NAME_SIZE + 2], value[ASN1_MAX_NAME_SIZE];
+ int retCode = ASN1_SUCCESS, result;
+ int len, len2, len3;
+ asn1_node_const p2;
+--
+2.47.1
+
diff --git a/meta/recipes-support/gnutls/libtasn1_4.20.0.bb b/meta/recipes-support/gnutls/libtasn1_4.20.0.bb
index 8127ba5b1db..bfc011a2f17 100644
--- a/meta/recipes-support/gnutls/libtasn1_4.20.0.bb
+++ b/meta/recipes-support/gnutls/libtasn1_4.20.0.bb
@@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=1ebbd3e34237af26da5dc08a4e440464 \
SRC_URI = "${GNU_MIRROR}/libtasn1/libtasn1-${PV}.tar.gz \
file://dont-depend-on-help2man.patch \
+ file://CVE-2025-13151.patch \
"
DEPENDS = "bison-native"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 10/25] libxml2: patch CVE-2026-0989
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (8 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 09/25] libtasn1: Fix CVE-2025-13151 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 11/25] libxml2: patch CVE-2026-0990 Yoann Congal
` (14 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch from [1] linked from [2].
[1] https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/374
[2] https://gitlab.gnome.org/GNOME/libxml2/-/issues/998
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libxml/libxml2/CVE-2026-0989.patch | 309 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 +
2 files changed, 310 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0989.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0989.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0989.patch
new file mode 100644
index 00000000000..66ff1219ded
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0989.patch
@@ -0,0 +1,309 @@
+From 19549c61590c1873468c53e0026a2fbffae428ef Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Fri, 10 Oct 2025 09:38:31 +0200
+Subject: [PATCH] Add RelaxNG include limit
+
+This patch adds a default xmlRelaxNGIncludeLimit of 1.000, and that
+limit can be modified at runtime with the env variable
+RNG_INCLUDE_LIMIT.
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/998
+
+CVE: CVE-2026-0989
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/19549c61590c1873468c53e0026a2fbffae428ef]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ include/libxml/relaxng.h | 4 ++
+ relaxng.c | 63 ++++++++++++++++++++--
+ runtest.c | 67 ++++++++++++++++++++++++
+ test/relaxng/include/include-limit.rng | 4 ++
+ test/relaxng/include/include-limit_1.rng | 4 ++
+ test/relaxng/include/include-limit_2.rng | 4 ++
+ test/relaxng/include/include-limit_3.rng | 8 +++
+ 7 files changed, 150 insertions(+), 4 deletions(-)
+ create mode 100644 test/relaxng/include/include-limit.rng
+ create mode 100644 test/relaxng/include/include-limit_1.rng
+ create mode 100644 test/relaxng/include/include-limit_2.rng
+ create mode 100644 test/relaxng/include/include-limit_3.rng
+
+diff --git a/include/libxml/relaxng.h b/include/libxml/relaxng.h
+index eafc6604..099dacd8 100644
+--- a/include/libxml/relaxng.h
++++ b/include/libxml/relaxng.h
+@@ -138,6 +138,10 @@ XMLPUBFUN int
+ xmlRelaxParserSetFlag (xmlRelaxNGParserCtxtPtr ctxt,
+ int flag);
+
++XMLPUBFUN int
++ xmlRelaxParserSetIncLImit (xmlRelaxNGParserCtxt *ctxt,
++ int limit);
++
+ XMLPUBFUN void
+ xmlRelaxNGFreeParserCtxt (xmlRelaxNGParserCtxtPtr ctxt);
+ XMLPUBFUN void
+diff --git a/relaxng.c b/relaxng.c
+index 1d74ba9f..c0e94a3c 100644
+--- a/relaxng.c
++++ b/relaxng.c
+@@ -18,6 +18,8 @@
+
+ #ifdef LIBXML_SCHEMAS_ENABLED
+
++#include <errno.h>
++#include <stdlib.h>
+ #include <string.h>
+ #include <stdio.h>
+ #include <stddef.h>
+@@ -44,6 +46,12 @@
+ static const xmlChar *xmlRelaxNGNs = (const xmlChar *)
+ "http://relaxng.org/ns/structure/1.0";
+
++/*
++ * Default include limit, this can be override with RNG_INCLUDE_LIMIT
++ * env variable
++ */
++static const int _xmlRelaxNGIncludeLimit = 1000;
++
+ #define IS_RELAXNG(node, typ) \
+ ((node != NULL) && (node->ns != NULL) && \
+ (node->type == XML_ELEMENT_NODE) && \
+@@ -225,6 +233,7 @@ struct _xmlRelaxNGParserCtxt {
+ int incNr; /* Depth of the include parsing stack */
+ int incMax; /* Max depth of the parsing stack */
+ xmlRelaxNGIncludePtr *incTab; /* array of incs */
++ int incLimit; /* Include limit, to avoid stack-overflow on parse */
+
+ int idref; /* requires idref checking */
+
+@@ -1410,6 +1419,23 @@ xmlRelaxParserSetFlag(xmlRelaxNGParserCtxtPtr ctxt, int flags)
+ return(0);
+ }
+
++/**
++ * Semi private function used to set the include recursion limit to a
++ * parser context. Set to 0 to use the default value.
++ *
++ * @param ctxt a RelaxNG parser context
++ * @param limit the new include depth limit
++ * @returns 0 if success and -1 in case of error
++ */
++int
++xmlRelaxParserSetIncLImit(xmlRelaxNGParserCtxt *ctxt, int limit)
++{
++ if (ctxt == NULL) return(-1);
++ if (limit < 0) return(-1);
++ ctxt->incLimit = limit;
++ return(0);
++}
++
+ /************************************************************************
+ * *
+ * Document functions *
+@@ -1425,7 +1451,7 @@ static xmlDocPtr xmlRelaxNGCleanupDoc(xmlRelaxNGParserCtxtPtr ctxt,
+ *
+ * Pushes a new include on top of the include stack
+ *
+- * Returns 0 in case of error, the index in the stack otherwise
++ * Returns -1 in case of error, the index in the stack otherwise
+ */
+ static int
+ xmlRelaxNGIncludePush(xmlRelaxNGParserCtxtPtr ctxt,
+@@ -1439,9 +1465,15 @@ xmlRelaxNGIncludePush(xmlRelaxNGParserCtxtPtr ctxt,
+ sizeof(ctxt->incTab[0]));
+ if (ctxt->incTab == NULL) {
+ xmlRngPErrMemory(ctxt, "allocating include\n");
+- return (0);
++ return (-1);
+ }
+ }
++ if (ctxt->incNr >= ctxt->incLimit) {
++ xmlRngPErr(ctxt, (xmlNodePtr)value->doc, XML_RNGP_PARSE_ERROR,
++ "xmlRelaxNG: inclusion recursion limit reached\n", NULL, NULL);
++ return(-1);
++ }
++
+ if (ctxt->incNr >= ctxt->incMax) {
+ ctxt->incMax *= 2;
+ ctxt->incTab =
+@@ -1450,7 +1482,7 @@ xmlRelaxNGIncludePush(xmlRelaxNGParserCtxtPtr ctxt,
+ sizeof(ctxt->incTab[0]));
+ if (ctxt->incTab == NULL) {
+ xmlRngPErrMemory(ctxt, "allocating include\n");
+- return (0);
++ return (-1);
+ }
+ }
+ ctxt->incTab[ctxt->incNr] = value;
+@@ -1620,7 +1652,9 @@ xmlRelaxNGLoadInclude(xmlRelaxNGParserCtxtPtr ctxt, const xmlChar * URL,
+ /*
+ * push it on the stack
+ */
+- xmlRelaxNGIncludePush(ctxt, ret);
++ if (xmlRelaxNGIncludePush(ctxt, ret) < 0) {
++ return (NULL);
++ }
+
+ /*
+ * Some preprocessing of the document content, this include recursing
+@@ -7357,11 +7391,32 @@ xmlRelaxNGParse(xmlRelaxNGParserCtxtPtr ctxt)
+ xmlDocPtr doc;
+ xmlNodePtr root;
+
++ const char *include_limit_env = getenv("RNG_INCLUDE_LIMIT");
++
+ xmlRelaxNGInitTypes();
+
+ if (ctxt == NULL)
+ return (NULL);
+
++ if (ctxt->incLimit == 0) {
++ ctxt->incLimit = _xmlRelaxNGIncludeLimit;
++ if (include_limit_env != NULL) {
++ char *strEnd;
++ unsigned long val = 0;
++ errno = 0;
++ val = strtoul(include_limit_env, &strEnd, 10);
++ if (errno != 0 || *strEnd != 0 || val > INT_MAX) {
++ xmlRngPErr(ctxt, NULL, XML_RNGP_PARSE_ERROR,
++ "xmlRelaxNGParse: invalid RNG_INCLUDE_LIMIT %s\n",
++ (const xmlChar*)include_limit_env,
++ NULL);
++ return(NULL);
++ }
++ if (val)
++ ctxt->incLimit = val;
++ }
++ }
++
+ /*
+ * First step is to parse the input document into an DOM/Infoset
+ */
+diff --git a/runtest.c b/runtest.c
+index 49519aef..45109f0a 100644
+--- a/runtest.c
++++ b/runtest.c
+@@ -3781,6 +3781,70 @@ rngTest(const char *filename,
+ return(ret);
+ }
+
++/**
++ * Parse an RNG schemas with a custom RNG_INCLUDE_LIMIT
++ *
++ * @param filename the schemas file
++ * @param result the file with expected result
++ * @param err the file with error messages
++ * @returns 0 in case of success, an error code otherwise
++ */
++static int
++rngIncludeTest(const char *filename,
++ const char *resul ATTRIBUTE_UNUSED,
++ const char *errr ATTRIBUTE_UNUSED,
++ int options ATTRIBUTE_UNUSED) {
++ xmlRelaxNGParserCtxtPtr ctxt;
++ xmlRelaxNGPtr schemas;
++ int ret = 0;
++
++ /* first compile the schemas if possible */
++ ctxt = xmlRelaxNGNewParserCtxt(filename);
++ xmlRelaxNGSetParserStructuredErrors(ctxt, testStructuredErrorHandler,
++ NULL);
++
++ /* Should work */
++ schemas = xmlRelaxNGParse(ctxt);
++ if (schemas == NULL) {
++ testErrorHandler(NULL, "Relax-NG schema %s failed to compile\n",
++ filename);
++ ret = -1;
++ goto done;
++ }
++ xmlRelaxNGFree(schemas);
++ xmlRelaxNGFreeParserCtxt(ctxt);
++
++ ctxt = xmlRelaxNGNewParserCtxt(filename);
++ /* Should fail */
++ xmlRelaxParserSetIncLImit(ctxt, 2);
++ xmlRelaxNGSetParserStructuredErrors(ctxt, testStructuredErrorHandler,
++ NULL);
++ schemas = xmlRelaxNGParse(ctxt);
++ if (schemas != NULL) {
++ ret = -1;
++ xmlRelaxNGFree(schemas);
++ }
++ xmlRelaxNGFreeParserCtxt(ctxt);
++
++ ctxt = xmlRelaxNGNewParserCtxt(filename);
++ /* Should work */
++ xmlRelaxParserSetIncLImit(ctxt, 3);
++ xmlRelaxNGSetParserStructuredErrors(ctxt, testStructuredErrorHandler,
++ NULL);
++ schemas = xmlRelaxNGParse(ctxt);
++ if (schemas == NULL) {
++ testErrorHandler(NULL, "Relax-NG schema %s failed to compile\n",
++ filename);
++ ret = -1;
++ goto done;
++ }
++ xmlRelaxNGFree(schemas);
++
++done:
++ xmlRelaxNGFreeParserCtxt(ctxt);
++ return(ret);
++}
++
+ #ifdef LIBXML_READER_ENABLED
+ /**
+ * rngStreamTest:
+@@ -5112,6 +5176,9 @@ testDesc testDescriptions[] = {
+ { "Relax-NG regression tests" ,
+ rngTest, "./test/relaxng/*.rng", NULL, NULL, NULL,
+ XML_PARSE_DTDATTR | XML_PARSE_NOENT },
++ { "Relax-NG include limit tests" ,
++ rngIncludeTest, "./test/relaxng/include/include-limit.rng", NULL, NULL, NULL,
++ 0 },
+ #ifdef LIBXML_READER_ENABLED
+ { "Relax-NG streaming regression tests" ,
+ rngStreamTest, "./test/relaxng/*.rng", NULL, NULL, NULL,
+diff --git a/test/relaxng/include/include-limit.rng b/test/relaxng/include/include-limit.rng
+new file mode 100644
+index 00000000..51f03942
+--- /dev/null
++++ b/test/relaxng/include/include-limit.rng
+@@ -0,0 +1,4 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<grammar xmlns="http://relaxng.org/ns/structure/1.0">
++ <include href="include-limit_1.rng"/>
++</grammar>
+diff --git a/test/relaxng/include/include-limit_1.rng b/test/relaxng/include/include-limit_1.rng
+new file mode 100644
+index 00000000..4672da38
+--- /dev/null
++++ b/test/relaxng/include/include-limit_1.rng
+@@ -0,0 +1,4 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<grammar xmlns="http://relaxng.org/ns/structure/1.0">
++ <include href="include-limit_2.rng"/>
++</grammar>
+diff --git a/test/relaxng/include/include-limit_2.rng b/test/relaxng/include/include-limit_2.rng
+new file mode 100644
+index 00000000..b35ecaa8
+--- /dev/null
++++ b/test/relaxng/include/include-limit_2.rng
+@@ -0,0 +1,4 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<grammar xmlns="http://relaxng.org/ns/structure/1.0">
++ <include href="include-limit_3.rng"/>
++</grammar>
+diff --git a/test/relaxng/include/include-limit_3.rng b/test/relaxng/include/include-limit_3.rng
+new file mode 100644
+index 00000000..86213c62
+--- /dev/null
++++ b/test/relaxng/include/include-limit_3.rng
+@@ -0,0 +1,8 @@
++<?xml version="1.0" encoding="UTF-8"?>
++<grammar xmlns="http://relaxng.org/ns/structure/1.0">
++ <start>
++ <element name="root">
++ <empty/>
++ </element>
++ </start>
++</grammar>
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 101be545c0d..396be51d994 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -25,6 +25,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2025-49795.patch \
file://CVE-2025-6170.patch \
file://CVE-2025-7425.patch \
+ file://CVE-2026-0989.patch \
"
SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 11/25] libxml2: patch CVE-2026-0990
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (9 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 10/25] libxml2: patch CVE-2026-0989 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 12/25] libxml2: patch CVE-2026-0992 Yoann Congal
` (13 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch which closed [1].
[1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libxml/libxml2/CVE-2026-0990.patch | 76 +++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 +
2 files changed, 77 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
new file mode 100644
index 00000000000..d001da19bcc
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0990.patch
@@ -0,0 +1,76 @@
+From 1961208e958ca22f80a0b4e4c9d71cfa050aa982 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Wed, 17 Dec 2025 15:24:08 +0100
+Subject: [PATCH] catalog: prevent inf recursion in xmlCatalogXMLResolveURI
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018
+
+CVE: CVE-2026-0989
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1961208e958ca22f80a0b4e4c9d71cfa050aa982]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ catalog.c | 31 +++++++++++++++++++++++--------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+diff --git a/catalog.c b/catalog.c
+index 76c063a8..46b877e6 100644
+--- a/catalog.c
++++ b/catalog.c
+@@ -2086,12 +2086,21 @@ static xmlChar *
+ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
+ xmlChar *ret = NULL;
+ xmlChar *urnID = NULL;
++ xmlCatalogEntryPtr cur = NULL;
+
+ if (catal == NULL)
+ return(NULL);
+ if (URI == NULL)
+ return(NULL);
+
++ if (catal->depth > MAX_CATAL_DEPTH) {
++ xmlCatalogErr(catal, NULL, XML_CATALOG_RECURSION,
++ "Detected recursion in catalog %s\n",
++ catal->name, NULL, NULL);
++ return(NULL);
++ }
++ catal->depth++;
++
+ if (!xmlStrncmp(URI, BAD_CAST XML_URN_PUBID, sizeof(XML_URN_PUBID) - 1)) {
+ urnID = xmlCatalogUnWrapURN(URI);
+ if (xmlDebugCatalogs) {
+@@ -2105,21 +2114,27 @@ xmlCatalogListXMLResolveURI(xmlCatalogEntryPtr catal, const xmlChar *URI) {
+ ret = xmlCatalogListXMLResolve(catal, urnID, NULL);
+ if (urnID != NULL)
+ xmlFree(urnID);
++ catal->depth--;
+ return(ret);
+ }
+- while (catal != NULL) {
+- if (catal->type == XML_CATA_CATALOG) {
+- if (catal->children == NULL) {
+- xmlFetchXMLCatalogFile(catal);
++ cur = catal;
++ while (cur != NULL) {
++ if (cur->type == XML_CATA_CATALOG) {
++ if (cur->children == NULL) {
++ xmlFetchXMLCatalogFile(cur);
+ }
+- if (catal->children != NULL) {
+- ret = xmlCatalogXMLResolveURI(catal->children, URI);
+- if (ret != NULL)
++ if (cur->children != NULL) {
++ ret = xmlCatalogXMLResolveURI(cur->children, URI);
++ if (ret != NULL) {
++ catal->depth--;
+ return(ret);
++ }
+ }
+ }
+- catal = catal->next;
++ cur = cur->next;
+ }
++
++ catal->depth--;
+ return(ret);
+ }
+
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 396be51d994..6a03fc3f6c7 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -26,6 +26,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2025-6170.patch \
file://CVE-2025-7425.patch \
file://CVE-2026-0989.patch \
+ file://CVE-2026-0990.patch \
"
SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 12/25] libxml2: patch CVE-2026-0992
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (10 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 11/25] libxml2: patch CVE-2026-0990 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 13/25] libxml2: add follow-up patch for CVE-2026-0992 Yoann Congal
` (12 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch which closed [1].
Adapt for missing xmlCatalogPrintDebug per [2].
[1] https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019
[2] https://gitlab.gnome.org/GNOME/libxml2/-/commit/728869809eb7eee1b1681d558b4b506a8019c151
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libxml/libxml2/CVE-2026-0992.patch | 49 +++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.12.10.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch
new file mode 100644
index 00000000000..b335dafb634
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch
@@ -0,0 +1,49 @@
+From f75abfcaa419a740a3191e56c60400f3ff18988d Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Fri, 19 Dec 2025 11:02:18 +0100
+Subject: [PATCH] catalog: Ignore repeated nextCatalog entries
+
+This patch makes the catalog parsing to ignore repeated entries of
+nextCatalog with the same value.
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019
+
+CVE: CVE-2026-0989
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/f75abfcaa419a740a3191e56c60400f3ff18988d]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ catalog.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/catalog.c b/catalog.c
+index 46b877e6..fa6d77ca 100644
+--- a/catalog.c
++++ b/catalog.c
+@@ -1266,9 +1266,27 @@ xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer,
+ BAD_CAST "delegateURI", BAD_CAST "uriStartString",
+ BAD_CAST "catalog", prefer, cgroup);
+ } else if (xmlStrEqual(cur->name, BAD_CAST "nextCatalog")) {
++ xmlCatalogEntryPtr prev = parent->children;
++
+ entry = xmlParseXMLCatalogOneNode(cur, XML_CATA_NEXT_CATALOG,
+ BAD_CAST "nextCatalog", NULL,
+ BAD_CAST "catalog", prefer, cgroup);
++ /* Avoid duplication of nextCatalog */
++ while (prev != NULL) {
++ if ((prev->type == XML_CATA_NEXT_CATALOG) &&
++ (xmlStrEqual (prev->URL, entry->URL)) &&
++ (xmlStrEqual (prev->value, entry->value)) &&
++ (prev->prefer == entry->prefer) &&
++ (prev->group == entry->group)) {
++ if (xmlDebugCatalogs)
++ fprintf(stderr,
++ "Ignoring repeated nextCatalog %s\n", entry->URL);
++ xmlFreeCatalogEntry(entry, NULL);
++ entry = NULL;
++ break;
++ }
++ prev = prev->next;
++ }
+ }
+ if (entry != NULL) {
+ if (parent != NULL) {
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index 6a03fc3f6c7..fa081c2382f 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -27,6 +27,7 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2025-7425.patch \
file://CVE-2026-0989.patch \
file://CVE-2026-0990.patch \
+ file://CVE-2026-0992.patch \
"
SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 13/25] libxml2: add follow-up patch for CVE-2026-0992
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (11 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 12/25] libxml2: patch CVE-2026-0992 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 14/25] python3: patch CVE-2025-13837 Yoann Congal
` (11 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
References:
* https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019
* https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/377
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
...2026-0992.patch => CVE-2026-0992-01.patch} | 0
.../libxml/libxml2/CVE-2026-0992-02.patch | 323 ++++++++++++++++++
.../libxml/libxml2/CVE-2026-0992-03.patch | 33 ++
meta/recipes-core/libxml/libxml2_2.12.10.bb | 4 +-
4 files changed, 359 insertions(+), 1 deletion(-)
rename meta/recipes-core/libxml/libxml2/{CVE-2026-0992.patch => CVE-2026-0992-01.patch} (100%)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0992-02.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2026-0992-03.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0992-01.patch
similarity index 100%
rename from meta/recipes-core/libxml/libxml2/CVE-2026-0992.patch
rename to meta/recipes-core/libxml/libxml2/CVE-2026-0992-01.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0992-02.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0992-02.patch
new file mode 100644
index 00000000000..bab0c4e1f0c
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0992-02.patch
@@ -0,0 +1,323 @@
+From f8399e62a31095bf1ced01827c33f9b29494046f Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <daniel.garcia@suse.com>
+Date: Fri, 19 Dec 2025 12:27:54 +0100
+Subject: [PATCH] testcatalog: Add new tests for catalog.c
+
+Adds a new test program to run specific tests related to catalog
+parsing.
+
+This initial version includes a couple of tests, the first one to check
+the infinite recursion detection related to:
+https://gitlab.gnome.org/GNOME/libxml2/-/issues/1018.
+
+The second one tests the nextCatalog element repeated parsing, related
+to:
+https://gitlab.gnome.org/GNOME/libxml2/-/issues/1019
+https://gitlab.gnome.org/GNOME/libxml2/-/issues/1040
+
+CVE: CVE-2026-0992
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/f8399e62a31095bf1ced01827c33f9b29494046f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ CMakeLists.txt | 2 +
+ Makefile.am | 6 ++
+ catalog.c | 63 +++++++++++-----
+ include/libxml/catalog.h | 2 +
+ test/catalogs/catalog-recursive.xml | 3 +
+ test/catalogs/repeated-next-catalog.xml | 10 +++
+ testcatalog.c | 96 +++++++++++++++++++++++++
+ 7 files changed, 163 insertions(+), 19 deletions(-)
+ create mode 100644 test/catalogs/catalog-recursive.xml
+ create mode 100644 test/catalogs/repeated-next-catalog.xml
+ create mode 100644 testcatalog.c
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 163661f8..7d5702df 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -517,6 +517,7 @@ if(LIBXML2_WITH_TESTS)
+ runxmlconf
+ runsuite
+ testapi
++ testcatalog
+ testchar
+ testdict
+ testModule
+@@ -543,6 +544,7 @@ if(LIBXML2_WITH_TESTS)
+ if(NOT WIN32)
+ add_test(NAME testapi COMMAND testapi)
+ endif()
++ add_test(NAME testcatalog COMMAND testcatalog)
+ add_test(NAME testchar COMMAND testchar)
+ add_test(NAME testdict COMMAND testdict)
+ add_test(NAME testparser COMMAND testparser)
+diff --git a/Makefile.am b/Makefile.am
+index c51dfd8e..c794eac8 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -21,6 +21,7 @@ check_PROGRAMS = \
+ testModule \
+ testThreads \
+ testapi \
++ testcatalog \
+ testchar \
+ testdict \
+ testlimits \
+@@ -143,6 +144,10 @@ testlimits_SOURCES=testlimits.c
+ testlimits_DEPENDENCIES = $(DEPS)
+ testlimits_LDADD= $(LDADDS)
+
++testcatalog_SOURCES=testcatalog.c
++testcatalog_DEPENDENCIES = $(DEPS)
++testcatalog_LDADD= $(LDADDS)
++
+ testchar_SOURCES=testchar.c
+ testchar_DEPENDENCIES = $(DEPS)
+ testchar_LDADD= $(LDADDS)
+@@ -206,6 +211,7 @@ check-local:
+ $(CHECKER) ./runtest$(EXEEXT)
+ $(CHECKER) ./testrecurse$(EXEEXT)
+ $(CHECKER) ./testapi$(EXEEXT)
++ $(CHECKER) ./testcatalog$(EXEEXT)
+ $(CHECKER) ./testchar$(EXEEXT)
+ $(CHECKER) ./testdict$(EXEEXT)
+ $(CHECKER) ./testparser$(EXEEXT)
+diff --git a/catalog.c b/catalog.c
+index 401dbc14..eb889162 100644
+--- a/catalog.c
++++ b/catalog.c
+@@ -649,43 +649,54 @@ static void xmlDumpXMLCatalogNode(xmlCatalogEntryPtr catal, xmlNodePtr catalog,
+ }
+ }
+
+-static int
+-xmlDumpXMLCatalog(FILE *out, xmlCatalogEntryPtr catal) {
+- int ret;
+- xmlDocPtr doc;
++static xmlDocPtr
++xmlDumpXMLCatalogToDoc(xmlCatalogEntryPtr catal) {
+ xmlNsPtr ns;
+ xmlDtdPtr dtd;
+ xmlNodePtr catalog;
+- xmlOutputBufferPtr buf;
++ xmlDocPtr doc = xmlNewDoc(NULL);
++ if (doc == NULL) {
++ return(NULL);
++ }
+
+- /*
+- * Rebuild a catalog
+- */
+- doc = xmlNewDoc(NULL);
+- if (doc == NULL)
+- return(-1);
+ dtd = xmlNewDtd(doc, BAD_CAST "catalog",
+- BAD_CAST "-//OASIS//DTD Entity Resolution XML Catalog V1.0//EN",
+-BAD_CAST "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd");
++ BAD_CAST "-//OASIS//DTD Entity Resolution XML Catalog V1.0//EN",
++ BAD_CAST "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd");
+
+ xmlAddChild((xmlNodePtr) doc, (xmlNodePtr) dtd);
+
+ ns = xmlNewNs(NULL, XML_CATALOGS_NAMESPACE, NULL);
+ if (ns == NULL) {
+- xmlFreeDoc(doc);
+- return(-1);
++ xmlFreeDoc(doc);
++ return(NULL);
+ }
+ catalog = xmlNewDocNode(doc, ns, BAD_CAST "catalog", NULL);
+ if (catalog == NULL) {
+- xmlFreeNs(ns);
+- xmlFreeDoc(doc);
+- return(-1);
++ xmlFreeDoc(doc);
++ xmlFreeNs(ns);
++ return(NULL);
+ }
+ catalog->nsDef = ns;
+ xmlAddChild((xmlNodePtr) doc, catalog);
+-
+ xmlDumpXMLCatalogNode(catal, catalog, doc, ns, NULL);
+
++ return(doc);
++}
++
++static int
++xmlDumpXMLCatalog(FILE *out, xmlCatalogEntryPtr catal) {
++ int ret;
++ xmlDocPtr doc;
++ xmlOutputBufferPtr buf;
++
++ /*
++ * Rebuild a catalog
++ */
++ doc = xmlDumpXMLCatalogToDoc(catal);
++ if (doc == NULL) {
++ return(-1);
++ }
++
+ /*
+ * reserialize it
+ */
+@@ -3417,6 +3428,20 @@ xmlCatalogDump(FILE *out) {
+
+ xmlACatalogDump(xmlDefaultCatalog, out);
+ }
++
++/**
++ * Dump all the global catalog content as a xmlDoc
++ * This function is just for testing/debugging purposes
++ *
++ * @returns The catalog as xmlDoc or NULL if failed, it must be freed by the caller.
++ */
++xmlDocPtr
++xmlCatalogDumpDoc(void) {
++ if (!xmlCatalogInitialized)
++ xmlInitializeCatalog();
++
++ return xmlDumpXMLCatalogToDoc(xmlDefaultCatalog->xml);
++}
+ #endif /* LIBXML_OUTPUT_ENABLED */
+
+ /**
+diff --git a/include/libxml/catalog.h b/include/libxml/catalog.h
+index 88a7483c..e1bc5feb 100644
+--- a/include/libxml/catalog.h
++++ b/include/libxml/catalog.h
+@@ -119,6 +119,8 @@ XMLPUBFUN void
+ #ifdef LIBXML_OUTPUT_ENABLED
+ XMLPUBFUN void
+ xmlCatalogDump (FILE *out);
++XMLPUBFUN xmlDocPtr
++ xmlCatalogDumpDoc (void);
+ #endif /* LIBXML_OUTPUT_ENABLED */
+ XMLPUBFUN xmlChar *
+ xmlCatalogResolve (const xmlChar *pubID,
+diff --git a/test/catalogs/catalog-recursive.xml b/test/catalogs/catalog-recursive.xml
+new file mode 100644
+index 00000000..3b3d03f9
+--- /dev/null
++++ b/test/catalogs/catalog-recursive.xml
+@@ -0,0 +1,3 @@
++<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
++ <delegateURI uriStartString="/foo" catalog="catalog-recursive.xml"/>
++</catalog>
+diff --git a/test/catalogs/repeated-next-catalog.xml b/test/catalogs/repeated-next-catalog.xml
+new file mode 100644
+index 00000000..76d34c3c
+--- /dev/null
++++ b/test/catalogs/repeated-next-catalog.xml
+@@ -0,0 +1,10 @@
++<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
++ <nextCatalog catalog="registry.xml"/>
++ <nextCatalog catalog="registry.xml"/>
++ <nextCatalog catalog="./registry.xml"/>
++ <nextCatalog catalog="././registry.xml"/>
++ <nextCatalog catalog="./././registry.xml"/>
++ <nextCatalog catalog="./../catalogs/registry.xml"/>
++ <nextCatalog catalog="./../catalogs/./registry.xml"/>
++</catalog>
++
+diff --git a/testcatalog.c b/testcatalog.c
+new file mode 100644
+index 00000000..86d33bd0
+--- /dev/null
++++ b/testcatalog.c
+@@ -0,0 +1,96 @@
++/*
++ * testcatalog.c: C program to run libxml2 catalog.c unit tests
++ *
++ * To compile on Unixes:
++ * cc -o testcatalog `xml2-config --cflags` testcatalog.c `xml2-config --libs` -lpthread
++ *
++ * See Copyright for the status of this software.
++ *
++ * Author: Daniel Garcia <dani@danigm.net>
++ */
++
++
++#include "libxml.h"
++#include <stdio.h>
++
++#ifdef LIBXML_CATALOG_ENABLED
++#include <libxml/catalog.h>
++
++/* Test catalog resolve uri with recursive catalog */
++static int
++testRecursiveDelegateUri(void) {
++ int ret = 0;
++ const char *cat = "test/catalogs/catalog-recursive.xml";
++ const char *entity = "/foo.ent";
++ xmlChar *resolved = NULL;
++
++ xmlInitParser();
++ xmlLoadCatalog(cat);
++
++ /* This should trigger recursive error */
++ resolved = xmlCatalogResolveURI(BAD_CAST entity);
++ if (resolved != NULL) {
++ fprintf(stderr, "CATALOG-FAILURE: Catalog %s entity should fail to resolve\n", entity);
++ ret = 1;
++ }
++ xmlCatalogCleanup();
++
++ return ret;
++}
++
++/* Test parsing repeated NextCatalog */
++static int
++testRepeatedNextCatalog(void) {
++ int ret = 0;
++ int i = 0;
++ const char *cat = "test/catalogs/repeated-next-catalog.xml";
++ const char *entity = "/foo.ent";
++ xmlDocPtr doc = NULL;
++ xmlNodePtr node = NULL;
++
++ xmlInitParser();
++
++ xmlLoadCatalog(cat);
++ /* To force the complete recursive load */
++ xmlCatalogResolveURI(BAD_CAST entity);
++ /**
++ * Ensure that the doc doesn't contain the same nextCatalog
++ */
++ doc = xmlCatalogDumpDoc();
++ xmlCatalogCleanup();
++
++ if (doc == NULL) {
++ fprintf(stderr, "CATALOG-FAILURE: Failed to dump the catalog\n");
++ return 1;
++ }
++
++ /* Just the root "catalog" node with a series of nextCatalog */
++ node = xmlDocGetRootElement(doc);
++ node = node->children;
++ for (i=0; node != NULL; node=node->next, i++) {}
++ if (i > 1) {
++ fprintf(stderr, "CATALOG-FAILURE: Found %d nextCatalog entries and should be 1\n", i);
++ ret = 1;
++ }
++
++ xmlFreeDoc(doc);
++
++ return ret;
++}
++
++int
++main(void) {
++ int err = 0;
++
++ err |= testRecursiveDelegateUri();
++ err |= testRepeatedNextCatalog();
++
++ return err;
++}
++#else
++/* No catalog, so everything okay */
++int
++main(void) {
++ return 0;
++}
++#endif
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2026-0992-03.patch b/meta/recipes-core/libxml/libxml2/CVE-2026-0992-03.patch
new file mode 100644
index 00000000000..5964fd16b51
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2026-0992-03.patch
@@ -0,0 +1,33 @@
+From deed3b7873dff30b7f87f7f33154c9932a772522 Mon Sep 17 00:00:00 2001
+From: Daniel Garcia Moreno <dani@danigm.net>
+Date: Sun, 18 Jan 2026 19:47:11 +0100
+Subject: [PATCH] catalog: Do not check value for duplication nextCatalog
+
+The value field stores the path as it appears in the catalog definition,
+the URL is built using xmlBuildURI that changes the relative paths to
+absolute.
+
+This change fixes the issue of using relative path to the same catalog
+in the same file.
+
+Fix https://gitlab.gnome.org/GNOME/libxml2/-/issues/1040
+
+CVE: CVE-2026-0992
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/deed3b7873dff30b7f87f7f33154c9932a772522]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ catalog.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/catalog.c b/catalog.c
+index eb889162..ba9ee7ae 100644
+--- a/catalog.c
++++ b/catalog.c
+@@ -1286,7 +1286,6 @@ xmlParseXMLCatalogNode(xmlNodePtr cur, xmlCatalogPrefer prefer,
+ while (prev != NULL) {
+ if ((prev->type == XML_CATA_NEXT_CATALOG) &&
+ (xmlStrEqual (prev->URL, entry->URL)) &&
+- (xmlStrEqual (prev->value, entry->value)) &&
+ (prev->prefer == entry->prefer) &&
+ (prev->group == entry->group)) {
+ if (xmlDebugCatalogs)
diff --git a/meta/recipes-core/libxml/libxml2_2.12.10.bb b/meta/recipes-core/libxml/libxml2_2.12.10.bb
index fa081c2382f..25da11bd2d3 100644
--- a/meta/recipes-core/libxml/libxml2_2.12.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.12.10.bb
@@ -27,7 +27,9 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20130923.tar;subdir=${BP};name=testt
file://CVE-2025-7425.patch \
file://CVE-2026-0989.patch \
file://CVE-2026-0990.patch \
- file://CVE-2026-0992.patch \
+ file://CVE-2026-0992-01.patch \
+ file://CVE-2026-0992-02.patch \
+ file://CVE-2026-0992-03.patch \
"
SRC_URI[archive.sha256sum] = "c3d8c0c34aa39098f66576fe51969db12a5100b956233dc56506f7a8679be995"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 14/25] python3: patch CVE-2025-13837
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (12 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 13/25] libxml2: add follow-up patch for CVE-2026-0992 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 15/25] python-urllib3: Backport fix for CVE-2026-21441 Yoann Congal
` (10 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Pick patch from 3.12 branch per NVD report.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python/python3/CVE-2025-13837.patch | 162 ++++++++++++++++++
.../python/python3_3.12.12.bb | 1 +
2 files changed, 163 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2025-13837.patch
diff --git a/meta/recipes-devtools/python/python3/CVE-2025-13837.patch b/meta/recipes-devtools/python/python3/CVE-2025-13837.patch
new file mode 100644
index 00000000000..0f2e06a4912
--- /dev/null
+++ b/meta/recipes-devtools/python/python3/CVE-2025-13837.patch
@@ -0,0 +1,162 @@
+From 5a8b19677d818fb41ee55f310233772e15aa1a2b Mon Sep 17 00:00:00 2001
+From: Serhiy Storchaka <storchaka@gmail.com>
+Date: Mon, 22 Dec 2025 15:49:44 +0200
+Subject: [PATCH] [3.12] gh-119342: Fix a potential denial of service in
+ plistlib (GH-119343) (#142149)
+
+Reading a specially prepared small Plist file could cause OOM because file's
+read(n) preallocates a bytes object for reading the specified amount of
+data. Now plistlib reads large data by chunks, therefore the upper limit of
+consumed memory is proportional to the size of the input file.
+(cherry picked from commit 694922cf40aa3a28f898b5f5ee08b71b4922df70)
+
+CVE: CVE-2025-13837
+Upstream-Status: Backport [https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ Lib/plistlib.py | 31 ++++++++++------
+ Lib/test/test_plistlib.py | 37 +++++++++++++++++--
+ ...-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst | 5 +++
+ 3 files changed, 59 insertions(+), 14 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst
+
+diff --git a/Lib/plistlib.py b/Lib/plistlib.py
+index 3292c30d5f..c5554ea1f7 100644
+--- a/Lib/plistlib.py
++++ b/Lib/plistlib.py
+@@ -73,6 +73,9 @@ from xml.parsers.expat import ParserCreate
+ PlistFormat = enum.Enum('PlistFormat', 'FMT_XML FMT_BINARY', module=__name__)
+ globals().update(PlistFormat.__members__)
+
++# Data larger than this will be read in chunks, to prevent extreme
++# overallocation.
++_MIN_READ_BUF_SIZE = 1 << 20
+
+ class UID:
+ def __init__(self, data):
+@@ -499,12 +502,24 @@ class _BinaryPlistParser:
+
+ return tokenL
+
++ def _read(self, size):
++ cursize = min(size, _MIN_READ_BUF_SIZE)
++ data = self._fp.read(cursize)
++ while True:
++ if len(data) != cursize:
++ raise InvalidFileException
++ if cursize == size:
++ return data
++ delta = min(cursize, size - cursize)
++ data += self._fp.read(delta)
++ cursize += delta
++
+ def _read_ints(self, n, size):
+- data = self._fp.read(size * n)
++ data = self._read(size * n)
+ if size in _BINARY_FORMAT:
+ return struct.unpack(f'>{n}{_BINARY_FORMAT[size]}', data)
+ else:
+- if not size or len(data) != size * n:
++ if not size:
+ raise InvalidFileException()
+ return tuple(int.from_bytes(data[i: i + size], 'big')
+ for i in range(0, size * n, size))
+@@ -561,22 +576,16 @@ class _BinaryPlistParser:
+
+ elif tokenH == 0x40: # data
+ s = self._get_size(tokenL)
+- result = self._fp.read(s)
+- if len(result) != s:
+- raise InvalidFileException()
++ result = self._read(s)
+
+ elif tokenH == 0x50: # ascii string
+ s = self._get_size(tokenL)
+- data = self._fp.read(s)
+- if len(data) != s:
+- raise InvalidFileException()
++ data = self._read(s)
+ result = data.decode('ascii')
+
+ elif tokenH == 0x60: # unicode string
+ s = self._get_size(tokenL) * 2
+- data = self._fp.read(s)
+- if len(data) != s:
+- raise InvalidFileException()
++ data = self._read(s)
+ result = data.decode('utf-16be')
+
+ elif tokenH == 0x80: # UID
+diff --git a/Lib/test/test_plistlib.py b/Lib/test/test_plistlib.py
+index fa46050658..229a5a242e 100644
+--- a/Lib/test/test_plistlib.py
++++ b/Lib/test/test_plistlib.py
+@@ -841,8 +841,7 @@ class TestPlistlib(unittest.TestCase):
+
+ class TestBinaryPlistlib(unittest.TestCase):
+
+- @staticmethod
+- def decode(*objects, offset_size=1, ref_size=1):
++ def build(self, *objects, offset_size=1, ref_size=1):
+ data = [b'bplist00']
+ offset = 8
+ offsets = []
+@@ -854,7 +853,11 @@ class TestBinaryPlistlib(unittest.TestCase):
+ len(objects), 0, offset)
+ data.extend(offsets)
+ data.append(tail)
+- return plistlib.loads(b''.join(data), fmt=plistlib.FMT_BINARY)
++ return b''.join(data)
++
++ def decode(self, *objects, offset_size=1, ref_size=1):
++ data = self.build(*objects, offset_size=offset_size, ref_size=ref_size)
++ return plistlib.loads(data, fmt=plistlib.FMT_BINARY)
+
+ def test_nonstandard_refs_size(self):
+ # Issue #21538: Refs and offsets are 24-bit integers
+@@ -963,6 +966,34 @@ class TestBinaryPlistlib(unittest.TestCase):
+ with self.assertRaises(plistlib.InvalidFileException):
+ plistlib.loads(b'bplist00' + data, fmt=plistlib.FMT_BINARY)
+
++ def test_truncated_large_data(self):
++ self.addCleanup(os_helper.unlink, os_helper.TESTFN)
++ def check(data):
++ with open(os_helper.TESTFN, 'wb') as f:
++ f.write(data)
++ # buffered file
++ with open(os_helper.TESTFN, 'rb') as f:
++ with self.assertRaises(plistlib.InvalidFileException):
++ plistlib.load(f, fmt=plistlib.FMT_BINARY)
++ # unbuffered file
++ with open(os_helper.TESTFN, 'rb', buffering=0) as f:
++ with self.assertRaises(plistlib.InvalidFileException):
++ plistlib.load(f, fmt=plistlib.FMT_BINARY)
++ for w in range(20, 64):
++ s = 1 << w
++ # data
++ check(self.build(b'\x4f\x13' + s.to_bytes(8, 'big')))
++ # ascii string
++ check(self.build(b'\x5f\x13' + s.to_bytes(8, 'big')))
++ # unicode string
++ check(self.build(b'\x6f\x13' + s.to_bytes(8, 'big')))
++ # array
++ check(self.build(b'\xaf\x13' + s.to_bytes(8, 'big')))
++ # dict
++ check(self.build(b'\xdf\x13' + s.to_bytes(8, 'big')))
++ # number of objects
++ check(b'bplist00' + struct.pack('>6xBBQQQ', 1, 1, s, 0, 8))
++
+
+ class TestKeyedArchive(unittest.TestCase):
+ def test_keyed_archive_data(self):
+diff --git a/Misc/NEWS.d/next/Security/2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst b/Misc/NEWS.d/next/Security/2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst
+new file mode 100644
+index 0000000000..04fd8faca4
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2024-05-21-22-11-31.gh-issue-119342.BTFj4Z.rst
+@@ -0,0 +1,5 @@
++Fix a potential memory denial of service in the :mod:`plistlib` module.
++When reading a Plist file received from untrusted source, it could cause
++an arbitrary amount of memory to be allocated.
++This could have led to symptoms including a :exc:`MemoryError`, swapping, out
++of memory (OOM) killed processes or containers, or even system crashes.
diff --git a/meta/recipes-devtools/python/python3_3.12.12.bb b/meta/recipes-devtools/python/python3_3.12.12.bb
index 280d98424a5..ce2c830655d 100644
--- a/meta/recipes-devtools/python/python3_3.12.12.bb
+++ b/meta/recipes-devtools/python/python3_3.12.12.bb
@@ -37,6 +37,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \
file://CVE-2025-6075.patch \
file://CVE-2025-12084.patch \
file://CVE-2025-13836.patch \
+ file://CVE-2025-13837.patch \
"
SRC_URI:append:class-native = " \
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 15/25] python-urllib3: Backport fix for CVE-2026-21441
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (13 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 14/25] python3: patch CVE-2025-13837 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 16/25] zlib: ignore CVE-2026-22184 Yoann Congal
` (9 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Include the patch linked in the NVD report : https://nvd.nist.gov/vuln/detail/CVE-2026-21441
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../python3-urllib3/CVE-2026-21441.patch | 105 ++++++++++++++++++
.../python/python3-urllib3_2.2.2.bb | 1 +
2 files changed, 106 insertions(+)
create mode 100644 meta/recipes-devtools/python/python3-urllib3/CVE-2026-21441.patch
diff --git a/meta/recipes-devtools/python/python3-urllib3/CVE-2026-21441.patch b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-21441.patch
new file mode 100644
index 00000000000..16af67af312
--- /dev/null
+++ b/meta/recipes-devtools/python/python3-urllib3/CVE-2026-21441.patch
@@ -0,0 +1,105 @@
+From 686d2bdd4affd3c86e605f54a72afe53c920f72f Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 7 Jan 2026 18:07:30 +0200
+Subject: [PATCH] Backport fix CVE-2026-21441 python urllib3
+
+Original commit: 8864ac407bba8607950025e0979c4c69bc7abc7b
+Original-author: Illia Volochii <illia.volochii@gmail.com>
+
+Bugfixes
+--------
+
+- Fixed a high-severity security issue where decompression-bomb safeguards of
+ the streaming API were bypassed when HTTP redirects were followed.
+ (`GHSA-38jv-5279-wg99 <https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>`__)
+
+* Stop decoding response content during redirects needlessly
+
+* Rename the new query parameter
+
+* Add a changelog entry
+
+Fixes CVE-2026-21441
+CVE: CVE-2026-21441
+
+Upstream-Status: Backport [https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ dummyserver/app.py | 8 +++++++-
+ src/urllib3/response.py | 6 +++++-
+ test/with_dummyserver/test_connectionpool.py | 19 +++++++++++++++++++
+ 3 files changed, 31 insertions(+), 2 deletions(-)
+
+diff --git a/dummyserver/app.py b/dummyserver/app.py
+index 9fc9d1b7..c4978152 100644
+--- a/dummyserver/app.py
++++ b/dummyserver/app.py
+@@ -233,10 +233,16 @@ async def redirect() -> ResponseReturnValue:
+ values = await request.values
+ target = values.get("target", "/")
+ status = values.get("status", "303 See Other")
++ compressed = values.get("compressed") == "true"
+ status_code = status.split(" ")[0]
+
+ headers = [("Location", target)]
+- return await make_response("", status_code, headers)
++ if compressed:
++ headers.append(("Content-Encoding", "gzip"))
++ data = gzip.compress(b"foo")
++ else:
++ data = b""
++ return await make_response(data, status_code, headers)
+
+
+ @hypercorn_app.route("/redirect_after")
+diff --git a/src/urllib3/response.py b/src/urllib3/response.py
+index a0273d65..909da62b 100644
+--- a/src/urllib3/response.py
++++ b/src/urllib3/response.py
+@@ -646,7 +646,11 @@ class HTTPResponse(BaseHTTPResponse):
+ Unread data in the HTTPResponse connection blocks the connection from being released back to the pool.
+ """
+ try:
+- self.read()
++ self.read(
++ # Do not spend resources decoding the content unless
++ # decoding has already been initiated.
++ decode_content=self._has_decoded_content,
++ )
+ except (HTTPError, OSError, BaseSSLError, HTTPException):
+ pass
+
+diff --git a/test/with_dummyserver/test_connectionpool.py b/test/with_dummyserver/test_connectionpool.py
+index 4fbe6a4f..ebcdf9bf 100644
+--- a/test/with_dummyserver/test_connectionpool.py
++++ b/test/with_dummyserver/test_connectionpool.py
+@@ -480,6 +480,25 @@ class TestConnectionPool(HypercornDummyServerTestCase):
+ assert r.status == 200
+ assert r.data == b"Dummy server!"
+
++ @mock.patch("urllib3.response.GzipDecoder.decompress")
++ def test_no_decoding_with_redirect_when_preload_disabled(
++ self, gzip_decompress: mock.MagicMock
++ ) -> None:
++ """
++ Test that urllib3 does not attempt to decode a gzipped redirect
++ response when `preload_content` is set to `False`.
++ """
++ with HTTPConnectionPool(self.host, self.port) as pool:
++ # Three requests are expected: two redirects and one final / 200 OK.
++ response = pool.request(
++ "GET",
++ "/redirect",
++ fields={"target": "/redirect?compressed=true", "compressed": "true"},
++ preload_content=False,
++ )
++ assert response.status == 200
++ gzip_decompress.assert_not_called()
++
+ def test_303_redirect_makes_request_lose_body(self) -> None:
+ with HTTPConnectionPool(self.host, self.port) as pool:
+ response = pool.request(
+--
+2.44.0
+
diff --git a/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb b/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb
index 620927322a0..f6ac8f89cad 100644
--- a/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb
+++ b/meta/recipes-devtools/python/python3-urllib3_2.2.2.bb
@@ -11,6 +11,7 @@ SRC_URI += " \
file://CVE-2025-50181.patch \
file://CVE-2025-66418.patch \
file://CVE-2025-66471.patch \
+ file://CVE-2026-21441.patch \
"
RDEPENDS:${PN} += "\
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 16/25] zlib: ignore CVE-2026-22184
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (14 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 15/25] python-urllib3: Backport fix for CVE-2026-21441 Yoann Congal
@ 2026-02-09 9:28 ` Yoann Congal
2026-02-09 10:49 ` Paul Barker
2026-02-09 9:29 ` [OE-core][scarthgap 17/25] ffmpeg: upgrade 6.1.3 -> 6.1.4 Yoann Congal
` (8 subsequent siblings)
24 siblings, 1 reply; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:28 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This is CVE for example tool contrib/untgz.
This is not compiled in Yocto zlib recipe.
This CVE has controversial CVSS3 score of 9.8.
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/zlib/zlib_1.3.1.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb
index e6a81ef7898..8ebc6befc2b 100644
--- a/meta/recipes-core/zlib/zlib_1.3.1.bb
+++ b/meta/recipes-core/zlib/zlib_1.3.1.bb
@@ -48,3 +48,4 @@ BBCLASSEXTEND = "native nativesdk"
CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip"
CVE_STATUS[CVE-2023-6992] = "cpe-incorrect: this CVE is for cloudflare zlib"
+CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 17/25] ffmpeg: upgrade 6.1.3 -> 6.1.4
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (15 preceding siblings ...)
2026-02-09 9:28 ` [OE-core][scarthgap 16/25] zlib: ignore CVE-2026-22184 Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 18/25] ffmpeg: ignore CVE-2025-25469 Yoann Congal
` (7 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Dropped patches that are part of the upstream version.
Changelog:
https://git.ffmpeg.org/gitweb/ffmpeg.git/blob/34277e12e80031c7f89494ba543684bc1dd0be8f:/Changelog
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../ffmpeg/ffmpeg/CVE-2024-35365.patch | 62 -----------
.../ffmpeg/ffmpeg/CVE-2024-36618.patch | 36 ------
.../ffmpeg/ffmpeg/CVE-2025-1594.patch | 105 ------------------
.../{ffmpeg_6.1.3.bb => ffmpeg_6.1.4.bb} | 5 +-
4 files changed, 1 insertion(+), 207 deletions(-)
delete mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35365.patch
delete mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36618.patch
delete mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-1594.patch
rename meta/recipes-multimedia/ffmpeg/{ffmpeg_6.1.3.bb => ffmpeg_6.1.4.bb} (98%)
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35365.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35365.patch
deleted file mode 100644
index 2b5646e07ca..00000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-35365.patch
+++ /dev/null
@@ -1,62 +0,0 @@
-From ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5 Mon Sep 17 00:00:00 2001
-From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
-Date: Mon, 25 Mar 2024 16:54:25 +0100
-Subject: [PATCH] fftools/ffmpeg_mux_init: Fix double-free on error
-
-MATCH_PER_STREAM_OPT iterates over all options of a given
-OptionDef and tests whether they apply to the current stream;
-if so, they are set to ost->apad, otherwise, the code errors
-out. If no error happens, ost->apad is av_strdup'ed in order
-to take ownership of this pointer.
-
-But this means that setting it originally was premature,
-as it leads to double-frees when an error happens lateron.
-This can simply be reproduced with
-ffmpeg -filter_complex anullsrc -apad bar -apad:n baz -f null -
-This is a regression since 83ace80bfd80fcdba2c65fa1d554923ea931d5bd.
-
-Fix this by using a temporary variable instead of directly
-setting ost->apad. Also only strdup the string if it actually
-is != NULL.
-
-Reviewed-by: Marth64 <marth64@proxyid.net>
-Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
-
-CVE: CVE-2024-35365
-
-Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/ced5c5fdb8634d39ca9472a2026b2d2fea16c4e5]
-
-Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
----
- fftools/ffmpeg_mux_init.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/fftools/ffmpeg_mux_init.c b/fftools/ffmpeg_mux_init.c
-index 63a25a3..685c064 100644
---- a/fftools/ffmpeg_mux_init.c
-+++ b/fftools/ffmpeg_mux_init.c
-@@ -845,6 +845,7 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o,
- int channels = 0;
- char *layout = NULL;
- char *sample_fmt = NULL;
-+ const char *apad = NULL;
-
- MATCH_PER_STREAM_OPT(audio_channels, i, channels, oc, st);
- if (channels) {
-@@ -882,8 +883,12 @@ static int new_stream_audio(Muxer *mux, const OptionsContext *o,
-
- MATCH_PER_STREAM_OPT(audio_sample_rate, i, audio_enc->sample_rate, oc, st);
-
-- MATCH_PER_STREAM_OPT(apad, str, ost->apad, oc, st);
-- ost->apad = av_strdup(ost->apad);
-+ MATCH_PER_STREAM_OPT(apad, str, apad, oc, st);
-+ if (apad) {
-+ ost->apad = av_strdup(apad);
-+ if (!ost->apad)
-+ return AVERROR(ENOMEM);
-+ }
-
- #if FFMPEG_OPT_MAP_CHANNEL
- /* check for channel mapping for this audio stream */
---
-2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36618.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36618.patch
deleted file mode 100644
index 5caca2da7c6..00000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2024-36618.patch
+++ /dev/null
@@ -1,36 +0,0 @@
-From 7a089ed8e049e3bfcb22de1250b86f2106060857 Mon Sep 17 00:00:00 2001
-From: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
-Date: Tue, 12 Mar 2024 23:23:17 +0100
-Subject: [PATCH] avformat/avidec: Fix integer overflow iff ULONG_MAX <
- INT64_MAX
-
-Affects many FATE-tests, see
-https://fate.ffmpeg.org/report.cgi?time=20240312011016&slot=ppc-linux-gcc-13.2-ubsan-altivec-qemu
-
-Reviewed-by: James Almer <jamrial@gmail.com>
-Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@outlook.com>
-
-CVE: CVE-2024-36618
-
-Upstream-Status: Backport [https://github.com/ffmpeg/ffmpeg/commit/7a089ed8e049e3bfcb22de1250b86f2106060857]
-
-Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
----
- libavformat/avidec.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/libavformat/avidec.c b/libavformat/avidec.c
-index 00bd7a9..bc95466 100644
---- a/libavformat/avidec.c
-+++ b/libavformat/avidec.c
-@@ -1696,7 +1696,7 @@ static int check_stream_max_drift(AVFormatContext *s)
- int *idx = av_calloc(s->nb_streams, sizeof(*idx));
- if (!idx)
- return AVERROR(ENOMEM);
-- for (min_pos = pos = 0; min_pos != INT64_MAX; pos = min_pos + 1LU) {
-+ for (min_pos = pos = 0; min_pos != INT64_MAX; pos = min_pos + 1ULL) {
- int64_t max_dts = INT64_MIN / 2;
- int64_t min_dts = INT64_MAX / 2;
- int64_t max_buffer = 0;
---
-2.40.0
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-1594.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-1594.patch
deleted file mode 100644
index af71055c02b..00000000000
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-1594.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From bedfb6eca402037f5cbb115fa767d106b8c14f1c Mon Sep 17 00:00:00 2001
-From: Lynne <dev@lynne.ee>
-Date: Sat, 8 Feb 2025 04:35:31 +0100
-Subject: [PATCH] aacenc_tns: clamp filter direction energy measurement
-
-The issue is that:
-
-float en[2];
-...
-tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
-for (g = 0; g < tns->n_filt[w]; g++) {
- tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];
-
-When using the AAC Main profile, n_filt = 3, and slant is by
-default 2 (normal long frames), g can go above 1.
-
-en is the evolution of energy in the frequency domain for every
-band at the given window. E.g. whether the energy is concentrated
-at the top of each band, or the bottom.
-
-For 2-pole filters, its straightforward.
-For 3-pole filters, we need more than 2 measurements.
-
-This commit properly implements support for 3-pole filters, by measuring
-the band energy across three areas.
-
-Do note that even xHE-AAC caps n_filt to 2, and only AAC Main allows
-n_filt == 3.
-
-Fixes https://trac.ffmpeg.org/ticket/11418
-
-CVE: CVE-2025-1594
-
-Upstream-Status: Backport [https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/bedfb6eca402037f5cbb115fa767d106b8c14f1c]
-
-Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
----
- libavcodec/aacenc_tns.c | 33 ++++++++++++++++++++++++---------
- 1 file changed, 24 insertions(+), 9 deletions(-)
-
-diff --git a/libavcodec/aacenc_tns.c b/libavcodec/aacenc_tns.c
-index 8dc6dfc..9ea3506 100644
---- a/libavcodec/aacenc_tns.c
-+++ b/libavcodec/aacenc_tns.c
-@@ -172,6 +172,7 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
- sce->ics.window_sequence[0] == LONG_START_SEQUENCE ? 0 : 2;
- const int sfb_len = sfb_end - sfb_start;
- const int coef_len = sce->ics.swb_offset[sfb_end] - sce->ics.swb_offset[sfb_start];
-+ const int n_filt = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
-
- if (coef_len <= 0 || sfb_len <= 0) {
- sce->tns.present = 0;
-@@ -179,16 +180,30 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
- }
-
- for (w = 0; w < sce->ics.num_windows; w++) {
-- float en[2] = {0.0f, 0.0f};
-+ float en[4] = {0.0f, 0.0f, 0.0f, 0.0f};
- int oc_start = 0, os_start = 0;
- int coef_start = sce->ics.swb_offset[sfb_start];
-
-- for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
-- FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
-- if (g > sfb_start + (sfb_len/2))
-- en[1] += band->energy;
-- else
-- en[0] += band->energy;
-+ if (n_filt == 2) {
-+ for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
-+ FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
-+ if (g > sfb_start + (sfb_len/2))
-+ en[1] += band->energy; /* End */
-+ else
-+ en[0] += band->energy; /* Start */
-+ }
-+ en[2] = en[0];
-+ } else {
-+ for (g = sfb_start; g < sce->ics.num_swb && g <= sfb_end; g++) {
-+ FFPsyBand *band = &s->psy.ch[s->cur_channel].psy_bands[w*16+g];
-+ if (g > sfb_start + (sfb_len/2) + (sfb_len/4))
-+ en[2] += band->energy; /* End */
-+ else if (g > sfb_start + (sfb_len/2) - (sfb_len/4))
-+ en[1] += band->energy; /* Middle */
-+ else
-+ en[0] += band->energy; /* Start */
-+ }
-+ en[3] = en[0];
- }
-
- /* LPC */
-@@ -198,9 +213,9 @@ void ff_aac_search_for_tns(AACEncContext *s, SingleChannelElement *sce)
- if (!order || !isfinite(gain) || gain < TNS_GAIN_THRESHOLD_LOW || gain > TNS_GAIN_THRESHOLD_HIGH)
- continue;
-
-- tns->n_filt[w] = is8 ? 1 : order != TNS_MAX_ORDER ? 2 : 3;
-+ tns->n_filt[w] = n_filt;
- for (g = 0; g < tns->n_filt[w]; g++) {
-- tns->direction[w][g] = slant != 2 ? slant : en[g] < en[!g];
-+ tns->direction[w][g] = slant != 2 ? slant : en[g] < en[g + 1];
- tns->order[w][g] = g < tns->n_filt[w] ? order/tns->n_filt[w] : order - oc_start;
- tns->length[w][g] = g < tns->n_filt[w] ? sfb_len/tns->n_filt[w] : sfb_len - os_start;
- quantize_coefs(&coefs[oc_start], tns->coef_idx[w][g], tns->coef[w][g],
---
-2.40.0
-
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
similarity index 98%
rename from meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.3.bb
rename to meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
index 38c6d1f2b7d..8b0b7cfd6e9 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.3.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
@@ -29,15 +29,12 @@ SRC_URI = " \
file://vulkan_fix_gcc14.patch \
file://CVE-2024-28661.patch \
file://CVE-2023-49528.patch \
- file://CVE-2024-35365.patch \
- file://CVE-2024-36618.patch \
file://CVE-2024-35369.patch \
file://CVE-2025-25473.patch \
file://CVE-2025-22921.patch \
- file://CVE-2025-1594.patch \
"
-SRC_URI[sha256sum] = "bc5f1e4a4d283a6492354684ee1124129c52293bcfc6a9169193539fbece3487"
+SRC_URI[sha256sum] = "a231e3d5742c44b1cdaebfb98ad7b6200d12763e0b6db9e1e2c5891f2c083a18"
# https://nvd.nist.gov/vuln/detail/CVE-2023-39018
# https://github.com/bramp/ffmpeg-cli-wrapper/issues/291
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 18/25] ffmpeg: ignore CVE-2025-25469
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (16 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 17/25] ffmpeg: upgrade 6.1.3 -> 6.1.4 Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 19/25] glibc: stable 2.39 branch updates Yoann Congal
` (6 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details https://nvd.nist.gov/vuln/detail/CVE-2025-25469
This vulnerability exists in IAMF (Immersive Audio Model and Formats demuxer)
which was introduced in version 7.0 [1]
$ git tag --contains 4ee05182b7cccfa6928dcb0a45c2b50b7d9ea39b
n7.0
n7.0.1
n7.0.2
n7.0.3
n7.1
n7.1-dev
n7.1.1
n7.1.2
n7.1.3
n7.2-dev
n8.0
n8.0.1
n8.1-dev
[1] https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/4ee05182b7cccfa6928dcb0a45c2b50b7d9ea39b
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
index 8b0b7cfd6e9..c1536015d98 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.4.bb
@@ -51,6 +51,8 @@ CVE_STATUS_GROUPS += "CVE_STATUS_FIXED_61x"
CVE_STATUS_FIXED_61x = "CVE-2023-49502 CVE-2023-50007 CVE-2023-50008 CVE-2023-50009 CVE-2023-50010 CVE-2024-31578 CVE-2024-31582 CVE-2024-31585"
CVE_STATUS_FIXED_61x[status] = "cpe-incorrect:these CVEs are fixed in 6.1.x"
+CVE_STATUS[CVE-2025-25469] = "cpe-incorrect: Current version (6.1.4) is not impacted."
+
# Build fails when thumb is enabled: https://bugzilla.yoctoproject.org/show_bug.cgi?id=7717
ARM_INSTRUCTION_SET:armv4 = "arm"
ARM_INSTRUCTION_SET:armv5 = "arm"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 19/25] glibc: stable 2.39 branch updates
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (17 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 18/25] ffmpeg: ignore CVE-2025-25469 Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-10 15:38 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 20/25] meta/classes: fix missing vardeps for CVE status variables Yoann Congal
` (5 subsequent siblings)
24 siblings, 1 reply; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
git log --oneline 58cbbd43fe82910cf8ae9008351b0b0665104500..ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc
ce65d944e3 (HEAD -> release/2.39/master, origin/release/2.39/master) posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814)
831f63b94c resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)
fb22fd3f5b memalign: reinstate alignment overflow check (CVE-2026-0861)
10c0bcb3d3 support: Exit on consistency check failure in resolv_response_add_name
f47dd22366 support: Fix FILE * leak in check_for_unshare_hints in test-container
4a53354eaf sprof: fix -Wformat warnings on 32-bit hosts
beb8267909 sprof: check pread size and offset for overflow
c07002038f getaddrinfo.c: Avoid uninitialized pointer access [BZ #32465]
ae5fb93559 nptl: Optimize trylock for high cache contention workloads (BZ #33704)
efff7cb659 ppc64le: Power 10 rawmemchr clobbers v20 (bug #33091)
f6becd8ae8 ppc64le: Restore optimized strncmp for power10
0daa4e46b8 ppc64le: Restore optimized strcmp for power10
28c1de6580 AArch64: Fix instability in AdvSIMD tan
03d0393343 AArch64: Optimise SVE scalar callbacks
0d05a895f1 aarch64: fix includes in SME tests
c1dc4412f8 aarch64: fix cfi directives around __libc_arm_za_disable
d60f15dc89 aarch64: tests for SME
d1d0d09e9e aarch64: clear ZA state of SME before clone and clone3 syscalls
dbe1904b7c aarch64: define macro for calling __libc_arm_za_disable
58cf4aa421 aarch64: update tests for SME
1b3bd9a9a6 aarch64: Disable ZA state of SME in setjmp and sigsetjmp
38942a336b linux: Also check pkey_get for ENOSYS on tst-pkey (BZ 31996)
c74d59a656 aarch64: Do not link conform tests with -Wl,-z,force-bti (bug 33601)
323ad087a1 x86: fix wmemset ifunc stray '!' (bug 33542)
Testing Results:
Before After Diff
PASS 4926 4921 -5
XPASS 4 4 0
FAIL 223 229 +6
XFAIL 16 16 0
UNSUPPORTED 224 224 0
Changes in failed testcases:
testcase-name before after
elf/tst-audit21 PASS FAIL
malloc/tst-malloc-too-large PASS FAIL
malloc/tst-malloc-too-large-malloc-check PASS FAIL
malloc/tst-malloc-too-large-malloc-hugetlb1 PASS FAIL
malloc/tst-malloc-too-large-malloc-hugetlb2 PASS FAIL
malloc/tst-malloc-too-large-mcheck PASS FAIL
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-core/glibc/glibc-version.inc | 2 +-
meta/recipes-core/glibc/glibc_2.39.bb | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
index 2ca15711587..03a8e5d01e3 100644
--- a/meta/recipes-core/glibc/glibc-version.inc
+++ b/meta/recipes-core/glibc/glibc-version.inc
@@ -1,6 +1,6 @@
SRCBRANCH ?= "release/2.39/master"
PV = "2.39+git"
-SRCREV_glibc ?= "58cbbd43fe82910cf8ae9008351b0b0665104500"
+SRCREV_glibc ?= "ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc"
SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
index ff6c8f3b437..7958d64eed1 100644
--- a/meta/recipes-core/glibc/glibc_2.39.bb
+++ b/meta/recipes-core/glibc/glibc_2.39.bb
@@ -18,7 +18,7 @@ easier access for another. 'ASLR bypass itself is not a vulnerability.'"
CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
CVE_STATUS_STABLE_BACKPORTS = "CVE-2024-2961 CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602 CVE-2025-0395 \
- CVE-2025-4802 CVE-2025-5702 CVE-2025-8058"
+ CVE-2025-4802 CVE-2025-5702 CVE-2025-8058 CVE-2025-15281 CVE-2026-0861 CVE-2026-0915"
CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
DEPENDS += "gperf-native bison-native"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 20/25] meta/classes: fix missing vardeps for CVE status variables
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (18 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 19/25] glibc: stable 2.39 branch updates Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data Yoann Congal
` (4 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Several CVE helper functions (get_patched_cves() and decode_cve_status())
implicitly depend on the CVE_STATUS and CVE_CHECK_STATUSMAP variables, but
these were not declared in the vardeps of their callers.
On Scarthgap, the upstream fix (2cc43c72ff28aa39a417dd8d57cd7c8741c0e541)
cannot be cherry-picked cleanly, as it also requires BitBake changes.
As a workaround, explicitly add CVE_STATUS and CVE_CHECK_STATUSMAP to the
vardeps of all tasks invoking these helpers, ensuring correct task
re-execution when CVE status changes.
This keeps CVE-related metadata generation consistent without requiring
BitBake modifications.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/classes/create-spdx-2.2.bbclass | 1 +
meta/classes/create-spdx-3.0.bbclass | 2 ++
meta/classes/cve-check.bbclass | 1 +
meta/classes/vex.bbclass | 1 +
4 files changed, 5 insertions(+)
diff --git a/meta/classes/create-spdx-2.2.bbclass b/meta/classes/create-spdx-2.2.bbclass
index aaa2e78fe21..037193bb4b9 100644
--- a/meta/classes/create-spdx-2.2.bbclass
+++ b/meta/classes/create-spdx-2.2.bbclass
@@ -710,6 +710,7 @@ python do_create_spdx() {
oe.sbom.write_doc(d, package_doc, pkg_arch, "packages", indent=get_json_indent(d))
}
+do_create_spdx[vardeps] += "CVE_STATUS"
do_create_spdx[vardepsexclude] += "BB_NUMBER_THREADS"
# NOTE: depending on do_unpack is a hack that is necessary to get it's dependencies for archive the source
addtask do_create_spdx after do_package do_packagedata do_unpack do_collect_spdx_deps before do_populate_sdk do_build do_rm_work
diff --git a/meta/classes/create-spdx-3.0.bbclass b/meta/classes/create-spdx-3.0.bbclass
index 6125e8b5479..388497054b0 100644
--- a/meta/classes/create-spdx-3.0.bbclass
+++ b/meta/classes/create-spdx-3.0.bbclass
@@ -159,6 +159,8 @@ do_create_spdx[vardeps] += "\
SPDX_PROFILES \
SPDX_NAMESPACE_PREFIX \
SPDX_UUID_NAMESPACE \
+ CVE_STATUS \
+ CVE_CHECK_STATUSMAP \
"
addtask do_create_spdx after \
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index f5bbaa5d159..3f4704fb4ec 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -187,6 +187,7 @@ python do_cve_check () {
}
addtask cve_check before do_build
+do_cve_check[vardeps] += "CVE_STATUS CVE_CHECK_STATUSMAP"
do_cve_check[depends] = "cve-update-nvd2-native:do_unpack"
do_cve_check[nostamp] = "1"
diff --git a/meta/classes/vex.bbclass b/meta/classes/vex.bbclass
index 707e6f45a19..45a15348724 100644
--- a/meta/classes/vex.bbclass
+++ b/meta/classes/vex.bbclass
@@ -160,6 +160,7 @@ python do_generate_vex () {
cve_write_data_json(d, cve_data, cves_status)
}
+do_generate_vex[vardeps] += "CVE_STATUS CVE_CHECK_STATUSMAP"
addtask generate_vex before do_build
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (19 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 20/25] meta/classes: fix missing vardeps for CVE status variables Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-09 10:58 ` Paul Barker
2026-02-09 9:29 ` [OE-core][scarthgap 22/25] lighttpd: Fix trailing slash on files in mod_dirlisting Yoann Congal
` (3 subsequent siblings)
24 siblings, 1 reply; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Daniel Turull <daniel.turull@ericsson.com>
Adding postprocessing script to process data from linux CNA that includes more accurate metadata and it is updated directly by the source.
Example of enhanced CVE from a report from cve-check:
{
"id": "CVE-2024-26710",
"status": "Ignored",
"link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
"summary": "In the Linux kernel, the following vulnerability [...]",
"scorev2": "0.0",
"scorev3": "5.5",
"scorev4": "0.0",
"modified": "2025-03-17T15:36:11.620",
"vector": "LOCAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"detail": "not-applicable-config",
"description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
},
And same from a report generated with vex:
{
"id": "CVE-2024-26710",
"status": "Ignored",
"link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
"detail": "not-applicable-config",
"description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
},
For unpatched CVEs, provide more context in the description:
Tested with 6.12.22 kernel
{
"id": "CVE-2025-39728",
"status": "Unpatched",
"link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39728",
"summary": "In the Linux kernel, the following vulnerability has been [...],
"scorev2": "0.0",
"scorev3": "0.0",
"scorev4": "0.0",
"modified": "2025-04-21T14:23:45.950",
"vector": "UNKNOWN",
"vectorString": "UNKNOWN",
"detail": "version-in-range",
"description": "Needs backporting (fixed from 6.12.23)"
},
CC: Peter Marko <peter.marko@siemens.com>
CC: Marta Rybczynska <rybczynska@gmail.com>
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e60b1759c1aea5b8f5317e46608f0a3e782ecf57)
Signed-off-by: Suresh H A <suresh.ha@bmwtechworks.in>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
scripts/contrib/improve_kernel_cve_report.py | 467 +++++++++++++++++++
1 file changed, 467 insertions(+)
create mode 100755 scripts/contrib/improve_kernel_cve_report.py
diff --git a/scripts/contrib/improve_kernel_cve_report.py b/scripts/contrib/improve_kernel_cve_report.py
new file mode 100755
index 00000000000..829cc4cd30e
--- /dev/null
+++ b/scripts/contrib/improve_kernel_cve_report.py
@@ -0,0 +1,467 @@
+#! /usr/bin/env python3
+#
+# Copyright OpenEmbedded Contributors
+#
+# The script uses another source of CVE information from linux-vulns
+# to enrich the cve-summary from cve-check or vex.
+# It can also use the list of compiled files from the kernel spdx to ignore CVEs
+# that are not affected since the files are not compiled.
+#
+# It creates a new json file with updated CVE information
+#
+# Compiled files can be extracted adding the following in local.conf
+# SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1"
+#
+# Tested with the following CVE sources:
+# - https://git.kernel.org/pub/scm/linux/security/vulns.git
+# - https://github.com/CVEProject/cvelistV5
+#
+# Example:
+# python3 ./openembedded-core/scripts/contrib/improve_kernel_cve_report.py --spdx tmp/deploy/spdx/3.0.1/qemux86_64/recipes/recipe-linux-yocto.spdx.json --kernel-version 6.12.27 --datadir ./vulns
+# python3 ./openembedded-core/scripts/contrib/improve_kernel_cve_report.py --spdx tmp/deploy/spdx/3.0.1/qemux86_64/recipes/recipe-linux-yocto.spdx.json --datadir ./vulns --old-cve-report build/tmp/log/cve/cve-summary.json
+#
+# SPDX-License-Identifier: GPLv2
+
+import argparse
+import json
+import sys
+import logging
+import glob
+import os
+import pathlib
+from packaging.version import Version
+
+def is_linux_cve(cve_info):
+ '''Return true is the CVE belongs to Linux'''
+ if not "affected" in cve_info["containers"]["cna"]:
+ return False
+ for affected in cve_info["containers"]["cna"]["affected"]:
+ if not "product" in affected:
+ return False
+ if affected["product"] == "Linux" and affected["vendor"] == "Linux":
+ return True
+ return False
+
+def get_kernel_cves(datadir, compiled_files, version):
+ """
+ Get CVEs for the kernel
+ """
+ cves = {}
+
+ check_config = len(compiled_files) > 0
+
+ base_version = Version(f"{version.major}.{version.minor}")
+
+ # Check all CVES from kernel vulns
+ pattern = os.path.join(datadir, '**', "CVE-*.json")
+ cve_files = glob.glob(pattern, recursive=True)
+ not_applicable_config = 0
+ fixed_as_later_backport = 0
+ vulnerable = 0
+ not_vulnerable = 0
+ for cve_file in sorted(cve_files):
+ cve_info = {}
+ with open(cve_file, "r", encoding='ISO-8859-1') as f:
+ cve_info = json.load(f)
+
+ if len(cve_info) == 0:
+ logging.error("Not valid data in %s. Aborting", cve_file)
+ break
+
+ if not is_linux_cve(cve_info):
+ continue
+ cve_id = os.path.basename(cve_file)[:-5]
+ description = cve_info["containers"]["cna"]["descriptions"][0]["value"]
+ if cve_file.find("rejected") >= 0:
+ logging.debug("%s is rejected by the CNA", cve_id)
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Ignored",
+ "detail": "rejected",
+ "summary": description,
+ "description": f"Rejected by CNA"
+ }
+ continue
+ if any(elem in cve_file for elem in ["review", "reverved", "testing"]):
+ continue
+
+ is_vulnerable, first_affected, last_affected, better_match_first, better_match_last, affected_versions = get_cpe_applicability(cve_info, version)
+
+ logging.debug("%s: %s (%s - %s) (%s - %s)", cve_id, is_vulnerable, better_match_first, better_match_last, first_affected, last_affected)
+
+ if is_vulnerable is None:
+ logging.warning("%s doesn't have good metadata", cve_id)
+ if is_vulnerable:
+ is_affected = True
+ affected_files = []
+ if check_config:
+ is_affected, affected_files = check_kernel_compiled_files(compiled_files, cve_info)
+
+ if not is_affected and len(affected_files) > 0:
+ logging.debug(
+ "%s - not applicable configuration since affected files not compiled: %s",
+ cve_id, affected_files)
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Ignored",
+ "detail": "not-applicable-config",
+ "summary": description,
+ "description": f"Source code not compiled by config. {affected_files}"
+ }
+ not_applicable_config +=1
+ # Check if we have backport
+ else:
+ if not better_match_last:
+ fixed_in = last_affected
+ else:
+ fixed_in = better_match_last
+ logging.debug("%s needs backporting (fixed from %s)", cve_id, fixed_in)
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Unpatched",
+ "detail": "version-in-range",
+ "summary": description,
+ "description": f"Needs backporting (fixed from {fixed_in})"
+ }
+ vulnerable += 1
+ if (better_match_last and
+ Version(f"{better_match_last.major}.{better_match_last.minor}") == base_version):
+ fixed_as_later_backport += 1
+ # Not vulnerable
+ else:
+ if not first_affected:
+ logging.debug("%s - not known affected %s",
+ cve_id,
+ better_match_last)
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Patched",
+ "detail": "version-not-in-range",
+ "summary": description,
+ "description": "No CPE match"
+ }
+ not_vulnerable += 1
+ continue
+ backport_base = Version(f"{better_match_last.major}.{better_match_last.minor}")
+ if version < first_affected:
+ logging.debug('%s - fixed-version: only affects %s onwards',
+ cve_id,
+ first_affected)
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Patched",
+ "detail": "fixed-version",
+ "summary": description,
+ "description": f"only affects {first_affected} onwards"
+ }
+ not_vulnerable += 1
+ elif last_affected <= version:
+ logging.debug("%s - fixed-version: Fixed from version %s",
+ cve_id,
+ last_affected)
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Patched",
+ "detail": "fixed-version",
+ "summary": description,
+ "description": f"fixed-version: Fixed from version {last_affected}"
+ }
+ not_vulnerable += 1
+ elif backport_base == base_version:
+ logging.debug("%s - cpe-stable-backport: Backported in %s",
+ cve_id,
+ better_match_last)
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Patched",
+ "detail": "cpe-stable-backport",
+ "summary": description,
+ "description": f"Backported in {better_match_last}"
+ }
+ not_vulnerable += 1
+ else:
+ logging.debug("%s - version not affected %s", cve_id, str(affected_versions))
+ cves[cve_id] = {
+ "id": cve_id,
+ "status": "Patched",
+ "detail": "version-not-in-range",
+ "summary": description,
+ "description": f"Range {affected_versions}"
+ }
+ not_vulnerable += 1
+
+ logging.info("Total CVEs ignored due to not applicable config: %d", not_applicable_config)
+ logging.info("Total CVEs not vulnerable due version-not-in-range: %d", not_vulnerable)
+ logging.info("Total vulnerable CVEs: %d", vulnerable)
+
+ logging.info("Total CVEs already backported in %s: %s", base_version,
+ fixed_as_later_backport)
+ return cves
+
+def read_spdx(spdx_file):
+ '''Open SPDX file and extract compiled files'''
+ with open(spdx_file, 'r', encoding='ISO-8859-1') as f:
+ spdx = json.load(f)
+ if "spdxVersion" in spdx:
+ if spdx["spdxVersion"] == "SPDX-2.2":
+ return read_spdx2(spdx)
+ if "@graph" in spdx:
+ return read_spdx3(spdx)
+ return []
+
+def read_spdx2(spdx):
+ '''
+ Read spdx2 compiled files from spdx
+ '''
+ cfiles = set()
+ if 'files' not in spdx:
+ return cfiles
+ for item in spdx['files']:
+ for ftype in item['fileTypes']:
+ if ftype == "SOURCE":
+ filename = item["fileName"][item["fileName"].find("/")+1:]
+ cfiles.add(filename)
+ return cfiles
+
+def read_spdx3(spdx):
+ '''
+ Read spdx3 compiled files from spdx
+ '''
+ cfiles = set()
+ for item in spdx["@graph"]:
+ if "software_primaryPurpose" not in item:
+ continue
+ if item["software_primaryPurpose"] == "source":
+ filename = item['name'][item['name'].find("/")+1:]
+ cfiles.add(filename)
+ return cfiles
+
+def check_kernel_compiled_files(compiled_files, cve_info):
+ """
+ Return if a CVE affected us depending on compiled files
+ """
+ files_affected = set()
+ is_affected = False
+
+ for item in cve_info['containers']['cna']['affected']:
+ if "programFiles" in item:
+ for f in item['programFiles']:
+ if f not in files_affected:
+ files_affected.add(f)
+
+ if len(files_affected) > 0:
+ for f in files_affected:
+ if f in compiled_files:
+ logging.debug("File match: %s", f)
+ is_affected = True
+ return is_affected, files_affected
+
+def get_cpe_applicability(cve_info, v):
+ '''
+ Check if version is affected and return affected versions
+ '''
+ base_branch = Version(f"{v.major}.{v.minor}")
+ affected = []
+ if not 'cpeApplicability' in cve_info["containers"]["cna"]:
+ return None, None, None, None, None, None
+
+ for nodes in cve_info["containers"]["cna"]["cpeApplicability"]:
+ for node in nodes.values():
+ vulnerable = False
+ matched_branch = False
+ first_affected = Version("5000")
+ last_affected = Version("0")
+ better_match_first = Version("0")
+ better_match_last = Version("5000")
+
+ if len(node[0]['cpeMatch']) == 0:
+ first_affected = None
+ last_affected = None
+ better_match_first = None
+ better_match_last = None
+
+ for cpe_match in node[0]['cpeMatch']:
+ version_start_including = Version("0")
+ version_end_excluding = Version("0")
+ if 'versionStartIncluding' in cpe_match:
+ version_start_including = Version(cpe_match['versionStartIncluding'])
+ else:
+ version_start_including = Version("0")
+ # if versionEndExcluding is missing we are in a branch, which is not fixed.
+ if "versionEndExcluding" in cpe_match:
+ version_end_excluding = Version(cpe_match["versionEndExcluding"])
+ else:
+ # if versionEndExcluding is missing we are in a branch, which is not fixed.
+ version_end_excluding = Version(
+ f"{version_start_including.major}.{version_start_including.minor}.5000"
+ )
+ affected.append(f" {version_start_including}-{version_end_excluding}")
+ # Detect if versionEnd is in fixed in base branch. It has precedence over the rest
+ branch_end = Version(f"{version_end_excluding.major}.{version_end_excluding.minor}")
+ if branch_end == base_branch:
+ if version_start_including <= v < version_end_excluding:
+ vulnerable = cpe_match['vulnerable']
+ # If we don't match in our branch, we are not vulnerable,
+ # since we have a backport
+ matched_branch = True
+ better_match_first = version_start_including
+ better_match_last = version_end_excluding
+ if version_start_including <= v < version_end_excluding and not matched_branch:
+ if version_end_excluding < better_match_last:
+ better_match_first = max(version_start_including, better_match_first)
+ better_match_last = min(better_match_last, version_end_excluding)
+ vulnerable = cpe_match['vulnerable']
+ matched_branch = True
+
+ first_affected = min(version_start_including, first_affected)
+ last_affected = max(version_end_excluding, last_affected)
+ # Not a better match, we use the first and last affected instead of the fake .5000
+ if vulnerable and better_match_last == Version(f"{base_branch}.5000"):
+ better_match_last = last_affected
+ better_match_first = first_affected
+ return vulnerable, first_affected, last_affected, better_match_first, better_match_last, affected
+
+def copy_data(old, new):
+ '''Update dictionary with new entries, while keeping the old ones'''
+ for k in new.keys():
+ old[k] = new[k]
+ return old
+
+# Function taken from cve_check.bbclass. Adapted to cve fields
+def cve_update(cve_data, cve, entry):
+ # If no entry, just add it
+ if cve not in cve_data:
+ cve_data[cve] = entry
+ return
+ # If we are updating, there might be change in the status
+ if cve_data[cve]['status'] == "Unknown":
+ cve_data[cve] = copy_data(cve_data[cve], entry)
+ return
+ if cve_data[cve]['status'] == entry['status']:
+ return
+ if entry['status'] == "Unpatched" and cve_data[cve]['status'] == "Patched":
+ logging.warning("CVE entry %s update from Patched to Unpatched from the scan result", cve)
+ cve_data[cve] = copy_data(cve_data[cve], entry)
+ return
+ if entry['status'] == "Patched" and cve_data[cve]['status'] == "Unpatched":
+ logging.warning("CVE entry %s update from Unpatched to Patched from the scan result", cve)
+ cve_data[cve] = copy_data(cve_data[cve], entry)
+ return
+ # If we have an "Ignored", it has a priority
+ if cve_data[cve]['status'] == "Ignored":
+ logging.debug("CVE %s not updating because Ignored", cve)
+ return
+ # If we have an "Ignored", it has a priority
+ if entry['status'] == "Ignored":
+ cve_data[cve] = copy_data(cve_data[cve], entry)
+ logging.debug("CVE entry %s updated from Unpatched to Ignored", cve)
+ return
+ logging.warning("Unhandled CVE entry update for %s %s from %s %s to %s",
+ cve, cve_data[cve]['status'], cve_data[cve]['detail'], entry['status'], entry['detail'])
+
+def main():
+ parser = argparse.ArgumentParser(
+ description="Update cve-summary with kernel compiled files and kernel CVE information"
+ )
+ parser.add_argument(
+ "-s",
+ "--spdx",
+ help="SPDX2/3 for the kernel. Needs to include compiled sources",
+ )
+ parser.add_argument(
+ "--datadir",
+ type=pathlib.Path,
+ help="Directory where CVE data is",
+ required=True
+ )
+ parser.add_argument(
+ "--old-cve-report",
+ help="CVE report to update. (Optional)",
+ )
+ parser.add_argument(
+ "--kernel-version",
+ help="Kernel version. Needed if old cve_report is not provided (Optional)",
+ type=Version
+ )
+ parser.add_argument(
+ "--new-cve-report",
+ help="Output file",
+ default="cve-summary-enhance.json"
+ )
+ parser.add_argument(
+ "-D",
+ "--debug",
+ help='Enable debug ',
+ action="store_true")
+
+ args = parser.parse_args()
+
+ if args.debug:
+ log_level=logging.DEBUG
+ else:
+ log_level=logging.INFO
+ logging.basicConfig(format='[%(filename)s:%(lineno)d] %(message)s', level=log_level)
+
+ if not args.kernel_version and not args.old_cve_report:
+ parser.error("either --kernel-version or --old-cve-report are needed")
+ return -1
+
+ # by default we don't check the compiled files, unless provided
+ compiled_files = []
+ if args.spdx:
+ compiled_files = read_spdx(args.spdx)
+ logging.info("Total compiled files %d", len(compiled_files))
+
+ if args.old_cve_report:
+ with open(args.old_cve_report, encoding='ISO-8859-1') as f:
+ cve_report = json.load(f)
+ else:
+ #If summary not provided, we create one
+ cve_report = {
+ "version": "1",
+ "package": [
+ {
+ "name": "linux-yocto",
+ "version": str(args.kernel_version),
+ "products": [
+ {
+ "product": "linux_kernel",
+ "cvesInRecord": "Yes"
+ }
+ ],
+ "issue": []
+ }
+ ]
+ }
+
+ for pkg in cve_report['package']:
+ is_kernel = False
+ for product in pkg['products']:
+ if product['product'] == "linux_kernel":
+ is_kernel=True
+ if not is_kernel:
+ continue
+
+ kernel_cves = get_kernel_cves(args.datadir,
+ compiled_files,
+ Version(pkg["version"]))
+ logging.info("Total kernel cves from kernel CNA: %s", len(kernel_cves))
+ cves = {issue["id"]: issue for issue in pkg["issue"]}
+ logging.info("Total kernel before processing cves: %s", len(cves))
+
+ for cve in kernel_cves:
+ cve_update(cves, cve, kernel_cves[cve])
+
+ pkg["issue"] = []
+ for cve in sorted(cves):
+ pkg["issue"].extend([cves[cve]])
+ logging.info("Total kernel cves after processing: %s", len(pkg['issue']))
+
+ with open(args.new_cve_report, "w", encoding='ISO-8859-1') as f:
+ json.dump(cve_report, f, indent=2)
+
+ return 0
+
+if __name__ == "__main__":
+ sys.exit(main())
+
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 22/25] lighttpd: Fix trailing slash on files in mod_dirlisting
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (20 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 23/25] docbook-xml-dtd4: fix the fetching failure Yoann Congal
` (2 subsequent siblings)
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Fred Bacon <fred.w.bacon@gmail.com>
Fixes [YOCTO #16128]
Backport of upstream bug fix from lighttpd-1.4.75. Version 1.4.74 introduced a bug that
would append a trailing slash to files in a directory listing. When the user attempts to
download one of these files, the web browser could not save the file with a trailing
slash. As a consequence, every web browser tested would generate a random character string
for the saved file name.
Signed-off-by: Fred Bacon <bacon@aerodyne.com>
[Yoann: Fixed Upstream-Status: Backport URL]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../lighttpd/0001-mod_dirlisting.patch | 48 +++++++++++++++++++
.../lighttpd/lighttpd_1.4.74.bb | 1 +
2 files changed, 49 insertions(+)
create mode 100644 meta/recipes-extended/lighttpd/lighttpd/0001-mod_dirlisting.patch
diff --git a/meta/recipes-extended/lighttpd/lighttpd/0001-mod_dirlisting.patch b/meta/recipes-extended/lighttpd/lighttpd/0001-mod_dirlisting.patch
new file mode 100644
index 00000000000..9df2b7556c2
--- /dev/null
+++ b/meta/recipes-extended/lighttpd/lighttpd/0001-mod_dirlisting.patch
@@ -0,0 +1,48 @@
+From 3d400ce06dcb950a61363f87330324db244f4bac Mon Sep 17 00:00:00 2001
+From: Glenn Strauss <gstrauss@gluelogic.com>
+Date: Thu, 29 Feb 2024 20:59:57 -0500
+Subject: [PATCH] [mod_dirlisting] fix suffix display of '/' on file (fixes
+ #3242)
+
+fix incorrect suffix display of '/' on files
+
+(regression in lighttpd 1.4.74)
+
+(thx guy)
+
+Upstream-Status: Backport [https://github.com/lighttpd/lighttpd1.4/commit/3d400ce06dcb950a61363f87330324db244f4bac]
+
+References:
+[1] https://redmine.lighttpd.net/issues/3242
+
+Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
+---
+ src/mod_dirlisting.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/mod_dirlisting.c b/src/mod_dirlisting.c
+index a3432211..2686cd3e 100644
+--- a/src/mod_dirlisting.c
++++ b/src/mod_dirlisting.c
+@@ -1022,10 +1022,19 @@ static void http_list_directory_dirname(buffer * const out, const dirls_entry_t
+ buffer_append_string_len(out, CONST_STR_LEN("</td><td class=\"s\">- </td><td class=\"t\">Directory</td></tr>\n"));
+ }
+
++static void http_list_file_ent(buffer * const out, const dirls_entry_t * const ent, const char * const name) {
++ buffer_append_string_encoded(out, name, ent->namelen, ENCODING_REL_URI_PART);
++ buffer_append_string_len(out, CONST_STR_LEN("\">"));
++ buffer_append_string_encoded(out, name, ent->namelen, ENCODING_MINIMAL_XML);
++ buffer_append_string_len(out, CONST_STR_LEN("</a></td><td class=\"m\">"));
++
++ http_list_directory_mtime(out, ent);
++}
++
+ static void http_list_directory_filename(buffer * const out, const dirls_entry_t * const ent, const char * const name, handler_ctx * const hctx) {
+ buffer_append_string_len(out, CONST_STR_LEN("<tr><td class=\"n\"><a href=\""));
+
+- http_list_directory_ent(out, ent, name);
++ http_list_file_ent(out, ent, name);
+
+ const buffer *content_type;
+ #if defined(HAVE_XATTR) || defined(HAVE_EXTATTR) /*(pass full path)*/
+
diff --git a/meta/recipes-extended/lighttpd/lighttpd_1.4.74.bb b/meta/recipes-extended/lighttpd/lighttpd_1.4.74.bb
index 7460d3d716d..e48fd165145 100644
--- a/meta/recipes-extended/lighttpd/lighttpd_1.4.74.bb
+++ b/meta/recipes-extended/lighttpd/lighttpd_1.4.74.bb
@@ -14,6 +14,7 @@ SRC_URI = "http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-${PV}.t
file://index.html.lighttpd \
file://lighttpd.conf \
file://lighttpd \
+ file://0001-mod_dirlisting.patch \
"
SRC_URI[sha256sum] = "5c08736e83088f7e019797159f306e88ec729abe976dc98fb3bed71b9d3e53b5"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 23/25] docbook-xml-dtd4: fix the fetching failure
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (21 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 22/25] lighttpd: Fix trailing slash on files in mod_dirlisting Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 24/25] pseudo: Update to 1.9.3 release Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 25/25] libtheora: set CVE_PRODUCT Yoann Congal
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Khai Dang <khaidangbk1998@gmail.com>
Updating SRC_URI, the old archive url is deprecated.
Signed-off-by: Khai Dang <khai.dang@lge.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c137d3637b6171fbd3bfd671a56096e7f2b3c318)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../docbook-xml/docbook-xml-dtd4_4.5.bb | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/meta/recipes-devtools/docbook-xml/docbook-xml-dtd4_4.5.bb b/meta/recipes-devtools/docbook-xml/docbook-xml-dtd4_4.5.bb
index e4b4201b1f9..43c3ba17ad8 100644
--- a/meta/recipes-devtools/docbook-xml/docbook-xml-dtd4_4.5.bb
+++ b/meta/recipes-devtools/docbook-xml/docbook-xml-dtd4_4.5.bb
@@ -25,11 +25,11 @@ LIC_FILES_CHKSUM = "file://${WORKDIR}/LICENSE-OASIS;md5=c608985dd5f7f215e669e763
# bitbake build system.
#
-SRC_URI = "https://docbook.org/xml/4.1.2/docbkx412.zip;name=payload412;subdir=docbook-4.1.2 \
- https://docbook.org/xml/4.2/docbook-xml-4.2.zip;name=payload42;subdir=docbook-4.2 \
- https://docbook.org/xml/4.3/docbook-xml-4.3.zip;name=payload43;subdir=docbook-4.3 \
- https://docbook.org/xml/4.4/docbook-xml-4.4.zip;name=payload44;subdir=docbook-4.4 \
- https://docbook.org/xml/${PV}/docbook-xml-${PV}.zip;name=payloadPV;subdir=docbook-${PV} \
+SRC_URI = "https://archive.docbook.org/xml/4.1.2/docbkx412.zip;name=payload412;subdir=docbook-4.1.2 \
+ https://archive.docbook.org/xml/4.2/docbook-xml-4.2.zip;name=payload42;subdir=docbook-4.2 \
+ https://archive.docbook.org/xml/4.3/docbook-xml-4.3.zip;name=payload43;subdir=docbook-4.3 \
+ https://archive.docbook.org/xml/4.4/docbook-xml-4.4.zip;name=payload44;subdir=docbook-4.4 \
+ https://archive.docbook.org/xml/${PV}/docbook-xml-${PV}.zip;name=payloadPV;subdir=docbook-${PV} \
file://docbook-xml-update-catalog.xml.patch \
file://LICENSE-OASIS"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 24/25] pseudo: Update to 1.9.3 release
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (22 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 23/25] docbook-xml-dtd4: fix the fetching failure Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 25/25] libtheora: set CVE_PRODUCT Yoann Congal
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Pulls in the following changes:
Makefile.in: Bump version to 1.9.3
configure: Minor code quality changes
pseudo: code quality scan - resolved various potential issues
makewrappers: improve error handling and robustness
Update COPYRIGHT files
ports/linux/pseudo_wrappers.c: Call the wrappers where possible
ports/linux/pseudo_wrappers.c: Workaround compile error on Debian 11
ports/linux/pseudo_wrappers.c: Reorder the syscall operations
ports/unix/guts/realpath.c: Fix indents
pseudo_util.c: Skip realpath like expansion for /proc on Linux
test/test-proc-pipe.sh: Add test case for proc pipes
ports/unix/guts/realpath.c: realpath fails if the resolved path doesn't exist
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Antonin Godard <antonin.godard@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 524f4bbb11f9c7e0126e8bd46af217b452d48f5e)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-devtools/pseudo/pseudo_git.bb | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-devtools/pseudo/pseudo_git.bb b/meta/recipes-devtools/pseudo/pseudo_git.bb
index c78f1ab724d..d08fe9f42c3 100644
--- a/meta/recipes-devtools/pseudo/pseudo_git.bb
+++ b/meta/recipes-devtools/pseudo/pseudo_git.bb
@@ -12,9 +12,9 @@ SRC_URI:append:class-nativesdk = " \
file://older-glibc-symbols.patch"
SRC_URI[prebuilt.sha256sum] = "ed9f456856e9d86359f169f46a70ad7be4190d6040282b84c8d97b99072485aa"
-SRCREV = "125b020dd2bc46baa37a80784704e382732357b4"
+SRCREV = "750362cc7b9fa58dffccd95d919b435c6d8ac614"
S = "${WORKDIR}/git"
-PV = "1.9.2+git"
+PV = "1.9.3+git"
# largefile and 64bit time_t support adds these macros via compiler flags globally
# remove them for pseudo since pseudo intercepts some of the functions which will be
^ permalink raw reply related [flat|nested] 33+ messages in thread
* [OE-core][scarthgap 25/25] libtheora: set CVE_PRODUCT
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
` (23 preceding siblings ...)
2026-02-09 9:29 ` [OE-core][scarthgap 24/25] pseudo: Update to 1.9.3 release Yoann Congal
@ 2026-02-09 9:29 ` Yoann Congal
24 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-09 9:29 UTC (permalink / raw)
To: openembedded-core
From: Ken Kurematsu <k.kurematsu@nskint.co.jp>
In the NVD database, the product name of libtheora is theora.
This was set to ensure that cve-check works correctly.
Signed-off-by: Ken Kurematsu <k.kurematsu@nskint.co.jp>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a8ddda60332e2a3219e905c1545b5da917f855c6)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb b/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb
index 11674af379f..5e94bc29751 100644
--- a/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb
+++ b/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb
@@ -16,6 +16,8 @@ SRC_URI[sha256sum] = "b6ae1ee2fa3d42ac489287d3ec34c5885730b1296f0801ae577a35193d
UPSTREAM_CHECK_REGEX = "libtheora-(?P<pver>\d+(\.\d)+)\.(tar\.gz|tgz)"
+CVE_PRODUCT = "theora"
+
inherit autotools pkgconfig
EXTRA_OECONF = "--disable-examples"
^ permalink raw reply related [flat|nested] 33+ messages in thread
* Re: [OE-core][scarthgap 16/25] zlib: ignore CVE-2026-22184
2026-02-09 9:28 ` [OE-core][scarthgap 16/25] zlib: ignore CVE-2026-22184 Yoann Congal
@ 2026-02-09 10:49 ` Paul Barker
2026-02-10 10:45 ` Yoann Congal
0 siblings, 1 reply; 33+ messages in thread
From: Paul Barker @ 2026-02-09 10:49 UTC (permalink / raw)
To: yoann.congal, openembedded-core
[-- Attachment #1: Type: text/plain, Size: 1322 bytes --]
On Mon, 2026-02-09 at 10:28 +0100, Yoann Congal via
lists.openembedded.org wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> This is CVE for example tool contrib/untgz.
> This is not compiled in Yocto zlib recipe.
>
> This CVE has controversial CVSS3 score of 9.8.
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
> ---
> meta/recipes-core/zlib/zlib_1.3.1.bb | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb
> index e6a81ef7898..8ebc6befc2b 100644
> --- a/meta/recipes-core/zlib/zlib_1.3.1.bb
> +++ b/meta/recipes-core/zlib/zlib_1.3.1.bb
> @@ -48,3 +48,4 @@ BBCLASSEXTEND = "native nativesdk"
>
> CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip"
> CVE_STATUS[CVE-2023-6992] = "cpe-incorrect: this CVE is for cloudflare zlib"
> +CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled"
I think we should consider backporting 119b775b36df ("zlib: Add
CVE_PRODUCT to exclude false positives") and the relevant bits of
73ee9789183a ("recipes: cleanup CVE_STATUS which are resolved now"),
then we can cherry-pick b0592c51b6ad from master.
Best regards,
--
Paul Barker
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data
2026-02-09 9:29 ` [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data Yoann Congal
@ 2026-02-09 10:58 ` Paul Barker
2026-02-10 9:35 ` Yoann Congal
0 siblings, 1 reply; 33+ messages in thread
From: Paul Barker @ 2026-02-09 10:58 UTC (permalink / raw)
To: yoann.congal, openembedded-core
[-- Attachment #1: Type: text/plain, Size: 2655 bytes --]
On Mon, 2026-02-09 at 10:29 +0100, Yoann Congal via
lists.openembedded.org wrote:
> From: Daniel Turull <daniel.turull@ericsson.com>
>
> Adding postprocessing script to process data from linux CNA that includes more accurate metadata and it is updated directly by the source.
>
> Example of enhanced CVE from a report from cve-check:
>
> {
> "id": "CVE-2024-26710",
> "status": "Ignored",
> "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
> "summary": "In the Linux kernel, the following vulnerability [...]",
> "scorev2": "0.0",
> "scorev3": "5.5",
> "scorev4": "0.0",
> "modified": "2025-03-17T15:36:11.620",
> "vector": "LOCAL",
> "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
> "detail": "not-applicable-config",
> "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
> },
>
> And same from a report generated with vex:
> {
> "id": "CVE-2024-26710",
> "status": "Ignored",
> "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
> "detail": "not-applicable-config",
> "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
> },
>
> For unpatched CVEs, provide more context in the description:
> Tested with 6.12.22 kernel
> {
> "id": "CVE-2025-39728",
> "status": "Unpatched",
> "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39728",
> "summary": "In the Linux kernel, the following vulnerability has been [...],
> "scorev2": "0.0",
> "scorev3": "0.0",
> "scorev4": "0.0",
> "modified": "2025-04-21T14:23:45.950",
> "vector": "UNKNOWN",
> "vectorString": "UNKNOWN",
> "detail": "version-in-range",
> "description": "Needs backporting (fixed from 6.12.23)"
> },
>
> CC: Peter Marko <peter.marko@siemens.com>
> CC: Marta Rybczynska <rybczynska@gmail.com>
> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
> (cherry picked from commit e60b1759c1aea5b8f5317e46608f0a3e782ecf57)
> Signed-off-by: Suresh H A <suresh.ha@bmwtechworks.in>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
This looks like a backport of a new feature, if we're making an
exception to allow this to be backported then we should document the
reason why (apologies if this is somewhere on the list and I've missed
it).
If we do take this, we should also consider the other changes made to
this script since it was added to master.
Best regards,
--
Paul Barker
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 252 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data
2026-02-09 10:58 ` Paul Barker
@ 2026-02-10 9:35 ` Yoann Congal
2026-02-10 10:46 ` Yoann Congal
0 siblings, 1 reply; 33+ messages in thread
From: Yoann Congal @ 2026-02-10 9:35 UTC (permalink / raw)
To: Paul Barker, openembedded-core
On Mon Feb 9, 2026 at 11:58 AM CET, Paul Barker wrote:
> On Mon, 2026-02-09 at 10:29 +0100, Yoann Congal via
> lists.openembedded.org wrote:
>> From: Daniel Turull <daniel.turull@ericsson.com>
>>
>> Adding postprocessing script to process data from linux CNA that includes more accurate metadata and it is updated directly by the source.
>>
>> Example of enhanced CVE from a report from cve-check:
>>
>> {
>> "id": "CVE-2024-26710",
>> "status": "Ignored",
>> "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
>> "summary": "In the Linux kernel, the following vulnerability [...]",
>> "scorev2": "0.0",
>> "scorev3": "5.5",
>> "scorev4": "0.0",
>> "modified": "2025-03-17T15:36:11.620",
>> "vector": "LOCAL",
>> "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
>> "detail": "not-applicable-config",
>> "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
>> },
>>
>> And same from a report generated with vex:
>> {
>> "id": "CVE-2024-26710",
>> "status": "Ignored",
>> "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
>> "detail": "not-applicable-config",
>> "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
>> },
>>
>> For unpatched CVEs, provide more context in the description:
>> Tested with 6.12.22 kernel
>> {
>> "id": "CVE-2025-39728",
>> "status": "Unpatched",
>> "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39728",
>> "summary": "In the Linux kernel, the following vulnerability has been [...],
>> "scorev2": "0.0",
>> "scorev3": "0.0",
>> "scorev4": "0.0",
>> "modified": "2025-04-21T14:23:45.950",
>> "vector": "UNKNOWN",
>> "vectorString": "UNKNOWN",
>> "detail": "version-in-range",
>> "description": "Needs backporting (fixed from 6.12.23)"
>> },
>>
>> CC: Peter Marko <peter.marko@siemens.com>
>> CC: Marta Rybczynska <rybczynska@gmail.com>
>> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
>> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
>> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
>> (cherry picked from commit e60b1759c1aea5b8f5317e46608f0a3e782ecf57)
>> Signed-off-by: Suresh H A <suresh.ha@bmwtechworks.in>
>> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
>
> This looks like a backport of a new feature, if we're making an
> exception to allow this to be backported then we should document the
> reason why (apologies if this is somewhere on the list and I've missed
> it).
I've talked about it briefly there:
https://lore.kernel.org/openembedded-core/CAMSfU+6DXfuaG0uyPtEg5hE7oHqP=8pRhSttciF+NHcwr0Hpjg@mail.gmail.com/t/#u
Mainly, since this is "contrib/", I don't mind relaxing rules a bit.
@Paul, do you think this is reasonable?
I agree that this exception should be documented (I will add a note in the
commit message)
> If we do take this, we should also consider the other changes made to
> this script since it was added to master.
Yes, if I accept this one, I would also accept further updates on this
script.
Cheers,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [OE-core][scarthgap 16/25] zlib: ignore CVE-2026-22184
2026-02-09 10:49 ` Paul Barker
@ 2026-02-10 10:45 ` Yoann Congal
0 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-10 10:45 UTC (permalink / raw)
To: Paul Barker, openembedded-core
On Mon Feb 9, 2026 at 11:49 AM CET, Paul Barker wrote:
> On Mon, 2026-02-09 at 10:28 +0100, Yoann Congal via
> lists.openembedded.org wrote:
>> From: Peter Marko <peter.marko@siemens.com>
>>
>> This is CVE for example tool contrib/untgz.
>> This is not compiled in Yocto zlib recipe.
>>
>> This CVE has controversial CVSS3 score of 9.8.
>>
>> Signed-off-by: Peter Marko <peter.marko@siemens.com>
>> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
>> ---
>> meta/recipes-core/zlib/zlib_1.3.1.bb | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/meta/recipes-core/zlib/zlib_1.3.1.bb b/meta/recipes-core/zlib/zlib_1.3.1.bb
>> index e6a81ef7898..8ebc6befc2b 100644
>> --- a/meta/recipes-core/zlib/zlib_1.3.1.bb
>> +++ b/meta/recipes-core/zlib/zlib_1.3.1.bb
>> @@ -48,3 +48,4 @@ BBCLASSEXTEND = "native nativesdk"
>>
>> CVE_STATUS[CVE-2023-45853] = "not-applicable-config: we don't build minizip"
>> CVE_STATUS[CVE-2023-6992] = "cpe-incorrect: this CVE is for cloudflare zlib"
>> +CVE_STATUS[CVE-2026-22184] = "not-applicable-config: vulnerable file is not compiled"
>
> I think we should consider backporting 119b775b36df ("zlib: Add
> CVE_PRODUCT to exclude false positives") and the relevant bits of
> 73ee9789183a ("recipes: cleanup CVE_STATUS which are resolved now"),
> then we can cherry-pick b0592c51b6ad from master.
Since everything is in whinlatter, I've done that: 3 commits at
https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/scarthgap-nut&id=ee55482f572f13b7194baa0eabc771ceef275a4b
>
> Best regards,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data
2026-02-10 9:35 ` Yoann Congal
@ 2026-02-10 10:46 ` Yoann Congal
0 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-10 10:46 UTC (permalink / raw)
To: Yoann Congal, Paul Barker, openembedded-core
On Tue Feb 10, 2026 at 10:35 AM CET, Yoann Congal wrote:
> On Mon Feb 9, 2026 at 11:58 AM CET, Paul Barker wrote:
>> On Mon, 2026-02-09 at 10:29 +0100, Yoann Congal via
>> lists.openembedded.org wrote:
>>> From: Daniel Turull <daniel.turull@ericsson.com>
>>>
>>> Adding postprocessing script to process data from linux CNA that includes more accurate metadata and it is updated directly by the source.
>>>
>>> Example of enhanced CVE from a report from cve-check:
>>>
>>> {
>>> "id": "CVE-2024-26710",
>>> "status": "Ignored",
>>> "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
>>> "summary": "In the Linux kernel, the following vulnerability [...]",
>>> "scorev2": "0.0",
>>> "scorev3": "5.5",
>>> "scorev4": "0.0",
>>> "modified": "2025-03-17T15:36:11.620",
>>> "vector": "LOCAL",
>>> "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
>>> "detail": "not-applicable-config",
>>> "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
>>> },
>>>
>>> And same from a report generated with vex:
>>> {
>>> "id": "CVE-2024-26710",
>>> "status": "Ignored",
>>> "link": "https://nvd.nist.gov/vuln/detail/CVE-2024-26710",
>>> "detail": "not-applicable-config",
>>> "description": "Source code not compiled by config. ['arch/powerpc/include/asm/thread_info.h']"
>>> },
>>>
>>> For unpatched CVEs, provide more context in the description:
>>> Tested with 6.12.22 kernel
>>> {
>>> "id": "CVE-2025-39728",
>>> "status": "Unpatched",
>>> "link": "https://nvd.nist.gov/vuln/detail/CVE-2025-39728",
>>> "summary": "In the Linux kernel, the following vulnerability has been [...],
>>> "scorev2": "0.0",
>>> "scorev3": "0.0",
>>> "scorev4": "0.0",
>>> "modified": "2025-04-21T14:23:45.950",
>>> "vector": "UNKNOWN",
>>> "vectorString": "UNKNOWN",
>>> "detail": "version-in-range",
>>> "description": "Needs backporting (fixed from 6.12.23)"
>>> },
>>>
>>> CC: Peter Marko <peter.marko@siemens.com>
>>> CC: Marta Rybczynska <rybczynska@gmail.com>
>>> Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
>>> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
>>> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
>>> (cherry picked from commit e60b1759c1aea5b8f5317e46608f0a3e782ecf57)
>>> Signed-off-by: Suresh H A <suresh.ha@bmwtechworks.in>
>>> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
>>
>> This looks like a backport of a new feature, if we're making an
>> exception to allow this to be backported then we should document the
>> reason why (apologies if this is somewhere on the list and I've missed
>> it).
>
> I've talked about it briefly there:
> https://lore.kernel.org/openembedded-core/CAMSfU+6DXfuaG0uyPtEg5hE7oHqP=8pRhSttciF+NHcwr0Hpjg@mail.gmail.com/t/#u
> Mainly, since this is "contrib/", I don't mind relaxing rules a bit.
> @Paul, do you think this is reasonable?
>
> I agree that this exception should be documented (I will add a note in the
> commit message)
@Paul, see the update commit message in
https://git.openembedded.org/openembedded-core-contrib/commit/?h=stable/scarthgap-nut&id=26138b9f4c1cfe4718f719ea7710c80290d9a8da :
> [Yoann: Stable policy exception: This change is clearly a new feature
> and thus should be rejected from stables by policy. But, since this is
> contrib/ an exception can be made]
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
>> If we do take this, we should also consider the other changes made to
>> this script since it was added to master.
>
> Yes, if I accept this one, I would also accept further updates on this
> script.
>
> Cheers,
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 33+ messages in thread
* Re: [OE-core][scarthgap 19/25] glibc: stable 2.39 branch updates
2026-02-09 9:29 ` [OE-core][scarthgap 19/25] glibc: stable 2.39 branch updates Yoann Congal
@ 2026-02-10 15:38 ` Yoann Congal
0 siblings, 0 replies; 33+ messages in thread
From: Yoann Congal @ 2026-02-10 15:38 UTC (permalink / raw)
To: Yoann Congal, openembedded-core
On Mon Feb 9, 2026 at 10:29 AM CET, Yoann Congal wrote:
> From: Peter Marko <peter.marko@siemens.com>
>
> git log --oneline 58cbbd43fe82910cf8ae9008351b0b0665104500..ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc
> ce65d944e3 (HEAD -> release/2.39/master, origin/release/2.39/master) posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814)
> 831f63b94c resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)
> fb22fd3f5b memalign: reinstate alignment overflow check (CVE-2026-0861)
> 10c0bcb3d3 support: Exit on consistency check failure in resolv_response_add_name
> f47dd22366 support: Fix FILE * leak in check_for_unshare_hints in test-container
> 4a53354eaf sprof: fix -Wformat warnings on 32-bit hosts
> beb8267909 sprof: check pread size and offset for overflow
> c07002038f getaddrinfo.c: Avoid uninitialized pointer access [BZ #32465]
> ae5fb93559 nptl: Optimize trylock for high cache contention workloads (BZ #33704)
> efff7cb659 ppc64le: Power 10 rawmemchr clobbers v20 (bug #33091)
> f6becd8ae8 ppc64le: Restore optimized strncmp for power10
> 0daa4e46b8 ppc64le: Restore optimized strcmp for power10
> 28c1de6580 AArch64: Fix instability in AdvSIMD tan
> 03d0393343 AArch64: Optimise SVE scalar callbacks
> 0d05a895f1 aarch64: fix includes in SME tests
> c1dc4412f8 aarch64: fix cfi directives around __libc_arm_za_disable
> d60f15dc89 aarch64: tests for SME
> d1d0d09e9e aarch64: clear ZA state of SME before clone and clone3 syscalls
> dbe1904b7c aarch64: define macro for calling __libc_arm_za_disable
> 58cf4aa421 aarch64: update tests for SME
> 1b3bd9a9a6 aarch64: Disable ZA state of SME in setjmp and sigsetjmp
> 38942a336b linux: Also check pkey_get for ENOSYS on tst-pkey (BZ 31996)
> c74d59a656 aarch64: Do not link conform tests with -Wl,-z,force-bti (bug 33601)
> 323ad087a1 x86: fix wmemset ifunc stray '!' (bug 33542)
>
> Testing Results:
> Before After Diff
> PASS 4926 4921 -5
> XPASS 4 4 0
> FAIL 223 229 +6
> XFAIL 16 16 0
> UNSUPPORTED 224 224 0
>
> Changes in failed testcases:
>
> testcase-name before after
> elf/tst-audit21 PASS FAIL
> malloc/tst-malloc-too-large PASS FAIL
> malloc/tst-malloc-too-large-malloc-check PASS FAIL
> malloc/tst-malloc-too-large-malloc-hugetlb1 PASS FAIL
> malloc/tst-malloc-too-large-malloc-hugetlb2 PASS FAIL
> malloc/tst-malloc-too-large-mcheck PASS FAIL
>
> Signed-off-by: Peter Marko <peter.marko@siemens.com>
> Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
> ---
> meta/recipes-core/glibc/glibc-version.inc | 2 +-
> meta/recipes-core/glibc/glibc_2.39.bb | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
Hello,
When run on the autobuilder, all those new FAIL tests are PASS:
https://valkyrie.yocto.io/pub/non-release/20260209-10/testresults/qemux86-64-tc/testresults.json
I will add this info in the commit message then proceed with merge.
Regards,
>
> diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc
> index 2ca15711587..03a8e5d01e3 100644
> --- a/meta/recipes-core/glibc/glibc-version.inc
> +++ b/meta/recipes-core/glibc/glibc-version.inc
> @@ -1,6 +1,6 @@
> SRCBRANCH ?= "release/2.39/master"
> PV = "2.39+git"
> -SRCREV_glibc ?= "58cbbd43fe82910cf8ae9008351b0b0665104500"
> +SRCREV_glibc ?= "ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc"
> SRCREV_localedef ?= "cba02c503d7c853a38ccfb83c57e343ca5ecd7e5"
>
> GLIBC_GIT_URI ?= "git://sourceware.org/git/glibc.git;protocol=https"
> diff --git a/meta/recipes-core/glibc/glibc_2.39.bb b/meta/recipes-core/glibc/glibc_2.39.bb
> index ff6c8f3b437..7958d64eed1 100644
> --- a/meta/recipes-core/glibc/glibc_2.39.bb
> +++ b/meta/recipes-core/glibc/glibc_2.39.bb
> @@ -18,7 +18,7 @@ easier access for another. 'ASLR bypass itself is not a vulnerability.'"
>
> CVE_STATUS_GROUPS += "CVE_STATUS_STABLE_BACKPORTS"
> CVE_STATUS_STABLE_BACKPORTS = "CVE-2024-2961 CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602 CVE-2025-0395 \
> - CVE-2025-4802 CVE-2025-5702 CVE-2025-8058"
> + CVE-2025-4802 CVE-2025-5702 CVE-2025-8058 CVE-2025-15281 CVE-2026-0861 CVE-2026-0915"
> CVE_STATUS_STABLE_BACKPORTS[status] = "cpe-stable-backport: fix available in used git hash"
>
> DEPENDS += "gperf-native bison-native"
--
Yoann Congal
Smile ECS
^ permalink raw reply [flat|nested] 33+ messages in thread
end of thread, other threads:[~2026-02-10 15:38 UTC | newest]
Thread overview: 33+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-02-09 9:28 [OE-core][scarthgap 00/25] Patch review Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 01/25] curl: fix CVE-2025-10148 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 02/25] curl: patch CVE-2025-14524 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 03/25] expat: patch CVE-2026-24515 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 04/25] expat: patch CVE-2026-25210 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 05/25] glib-2.0: patch CVE-2026-0988 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 06/25] inetutils: Fix CVE-2026-24061 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 07/25] libpng: patch CVE-2026-22695 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 08/25] libpng: patch CVE-2026-22801 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 09/25] libtasn1: Fix CVE-2025-13151 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 10/25] libxml2: patch CVE-2026-0989 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 11/25] libxml2: patch CVE-2026-0990 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 12/25] libxml2: patch CVE-2026-0992 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 13/25] libxml2: add follow-up patch for CVE-2026-0992 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 14/25] python3: patch CVE-2025-13837 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 15/25] python-urllib3: Backport fix for CVE-2026-21441 Yoann Congal
2026-02-09 9:28 ` [OE-core][scarthgap 16/25] zlib: ignore CVE-2026-22184 Yoann Congal
2026-02-09 10:49 ` Paul Barker
2026-02-10 10:45 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 17/25] ffmpeg: upgrade 6.1.3 -> 6.1.4 Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 18/25] ffmpeg: ignore CVE-2025-25469 Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 19/25] glibc: stable 2.39 branch updates Yoann Congal
2026-02-10 15:38 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 20/25] meta/classes: fix missing vardeps for CVE status variables Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 21/25] improve_kernel_cve_report: add script for postprocesing of kernel CVE data Yoann Congal
2026-02-09 10:58 ` Paul Barker
2026-02-10 9:35 ` Yoann Congal
2026-02-10 10:46 ` Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 22/25] lighttpd: Fix trailing slash on files in mod_dirlisting Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 23/25] docbook-xml-dtd4: fix the fetching failure Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 24/25] pseudo: Update to 1.9.3 release Yoann Congal
2026-02-09 9:29 ` [OE-core][scarthgap 25/25] libtheora: set CVE_PRODUCT Yoann Congal
-- strict thread matches above, loose matches on Subject: below --
2025-01-04 13:41 [OE-core][scarthgap 00/25] Patch review Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox