* [OE-core][wrynose 01/27] expat: fix CVE-2026-56403
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 02/27] expat: fix CVE-2026-56408 Yoann Congal
` (25 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
These patches apply the upstream fixes shown in [1] and [2], as
referenced by [3].
[1] https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648
[2] https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-56403
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56403_p1.patch | 83 +++++++++++++++++++
.../expat/expat/CVE-2026-56403_p2.patch | 40 +++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 2 +
3 files changed, 125 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
new file mode 100644
index 00000000000..4cf5c3bd54d
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p1.patch
@@ -0,0 +1,83 @@
+From 4a264be1794368a1acc08476058b6cf087686d11 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Wed, 20 May 2026 12:12:10 +0200
+Subject: [PATCH] lib: Protect function `storeAtts` from signed integer
+ overflow
+
+CVE: CVE-2026-56403
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/12dc6d8d3d65f79471a94d8565f6bf1cf245f648]
+
+Backport Changes:
+- Retain the Expat 2.7.5 binding URI reallocation and active tag pointer
+ updates while using the overflow-safe localPartLen calculation.
+
+(cherry picked from commit 12dc6d8d3d65f79471a94d8565f6bf1cf245f648)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 30 ++++++++++++++++++++----------
+ 1 file changed, 20 insertions(+), 10 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 0248b665..e441ff7f 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -4235,26 +4235,32 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ return XML_ERROR_NONE;
+ prefixLen = 0;
+ if (parser->m_ns_triplets && binding->prefix->name) {
+- while (binding->prefix->name[prefixLen++])
+- ; /* prefixLen includes null terminator */
++ size_t candidateLen = 0;
++ while (binding->prefix->name[candidateLen++])
++ ; /* candidateLen includes null terminator */
++ /* Detect and prevent integer overflow */
++ if (candidateLen > INT_MAX)
++ return XML_ERROR_NO_MEMORY;
++ prefixLen = (int)candidateLen;
+ }
+ tagNamePtr->localPart = localPart;
+ tagNamePtr->uriLen = binding->uriLen;
+ tagNamePtr->prefix = binding->prefix->name;
+ tagNamePtr->prefixLen = prefixLen;
+- for (i = 0; localPart[i++];)
+- ; /* i includes null terminator */
++
++ size_t localPartLen = 0;
++ for (; localPart[localPartLen++];)
++ ; /* localPartLen includes null terminator */
+
+ /* Detect and prevent integer overflow */
+- if (binding->uriLen > INT_MAX - prefixLen
+- || i > INT_MAX - (binding->uriLen + prefixLen)) {
++ if (localPartLen > INT_MAX || binding->uriLen > INT_MAX - prefixLen
++ || localPartLen > (size_t)INT_MAX - (binding->uriLen + prefixLen)) {
+ return XML_ERROR_NO_MEMORY;
+ }
+
+- n = i + binding->uriLen + prefixLen;
++ n = (int)localPartLen + binding->uriLen + prefixLen;
+ if (n > binding->uriAlloc) {
+ TAG *p;
+-
+ /* Detect and prevent integer overflow */
+ if (n > INT_MAX - EXPAND_SPARE) {
+ return XML_ERROR_NO_MEMORY;
+@@ -4282,10 +4288,14 @@ storeAtts(XML_Parser parser, const ENCODING *enc, const char *attStr,
+ }
+ /* if m_namespaceSeparator != '\0' then uri includes it already */
+ uri = binding->uri + binding->uriLen;
+- memcpy(uri, localPart, i * sizeof(XML_Char));
++ /* Detect and prevent integer overflow */
++ if (localPartLen > SIZE_MAX / sizeof(XML_Char)) {
++ return XML_ERROR_NO_MEMORY;
++ }
++ memcpy(uri, localPart, localPartLen * sizeof(XML_Char));
+ /* we always have a namespace separator between localPart and prefix */
+ if (prefixLen) {
+- uri += i - 1;
++ uri += localPartLen - 1;
+ *uri = parser->m_namespaceSeparator; /* replace null terminator */
+ memcpy(uri + 1, binding->prefix->name, prefixLen * sizeof(XML_Char));
+ }
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
new file mode 100644
index 00000000000..62fdff79e3c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56403_p2.patch
@@ -0,0 +1,40 @@
+From e8100827a4f68c70d8cadf446bb82bec7cbebbac Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Fri, 22 May 2026 00:43:52 +0200
+Subject: [PATCH] xmlwf: Protect function `xcsdup` from signed integer overflow
+
+CVE: CVE-2026-56403
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/147c8f36d6277d5c6011c098370a8362aed47b15]
+
+(cherry picked from commit 147c8f36d6277d5c6011c098370a8362aed47b15)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index 2d0c4f8e..934473ce 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -305,13 +305,18 @@ processingInstruction(void *userData, const XML_Char *target,
+ static XML_Char *
+ xcsdup(const XML_Char *s) {
+ XML_Char *result;
+- int count = 0;
++ size_t count = 0;
+ size_t numBytes;
+
+ /* Get the length of the string, including terminator */
+ while (s[count++] != 0) {
+ /* Do nothing */
+ }
++
++ // Detect and prevent integer overflow
++ if (count > SIZE_MAX / sizeof(XML_Char))
++ return NULL;
++
+ numBytes = count * sizeof(XML_Char);
+ result = malloc(numBytes);
+ if (result == NULL)
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index ae90ec04e36..423219c726f 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -19,6 +19,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-45186-07.patch \
file://CVE-2026-41080-1.patch \
file://CVE-2026-41080-2.patch \
+ file://CVE-2026-56403_p1.patch;striplevel=2 \
+ file://CVE-2026-56403_p2.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 02/27] expat: fix CVE-2026-56408
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 01/27] expat: fix CVE-2026-56403 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 03/27] expat: fix CVE-2026-56404 Yoann Congal
` (24 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
The fix is adapted to the existing Expat 2.7.5 copyString implementation.
[1] https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56408
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56408.patch | 36 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56408.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56408.patch b/meta/recipes-core/expat/expat/CVE-2026-56408.patch
new file mode 100644
index 00000000000..b8c43636cc0
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56408.patch
@@ -0,0 +1,36 @@
+From b0cf9e9b0f5dfdd938148931a4605a0fd6b917a7 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Thu, 23 Apr 2026 10:31:45 +0200
+Subject: [PATCH] lib: Waterproof `copyString` from integer overflow
+
+CVE: CVE-2026-56408
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/16e2efd867ea8567ffa012210b52ef5918e20817]
+
+Backport Changes:
+- Adapt the fix to Expat 2.7.5, which calculates charsRequired using
+ an existing loop instead of xcslen. The upstream string helper
+ refactoring is not required for the overflow guard.
+
+(cherry picked from commit 16e2efd867ea8567ffa012210b52ef5918e20817)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index e441ff7f..4ff5e33b 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -8505,6 +8505,10 @@ copyString(const XML_Char *s, XML_Parser parser) {
+ /* Include the terminator */
+ charsRequired++;
+
++ /* Detect and prevent integer overflow */
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char))
++ return NULL;
++
+ /* Now allocate space for the copy */
+ result = MALLOC(parser, charsRequired * sizeof(XML_Char));
+ if (result == NULL)
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 423219c726f..934cde4b1a8 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -21,6 +21,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-41080-2.patch \
file://CVE-2026-56403_p1.patch;striplevel=2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
+ file://CVE-2026-56408.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 03/27] expat: fix CVE-2026-56404
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 01/27] expat: fix CVE-2026-56403 Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 02/27] expat: fix CVE-2026-56408 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 04/27] expat: fix CVE-2026-56405 Yoann Congal
` (23 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56404
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56404.patch | 47 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56404.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56404.patch b/meta/recipes-core/expat/expat/CVE-2026-56404.patch
new file mode 100644
index 00000000000..6bca7cf961c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56404.patch
@@ -0,0 +1,47 @@
+From 8cb4583ac3204175a03c8ea8e371adee583b0bec Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Thu, 28 May 2026 12:44:11 +0530
+Subject: [PATCH] lib: protect function addBinding from signed integer overflow
+
+CVE: CVE-2026-56404
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/babfc48090977cbf7be24b2c48f6053dca75c164]
+
+(cherry picked from commit babfc48090977cbf7be24b2c48f6053dca75c164)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 53f842d1..33b92c9c 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -4485,6 +4485,10 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ }
+
+ for (len = 0; uri[len]; len++) {
++ /* Detect and prevent signed integer overflow */
++ if (len == INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ if (isXML && (len > xmlLen || uri[len] != xmlNamespace[len]))
+ isXML = XML_FALSE;
+
+@@ -4525,8 +4529,13 @@ addBinding(XML_Parser parser, PREFIX *prefix, const ATTRIBUTE_ID *attId,
+ if (isXMLNS)
+ return XML_ERROR_RESERVED_NAMESPACE_URI;
+
+- if (parser->m_namespaceSeparator)
++ if (parser->m_namespaceSeparator) {
++ /* Detect and prevent signed integer overflow */
++ if (len == INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ len++;
++ }
+ if (parser->m_freeBindingList) {
+ b = parser->m_freeBindingList;
+ if (len > b->uriAlloc) {
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 934cde4b1a8..d15e0232077 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -22,6 +22,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56403_p1.patch;striplevel=2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
file://CVE-2026-56408.patch;striplevel=2 \
+ file://CVE-2026-56404.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 04/27] expat: fix CVE-2026-56405
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (2 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 03/27] expat: fix CVE-2026-56404 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 05/27] expat: fix CVE-2026-56410 Yoann Congal
` (22 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56405
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56405.patch | 32 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 33 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56405.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56405.patch b/meta/recipes-core/expat/expat/CVE-2026-56405.patch
new file mode 100644
index 00000000000..c850801c1ac
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56405.patch
@@ -0,0 +1,32 @@
+From 73209f445f0265b203829fa7873caa78ca83cefe Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Fri, 29 May 2026 11:45:17 +0530
+Subject: [PATCH] lib: Protect function getAttributeId from signed integer
+ overflow
+
+CVE: CVE-2026-56405
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/2c6c42d33689f6b266a5267b639e03cde17e53c0]
+
+(cherry picked from commit 2c6c42d33689f6b266a5267b639e03cde17e53c0)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 1b7e289f..ec707336 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -7324,6 +7324,10 @@ getAttributeId(XML_Parser parser, const ENCODING *enc, const char *start,
+ } else {
+ int i;
+ for (i = 0; name[i]; i++) {
++ /* Detect and prevent signed integer overflow */
++ if (i == INT_MAX) {
++ return NULL;
++ }
+ /* attributes without prefix are *not* in the default namespace */
+ if (name[i] == XML_T(ASCII_COLON)) {
+ int j;
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index d15e0232077..789fd7e077b 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -23,6 +23,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56403_p2.patch;striplevel=2 \
file://CVE-2026-56408.patch;striplevel=2 \
file://CVE-2026-56404.patch;striplevel=2 \
+ file://CVE-2026-56405.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 05/27] expat: fix CVE-2026-56410
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (3 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 04/27] expat: fix CVE-2026-56405 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 06/27] expat: fix CVE-2026-56406 Yoann Congal
` (21 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
These patches apply the upstream fixes shown in [1] and [2], as
referenced by [3].
[1] https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347
[2] https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-56410
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56410_p1.patch | 40 ++++++++++++++++++
.../expat/expat/CVE-2026-56410_p2.patch | 41 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 2 +
3 files changed, 83 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
new file mode 100644
index 00000000000..aa4378f1b77
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56410_p1.patch
@@ -0,0 +1,40 @@
+From 759b77a8439bcbf57c86900bc472d46d8ef70c92 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Fri, 29 May 2026 17:51:25 +0530
+Subject: [PATCH] xmlwf: protect resolveSystemId from integer overflow
+
+CVE: CVE-2026-56410
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/deeb97f7c88d17a16b0ea2521a13733abc283347]
+
+Backport Changes:
+- Adjust the removed allocation line for Wrynose's explicit malloc cast while
+ keeping upstream's overflow checks and final allocation logic.
+
+(cherry picked from commit deeb97f7c88d17a16b0ea2521a13733abc283347)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlfile.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlfile.c b/expat/xmlwf/xmlfile.c
+index c4eb839f..31a40209 100644
+--- a/expat/xmlwf/xmlfile.c
++++ b/expat/xmlwf/xmlfile.c
+@@ -138,8 +138,13 @@ resolveSystemId(const XML_Char *base, const XML_Char *systemId,
+ #endif
+ )
+ return systemId;
+- *toFree = (XML_Char *)malloc((tcslen(base) + tcslen(systemId) + 2)
+- * sizeof(XML_Char));
++ const size_t charsRequired = tcslen(base) + tcslen(systemId) + 2;
++
++ /* Detect and prevent integer overflow */
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char))
++ return systemId;
++
++ *toFree = malloc(charsRequired * sizeof(XML_Char));
+ if (! *toFree)
+ return systemId;
+ tcscpy(*toFree, base);
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
new file mode 100644
index 00000000000..71f3122602a
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56410_p2.patch
@@ -0,0 +1,41 @@
+From f16fa442eaa81bfceec5302d977219959eaac7b7 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Sat, 30 May 2026 11:28:51 +0530
+Subject: [PATCH] xmlwf: guard each operator in resolveSystemId length sum
+
+CVE: CVE-2026-56410
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea]
+
+(cherry picked from commit cee20e91bf14dc7f6d2fc48f0d70d86b2dc3afea)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlfile.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlfile.c b/expat/xmlwf/xmlfile.c
+index 31a40209..15c69217 100644
+--- a/expat/xmlwf/xmlfile.c
++++ b/expat/xmlwf/xmlfile.c
+@@ -139,9 +139,17 @@ resolveSystemId(const XML_Char *base, const XML_Char *systemId,
+ #endif
+ )
+ return systemId;
+- const size_t charsRequired = tcslen(base) + tcslen(systemId) + 2;
++ const size_t baseLen = tcslen(base);
++ const size_t systemIdLen = tcslen(systemId);
+
+- /* Detect and prevent integer overflow */
++ /* Detect and prevent integer overflow in the addition (without risking
++ underflow) */
++ if (baseLen > SIZE_MAX - systemIdLen || baseLen > SIZE_MAX - systemIdLen - 2)
++ return systemId;
++
++ const size_t charsRequired = baseLen + systemIdLen + 2;
++
++ /* Detect and prevent integer overflow in the multiplication */
+ if (charsRequired > SIZE_MAX / sizeof(XML_Char))
+ return systemId;
+
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 789fd7e077b..5c93b15484e 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -24,6 +24,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56408.patch;striplevel=2 \
file://CVE-2026-56404.patch;striplevel=2 \
file://CVE-2026-56405.patch;striplevel=2 \
+ file://CVE-2026-56410_p1.patch;striplevel=2 \
+ file://CVE-2026-56410_p2.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 06/27] expat: fix CVE-2026-56406
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (4 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 05/27] expat: fix CVE-2026-56410 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 07/27] expat: fix CVE-2026-56409 Yoann Congal
` (20 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [3].
The prerequisite in [2] provides XML_INDEX_MAX for the Expat 2.7.5
backport.
[1] https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d
[2] https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-56406
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/CVE-2026-56406-dependent.patch | 58 +++++++++++++++++++
.../expat/expat/CVE-2026-56406.patch | 37 ++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 2 +
3 files changed, 97 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56406.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch b/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
new file mode 100644
index 00000000000..6ef7c42298c
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56406-dependent.patch
@@ -0,0 +1,58 @@
+From 4f828b7ee9d6efef618e8a99a0392acbb95e84f2 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Wed, 27 May 2026 17:01:44 -0700
+Subject: [PATCH] lib: Make `XML_Index` overflow check more intuitive
+
+In fixing a bug, 7e5b71b748491b6e459e5c9a1d090820f94544d8 introduced a
+magic number `2` in this code that made it difficult to understand the
+rationale for this overflow check without reading the commit log. This
+change introduces some more readable constants to use in these
+situations.
+
+CVE: CVE-2026-56406
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/252ff1a307b1490ce0f430632791e7e52d7e43fd]
+
+(cherry picked from commit 252ff1a307b1490ce0f430632791e7e52d7e43fd)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 96127bf8..5ecea7a8 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -101,7 +101,7 @@
+ #include <stddef.h>
+ #include <string.h> /* memset(), memcpy() */
+ #include <assert.h>
+-#include <limits.h> /* INT_MAX, UINT_MAX */
++#include <limits.h> /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */
+ #include <stdio.h> /* fprintf */
+ #include <stdlib.h> /* getenv, rand_s */
+ #include <stdint.h> /* SIZE_MAX, uintptr_t */
+@@ -209,6 +209,12 @@ typedef char ICHAR;
+
+ #endif
+
++#ifdef XML_LARGE_SIZE
++# define XML_INDEX_MAX LLONG_MAX
++#else
++# define XML_INDEX_MAX LONG_MAX
++#endif
++
+ /* Round up n to be a multiple of sz, where sz is a power of 2. */
+ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1))
+
+@@ -2395,7 +2401,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal) {
+ int nLeftOver;
+ enum XML_Status result;
+ /* Detect overflow (a+b > MAX <==> b > MAX-a) */
+- if ((XML_Size)len > ((XML_Size)-1) / 2 - parser->m_parseEndByteIndex) {
++ if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) {
+ parser->m_errorCode = XML_ERROR_NO_MEMORY;
+ parser->m_eventPtr = parser->m_eventEndPtr = NULL;
+ parser->m_processor = errorProcessor;
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56406.patch b/meta/recipes-core/expat/expat/CVE-2026-56406.patch
new file mode 100644
index 00000000000..4077b9946a9
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56406.patch
@@ -0,0 +1,37 @@
+From 6e52f18aded0a76cf89f191d7810bc04287f5337 Mon Sep 17 00:00:00 2001
+From: Sebastian Pipping <sebastian@pipping.org>
+Date: Sun, 31 May 2026 15:18:58 +0200
+Subject: [PATCH] lib: Copy overflow check from `XML_Parse` to
+ `XML_ParseBuffer`
+
+CVE: CVE-2026-56406
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/99d8454fdf900a6d00c2a52748e6c0eeb507574d]
+
+(cherry picked from commit 99d8454fdf900a6d00c2a52748e6c0eeb507574d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 5ecea7a8..71fe2c79 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -2518,6 +2518,14 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal) {
+ parser->m_parsingStatus.parsing = XML_PARSING;
+ }
+
++ // Detect and avoid integer overflow
++ if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) {
++ parser->m_errorCode = XML_ERROR_NO_MEMORY;
++ parser->m_eventPtr = parser->m_eventEndPtr = NULL;
++ parser->m_processor = errorProcessor;
++ return XML_STATUS_ERROR;
++ }
++
+ start = parser->m_bufferPtr;
+ parser->m_positionPtr = start;
+ parser->m_bufferEnd += len;
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 5c93b15484e..f14e39c00b3 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -26,6 +26,8 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56405.patch;striplevel=2 \
file://CVE-2026-56410_p1.patch;striplevel=2 \
file://CVE-2026-56410_p2.patch;striplevel=2 \
+ file://CVE-2026-56406-dependent.patch;striplevel=2 \
+ file://CVE-2026-56406.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 07/27] expat: fix CVE-2026-56409
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (5 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 06/27] expat: fix CVE-2026-56406 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 08/27] expat: fix CVE-2026-56411 Yoann Congal
` (19 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56409
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56409.patch | 53 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56409.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56409.patch b/meta/recipes-core/expat/expat/CVE-2026-56409.patch
new file mode 100644
index 00000000000..ff0e650a2ab
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56409.patch
@@ -0,0 +1,53 @@
+From 10938bc2cef7573087566b5b1c948061baa68b98 Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Mon, 1 Jun 2026 11:53:19 +0530
+Subject: [PATCH] xmlwf: protect output path join from integer overflow
+
+CVE: CVE-2026-56409
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e]
+
+Backport Changes:
+- Adapt the allocation hunk to the explicit cast used by Expat 2.7.5.
+
+(cherry picked from commit 61f7cdda22546c4bee38dd2d3fa3d6e4aa64d33e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index 06416454..6a0a707a 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -1236,8 +1236,26 @@ tmain(int argc, XML_Char **argv) {
+ }
+ #endif
+ }
+- outName = (XML_Char *)malloc((tcslen(outputDir) + tcslen(file) + 2)
+- * sizeof(XML_Char));
++ const size_t outputDirLen = tcslen(outputDir);
++ const size_t fileLen = tcslen(file);
++
++ /* Detect and prevent integer overflow in the addition (without
++ risking underflow) and the multiplication, mirroring the guards
++ in xcsdup() and resolveSystemId() */
++ if (outputDirLen > SIZE_MAX - fileLen
++ || outputDirLen > SIZE_MAX - fileLen - 2) {
++ tperror(T("Could not allocate memory"));
++ exit(XMLWF_EXIT_INTERNAL_ERROR);
++ }
++
++ const size_t charsRequired = outputDirLen + fileLen + 2;
++
++ if (charsRequired > SIZE_MAX / sizeof(XML_Char)) {
++ tperror(T("Could not allocate memory"));
++ exit(XMLWF_EXIT_INTERNAL_ERROR);
++ }
++
++ outName = malloc(charsRequired * sizeof(XML_Char));
+ if (! outName) {
+ tperror(T("Could not allocate memory"));
+ exit(XMLWF_EXIT_INTERNAL_ERROR);
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index f14e39c00b3..cb8f9dd1acd 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -28,6 +28,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56410_p2.patch;striplevel=2 \
file://CVE-2026-56406-dependent.patch;striplevel=2 \
file://CVE-2026-56406.patch;striplevel=2 \
+ file://CVE-2026-56409.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 08/27] expat: fix CVE-2026-56411
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (6 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 07/27] expat: fix CVE-2026-56409 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 09/27] expat: fix CVE-2026-56407 Yoann Congal
` (18 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56411
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56411.patch | 47 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56411.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56411.patch b/meta/recipes-core/expat/expat/CVE-2026-56411.patch
new file mode 100644
index 00000000000..884837b61e1
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56411.patch
@@ -0,0 +1,47 @@
+From e447d5d72884a1246894f111a5b72de4e479152e Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Tue, 2 Jun 2026 13:13:34 +0530
+Subject: [PATCH] xmlwf: protect notation list allocation from integer overflow
+
+CVE: CVE-2026-56411
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/528a4e5017e1bd3b48b689fd0c131df940ae3ea5]
+
+(cherry picked from commit 528a4e5017e1bd3b48b689fd0c131df940ae3ea5)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/xmlwf/xmlwf.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/expat/xmlwf/xmlwf.c b/expat/xmlwf/xmlwf.c
+index 6a0a707a..a9640190 100644
+--- a/expat/xmlwf/xmlwf.c
++++ b/expat/xmlwf/xmlwf.c
+@@ -383,9 +383,9 @@ static void XMLCALL
+ endDoctypeDecl(void *userData) {
+ XmlwfUserData *data = (XmlwfUserData *)userData;
+ NotationList **notations;
+- int notationCount = 0;
++ size_t notationCount = 0;
+ NotationList *p;
+- int i;
++ size_t i;
+
+ /* How many notations do we have? */
+ for (p = data->notationListHead; p != NULL; p = p->next)
+@@ -395,6 +395,13 @@ endDoctypeDecl(void *userData) {
+ goto cleanUp;
+ }
+
++ /* Detect and prevent integer overflow in the multiplication, mirroring
++ the guards in xcsdup() and resolveSystemId() */
++ if (notationCount > SIZE_MAX / sizeof(NotationList *)) {
++ fprintf(stderr, "Unable to sort notations");
++ goto cleanUp;
++ }
++
+ notations = malloc(notationCount * sizeof(NotationList *));
+ if (notations == NULL) {
+ fprintf(stderr, "Unable to sort notations");
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index cb8f9dd1acd..bd6656c6e06 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -29,6 +29,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56406-dependent.patch;striplevel=2 \
file://CVE-2026-56406.patch;striplevel=2 \
file://CVE-2026-56409.patch;striplevel=2 \
+ file://CVE-2026-56411.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 09/27] expat: fix CVE-2026-56407
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (7 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 08/27] expat: fix CVE-2026-56411 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 10/27] expat: fix CVE-2026-56132 Yoann Congal
` (17 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix shown in [1] as referenced by [2].
[1] https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-56407
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56407.patch | 44 +++++++++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56407.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56407.patch b/meta/recipes-core/expat/expat/CVE-2026-56407.patch
new file mode 100644
index 00000000000..5a2a22e0172
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56407.patch
@@ -0,0 +1,44 @@
+From 7216b3584bcfb2d415026d16b8902ee7eacad5ca Mon Sep 17 00:00:00 2001
+From: netliomax25-code <netliomax25@gmail.com>
+Date: Tue, 2 Jun 2026 11:59:01 +0530
+Subject: [PATCH] cap entity textLen against signed integer overflow
+
+CVE: CVE-2026-56407
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13]
+
+(cherry picked from commit 30c2fc179ce5d2b1b1bae30bbe0dfddeac894e13)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 71fe2c79..8e90fea8 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5684,6 +5684,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ parser, enc, s + enc->minBytesPerChar, next - enc->minBytesPerChar,
+ XML_ACCOUNT_NONE);
+ if (parser->m_declEntity) {
++ /* Detect and prevent signed integer overflow */
++ if ((size_t)poolLength(&dtd->entityValuePool) > (size_t)INT_MAX) {
++ return XML_ERROR_NO_MEMORY;
++ }
+ parser->m_declEntity->textPtr = poolStart(&dtd->entityValuePool);
+ parser->m_declEntity->textLen
+ = (int)(poolLength(&dtd->entityValuePool));
+@@ -7099,6 +7103,11 @@ storeSelfEntityValue(XML_Parser parser, ENTITY *entity) {
+ return XML_ERROR_NO_MEMORY;
+ }
+
++ /* Detect and prevent signed integer overflow */
++ if ((size_t)poolLength(pool) > (size_t)INT_MAX) {
++ poolDiscard(pool);
++ return XML_ERROR_NO_MEMORY;
++ }
+ entity->textPtr = poolStart(pool);
+ entity->textLen = (int)(poolLength(pool));
+ poolFinish(pool);
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index bd6656c6e06..9f519b482ec 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -30,6 +30,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56406.patch;striplevel=2 \
file://CVE-2026-56409.patch;striplevel=2 \
file://CVE-2026-56411.patch;striplevel=2 \
+ file://CVE-2026-56407.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 10/27] expat: fix CVE-2026-56132
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (8 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 09/27] expat: fix CVE-2026-56407 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 11/27] gnutls: Fix CVE-2026-3832 Yoann Congal
` (16 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
These patches apply the upstream fix shown in [2], its prerequisite
[1], the regression test in [3], and the follow-up cleanups in [4] and
[5], as referenced by [6].
[1] https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3
[2] https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e
[3] https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf
[4] https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4
[5] https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5
[6] https://nvd.nist.gov/vuln/detail/CVE-2026-56132
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../expat/expat/CVE-2026-56132_p1.patch | 90 +++++++++++++++++++
.../expat/expat/CVE-2026-56132_p2.patch | 63 +++++++++++++
.../expat/expat/CVE-2026-56132_p3.patch | 77 ++++++++++++++++
.../expat/expat/CVE-2026-56132_p4.patch | 63 +++++++++++++
.../expat/expat/CVE-2026-56132_p5.patch | 58 ++++++++++++
meta/recipes-core/expat/expat_2.7.5.bb | 5 ++
6 files changed, 356 insertions(+)
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
new file mode 100644
index 00000000000..a413bf0acd0
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p1.patch
@@ -0,0 +1,90 @@
+From 2e5920edcbc77bf29ce8575bd38ed2886408f4af Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH] lib: Remove reuse of `m_groupSize` to count `m_scaffIndex`
+ allocation
+
+The sizes of the two arrays `m_groupConnector` and `scaffIndex` need to
+vary independently. This change is a step towards allowing this.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/3a4eaf47af8fd7abda38ea2c08308c91152061f3]
+
+(cherry picked from commit 3a4eaf47af8fd7abda38ea2c08308c91152061f3)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index 8e90fea8..d4864af8 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -424,6 +424,7 @@ typedef struct {
+ unsigned scaffCount;
+ int scaffLevel;
+ int *scaffIndex;
++ size_t scaffIndexSize;
+ } DTD;
+
+ enum EntityType {
+@@ -5995,7 +5996,6 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
+ #if UINT_MAX >= SIZE_MAX
+ if (parser->m_groupSize > SIZE_MAX / sizeof(int)) {
+- parser->m_groupSize /= 2;
+ return XML_ERROR_NO_MEMORY;
+ }
+ #endif
+@@ -6003,10 +6003,10 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ int *const new_scaff_index = REALLOC(
+ parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int));
+ if (new_scaff_index == NULL) {
+- parser->m_groupSize /= 2;
+ return XML_ERROR_NO_MEMORY;
+ }
+ dtd->scaffIndex = new_scaff_index;
++ dtd->scaffIndexSize = parser->m_groupSize;
+ }
+ } else {
+ parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32);
+@@ -7587,6 +7587,7 @@ dtdCreate(XML_Parser parser) {
+
+ p->in_eldecl = XML_FALSE;
+ p->scaffIndex = NULL;
++ p->scaffIndexSize = 0;
+ p->scaffold = NULL;
+ p->scaffLevel = 0;
+ p->scaffSize = 0;
+@@ -7627,6 +7628,7 @@ dtdReset(DTD *p, XML_Parser parser) {
+
+ FREE(parser, p->scaffIndex);
+ p->scaffIndex = NULL;
++ p->scaffIndexSize = 0;
+ FREE(parser, p->scaffold);
+ p->scaffold = NULL;
+
+@@ -7801,6 +7803,7 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd,
+ newDtd->scaffSize = oldDtd->scaffSize;
+ newDtd->scaffLevel = oldDtd->scaffLevel;
+ newDtd->scaffIndex = oldDtd->scaffIndex;
++ newDtd->scaffIndexSize = oldDtd->scaffIndexSize;
+
+ return 1;
+ } /* End dtdCopy */
+@@ -8331,6 +8334,7 @@ nextScaffoldPart(XML_Parser parser) {
+ dtd->scaffIndex = MALLOC(parser, parser->m_groupSize * sizeof(int));
+ if (! dtd->scaffIndex)
+ return -1;
++ dtd->scaffIndexSize = parser->m_groupSize;
+ dtd->scaffIndex[0] = 0;
+ }
+
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
new file mode 100644
index 00000000000..6fb8f6078ba
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p2.patch
@@ -0,0 +1,63 @@
+From 2b6ebe08e4b6b3dd4d0f4f197dac18eecef16e6e Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH] lib: doProlog: Fix out-of-bound scaffolding index store
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The scaffold backing array is reallocated using the caller parser’s
+per-parser `m_groupSize`, but the DTD struct (which carries
+`scaffIndex`) is shared between a parent parser and any external
+parameter-entity sub-parser created via
+`XML_ExternalEntityParserCreate(parent, NULL, …)`. A sub-parser whose
+group nesting is shallower than the parent’s can `REALLOC` the shared
+`scaffIndex` down to its own size; when the parent resumes and parses a
+deeper element content model, its bounds check passes (its private
+`m_groupSize` is still large enough), the doubling-grow path is skipped,
+and the next write lands past the shrunken buffer.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+Reported-by: Trail of Bits, in collaboration with Anthropic
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/58400483d7c97be316d7a77739c0a6af5d55932e]
+
+(cherry picked from commit 58400483d7c97be316d7a77739c0a6af5d55932e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index d4864af8..b528c9bc 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -6022,6 +6022,21 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ if (myindex < 0)
+ return XML_ERROR_NO_MEMORY;
+ assert(dtd->scaffIndex != NULL);
++ if ((size_t)dtd->scaffLevel >= dtd->scaffIndexSize) {
++ /* Detect and prevent integer overflow */
++ if (dtd->scaffIndexSize > SIZE_MAX / 2 / sizeof(int)) {
++ return XML_ERROR_NO_MEMORY;
++ }
++ assert(dtd->scaffIndexSize > 0);
++ const size_t new_size = dtd->scaffIndexSize * 2;
++ int *const new_scaff_index
++ = REALLOC(parser, dtd->scaffIndex, new_size * sizeof(int));
++ if (new_scaff_index == NULL) {
++ return XML_ERROR_NO_MEMORY;
++ }
++ dtd->scaffIndex = new_scaff_index;
++ dtd->scaffIndexSize = new_size;
++ }
+ dtd->scaffIndex[dtd->scaffLevel] = myindex;
+ dtd->scaffLevel++;
+ dtd->scaffold[myindex].type = XML_CTYPE_SEQ;
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
new file mode 100644
index 00000000000..5405224ec38
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p3.patch
@@ -0,0 +1,77 @@
+From 22805ecc87ba8f66b693220442408a6f7c7e741d Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH] tests: Add a test case for scaffolding array limits in shared
+ DTDs
+
+This test case provokes the bug fixed in the previous commit.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+Reported-by: Trail of Bits, in collaboration with Anthropic
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/353919b3b9f2174073a557ac7d517a5f3cd0cbbf]
+
+(cherry picked from commit 353919b3b9f2174073a557ac7d517a5f3cd0cbbf)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/tests/basic_tests.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+diff --git a/expat/tests/basic_tests.c b/expat/tests/basic_tests.c
+index 02d1d5fd..53b920da 100644
+--- a/expat/tests/basic_tests.c
++++ b/expat/tests/basic_tests.c
+@@ -4091,6 +4091,37 @@ START_TEST(test_skipped_external_entity) {
+ }
+ END_TEST
+
++START_TEST(test_scaff_index_shared_across_external_entity_parser) {
++ const char text[]
++ = "<!DOCTYPE doc [\n"
++ "<!ELEMENT a "
++ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((b))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))>\n"
++ "<!ENTITY % e SYSTEM 'ext'>\n"
++ "%e;\n"
++ "<!ELEMENT c "
++ "(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((d)))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))))>\n"
++ "]>\n"
++ "<doc/>";
++ ExtOption options[]
++ = {{XCS("ext"),
++ "<!ELEMENT x "
++ "((((((((((((((((((((((((((((((((y))))))))))))))))))))))))))))))))>"},
++ {NULL, NULL}};
++
++ XML_Parser parser = XML_ParserCreate(NULL);
++ XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS);
++ XML_SetUserData(parser, options);
++ XML_SetExternalEntityRefHandler(parser, external_entity_optioner);
++ XML_SetElementDeclHandler(parser, dummy_element_decl_handler);
++
++ if (_XML_Parse_SINGLE_BYTES(parser, text, (int)strlen(text), XML_TRUE)
++ == XML_STATUS_ERROR)
++ xml_failure(parser);
++
++ XML_ParserFree(parser);
++}
++END_TEST
++
+ /* Test a different form of unknown external entity */
+ START_TEST(test_skipped_null_loaded_ext_entity) {
+ const char *text = "<!DOCTYPE doc SYSTEM 'http://example.org/one.ent'>\n"
+@@ -6448,6 +6479,8 @@ make_basic_test_case(Suite *s) {
+ tcase_add_test(tc_basic, test_trailing_cr_in_att_value);
+ tcase_add_test(tc_basic, test_standalone_internal_entity);
+ tcase_add_test(tc_basic, test_skipped_external_entity);
++ tcase_add_test__ifdef_xml_dtd(
++ tc_basic, test_scaff_index_shared_across_external_entity_parser);
+ tcase_add_test(tc_basic, test_skipped_null_loaded_ext_entity);
+ tcase_add_test(tc_basic, test_skipped_unloaded_ext_entity);
+ tcase_add_test__ifdef_xml_dtd(tc_basic, test_param_entity_with_trailing_cr);
+--
+2.43.7
+
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
new file mode 100644
index 00000000000..0cef4df4527
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p4.patch
@@ -0,0 +1,63 @@
+From 36df125531dab7e0dc640b341d07b4b1f5ede37b Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH] lib: Remove unnecessary `scaffIndex` expansion
+
+Following the previous changes, all locations that append entries to
+`scaffIndex` handle expanding the array if it is not already large
+enough. So this extra expansion code is no longer necessary. In some
+cases such as processing siblings with alternating scaffolding counts,
+this logic would actually _shrink_ the array only to then later
+re-expand it.
+
+Anthropic: ANT-2026-00037
+Anthropic: ANT-2026-03621
+Anthropic: ANT-2026-03867
+Co-authored-by: Alessandro Gario <alessandro.gario@trailofbits.com>
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/bca93b4ba9e15fd84425568d772b69baebf790e4]
+
+Backport Changes:
+- Remove the expanded Expat 2.7.5 scaffIndex resize block, including its
+ branch-specific integer overflow guard.
+
+(cherry picked from commit bca93b4ba9e15fd84425568d772b69baebf790e4)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 20 --------------------
+ 1 file changed, 20 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index b528c9bc..e59ad556 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5988,26 +5988,6 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ }
+ parser->m_groupConnector = new_connector;
+ }
+-
+- if (dtd->scaffIndex) {
+- /* Detect and prevent integer overflow.
+- * The preprocessor guard addresses the "always false" warning
+- * from -Wtype-limits on platforms where
+- * sizeof(unsigned int) < sizeof(size_t), e.g. on x86_64. */
+-#if UINT_MAX >= SIZE_MAX
+- if (parser->m_groupSize > SIZE_MAX / sizeof(int)) {
+- return XML_ERROR_NO_MEMORY;
+- }
+-#endif
+-
+- int *const new_scaff_index = REALLOC(
+- parser, dtd->scaffIndex, parser->m_groupSize * sizeof(int));
+- if (new_scaff_index == NULL) {
+- return XML_ERROR_NO_MEMORY;
+- }
+- dtd->scaffIndex = new_scaff_index;
+- dtd->scaffIndexSize = parser->m_groupSize;
+- }
+ } else {
+ parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32);
+ if (! parser->m_groupConnector) {
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch b/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
new file mode 100644
index 00000000000..8655298b65f
--- /dev/null
+++ b/meta/recipes-core/expat/expat/CVE-2026-56132_p5.patch
@@ -0,0 +1,58 @@
+From c6256eca63fe36d4ef26fd59cbcaab7b72e1d6f2 Mon Sep 17 00:00:00 2001
+From: Matthew Fernandez <matthew.fernandez@gmail.com>
+Date: Thu, 4 Jun 2026 17:01:02 -0700
+Subject: [PATCH] lib: Remove indented scoping of `new_connector` local
+
+Following the previous change, the lifetime of `new_connector` as
+constrained by this introduced scope was identical to the parent scope.
+
+CVE: CVE-2026-56132
+Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/08baa7ef9d168b99094249998fd78f8d190526e5]
+
+Backport Changes:
+- Keep the Expat 2.7.5 unsigned-int overflow guard while removing the
+ redundant new_connector scope.
+
+(cherry picked from commit 08baa7ef9d168b99094249998fd78f8d190526e5)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ expat/lib/xmlparse.c | 22 ++++++++++------------
+ 1 file changed, 10 insertions(+), 12 deletions(-)
+
+diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
+index e59ad556..e8d6fc3a 100644
+--- a/expat/lib/xmlparse.c
++++ b/expat/lib/xmlparse.c
+@@ -5974,20 +5974,18 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
+ case XML_ROLE_GROUP_OPEN:
+ if (parser->m_prologState.level >= parser->m_groupSize) {
+ if (parser->m_groupSize) {
+- {
+- /* Detect and prevent integer overflow */
+- if (parser->m_groupSize > (unsigned int)(-1) / 2u) {
+- return XML_ERROR_NO_MEMORY;
+- }
++ /* Detect and prevent integer overflow */
++ if (parser->m_groupSize > (unsigned int)(-1) / 2u) {
++ return XML_ERROR_NO_MEMORY;
++ }
+
+- char *const new_connector = REALLOC(
+- parser, parser->m_groupConnector, parser->m_groupSize *= 2);
+- if (new_connector == NULL) {
+- parser->m_groupSize /= 2;
+- return XML_ERROR_NO_MEMORY;
+- }
+- parser->m_groupConnector = new_connector;
++ char *const new_connector = REALLOC(parser, parser->m_groupConnector,
++ parser->m_groupSize *= 2);
++ if (new_connector == NULL) {
++ parser->m_groupSize /= 2;
++ return XML_ERROR_NO_MEMORY;
+ }
++ parser->m_groupConnector = new_connector;
+ } else {
+ parser->m_groupConnector = MALLOC(parser, parser->m_groupSize = 32);
+ if (! parser->m_groupConnector) {
+--
+2.43.7
diff --git a/meta/recipes-core/expat/expat_2.7.5.bb b/meta/recipes-core/expat/expat_2.7.5.bb
index 9f519b482ec..890ee5b7d34 100644
--- a/meta/recipes-core/expat/expat_2.7.5.bb
+++ b/meta/recipes-core/expat/expat_2.7.5.bb
@@ -31,6 +31,11 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
file://CVE-2026-56409.patch;striplevel=2 \
file://CVE-2026-56411.patch;striplevel=2 \
file://CVE-2026-56407.patch;striplevel=2 \
+ file://CVE-2026-56132_p1.patch;striplevel=2 \
+ file://CVE-2026-56132_p2.patch;striplevel=2 \
+ file://CVE-2026-56132_p3.patch;striplevel=2 \
+ file://CVE-2026-56132_p4.patch;striplevel=2 \
+ file://CVE-2026-56132_p5.patch;striplevel=2 \
"
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 11/27] gnutls: Fix CVE-2026-3832
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (9 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 10/27] expat: fix CVE-2026-56132 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 12/27] gnutls: Fix CVE-2026-42009 Yoann Congal
` (15 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fix [1] and test coverage [2], as
referenced in [3], to address multi-record OCSP response handling where
GnuTLS could check revocation status from the wrong OCSP entry.
[1] https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2
[2] https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e
[3] https://security-tracker.debian.org/tracker/CVE-2026-3832
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-3832
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gnutls/gnutls/CVE-2026-3832_p1.patch | 52 ++++++++
.../gnutls/gnutls/CVE-2026-3832_p2.patch | 114 ++++++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 +
3 files changed, 168 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
new file mode 100644
index 00000000000..344a1d241a2
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p1.patch
@@ -0,0 +1,52 @@
+From 141c9b6015fc56cd05db3a853f08d03fcbd9b0f4 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Thu, 12 Mar 2026 09:48:57 +0100
+Subject: [PATCH] cert-session: fix multi-entry OCSP revocation bypass
+
+In check_ocsp_response(), the code first searched
+for the SingleResponse that matches the certificate being validated.
+But later, the status was retrieved from entry 0 unconditionally,
+rather than from the matched resp_indx.
+As a result, if entry 0 corresponded to a different certificate and was good,
+while the matched entry for the peer certificate is revoked,
+the revocation check could've mistakenly accept the certificate.
+
+Reported-by: Oleh Konko (1seal) <security@1seal.org>
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1801
+Fixes: #1812
+Fixes: CVE-2026-3832
+Fixes: GNUTLS-SA-2026-04-29-12
+CVSS: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
+Introduced-in: ae404fe8488dee424876b5963c00d7e041672415 3.8.9
+
+CVE: CVE-2026-3832
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2]
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit 731861b9de8dccaf7d3b0c1446833051e48670c2)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/cert-session.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/lib/cert-session.c b/lib/cert-session.c
+index 963f797ee..f48c7a1fb 100644
+--- a/lib/cert-session.c
++++ b/lib/cert-session.c
+@@ -343,9 +343,9 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,
+ goto cleanup;
+ }
+
+- ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL,
+- &cert_status, &vtime, &ntime, &rtime,
+- NULL);
++ ret = gnutls_ocsp_resp_get_single(resp, resp_indx, NULL, NULL, NULL,
++ NULL, &cert_status, &vtime, &ntime,
++ &rtime, NULL);
+ if (ret < 0) {
+ _gnutls_audit_log(
+ session,
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
new file mode 100644
index 00000000000..4b8288ae54a
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-3832_p2.patch
@@ -0,0 +1,114 @@
+From ac357f76abeaf59429bc15b8764ad01920df0ef1 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Thu, 12 Mar 2026 15:25:24 +0100
+Subject: [PATCH] tests/ocsp-tests/ocsp-must-staple-connection: test
+ CVE-2026-3832
+
+CVE: CVE-2026-3832
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e]
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit d52d5f4f383e8c5d8e9a03334f2421ff35d37d2e)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ .../ocsp-tests/ocsp-must-staple-connection.sh | 70 +++++++++++++++++++
+ 1 file changed, 70 insertions(+)
+
+diff --git a/tests/ocsp-tests/ocsp-must-staple-connection.sh b/tests/ocsp-tests/ocsp-must-staple-connection.sh
+index 94d41ce24..5e100b9d9 100755
+--- a/tests/ocsp-tests/ocsp-must-staple-connection.sh
++++ b/tests/ocsp-tests/ocsp-must-staple-connection.sh
+@@ -85,6 +85,7 @@ OCSP_RESPONSE_FILE="$testdir/ms-resp.tmp"
+ OCSP_REQ_FILE="$testdir/ms-req.tmp"
+ INDEXFILE="$testdir/ocsp_index.txt"
+ ATTRFILE="${INDEXFILE}.attr"
++SERVER_CERT_BAD_FILE="$testdir/ms-cert-bad.pem.tmp"
+
+ stop_servers ()
+ {
+@@ -118,6 +119,20 @@ ${CERTTOOL} \
+ --load-privkey "${srcdir}/ocsp-tests/certs/server_good.key" \
+ --template "${TEMPLATE_FILE}" --outfile "${SERVER_CERT_FILE}" 2>/dev/null
+
++echo "=== Generating bad server certificate ==="
++
++rm -f "$TEMPLATE_FILE"
++cp "${srcdir}/ocsp-tests/certs/server_bad.template" "$TEMPLATE_FILE"
++chmod u+w "$TEMPLATE_FILE"
++echo "ocsp_uri=http://localhost:${OCSP_PORT}/ocsp/" >>"$TEMPLATE_FILE"
++
++${CERTTOOL} \
++ --attime "${CERTDATE}" \
++ --generate-certificate --load-ca-privkey "${srcdir}/ocsp-tests/certs/ca.key" \
++ --load-ca-certificate "${srcdir}/ocsp-tests/certs/ca.pem" \
++ --load-privkey "${srcdir}/ocsp-tests/certs/server_bad.key" \
++ --template "${TEMPLATE_FILE}" --outfile "${SERVER_CERT_BAD_FILE}" 2>/dev/null
++
+ echo "=== Bringing OCSP server up ==="
+
+ cp "${srcdir}/ocsp-tests/certs/ocsp_index.txt" ${INDEXFILE}
+@@ -486,6 +501,61 @@ kill "${TLS_SERVER_PID}"
+ wait "${TLS_SERVER_PID}"
+ unset TLS_SERVER_PID
+
++echo "=== Test 10: Server with revoked certificate - CVE-2026-3832 ==="
++
++# The revocation status was always mistakenly checked for the first cert.
++# Check a pair of responses: (irrelevant good unrevoked, relevant bad revoked).
++
++rm -f "${OCSP_RESPONSE_FILE}"
++
++"$FAKETIME" "${TESTDATE}" \
++ ${OPENSSL} ocsp -index "${INDEXFILE}" \
++ -issuer "${srcdir}/ocsp-tests/certs/ca.pem" \
++ -CA "${srcdir}/ocsp-tests/certs/ca.pem" \
++ -rsigner "${srcdir}/ocsp-tests/certs/ocsp-server.pem" \
++ -rkey "${srcdir}/ocsp-tests/certs/ocsp-server.key" \
++ -cert "${SERVER_CERT_FILE}" \
++ -cert "${SERVER_CERT_BAD_FILE}" \
++ -respout "${OCSP_RESPONSE_FILE}"
++
++eval "${GETPORT}"
++# Port for gnutls-serv
++TLS_SERVER_PORT=$PORT
++PORT=${TLS_SERVER_PORT}
++launch_bare_server \
++ "${SERV}" --attime "${TESTDATE}" --echo --disable-client-cert \
++ --x509keyfile="${srcdir}/ocsp-tests/certs/server_bad.key" \
++ --x509certfile="${SERVER_CERT_BAD_FILE}" \
++ --port="${TLS_SERVER_PORT}" \
++ --ocsp-response="${OCSP_RESPONSE_FILE}" --ignore-ocsp-response-errors
++TLS_SERVER_PID="${!}"
++wait_server $TLS_SERVER_PID
++
++wait_for_port "${TLS_SERVER_PORT}"
++
++out=$(
++ echo "test 123456" | \
++ "${CLI}" -d1 --attime "${TESTDATE}" --ocsp \
++ --x509cafile "${srcdir}/ocsp-tests/certs/ca.pem" \
++ --port "${TLS_SERVER_PORT}" localhost \
++ 2>&1
++ rc=$?
++)
++printf '%s\n' "$out"
++
++if test "${rc}" = "0"; then
++ echo 'ERROR: client accepted a revoked leaf (CVE-2026-3832)'
++ exit 1
++fi
++if ! echo "${out}" | grep "The certificate was revoked via OCSP" >/dev/null
++then
++ echo '"The certificate was revoked via OCSP" not found in output'
++ exit 1
++fi
++
++kill "${TLS_SERVER_PID}"
++wait "${TLS_SERVER_PID}"
++unset TLS_SERVER_PID
+
+ kill ${OCSP_PID}
+ wait ${OCSP_PID}
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index b92470768c2..03eee5c50e9 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -32,6 +32,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://0006-buffers-match-DTLS-datagrams-by-sequence-number.patch \
file://0007-tests-mini-dtls-fragments-1839-mismatching-message_s.patch \
file://0008-tests-mini-dtls-framents-link-to-gnulib.patch \
+ file://CVE-2026-3832_p1.patch \
+ file://CVE-2026-3832_p2.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 12/27] gnutls: Fix CVE-2026-42009
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (10 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 11/27] gnutls: Fix CVE-2026-3832 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 13/27] curl: ignore CVE-2026-4873 Yoann Congal
` (14 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies upstream fixes [1] and [2], as referenced in [3],
to address a DTLS packet reordering flaw where duplicate sequence
numbers could lead to unstable ordering or undefined behavior.
Rebase CVE-2026-42009_p1.patch on top of the Wrynose
CVE-2026-33846 backport stack, which already includes the recv_buf
helper from upstream commit 9deffca528c23bbb218f5ec3bd4bb1bf4cbd1fc0.
[1] https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d
[2] https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f
[3] https://security-tracker.debian.org/tracker/CVE-2026-42009
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2026-42009
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gnutls/gnutls/CVE-2026-42009_p1.patch | 62 +++++++++++++++++++
.../gnutls/gnutls/CVE-2026-42009_p2.patch | 48 ++++++++++++++
meta/recipes-support/gnutls/gnutls_3.8.12.bb | 2 +
3 files changed, 112 insertions(+)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
new file mode 100644
index 00000000000..e01fcc19acc
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p1.patch
@@ -0,0 +1,62 @@
+From d1191b910e63149a10647a089995d3cd85e16400 Mon Sep 17 00:00:00 2001
+From: Alexander Sosedkin <asosedkin@redhat.com>
+Date: Tue, 21 Apr 2026 16:52:48 +0200
+Subject: [PATCH] lib/buffers: ensure packets have differing sequence
+ numbers
+
+There should normally be no packets with same sequence number and
+differing handshake type, unless an adversary crafts them.
+Discarding them allows to get rid of packets
+with duplicate sequence ID in the buffer,
+relieving us from the question of how to sort them later.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f01e21441e29052a6f0963840794c41d3b3ee66d]
+
+Backport Changes:
+- Rebased on top of the Wrynose CVE-2026-33846 backport stack, which
+ already includes the recv_buf helper and sequence-number matching
+ prerequisite patches.
+
+Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>
+(cherry picked from commit f01e21441e29052a6f0963840794c41d3b3ee66d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index 62f140ed3..e7f08b5625 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -971,8 +971,20 @@ static int merge_handshake_packet(gnutls_session_t session,
+ session->internals.handshake_recv_buffer;
+
+ for (i = 0; i < session->internals.handshake_recv_buffer_size; i++) {
+- if (recv_buf[i].htype == hsk->htype &&
+- recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].sequence == hsk->sequence) {
++ if (recv_buf[i].htype != hsk->htype) {
++ _gnutls_audit_log(
++ session,
++ "Discarded unexpected handshake packet "
++ "with duplicate sequence %d, but "
++ "mismatched type %s (previously %s)\n",
++ hsk->sequence,
++ _gnutls_handshake2str(hsk->htype),
++ _gnutls_handshake2str(
++ recv_buf[i].htype));
++ _gnutls_handshake_buffer_clear(hsk);
++ return 0;
++ }
+ exists = 1;
+ pos = i;
+ break;
+--
+2.51.0
diff --git a/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
new file mode 100644
index 00000000000..d834d3da203
--- /dev/null
+++ b/meta/recipes-support/gnutls/gnutls/CVE-2026-42009_p2.patch
@@ -0,0 +1,48 @@
+From 5374a6d584b8598511f7880b4e64ee52ee1f0cc5 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <joshua@joshua.hu>
+Date: Tue, 21 Apr 2026 18:11:39 +0200
+Subject: [PATCH] buffers: fix handshake_compare when sequence numbers
+ match
+
+The comparator function used for ordering DTLS packets
+by sequence numbers did not follow qsort comparator contracts
+in case of packets with duplicate sequence numbers,
+which could lead to unstable ordering or undefined behaviour.
+Returning 0 in such cases makes the sorting stable.
+
+Reported-by: Joshua Rogers of AISLE Research Team <joshua@joshua.hu>
+Fixes: #1848
+Fixes: CVE-2026-42009
+Fixes: GNUTLS-SA-2026-04-29-2
+CVSS: 7.5 High CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+
+CVE: CVE-2026-42009
+Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/f341441fad91142897d83b44a175ffc8f925b76f]
+
+Signed-off-by: Joshua Rogers <joshua@joshua.hu>
+(cherry picked from commit f341441fad91142897d83b44a175ffc8f925b76f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/buffers.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+diff --git a/lib/buffers.c b/lib/buffers.c
+index e7f08b5625..1ac27e4e96 100644
+--- a/lib/buffers.c
++++ b/lib/buffers.c
+@@ -844,11 +844,7 @@ static int handshake_compare(const void *_e1, const void *_e2)
+ {
+ const handshake_buffer_st *e1 = _e1;
+ const handshake_buffer_st *e2 = _e2;
+-
+- if (e1->sequence <= e2->sequence)
+- return 1;
+- else
+- return -1;
++ return (e1->sequence < e2->sequence) - (e1->sequence > e2->sequence);
+ }
+
+ #define SSL2_HEADERS 1
+--
+2.51.0
+
diff --git a/meta/recipes-support/gnutls/gnutls_3.8.12.bb b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
index 03eee5c50e9..3085a62310a 100644
--- a/meta/recipes-support/gnutls/gnutls_3.8.12.bb
+++ b/meta/recipes-support/gnutls/gnutls_3.8.12.bb
@@ -34,6 +34,8 @@ SRC_URI = "https://www.gnupg.org/ftp/gcrypt/gnutls/v${SHRT_VER}/gnutls-${PV}.tar
file://0008-tests-mini-dtls-framents-link-to-gnulib.patch \
file://CVE-2026-3832_p1.patch \
file://CVE-2026-3832_p2.patch \
+ file://CVE-2026-42009_p1.patch \
+ file://CVE-2026-42009_p2.patch \
"
SRC_URI[sha256sum] = "a7b341421bfd459acf7a374ca4af3b9e06608dcd7bd792b2bf470bea012b8e51"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 13/27] curl: ignore CVE-2026-4873
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (11 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 12/27] gnutls: Fix CVE-2026-42009 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 14/27] curl: fix CVE-2026-5545 Yoann Congal
` (13 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
- CVE-2026-4873 affects curl before 8.20.0 when a connection negotiated with
clear-text IMAP, POP3, or SMTP can later be reused for a TLS-required
transfer.
- In wrynose, these protocols are optional PACKAGECONFIG entries and are not
enabled by default in curl_8.19.0.bb, so record this CVE as configuration-not-applicable
for the default recipe configuration.
Reference:
- https://curl.se/docs/CVE-2026-4873.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4873
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 3326f478b5c..1cda69401bc 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -28,6 +28,7 @@ SRC_URI[sha256sum] = "4eb41489790d19e190d7ac7e18e82857cdd68af8f4e66b292ced562d33
# Curl has used many names over the years...
CVE_PRODUCT = "haxx:curl haxx:libcurl curl:curl curl:libcurl libcurl:libcurl daniel_stenberg:curl"
CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack"
+CVE_STATUS[CVE-2026-4873] = "${@bb.utils.contains_any('PACKAGECONFIG', 'imap pop3 smtp', 'unpatched', 'not-applicable-config: clear-text imap/pop3/smtp support is not enabled in PACKAGECONFIG', d)}"
inherit autotools pkgconfig binconfig multilib_header ptest
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 14/27] curl: fix CVE-2026-5545
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (12 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 13/27] curl: ignore CVE-2026-4873 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 15/27] curl: fix CVE-2026-6253 Yoann Congal
` (12 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for the Negotiate-authenticated connection
reuse issue described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd
[2] https://curl.se/docs/CVE-2026-5545.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-5545
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../curl/curl/CVE-2026-5545.patch | 43 +++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 44 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-5545.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-5545.patch b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
new file mode 100644
index 00000000000..bb3b1407d47
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-5545.patch
@@ -0,0 +1,43 @@
+From 33e43985b8f3b9e66691d06e70be0395849856cd Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 2 Apr 2026 11:33:39 +0200
+Subject: [PATCH] url: improve connection reuse on negotiate
+
+Check state of negotiate to allow proper connection reuse.
+
+Closes #21203
+
+CVE: CVE-2026-5545
+Upstream-Status: Backport [https://github.com/curl/curl/commit/33e43985b8f3b9e66691d06e70be0395849856cd]
+
+(cherry picked from commit 33e43985b8f3b9e66691d06e70be0395849856cd)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 12 +++++++++---
+ 1 file changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index b9e308a..7c24f1a 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -1110,11 +1110,17 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+ if(m->want_ntlm_http) {
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+ Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
+-
+ /* we prefer a credential match, but this is at least a connection
+- that can be reused and "upgraded" to NTLM */
+- if(conn->http_ntlm_state == NTLMSTATE_NONE)
++ that can be reused and "upgraded" to NTLM if it does
++ not have any auth ongoing. */
++#ifdef USE_SPNEGO
++ if((conn->http_ntlm_state == NTLMSTATE_NONE)
++ && (conn->http_negotiate_state == GSS_AUTHNONE)) {
++#else
++ if(conn->http_ntlm_state == NTLMSTATE_NONE) {
++#endif
+ m->found = conn;
++ }
+ return FALSE;
+ }
+ }
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 1cda69401bc..558a2d311e4 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -17,6 +17,7 @@ SRC_URI = " \
file://CVE-2026-6276.patch \
file://CVE-2026-5773.patch \
file://mbedtls.patch \
+ file://CVE-2026-5545.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 15/27] curl: fix CVE-2026-6253
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (13 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 14/27] curl: fix CVE-2026-5545 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 16/27] curl: fix CVE-2026-6429 Yoann Congal
` (11 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] for the proxy credential leak on redirect
described in [2] and tracked by [3].
[1] https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f
[2] https://curl.se/docs/CVE-2026-6253.html
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-6253
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../curl/curl/CVE-2026-6253.patch | 389 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 1 +
2 files changed, 390 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6253.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6253.patch b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
new file mode 100644
index 00000000000..0e7dd72612a
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6253.patch
@@ -0,0 +1,389 @@
+From 188c2f166a20fa97c2325b2da7d0e5cecc13725f Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 13 Apr 2026 17:17:23 +0200
+Subject: [PATCH] http: clear the proxy credentials as well on port or scheme
+ change
+
+Add tests 2009-2011 to verify switching between proxies with credentials
+when the switch is driven by a redirect
+
+Reported-by: Dwij Mehta
+
+Closes #21304
+
+CVE: CVE-2026-6253
+Upstream-Status: Backport [https://github.com/curl/curl/commit/188c2f166a20fa97c2325b2da7d0e5cecc13725f]
+
+Backport Changes:
+- Adapted the redirect credential reset hunk to curl 8.19.0 Curl_http_follow() after the existing wrynose CVE-2026-6276 backport.
+- Adapted tests/data/Makefile.am placement for the wrynose test list.
+
+(cherry picked from commit 188c2f166a20fa97c2325b2da7d0e5cecc13725f)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/http.c | 12 +++++++
+ lib/transfer.c | 51 +++++++++++++++++++++---------
+ lib/transfer.h | 2 ++
+ tests/data/Makefile.am | 1 +
+ tests/data/test2009 | 70 +++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2010 | 71 ++++++++++++++++++++++++++++++++++++++++++
+ tests/data/test2011 | 70 +++++++++++++++++++++++++++++++++++++++++
+ 7 files changed, 262 insertions(+), 15 deletions(-)
+ create mode 100644 tests/data/test2009
+ create mode 100644 tests/data/test2010
+ create mode 100644 tests/data/test2011
+
+diff --git a/lib/http.c b/lib/http.c
+index 7ebbdfa..b960d79 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1252,12 +1252,24 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+ curlx_free(scheme);
+ }
+ if(clear) {
++ CURLcode result = Curl_reset_userpwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
++ }
+ Curl_safefree(data->state.aptr.user);
+ Curl_safefree(data->state.aptr.passwd);
+ }
+ }
+ }
+ DEBUGASSERT(follow_url);
++ {
++ CURLcode result = Curl_reset_proxypwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
++ }
++ }
+
+ if(type == FOLLOW_FAKE) {
+ /* we are only figuring out the new URL if we would have followed locations
+diff --git a/lib/transfer.c b/lib/transfer.c
+index 6dd2f52..af5bee2 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -439,6 +439,40 @@ void Curl_init_CONNECT(struct Curl_easy *data)
+ data->state.upload = (data->state.httpreq == HTTPREQ_PUT);
+ }
+
++/*
++ * Restore the user credentials to those set in options.
++ */
++CURLcode Curl_reset_userpwd(struct Curl_easy *data)
++{
++ CURLcode result;
++ if(data->set.str[STRING_USERNAME] || data->set.str[STRING_PASSWORD])
++ data->state.creds_from = CREDS_OPTION;
++ result = Curl_setstropt(&data->state.aptr.user,
++ data->set.str[STRING_USERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.passwd,
++ data->set.str[STRING_PASSWORD]);
++ return result;
++}
++
++/*
++ * Restore the proxy credentials to those set in options.
++ */
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data)
++{
++#ifndef CURL_DISABLE_PROXY
++ CURLcode result = Curl_setstropt(&data->state.aptr.proxyuser,
++ data->set.str[STRING_PROXYUSERNAME]);
++ if(!result)
++ result = Curl_setstropt(&data->state.aptr.proxypasswd,
++ data->set.str[STRING_PROXYPASSWORD]);
++ return result;
++#else
++ (void)data;
++ return CURLE_OK;
++#endif
++}
++
+ /*
+ * Curl_pretransfer() is called immediately before a transfer starts, and only
+ * once for one transfer no matter if it has redirects or do multi-pass
+@@ -584,23 +618,10 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
+ return CURLE_OUT_OF_MEMORY;
+ }
+
+- if(data->set.str[STRING_USERNAME] ||
+- data->set.str[STRING_PASSWORD])
+- data->state.creds_from = CREDS_OPTION;
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.user,
+- data->set.str[STRING_USERNAME]);
++ result = Curl_reset_userpwd(data);
+ if(!result)
+- result = Curl_setstropt(&data->state.aptr.passwd,
+- data->set.str[STRING_PASSWORD]);
+-#ifndef CURL_DISABLE_PROXY
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxyuser,
+- data->set.str[STRING_PROXYUSERNAME]);
+- if(!result)
+- result = Curl_setstropt(&data->state.aptr.proxypasswd,
+- data->set.str[STRING_PROXYPASSWORD]);
+-#endif
++ result = Curl_reset_proxypwd(data);
+
+ data->req.headerbytecount = 0;
+ Curl_headers_cleanup(data);
+diff --git a/lib/transfer.h b/lib/transfer.h
+index 05a5f89..131e31a 100644
+--- a/lib/transfer.h
++++ b/lib/transfer.h
+@@ -31,6 +31,8 @@ char *Curl_checkheaders(const struct Curl_easy *data,
+
+ void Curl_init_CONNECT(struct Curl_easy *data);
+
++CURLcode Curl_reset_userpwd(struct Curl_easy *data);
++CURLcode Curl_reset_proxypwd(struct Curl_easy *data);
+ CURLcode Curl_pretransfer(struct Curl_easy *data);
+
+ CURLcode Curl_sendrecv(struct Curl_easy *data);
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index da0f8f5..00a5221 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -244,6 +244,7 @@ test1970 test1971 test1972 test1973 test1974 test1975 test1976 test1977 \
+ test1978 test1979 test1980 test1981 \
+ \
+ test2000 test2001 test2002 test2003 test2004 test2005 test2006 \
++test2009 test2010 test2011 \
+ \
+ test2023 \
+ test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
+diff --git a/tests/data/test2009 b/tests/data/test2009
+new file mode 100644
+index 0000000..d2fd79e
+--- /dev/null
++++ b/tests/data/test2009
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via env variables, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2010 b/tests/data/test2010
+new file mode 100644
+index 0000000..443ae9d
+--- /dev/null
++++ b/tests/data/test2010
+@@ -0,0 +1,71 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy credentials via options for two proxies, redirect from http to https
++</name>
++
++<setenv>
++http_proxy=http://%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++--proxy-user batman:robin http://somewhere.example/ --follow --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++Proxy-Authorization: Basic %b64[batman:robin]b64%
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2011 b/tests/data/test2011
+new file mode 100644
+index 0000000..dd4e534
+--- /dev/null
++++ b/tests/data/test2011
+@@ -0,0 +1,70 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP proxy
++http_proxy
++</keywords>
++</info>
++# Server-side
++<reply>
++<connect>
++HTTP/1.1 407 Denied
++
++</connect>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Content-Length: 4
++Content-Type: text/html
++Location: https://another.example/%TESTNUMBER0002
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++proxy
++</features>
++<server>
++http
++https
++</server>
++<name>
++proxy creds via env, cross-scheme redirect, --location-trusted
++</name>
++
++<setenv>
++http_proxy=http://user:secret@%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPORT/
++</setenv>
++<command>
++http://somewhere.example/ --location-trusted --proxy-insecure
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://somewhere.example/ HTTP/1.1
++Host: somewhere.example
++Proxy-Authorization: Basic %b64[user:secret]b64%
++User-Agent: curl/%VERSION
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++CONNECT another.example:443 HTTP/1.1
++Host: another.example:443
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</protocol>
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 558a2d311e4..b1ee0f8b9ba 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -18,6 +18,7 @@ SRC_URI = " \
file://CVE-2026-5773.patch \
file://mbedtls.patch \
file://CVE-2026-5545.patch \
+ file://CVE-2026-6253.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 16/27] curl: fix CVE-2026-6429
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (14 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 15/27] curl: fix CVE-2026-6253 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 17/27] glib-2.0: upgrade 2.88.0 -> 2.88.2 Yoann Congal
` (10 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
Backport the upstream fix [1] and the required dependent change [2] to
address the netrc credential leak across redirects, as mentioned in [3] and
tracked by [4].
[1] https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
[2] https://github.com/curl/curl/commit/32a513e180ce83d5e9b708211306045407074134
[3] https://curl.se/docs/CVE-2026-6429.html
[4] https://nvd.nist.gov/vuln/detail/CVE-2026-6429
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../curl/curl/CVE-2026-6429-dependent.patch | 81 +++++
.../curl/curl/CVE-2026-6429.patch | 325 ++++++++++++++++++
meta/recipes-support/curl/curl_8.19.0.bb | 2 +
3 files changed, 408 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2026-6429.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
new file mode 100644
index 00000000000..a3f68ae5392
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6429-dependent.patch
@@ -0,0 +1,81 @@
+From 6b1769c54659f1e6d6323891cb45c682c22182b7 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 15 Apr 2026 10:43:12 +0200
+Subject: [PATCH] urlapi: same origin tests
+
+Add new internal `curl_url_same_origin()` to check if a href has the
+same origin as a base URL. Add test cases in test1675 and use this in
+http2 push handling.
+
+Closes #21328
+
+CVE: CVE-2026-6429
+Upstream-Status: Backport [https://github.com/curl/curl/commit/32a513e180ce83d5e9b708211306045407074134]
+
+Backport Changes:
+- curl 8.19.0 does not provide Curl_url_same_origin(), but the CVE-2026-6429
+ fix from https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306
+ uses it in lib/http.c.
+- kept only the helper declaration and implementation of
+ lib/urlapi-int.h and lib/urlapi.c.
+- Excluded unrelated upstream test and HTTP/2 changes from that commit.
+
+(cherry picked from commit 32a513e180ce83d5e9b708211306045407074134)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/urlapi-int.h | 2 ++
+ lib/urlapi.c | 33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+
+diff --git a/lib/urlapi-int.h b/lib/urlapi-int.h
+index 29d4fe5f39..591062035b 100644
+--- a/lib/urlapi-int.h
++++ b/lib/urlapi-int.h
+@@ -40,4 +40,6 @@ UNITTEST CURLUcode Curl_parse_port(struct Curl_URL *u, struct dynbuf *host,
+ #define U_CURLU_URLDECODE (unsigned int)CURLU_URLDECODE
+ #define U_CURLU_PATH_AS_IS (unsigned int)CURLU_PATH_AS_IS
+
++bool Curl_url_same_origin(CURLU *base, CURLU *href);
++
+ #endif /* HEADER_CURL_URLAPI_INT_H */
+diff --git a/lib/urlapi.c b/lib/urlapi.c
+index a4b82f31bd..20c6585b55 100644
+--- a/lib/urlapi.c
++++ b/lib/urlapi.c
+@@ -1996,3 +1996,36 @@ nomem:
+ }
+ return CURLUE_OK;
+ }
++
++bool Curl_url_same_origin(CURLU *base, CURLU *href)
++{
++ const struct Curl_scheme *s = NULL;
++
++ /* base must be an absolute URL */
++ if(!base->scheme || !base->host)
++ return FALSE;
++ if(href->scheme && !curl_strequal(base->scheme, href->scheme))
++ return FALSE;
++ if(href->host) {
++ if(!curl_strequal(base->host, href->host))
++ return FALSE;
++ if(!curl_strequal(base->port, href->port)) {
++ /* This may still match if only one has an explicit port
++ * and it is the default for the scheme. */
++ if(base->port && href->port)
++ return FALSE;
++
++ s = Curl_get_scheme(base->scheme);
++ if(!s) /* Cannot match default port for unknown scheme */
++ return FALSE;
++
++ /* The port which is set must be the default one */
++ if((base->port && (base->portnum != s->defport)) ||
++ (href->port && (href->portnum != s->defport)))
++ return FALSE;
++ }
++ }
++ else if(href->port) /* no host in href, then there must be no port */
++ return FALSE;
++ return TRUE;
++}
diff --git a/meta/recipes-support/curl/curl/CVE-2026-6429.patch b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
new file mode 100644
index 00000000000..76711aafc0b
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-6429.patch
@@ -0,0 +1,325 @@
+From 1d36681ca0e453faf199f44c483077d929899906 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 16 Apr 2026 14:26:20 +0200
+Subject: [PATCH] http: clear credentials better on redirect
+
+Verify with test 2506: netrc with redirect using proxy
+
+Updated test 998 which was wrong.
+
+Reported-by: Muhamad Arga Reksapati
+
+Closes #21345
+
+CVE: CVE-2026-6429
+Upstream-Status: Backport [https://github.com/curl/curl/commit/b4024bf808bd558026fdc6096e8457f199ace306]
+
+Backport Changes:
+- Aligned with curl 8.19.0 by using the existing
+ Curl_safefree() instead of the curlx_safefree() macro.
+- The curlx_safefree() macro was introduced in curl 8.20.0 by:
+ https://github.com/curl/curl/commit/0df6c01db398f5e25d00a062aae56f2a89d8ff55
+
+(cherry picked from commit b4024bf808bd558026fdc6096e8457f199ace306)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/http.c | 84 ++++++++++++--------------------------
+ tests/data/Makefile.am | 2 +-
+ tests/data/test2506 | 64 +++++++++++++++++++++++++++++
+ tests/data/test998 | 1 -
+ tests/libtest/Makefile.inc | 2 +-
+ tests/libtest/lib2506.c | 71 ++++++++++++++++++++++++++++++++
+ 6 files changed, 162 insertions(+), 62 deletions(-)
+ create mode 100644 tests/data/test2506
+ create mode 100644 tests/libtest/lib2506.c
+
+diff --git a/lib/http.c b/lib/http.c
+index b960d790a4..2596b4b3a2 100644
+--- a/lib/http.c
++++ b/lib/http.c
+@@ -1201,75 +1201,41 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
+ return CURLE_OUT_OF_MEMORY;
+ }
+ else {
+- uc = curl_url_get(data->state.uh, CURLUPART_URL, &follow_url, 0);
+- if(uc)
++ bool same_origin;
++ CURLcode result;
++ CURLU *u = curl_url();
++ if(!u)
++ return CURLE_OUT_OF_MEMORY;
++ uc = curl_url_set(u, CURLUPART_URL,
++ Curl_bufref_ptr(&data->state.url),
++ CURLU_URLENCODE | CURLU_ALLOW_SPACE);
++ if(!uc)
++ uc = curl_url_get(data->state.uh, CURLUPART_URL, &follow_url, 0);
++ if(uc) {
++ curl_url_cleanup(u);
+ return Curl_uc_to_curlcode(uc);
++ }
+
+- /* Clear auth if this redirects to a different port number or protocol,
+- unless permitted */
+- if(!data->set.allow_auth_to_other_hosts && (type != FOLLOW_FAKE)) {
+- int port;
+- bool clear = FALSE;
+-
+- if(data->set.use_port && data->state.allow_port)
+- /* a custom port is used */
+- port = (int)data->set.use_port;
+- else {
+- curl_off_t value;
+- char *portnum;
+- const char *p;
+- uc = curl_url_get(data->state.uh, CURLUPART_PORT, &portnum,
+- CURLU_DEFAULT_PORT);
+- if(uc) {
+- curlx_free(follow_url);
+- return Curl_uc_to_curlcode(uc);
+- }
+- p = portnum;
+- curlx_str_number(&p, &value, 0xffff);
+- port = (int)value;
+- curlx_free(portnum);
+- }
+- if(port != data->info.conn_remote_port) {
+- infof(data, "Clear auth, redirects to port from %u to %u",
+- data->info.conn_remote_port, port);
+- clear = TRUE;
+- }
+- else {
+- char *scheme;
+- const struct Curl_scheme *p;
+- uc = curl_url_get(data->state.uh, CURLUPART_SCHEME, &scheme, 0);
+- if(uc) {
+- curlx_free(follow_url);
+- return Curl_uc_to_curlcode(uc);
+- }
++ same_origin = Curl_url_same_origin(u, data->state.uh);
++ curl_url_cleanup(u);
+
+- p = Curl_get_scheme(scheme);
+- if(p && (p->protocol != data->info.conn_protocol)) {
+- infof(data, "Clear auth, redirects scheme from %s to %s",
+- data->info.conn_scheme, scheme);
+- clear = TRUE;
+- }
+- curlx_free(scheme);
+- }
+- if(clear) {
+- CURLcode result = Curl_reset_userpwd(data);
+- if(result) {
+- curlx_free(follow_url);
+- return result;
+- }
+- Curl_safefree(data->state.aptr.user);
+- Curl_safefree(data->state.aptr.passwd);
++ if((!same_origin && !data->set.allow_auth_to_other_hosts) ||
++ !data->set.str[STRING_USERNAME]) {
++ result = Curl_reset_userpwd(data);
++ if(result) {
++ curlx_free(follow_url);
++ return result;
+ }
++ Curl_safefree(data->state.aptr.user);
++ Curl_safefree(data->state.aptr.passwd);
+ }
+- }
+- DEBUGASSERT(follow_url);
+- {
+- CURLcode result = Curl_reset_proxypwd(data);
++ result = Curl_reset_proxypwd(data);
+ if(result) {
+ curlx_free(follow_url);
+ return result;
+ }
+ }
++ DEBUGASSERT(follow_url);
+
+ if(type == FOLLOW_FAKE) {
+ /* we are only figuring out the new URL if we would have followed locations
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 00a5221d1f..1b76b01a8c 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -265,7 +265,7 @@ test2309 \
+ \
+ test2400 test2401 test2402 test2403 test2404 test2405 test2406 test2407 \
+ \
+-test2500 test2501 test2502 test2503 test2504 \
++test2500 test2501 test2502 test2503 test2504 test2506 \
+ \
+ test2600 test2601 test2602 test2603 test2604 test2605 \
+ \
+diff --git a/tests/data/test2506 b/tests/data/test2506
+new file mode 100644
+index 0000000000..9c65002496
+--- /dev/null
++++ b/tests/data/test2506
+@@ -0,0 +1,64 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++<reply>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 3
++Location: http://numbertwo.example/%TESTNUMBER0002
++
++ok
++</data>
++<data2 crlf="headers" nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Length: 4
++
++yes
++</data2>
++</reply>
++
++<client>
++<server>
++http
++</server>
++<features>
++proxy
++</features>
++<tool>
++lib%TESTNUMBER
++</tool>
++<name>
++netrc with redirect using proxy
++</name>
++<file name="%LOGDIR/netrc2506">
++machine site.example login batman password robin
++</file>
++<command>
++http://%HOSTIP:%HTTPPORT http://site.example/ %LOGDIR/netrc2506
++</command>
++</client>
++
++<verify>
++<protocol crlf="headers">
++GET http://site.example/ HTTP/1.1
++Host: site.example
++Authorization: Basic %b64[batman:robin]b64%
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://numbertwo.example/25060002 HTTP/1.1
++Host: numbertwo.example
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test998 b/tests/data/test998
+index 24d1d3dd4e..56dbc0c891 100644
+--- a/tests/data/test998
++++ b/tests/data/test998
+@@ -77,7 +77,6 @@ Proxy-Connection: Keep-Alive
+
+ GET http://somewhere.else.example/a/path/9980002 HTTP/1.1
+ Host: somewhere.else.example
+-Authorization: Basic %b64[alberto:einstein]b64%
+ User-Agent: curl/%VERSION
+ Accept: */*
+ Proxy-Connection: Keep-Alive
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 2319bafe72..2f77c16975 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -113,7 +113,7 @@ TESTS_C = \
+ lib2023.c lib2032.c lib2082.c \
+ lib2301.c lib2302.c lib2304.c lib2306.c lib2308.c lib2309.c \
+ lib2402.c lib2404.c lib2405.c \
+- lib2502.c lib2504.c \
++ lib2502.c lib2504.c lib2506.c \
+ lib2700.c \
+ lib3010.c lib3025.c lib3026.c lib3027.c lib3033.c lib3034.c \
+ lib3100.c lib3101.c lib3102.c lib3103.c lib3104.c lib3105.c \
+diff --git a/tests/libtest/lib2506.c b/tests/libtest/lib2506.c
+new file mode 100644
+index 0000000000..8b3b3429f9
+--- /dev/null
++++ b/tests/libtest/lib2506.c
+@@ -0,0 +1,71 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "first.h"
++
++#include "testtrace.h"
++
++static size_t sink2506(char *ptr, size_t size, size_t nmemb, void *ud)
++{
++ (void)ptr;
++ (void)ud;
++ return size * nmemb;
++}
++
++static CURLcode test_lib2506(const char *URL)
++{
++ CURL *curl;
++ CURLcode result = CURLE_OUT_OF_MEMORY;
++
++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
++ curl_mfprintf(stderr, "curl_global_init() failed\n");
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2506);
++ test_setopt(curl, CURLOPT_PROXY, URL);
++ test_setopt(curl, CURLOPT_URL, libtest_arg2);
++ test_setopt(curl, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
++ test_setopt(curl, CURLOPT_NETRC_FILE, libtest_arg3);
++ test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
++ test_setopt(curl, CURLOPT_VERBOSE, 1L);
++
++ /* CURLOPT_UNRESTRICTED_AUTH should not make a difference because the
++ credentials come from netrc */
++ test_setopt(curl, CURLOPT_UNRESTRICTED_AUTH, 1L);
++
++ result = curl_easy_perform(curl);
++
++test_cleanup:
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++
++ return result;
++}
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index b1ee0f8b9ba..683163bfa61 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -19,6 +19,8 @@ SRC_URI = " \
file://mbedtls.patch \
file://CVE-2026-5545.patch \
file://CVE-2026-6253.patch \
+ file://CVE-2026-6429-dependent.patch \
+ file://CVE-2026-6429.patch \
"
SRC_URI:append:class-nativesdk = " \
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 17/27] glib-2.0: upgrade 2.88.0 -> 2.88.2
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (15 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 16/27] curl: fix CVE-2026-6429 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 18/27] libssh2: Fix CVE-2025-15661 Yoann Congal
` (9 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
Refresh patches via devtool.
Release notes: [1] and [2].
2.88.1: Fix various minor (low severity) security issues
CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013,
CVE-2026-58014 and CVE-2026-58015
[1] https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.1
[2] https://gitlab.gnome.org/GNOME/glib/-/releases/2.88.2
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../glib-2.0/files/CVE-2026-58016-1.patch | 12 ++++----
.../glib-2.0/files/CVE-2026-58016-2.patch | 30 +++++++++----------
...l_2.88.0.bb => glib-2.0-initial_2.88.2.bb} | 0
...{glib-2.0_2.88.0.bb => glib-2.0_2.88.2.bb} | 0
meta/recipes-core/glib-2.0/glib.inc | 2 +-
5 files changed, 22 insertions(+), 22 deletions(-)
rename meta/recipes-core/glib-2.0/{glib-2.0-initial_2.88.0.bb => glib-2.0-initial_2.88.2.bb} (100%)
rename meta/recipes-core/glib-2.0/{glib-2.0_2.88.0.bb => glib-2.0_2.88.2.bb} (100%)
diff --git a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch
index 2c4b248b97b..9beafd106d1 100644
--- a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch
+++ b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-1.patch
@@ -30,7 +30,7 @@ diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
index c7be334ce2f7..6f722ee6153d 100644
--- a/gio/gdbusintrospection.c
+++ b/gio/gdbusintrospection.c
-@@ -1272,7 +1272,7 @@ parser_start_element (GMarkupParseContext *context,
+@@ -1258,7 +1258,7 @@ parser_start_element (GMarkupParseContext *context,
/* ---------------------------------------------------------------------------------------------------- */
if (strcmp (element_name, "node") == 0)
{
@@ -43,10 +43,10 @@ diff --git a/gio/tests/gdbus-introspection.c b/gio/tests/gdbus-introspection.c
index 44cb7a96af45..daca313f77e7 100644
--- a/gio/tests/gdbus-introspection.c
+++ b/gio/tests/gdbus-introspection.c
-@@ -299,6 +299,38 @@ test_extra_data (void)
+@@ -300,6 +300,38 @@ test_extra_data (void)
g_dbus_node_info_unref (info);
}
-
+
+static void
+test_invalid (void)
+{
@@ -80,14 +80,14 @@ index 44cb7a96af45..daca313f77e7 100644
+}
+
/* ---------------------------------------------------------------------------------------------------- */
-
+
int
-@@ -316,6 +348,7 @@ main (int argc,
+@@ -317,6 +349,7 @@ main (int argc,
g_test_add_func ("/gdbus/introspection-generate", test_generate);
g_test_add_func ("/gdbus/introspection-default-direction", test_default_direction);
g_test_add_func ("/gdbus/introspection-extra-data", test_extra_data);
+ g_test_add_func ("/gdbus/introspection/invalid", test_invalid);
-
+
ret = session_bus_run ();
--
diff --git a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch
index a61e35ad8a7..a07aa529ae8 100644
--- a/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch
+++ b/meta/recipes-core/glib-2.0/files/CVE-2026-58016-2.patch
@@ -30,63 +30,63 @@ diff --git a/gio/gdbusintrospection.c b/gio/gdbusintrospection.c
index 6f722ee6153d..ed0d291f99f0 100644
--- a/gio/gdbusintrospection.c
+++ b/gio/gdbusintrospection.c
-@@ -1110,6 +1110,7 @@ parse_data_get_annotation (ParseData *data,
+@@ -1096,6 +1096,7 @@ parse_data_get_annotation (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->annotations, g_new0 (GDBusAnnotationInfo, 1));
+ g_assert (data->annotations->len > 0);
return data->annotations->pdata[data->annotations->len - 1];
}
-
-@@ -1119,6 +1120,7 @@ parse_data_get_arg (ParseData *data,
+
+@@ -1105,6 +1106,7 @@ parse_data_get_arg (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->args, g_new0 (GDBusArgInfo, 1));
+ g_assert (data->args->len > 0);
return data->args->pdata[data->args->len - 1];
}
-
-@@ -1128,6 +1130,7 @@ parse_data_get_out_arg (ParseData *data,
+
+@@ -1114,6 +1116,7 @@ parse_data_get_out_arg (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->out_args, g_new0 (GDBusArgInfo, 1));
+ g_assert (data->out_args->len > 0);
return data->out_args->pdata[data->out_args->len - 1];
}
-
-@@ -1137,6 +1140,7 @@ parse_data_get_method (ParseData *data,
+
+@@ -1123,6 +1126,7 @@ parse_data_get_method (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->methods, g_new0 (GDBusMethodInfo, 1));
+ g_assert (data->methods->len > 0);
return data->methods->pdata[data->methods->len - 1];
}
-
-@@ -1146,6 +1150,7 @@ parse_data_get_signal (ParseData *data,
+
+@@ -1132,6 +1136,7 @@ parse_data_get_signal (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->signals, g_new0 (GDBusSignalInfo, 1));
+ g_assert (data->signals->len > 0);
return data->signals->pdata[data->signals->len - 1];
}
-
-@@ -1155,6 +1160,7 @@ parse_data_get_property (ParseData *data,
+
+@@ -1141,6 +1146,7 @@ parse_data_get_property (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->properties, g_new0 (GDBusPropertyInfo, 1));
+ g_assert (data->properties->len > 0);
return data->properties->pdata[data->properties->len - 1];
}
-
-@@ -1164,6 +1170,7 @@ parse_data_get_interface (ParseData *data,
+
+@@ -1150,6 +1156,7 @@ parse_data_get_interface (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->interfaces, g_new0 (GDBusInterfaceInfo, 1));
+ g_assert (data->interfaces->len > 0);
return data->interfaces->pdata[data->interfaces->len - 1];
}
-
-@@ -1173,6 +1180,7 @@ parse_data_get_node (ParseData *data,
+
+@@ -1159,6 +1166,7 @@ parse_data_get_node (ParseData *data,
{
if (create_new)
g_ptr_array_add (data->nodes, g_new0 (GDBusNodeInfo, 1));
diff --git a/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.0.bb b/meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb
similarity index 100%
rename from meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.0.bb
rename to meta/recipes-core/glib-2.0/glib-2.0-initial_2.88.2.bb
diff --git a/meta/recipes-core/glib-2.0/glib-2.0_2.88.0.bb b/meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb
similarity index 100%
rename from meta/recipes-core/glib-2.0/glib-2.0_2.88.0.bb
rename to meta/recipes-core/glib-2.0/glib-2.0_2.88.2.bb
diff --git a/meta/recipes-core/glib-2.0/glib.inc b/meta/recipes-core/glib-2.0/glib.inc
index fb35f84eec5..d49ae131685 100644
--- a/meta/recipes-core/glib-2.0/glib.inc
+++ b/meta/recipes-core/glib-2.0/glib.inc
@@ -240,7 +240,7 @@ SRC_URI:append:class-native = " file://relocate-modules.patch \
file://0001-meson.build-do-not-enable-pidfd-features-on-native-g.patch \
"
-SRC_URI[archive.sha256sum] = "3546251ccbb3744d4bc4eb48354540e1f6200846572bab68e3a2b7b2b64dfd07"
+SRC_URI[archive.sha256sum] = "cf3f215a640c8a4257f14317586b8f1fdd25a10a93cb4bdda147c0f9ad88e74f"
# Find any meson cross files in FILESPATH that are relevant for the current
# build (using siteinfo) and add them to EXTRA_OEMESON.
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 18/27] libssh2: Fix CVE-2025-15661
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (16 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 17/27] glib-2.0: upgrade 2.88.0 -> 2.88.2 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 19/27] libpng: fix CVE-2026-34757 Yoann Congal
` (8 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: David Nyström <david.nystrom@est.tech>
Fix CVE-2025-15661[1] similiar to debian[2], two first commits identical,
third commit fixes a return code regression introduced by CVE fix commit.
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-15661
[2] https://sources.debian.org/patches/libssh2/1.11.1-4/
Signed-off-by: David Nyström <david.nystrom@est.tech>
[YC: fixed stray whitespaces at EOL]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libssh2/libssh2/CVE-2025-15661-1.patch | 45 ++++++
.../libssh2/libssh2/CVE-2025-15661-2.patch | 131 ++++++++++++++++++
.../libssh2/libssh2/CVE-2025-15661-3.patch | 57 ++++++++
.../recipes-support/libssh2/libssh2_1.11.1.bb | 3 +
4 files changed, 236 insertions(+)
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch
create mode 100644 meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch
new file mode 100644
index 00000000000..93a9e6eb596
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-1.patch
@@ -0,0 +1,45 @@
+From 95028b06d1875e07c99918145234a473e5e8521f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Nystr=C3=B6m?= <david.nystrom@est.tech>
+Date: Thu, 9 Jul 2026 12:36:24 +0000
+Subject: [PATCH 1/3] sftp: add LIBSSH2_UNCONST() macro needed by
+ CVE-2025-15661 fix
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Needed by the fix for CVE-2025-15661.
+
+Extracted from upstream commit 606c102e52f8447de2b745dd6c5ddf418defc519
+(build: enable -Wcast-qual, fix fallouts) by Viktor Szakats.
+Only the LIBSSH2_UNCONST() macro definition in libssh2_priv.h is
+included; the remainder of that commit is not applicable to this
+stable branch.
+
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/606c102e52f8447de2b745dd6c5ddf418defc519]
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ src/libssh2_priv.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/src/libssh2_priv.h b/src/libssh2_priv.h
+index 9b8866dc..bb1f8ad3 100644
+--- a/src/libssh2_priv.h
++++ b/src/libssh2_priv.h
+@@ -117,6 +117,14 @@
+ #define UINT32_MAX 0xffffffffU
+ #endif
+
++#ifdef _WIN64
++#define LIBSSH2_UNCONST(p) ((void *)(libssh2_uint64_t)(const void *)(p))
++#elif defined(_MSC_VER)
++#define LIBSSH2_UNCONST(p) ((void *)(unsigned int)(const void *)(p))
++#else
++#define LIBSSH2_UNCONST(p) ((void *)(uintptr_t)(const void *)(p))
++#endif
++
+ #if (defined(__GNUC__) || defined(__clang__)) && \
+ defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) && \
+ !defined(LIBSSH2_NO_FMT_CHECKS)
+--
+2.43.0
+
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch
new file mode 100644
index 00000000000..40096d3318d
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-2.patch
@@ -0,0 +1,131 @@
+From 72e8f8dd812503e07fecd775e7f88183e005d9ae Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Fri, 10 Oct 2025 08:26:20 -0700
+Subject: [PATCH 2/3] Update sftp_symlink to avoid out of bounds read on
+ malformed packet #1705 (#1717)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Use buffer struct to guard against out of bounds reads and invalid packets.
+
+Discovery Credit:
+Joshua Rogers
+
+CVE: CVE-2025-15661
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d]
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ src/sftp.c | 66 ++++++++++++++++++++++++++++++++++++++----------------
+ 1 file changed, 47 insertions(+), 19 deletions(-)
+
+diff --git a/src/sftp.c b/src/sftp.c
+index 6ede3111..43b6ff90 100644
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -3795,15 +3795,19 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ {
+ LIBSSH2_CHANNEL *channel = sftp->channel;
+ LIBSSH2_SESSION *session = channel->session;
+- size_t data_len = 0, link_len;
++ size_t data_len = 0, lk_len;
+ /* 13 = packet_len(4) + packet_type(1) + request_id(4) + path_len(4) */
+ ssize_t packet_len =
+ path_len + 13 +
+ ((link_type == LIBSSH2_SFTP_SYMLINK) ? (4 + target_len) : 0);
+ unsigned char *s, *data = NULL;
++ struct string_buf buf;
+ static const unsigned char link_responses[2] =
+ { SSH_FXP_NAME, SSH_FXP_STATUS };
+ int retcode;
++ unsigned char packet_type;
++ uint32_t tmp_u32;
++ unsigned char *lk_target;
+
+ if(sftp->symlink_state == libssh2_NB_state_idle) {
+ sftp->last_errno = LIBSSH2_FX_OK;
+@@ -3891,8 +3895,25 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+
+ sftp->symlink_state = libssh2_NB_state_idle;
+
+- if(data[0] == SSH_FXP_STATUS) {
+- retcode = _libssh2_ntohu32(data + 5);
++ buf.data = (unsigned char *)LIBSSH2_UNCONST(data);
++ buf.dataptr = buf.data;
++ buf.len = data_len;
++
++ if(_libssh2_get_byte(&buf, &packet_type)) {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (type)");
++ }
++
++ if(packet_type == SSH_FXP_STATUS) {
++ if(_libssh2_get_u32(&buf, &tmp_u32)) {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (code)");
++ }
++
++ retcode = (int)tmp_u32;
++
+ LIBSSH2_FREE(session, data);
+ if(retcode == LIBSSH2_FX_OK)
+ return LIBSSH2_ERROR_NONE;
+@@ -3903,30 +3924,37 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ }
+ }
+
+- if(_libssh2_ntohu32(data + 5) < 1) {
++ /* advance past id */
++ if(_libssh2_get_u32(&buf, &tmp_u32)) {
+ LIBSSH2_FREE(session, data);
+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
+- "Invalid READLINK/REALPATH response, "
+- "no name entries");
++ "SFTP Protocol Error (id)");
+ }
+
+- if(data_len < 13) {
+- if(data_len > 0) {
+- LIBSSH2_FREE(session, data);
+- }
++ /* look for at least one link */
++ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) {
++ LIBSSH2_FREE(session, data);
+ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
+- "SFTP stat packet too short");
++ "Invalid READLINK/REALPATH response, "
++ "no name entries");
+ }
+
+- /* this reads a u32 and stores it into a signed 32bit value */
+- link_len = _libssh2_ntohu32(data + 9);
+- if(link_len < target_len) {
+- memcpy(target, data + 13, link_len);
+- target[link_len] = 0;
+- retcode = (int)link_len;
++ if(_libssh2_get_string(&buf, &lk_target, &lk_len) == LIBSSH2_ERROR_NONE) {
++ if(lk_len < target_len) {
++ memcpy(target, lk_target, lk_len);
++ target[lk_len] = '\0';
++ retcode = (int)lk_len;
++ }
++ else {
++ retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;
++ }
+ }
+- else
+- retcode = LIBSSH2_ERROR_BUFFER_TOO_SMALL;
++ else {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (filename)");
++ }
++
+ LIBSSH2_FREE(session, data);
+
+ return retcode;
+--
+2.43.0
+
diff --git a/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch
new file mode 100644
index 00000000000..f34a8778080
--- /dev/null
+++ b/meta/recipes-support/libssh2/libssh2/CVE-2025-15661-3.patch
@@ -0,0 +1,57 @@
+From 09a4a795b051c8c39957a85b36abba5d8dbd7230 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Mon, 20 Oct 2025 14:04:52 -0700
+Subject: [PATCH 3/3] Fix sftp_symlink when getting SSH_FXP_STATUS response
+ (#1731)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Move advancing past packet ID before reading the FXP_STATUS response.
+
+Note:
+Fixes return code regression introduced by:
+"Update sftp_symlink to avoid out of bounds read on malformed packet #1705 (#1717)"
+
+CVE: CVE-2025-15661
+Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/4ed26f5740bdd409269ed9fb48a28bf8f565b681]
+Signed-off-by: David Nyström <david.nystrom@est.tech>
+---
+ src/sftp.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/src/sftp.c b/src/sftp.c
+index 43b6ff90..0a6d15de 100644
+--- a/src/sftp.c
++++ b/src/sftp.c
+@@ -3905,6 +3905,13 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ "SFTP Protocol Error (type)");
+ }
+
++ /* advance past id */
++ if(_libssh2_get_u32(&buf, &tmp_u32)) {
++ LIBSSH2_FREE(session, data);
++ return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
++ "SFTP Protocol Error (id)");
++ }
++
+ if(packet_type == SSH_FXP_STATUS) {
+ if(_libssh2_get_u32(&buf, &tmp_u32)) {
+ LIBSSH2_FREE(session, data);
+@@ -3924,13 +3931,6 @@ static int sftp_symlink(LIBSSH2_SFTP *sftp, const char *path,
+ }
+ }
+
+- /* advance past id */
+- if(_libssh2_get_u32(&buf, &tmp_u32)) {
+- LIBSSH2_FREE(session, data);
+- return _libssh2_error(session, LIBSSH2_ERROR_SFTP_PROTOCOL,
+- "SFTP Protocol Error (id)");
+- }
+-
+ /* look for at least one link */
+ if(_libssh2_get_u32(&buf, &tmp_u32) || tmp_u32 < 1) {
+ LIBSSH2_FREE(session, data);
+--
+2.43.0
+
diff --git a/meta/recipes-support/libssh2/libssh2_1.11.1.bb b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
index 2407ed34d94..32e1ad6c16c 100644
--- a/meta/recipes-support/libssh2/libssh2_1.11.1.bb
+++ b/meta/recipes-support/libssh2/libssh2_1.11.1.bb
@@ -13,6 +13,9 @@ SRC_URI = "http://www.libssh2.org/download/${BP}.tar.gz \
file://CVE-2026-7598.patch \
file://CVE-2026-55200.patch \
file://CVE-2026-55199.patch \
+ file://CVE-2025-15661-1.patch \
+ file://CVE-2025-15661-2.patch \
+ file://CVE-2025-15661-3.patch \
"
SRC_URI[sha256sum] = "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 19/27] libpng: fix CVE-2026-34757
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (17 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 18/27] libssh2: Fix CVE-2025-15661 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 20/27] openssh: Fix CVE-2026-59999 Yoann Congal
` (7 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Deepak Rathore <deeratho@cisco.com>
This patch applies the upstream fixes for libpng 1.6.57 for
CVE-2026-34757. The upstream fix commit is referenced in [1] & [2]
and the public CVE advisory is referenced in [3].
[1] https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a
[2] https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc
[3] https://github.com/pnggroup/libpng/issues/836
Reference:
https://security-tracker.debian.org/tracker/CVE-2026-34757
https://nvd.nist.gov/vuln/detail/CVE-2026-34757
Test results on qemux86-64 using ptest-runner:
====================================================================
Testsuite summary for libpng 1.6.56
====================================================================
# TOTAL: 36
# PASS: 36
# SKIP: 0
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
=====================================================================
Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../libpng/files/CVE-2026-34757_p1.patch | 518 ++++++++++++++++++
.../libpng/files/CVE-2026-34757_p2.patch | 481 ++++++++++++++++
.../libpng/libpng_1.6.56.bb | 4 +-
3 files changed, 1002 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch
create mode 100644 meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch
new file mode 100644
index 00000000000..7b5ebb18b7e
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p1.patch
@@ -0,0 +1,518 @@
+From e621c40a46aa748608d5392f6a5c0278f77573d3 Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Mon, 30 Mar 2026 17:35:30 +0300
+Subject: [PATCH] fix: Handle self-referencing pointers in getter-to-setter
+ aliasing
+
+Apply a robustness fix for a caller-side API usage pattern involving
+the getters and the setters for PLTE, tRNS, and hIST.
+
+Passing a pointer returned by the PLTE, tRNS, or hIST getters back
+into the corresponding setters used to cause the setters to read from
+a stale pointer. The fix consists in snapshotting the caller's data
+into a stack-local buffer before freeing the old internal storage.
+
+Fixes pnggroup/libpng#836
+
+Reported-by: Iv4n <Iv4n550@noreply.github.com>
+CVE: CVE-2026-34757
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/398cbe3df03f4e11bb031e07f416dfdde3684e8a]
+
+(cherry picked from commit 398cbe3df03f4e11bb031e07f416dfdde3684e8a)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ CMakeLists.txt | 12 ++
+ Makefile.am | 9 +-
+ contrib/libtests/pnggetset.c | 328 +++++++++++++++++++++++++++++++++++
+ pngset.c | 29 +++-
+ tests/pnggetset | 5 +
+ 5 files changed, 380 insertions(+), 3 deletions(-)
+ create mode 100644 contrib/libtests/pnggetset.c
+ create mode 100755 tests/pnggetset
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index fde2a323c..6401b7bd3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -624,6 +624,9 @@ set(pngvalid_sources
+ set(pngstest_sources
+ contrib/libtests/pngstest.c
+ )
++set(pnggetset_sources
++ contrib/libtests/pnggetset.c
++)
+ set(pngunknown_sources
+ contrib/libtests/pngunknown.c
+ )
+@@ -786,6 +789,15 @@ if(PNG_TESTS AND PNG_SHARED)
+ COMMAND pngtest
+ FILES "${TEST_PNG3_PNGS}")
+
++ # pnggetset test:
++ # Getter-to-setter roundtrips for various chunk types.
++ add_executable(pnggetset ${pnggetset_sources})
++ target_link_libraries(pnggetset
++ PRIVATE png_shared)
++
++ png_add_test(NAME pnggetset
++ COMMAND pnggetset)
++
+ # pngvalid tests:
+ # Internal validation of standard and progressive reading,
+ # transforms, and gamma handling.
+diff --git a/Makefile.am b/Makefile.am
+index 88f7ab628..fa5bbeb61 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -13,7 +13,7 @@ ACLOCAL_AMFLAGS = -I scripts/autoconf
+
+ # test programs - run on make check, make distcheck
+ if ENABLE_TESTS
+-check_PROGRAMS= pngtest pngunknown pngstest pngvalid pngimage pngcp
++check_PROGRAMS= pngtest pnggetset pngunknown pngstest pngvalid pngimage pngcp
+ if HAVE_CLOCK_GETTIME
+ check_PROGRAMS += timepng
+ endif
+@@ -42,6 +42,9 @@ if ENABLE_TESTS
+ pngtest_SOURCES = pngtest.c
+ pngtest_LDADD = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
+
++pnggetset_SOURCES = contrib/libtests/pnggetset.c
++pnggetset_LDADD = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
++
+ pngvalid_SOURCES = contrib/libtests/pngvalid.c
+ pngvalid_LDADD = libpng@PNGLIB_MAJOR@@PNGLIB_MINOR@.la
+
+@@ -73,6 +76,7 @@ endif
+ if ENABLE_TESTS
+ TESTS =\
+ tests/pngtest-all\
++ tests/pnggetset\
+ tests/pngvalid-gamma-16-to-8\
+ tests/pngvalid-gamma-alpha-mode\
+ tests/pngvalid-gamma-background\
+@@ -303,9 +307,10 @@ $(srcdir)/scripts/pnglibconf.h.prebuilt:
+ pngtest.o: pnglibconf.h
+
+ contrib/libtests/makepng.o: pnglibconf.h
++contrib/libtests/pnggetset.o: pnglibconf.h
++contrib/libtests/pngimage.o: pnglibconf.h
+ contrib/libtests/pngstest.o: pnglibconf.h
+ contrib/libtests/pngunknown.o: pnglibconf.h
+-contrib/libtests/pngimage.o: pnglibconf.h
+ contrib/libtests/pngvalid.o: pnglibconf.h
+ contrib/libtests/readpng.o: pnglibconf.h
+ contrib/libtests/tarith.o: pnglibconf.h
+diff --git a/contrib/libtests/pnggetset.c b/contrib/libtests/pnggetset.c
+new file mode 100644
+index 000000000..b42508094
+--- /dev/null
++++ b/contrib/libtests/pnggetset.c
+@@ -0,0 +1,328 @@
++/* pnggetset.c
++ *
++ * Copyright (c) 2026 Cosmin Truta
++ *
++ * This code is released under the libpng license.
++ * For conditions of distribution and use, see the disclaimer
++ * and license in png.h
++ *
++ * Test the get-then-set roundtrip pattern for PLTE, tRNS, and hIST.
++ *
++ * Passing the internal pointer returned by a getter back into the
++ * corresponding setter is a natural API usage pattern. A previous
++ * version had a use-after-free on this path because the setter freed
++ * the internal buffer before copying from the caller-supplied pointer.
++ */
++
++#include <stdio.h>
++#include <stdlib.h>
++#include <string.h>
++
++#if defined(HAVE_CONFIG_H) && !defined(PNG_NO_CONFIG_H)
++# include <config.h>
++#endif
++
++#ifdef PNG_FREESTANDING_TESTS
++# include <png.h>
++#else
++# include "../../png.h"
++#endif
++
++/* Test: get the PLTE, pass it straight back to set, verify roundtrip. */
++static int
++test_plte_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_color palette[4];
++ png_colorp got_palette = NULL;
++ int num_palette = 0;
++ int i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_plte_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up a palette-color image header. */
++ png_set_IHDR(png_ptr, info_ptr, 1, 1, 8, PNG_COLOR_TYPE_PALETTE,
++ PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
++
++ /* Populate with recognizable values. */
++ for (i = 0; i < 4; i++)
++ {
++ palette[i].red = (png_byte)(i * 10);
++ palette[i].green = (png_byte)(i * 20);
++ palette[i].blue = (png_byte)(i * 30);
++ }
++ png_set_PLTE(png_ptr, info_ptr, palette, 4);
++
++ /* Get the internal pointer and feed it straight back. */
++ png_get_PLTE(png_ptr, info_ptr, &got_palette, &num_palette);
++ if (got_palette == NULL || num_palette != 4)
++ {
++ fprintf(stderr, "pnggetset: png_get_PLTE returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: the pointer aliases info_ptr->palette. */
++ png_set_PLTE(png_ptr, info_ptr, got_palette, num_palette);
++
++ /* Verify the data survived the roundtrip. */
++ got_palette = NULL;
++ num_palette = 0;
++ png_get_PLTE(png_ptr, info_ptr, &got_palette, &num_palette);
++ if (got_palette == NULL || num_palette != 4)
++ {
++ fprintf(stderr, "pnggetset: PLTE lost after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_palette[i].red != (png_byte)(i * 10) ||
++ got_palette[i].green != (png_byte)(i * 20) ||
++ got_palette[i].blue != (png_byte)(i * 30))
++ {
++ fprintf(stderr,
++ "pnggetset: PLTE entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++
++#ifdef PNG_hIST_SUPPORTED
++/* Test: get the hIST, pass it straight back to set, verify roundtrip. */
++static int
++test_hist_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_color palette[4];
++ png_uint_16 hist[4];
++ png_uint_16p got_hist = NULL;
++ int i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_hist_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up a palette-color image header. */
++ memset(palette, 0, sizeof palette);
++ png_set_IHDR(png_ptr, info_ptr, 1, 1, 8, PNG_COLOR_TYPE_PALETTE,
++ PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
++ png_set_PLTE(png_ptr, info_ptr, palette, 4);
++
++ /* Populate with recognizable values. */
++ for (i = 0; i < 4; i++)
++ hist[i] = (png_uint_16)(i * 100 + 42);
++
++ png_set_hIST(png_ptr, info_ptr, hist);
++
++ /* Get the internal pointer and feed it straight back. */
++ if (png_get_hIST(png_ptr, info_ptr, &got_hist) == 0 || got_hist == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_get_hIST returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: the pointer aliases info_ptr->hist. */
++ png_set_hIST(png_ptr, info_ptr, got_hist);
++
++ /* Verify the data survived the roundtrip. */
++ got_hist = NULL;
++ if (png_get_hIST(png_ptr, info_ptr, &got_hist) == 0 || got_hist == NULL)
++ {
++ fprintf(stderr, "pnggetset: hIST lost after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_hist[i] != (png_uint_16)(i * 100 + 42))
++ {
++ fprintf(stderr,
++ "pnggetset: hIST entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_hIST_SUPPORTED */
++
++#ifdef PNG_tRNS_SUPPORTED
++/* Test: get the tRNS, pass it straight back to set, verify roundtrip. */
++static int
++test_trns_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_color palette[4];
++ png_byte trans_alpha[4];
++ png_color_16 trans_color;
++ png_bytep got_alpha = NULL;
++ png_color_16p got_color = NULL;
++ int num_trans = 0;
++ int i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_trns_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up a palette-color image. */
++ memset(palette, 0, sizeof palette);
++ png_set_IHDR(png_ptr, info_ptr, 1, 1, 8, PNG_COLOR_TYPE_PALETTE,
++ PNG_INTERLACE_NONE, PNG_COMPRESSION_TYPE_BASE, PNG_FILTER_TYPE_BASE);
++ png_set_PLTE(png_ptr, info_ptr, palette, 4);
++
++ /* Populate tRNS with recognizable values. */
++ for (i = 0; i < 4; i++)
++ trans_alpha[i] = (png_byte)(0xff - i * 0x11);
++ memset(&trans_color, 0, sizeof trans_color);
++
++ png_set_tRNS(png_ptr, info_ptr, trans_alpha, 4, &trans_color);
++
++ /* Get the internal pointer and feed it straight back. */
++ png_get_tRNS(png_ptr, info_ptr, &got_alpha, &num_trans, &got_color);
++ if (got_alpha == NULL || num_trans != 4)
++ {
++ fprintf(stderr, "pnggetset: png_get_tRNS returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: the pointer aliases info_ptr->trans_alpha. */
++ png_set_tRNS(png_ptr, info_ptr, got_alpha, num_trans, got_color);
++
++ /* Verify the data survived the roundtrip. */
++ got_alpha = NULL;
++ num_trans = 0;
++ png_get_tRNS(png_ptr, info_ptr, &got_alpha, &num_trans, &got_color);
++ if (got_alpha == NULL || num_trans != 4)
++ {
++ fprintf(stderr, "pnggetset: tRNS lost after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_alpha[i] != (png_byte)(0xff - i * 0x11))
++ {
++ fprintf(stderr,
++ "pnggetset: tRNS entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_tRNS_SUPPORTED */
++
++int
++main(void)
++{
++ int result = 0;
++
++ printf("Testing PLTE get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_plte_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++
++#ifdef PNG_hIST_SUPPORTED
++ printf("Testing hIST get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_hist_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++#ifdef PNG_tRNS_SUPPORTED
++ printf("Testing tRNS get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_trns_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++ return result;
++}
+diff --git a/pngset.c b/pngset.c
+index b9ccb7fb1..a6f20123e 100644
+--- a/pngset.c
++++ b/pngset.c
+@@ -385,6 +385,7 @@ void PNGAPI
+ png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
+ png_const_uint_16p hist)
+ {
++ png_uint_16 safe_hist[PNG_MAX_PALETTE_LENGTH];
+ int i;
+
+ png_debug1(1, "in %s storage function", "hIST");
+@@ -401,6 +402,13 @@ png_set_hIST(png_const_structrp png_ptr, png_inforp info_ptr,
+ return;
+ }
+
++ /* Snapshot the caller's hist before freeing, in case it points to
++ * info_ptr->hist (getter-to-setter aliasing).
++ */
++ memcpy(safe_hist, hist, (unsigned int)info_ptr->num_palette *
++ (sizeof (png_uint_16)));
++ hist = safe_hist;
++
+ png_free_data(png_ptr, info_ptr, PNG_FREE_HIST, 0);
+
+ /* Changed from info->num_palette to PNG_MAX_PALETTE_LENGTH in
+@@ -742,7 +750,7 @@ void PNGAPI
+ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
+ png_const_colorp palette, int num_palette)
+ {
+-
++ png_color safe_palette[PNG_MAX_PALETTE_LENGTH];
+ png_uint_32 max_palette_length;
+
+ png_debug1(1, "in %s storage function", "PLTE");
+@@ -776,6 +784,15 @@ png_set_PLTE(png_structrp png_ptr, png_inforp info_ptr,
+ png_error(png_ptr, "Invalid palette");
+ }
+
++ /* Snapshot the caller's palette before freeing, in case it points to
++ * info_ptr->palette (getter-to-setter aliasing).
++ */
++ if (num_palette > 0)
++ memcpy(safe_palette, palette, (unsigned int)num_palette *
++ (sizeof (png_color)));
++
++ palette = safe_palette;
++
+ png_free_data(png_ptr, info_ptr, PNG_FREE_PLTE, 0);
+
+ /* Changed in libpng-1.2.1 to allocate PNG_MAX_PALETTE_LENGTH instead
+@@ -1165,6 +1182,16 @@ png_set_tRNS(png_structrp png_ptr, png_inforp info_ptr,
+
+ if (trans_alpha != NULL)
+ {
++ /* Snapshot the caller's trans_alpha before freeing, in case it
++ * points to info_ptr->trans_alpha (getter-to-setter aliasing).
++ */
++ png_byte safe_trans[PNG_MAX_PALETTE_LENGTH];
++
++ if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
++ memcpy(safe_trans, trans_alpha, (size_t)num_trans);
++
++ trans_alpha = safe_trans;
++
+ png_free_data(png_ptr, info_ptr, PNG_FREE_TRNS, 0);
+
+ if (num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH)
+diff --git a/tests/pnggetset b/tests/pnggetset
+new file mode 100755
+index 000000000..57ef731a5
+--- /dev/null
++++ b/tests/pnggetset
+@@ -0,0 +1,5 @@
++#!/bin/sh
++
++# pnggetset test:
++# Getter-to-setter roundtrips for various chunk types.
++exec ./pnggetset
diff --git a/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch
new file mode 100644
index 00000000000..894f9d618be
--- /dev/null
+++ b/meta/recipes-multimedia/libpng/files/CVE-2026-34757_p2.patch
@@ -0,0 +1,481 @@
+From 815fdfc8dba0603abc26523d0b7e37f7ad21988b Mon Sep 17 00:00:00 2001
+From: Cosmin Truta <ctruta@gmail.com>
+Date: Mon, 30 Mar 2026 17:43:05 +0300
+Subject: [PATCH] fix: Handle getter-to-setter aliasing in append-style chunk
+ setters
+
+Apply the same class of robustness fix from the previous commit to
+`png_set_text`, `png_set_sPLT` and `png_set_unknown_chunks`. These
+append-style setters used `png_realloc_array` to grow the internal
+array, then freed the old array before copying from the caller's
+input. If the caller's pointer was obtained from the corresponding
+getter, it aliased the freed array.
+
+The fix defers the freeing of the old array until after the copy loop.
+
+Also extend the pnggetset regression test to cover all three setters.
+
+CVE: CVE-2026-34757
+Upstream-Status: Backport [https://github.com/pnggroup/libpng/commit/55d20aaa322c9274491cda82c5cd4f99b48c6bcc]
+
+(cherry picked from commit 55d20aaa322c9274491cda82c5cd4f99b48c6bcc)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ contrib/libtests/pnggetset.c | 330 ++++++++++++++++++++++++++++++++++-
+ pngset.c | 25 ++-
+ 2 files changed, 347 insertions(+), 8 deletions(-)
+
+diff --git a/contrib/libtests/pnggetset.c b/contrib/libtests/pnggetset.c
+index b42508094..6ae43dc66 100644
+--- a/contrib/libtests/pnggetset.c
++++ b/contrib/libtests/pnggetset.c
+@@ -6,12 +6,12 @@
+ * For conditions of distribution and use, see the disclaimer
+ * and license in png.h
+ *
+- * Test the get-then-set roundtrip pattern for PLTE, tRNS, and hIST.
++ * Test the get-then-set roundtrip for chunk types whose getters return
++ * a pointer to internal storage.
+ *
+- * Passing the internal pointer returned by a getter back into the
+- * corresponding setter is a natural API usage pattern. A previous
+- * version had a use-after-free on this path because the setter freed
+- * the internal buffer before copying from the caller-supplied pointer.
++ * Passing such a pointer back into the corresponding setter must not
++ * cause a use-after-free. A previous version freed the internal buffer
++ * before copying from the caller-supplied pointer.
+ */
+
+ #include <stdio.h>
+@@ -285,6 +285,290 @@ test_trns_roundtrip(void)
+ }
+ #endif /* PNG_tRNS_SUPPORTED */
+
++#ifdef PNG_TEXT_SUPPORTED
++/* Test: get the text array, pass it straight back to set, verify data. */
++#define TEXT_COUNT 6 /* enough to trigger reallocation on the second set */
++static int
++test_text_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_text text_entries[TEXT_COUNT];
++ png_textp got_text = NULL;
++ int got_num_text = 0;
++ int i;
++
++ /* Recognizable keys and values. */
++ static const char *keys[TEXT_COUNT] = {
++ "Title", "Author", "Desc", "Copyright", "Source", "Comment"
++ };
++ static const char *vals[TEXT_COUNT] = {
++ "t0", "t1", "t2", "t3", "t4", "t5"
++ };
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_text_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Populate the text entries. */
++ memset(text_entries, 0, sizeof text_entries);
++ for (i = 0; i < TEXT_COUNT; i++)
++ {
++ text_entries[i].compression = PNG_TEXT_COMPRESSION_NONE;
++ text_entries[i].key = (png_charp)keys[i];
++ text_entries[i].text = (png_charp)vals[i];
++ }
++ png_set_text(png_ptr, info_ptr, text_entries, TEXT_COUNT);
++
++ /* Get the internal pointer and feed it straight back (append). */
++ png_get_text(png_ptr, info_ptr, &got_text, &got_num_text);
++ if (got_text == NULL || got_num_text != TEXT_COUNT)
++ {
++ fprintf(stderr, "pnggetset: png_get_text returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: got_text aliases info_ptr->text. */
++ png_set_text(png_ptr, info_ptr, got_text, got_num_text);
++
++ /* Verify the original entries survived. */
++ got_text = NULL;
++ got_num_text = 0;
++ png_get_text(png_ptr, info_ptr, &got_text, &got_num_text);
++ if (got_text == NULL || got_num_text != TEXT_COUNT * 2)
++ {
++ fprintf(stderr, "pnggetset: text count %d, expected %d after roundtrip\n",
++ got_num_text, TEXT_COUNT * 2);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < TEXT_COUNT; i++)
++ {
++ if (got_text[i].key == NULL ||
++ strcmp(got_text[i].key, keys[i]) != 0 ||
++ got_text[i].text == NULL ||
++ strcmp(got_text[i].text, vals[i]) != 0)
++ {
++ fprintf(stderr,
++ "pnggetset: text entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#undef TEXT_COUNT
++#endif /* PNG_TEXT_SUPPORTED */
++
++#ifdef PNG_sPLT_SUPPORTED
++/* Test: get the sPLT array, pass it straight back to set, verify data. */
++static int
++test_splt_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_sPLT_t splt;
++ png_sPLT_entry splt_entries[4];
++ png_sPLT_tp got_spalettes = NULL;
++ int got_num, i;
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr, "pnggetset: libpng error in test_splt_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Populate with recognizable values. */
++ memset(splt_entries, 0, sizeof splt_entries);
++ for (i = 0; i < 4; i++)
++ {
++ splt_entries[i].red = (png_uint_16)(i * 1000);
++ splt_entries[i].green = (png_uint_16)(i * 2000);
++ splt_entries[i].blue = (png_uint_16)(i * 3000);
++ splt_entries[i].alpha = 0xffffU;
++ splt_entries[i].frequency = (png_uint_16)(i + 1);
++ }
++ memset(&splt, 0, sizeof splt);
++ splt.name = (png_charp)"test_sPLT";
++ splt.depth = 16;
++ splt.entries = splt_entries;
++ splt.nentries = 4;
++
++ png_set_sPLT(png_ptr, info_ptr, &splt, 1);
++
++ /* Get the internal pointer and feed it straight back (append). */
++ got_num = png_get_sPLT(png_ptr, info_ptr, &got_spalettes);
++ if (got_spalettes == NULL || got_num != 1)
++ {
++ fprintf(stderr, "pnggetset: png_get_sPLT returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: got_spalettes aliases internal storage. */
++ png_set_sPLT(png_ptr, info_ptr, got_spalettes, got_num);
++
++ /* Verify the original entry survived. */
++ got_spalettes = NULL;
++ got_num = png_get_sPLT(png_ptr, info_ptr, &got_spalettes);
++ if (got_spalettes == NULL || got_num != 2)
++ {
++ fprintf(stderr, "pnggetset: sPLT count %d, expected 2 after roundtrip\n",
++ got_num);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ if (strcmp(got_spalettes[0].name, "test_sPLT") != 0 ||
++ got_spalettes[0].nentries != 4 ||
++ got_spalettes[0].depth != 16)
++ {
++ fprintf(stderr,
++ "pnggetset: sPLT entry 0 corrupted after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ for (i = 0; i < 4; i++)
++ {
++ if (got_spalettes[0].entries[i].red != (png_uint_16)(i * 1000) ||
++ got_spalettes[0].entries[i].green != (png_uint_16)(i * 2000) ||
++ got_spalettes[0].entries[i].blue != (png_uint_16)(i * 3000))
++ {
++ fprintf(stderr,
++ "pnggetset: sPLT[0] entry %d corrupted after roundtrip\n", i);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_sPLT_SUPPORTED */
++
++#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
++/* Test: get unknown chunks, pass them straight back to set, verify data. */
++static int
++test_unknown_roundtrip(void)
++{
++ png_structp png_ptr;
++ png_infop info_ptr;
++ png_unknown_chunk unk;
++ png_unknown_chunkp got_unknowns = NULL;
++ int got_num;
++ static const png_byte test_data[] = {0xde, 0xad, 0xbe, 0xef};
++
++ png_ptr = png_create_write_struct(PNG_LIBPNG_VER_STRING,
++ NULL, NULL, NULL);
++ if (png_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_write_struct failed\n");
++ return 1;
++ }
++
++ info_ptr = png_create_info_struct(png_ptr);
++ if (info_ptr == NULL)
++ {
++ fprintf(stderr, "pnggetset: png_create_info_struct failed\n");
++ png_destroy_write_struct(&png_ptr, NULL);
++ return 1;
++ }
++
++ if (setjmp(png_jmpbuf(png_ptr)))
++ {
++ fprintf(stderr,
++ "pnggetset: libpng error in test_unknown_roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* Set up an unknown chunk with recognizable data. */
++ memset(&unk, 0, sizeof unk);
++ memcpy(unk.name, "teSt", 5);
++ unk.data = (png_bytep)test_data;
++ unk.size = sizeof test_data;
++ unk.location = PNG_HAVE_IHDR;
++
++ png_set_keep_unknown_chunks(png_ptr, PNG_HANDLE_CHUNK_ALWAYS, NULL, 0);
++ png_set_unknown_chunks(png_ptr, info_ptr, &unk, 1);
++
++ /* Get the internal pointer and feed it straight back (append). */
++ got_num = png_get_unknown_chunks(png_ptr, info_ptr, &got_unknowns);
++ if (got_unknowns == NULL || got_num != 1)
++ {
++ fprintf(stderr,
++ "pnggetset: png_get_unknown_chunks returned unexpected values\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ /* This is the critical call: got_unknowns aliases internal storage. */
++ png_set_unknown_chunks(png_ptr, info_ptr, got_unknowns, got_num);
++
++ /* Verify the original entry survived. */
++ got_unknowns = NULL;
++ got_num = png_get_unknown_chunks(png_ptr, info_ptr, &got_unknowns);
++ if (got_unknowns == NULL || got_num != 2)
++ {
++ fprintf(stderr,
++ "pnggetset: unknown_chunks count %d, expected 2 after roundtrip\n",
++ got_num);
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++ if (memcmp(got_unknowns[0].name, "teSt", 4) != 0 ||
++ got_unknowns[0].size != sizeof test_data ||
++ memcmp(got_unknowns[0].data, test_data, sizeof test_data) != 0)
++ {
++ fprintf(stderr,
++ "pnggetset: unknown chunk 0 corrupted after roundtrip\n");
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 1;
++ }
++
++ png_destroy_write_struct(&png_ptr, &info_ptr);
++ return 0;
++}
++#endif /* PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED */
++
+ int
+ main(void)
+ {
+@@ -324,5 +608,41 @@ main(void)
+ printf("PASS\n");
+ #endif
+
++#ifdef PNG_TEXT_SUPPORTED
++ printf("Testing tEXt get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_text_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++#ifdef PNG_sPLT_SUPPORTED
++ printf("Testing sPLT get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_splt_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
++#ifdef PNG_STORE_UNKNOWN_CHUNKS_SUPPORTED
++ printf("Testing unknown chunks get-then-set roundtrip... ");
++ fflush(stdout);
++ if (test_unknown_roundtrip() != 0)
++ {
++ printf("FAIL\n");
++ result = 1;
++ }
++ else
++ printf("PASS\n");
++#endif
++
+ return result;
+ }
+diff --git a/pngset.c b/pngset.c
+index a6f20123e..513c51eb4 100644
+--- a/pngset.c
++++ b/pngset.c
+@@ -954,6 +954,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ png_const_textp text_ptr, int num_text)
+ {
+ int i;
++ png_textp old_text = NULL;
+
+ png_debug1(1, "in text storage function, chunk typeid = 0x%lx",
+ png_ptr == NULL ? 0xabadca11UL : (unsigned long)png_ptr->chunk_name);
+@@ -1001,7 +1002,10 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ return 1;
+ }
+
+- png_free(png_ptr, info_ptr->text);
++ /* Defer freeing the old array until after the copy loop below,
++ * in case text_ptr aliases info_ptr->text (getter-to-setter).
++ */
++ old_text = info_ptr->text;
+
+ info_ptr->text = new_text;
+ info_ptr->free_me |= PNG_FREE_TEXT;
+@@ -1086,6 +1090,7 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ {
+ png_chunk_report(png_ptr, "text chunk: out of memory",
+ PNG_CHUNK_WRITE_ERROR);
++ png_free(png_ptr, old_text);
+
+ return 1;
+ }
+@@ -1139,6 +1144,8 @@ png_set_text_2(png_const_structrp png_ptr, png_inforp info_ptr,
+ png_debug1(3, "transferred text chunk %d", info_ptr->num_text);
+ }
+
++ png_free(png_ptr, old_text);
++
+ return 0;
+ }
+ #endif
+@@ -1276,6 +1283,7 @@ png_set_sPLT(png_const_structrp png_ptr,
+ */
+ {
+ png_sPLT_tp np;
++ png_sPLT_tp old_spalettes;
+
+ png_debug1(1, "in %s storage function", "sPLT");
+
+@@ -1296,7 +1304,10 @@ png_set_sPLT(png_const_structrp png_ptr,
+ return;
+ }
+
+- png_free(png_ptr, info_ptr->splt_palettes);
++ /* Defer freeing the old array until after the copy loop below,
++ * in case entries aliases info_ptr->splt_palettes (getter-to-setter).
++ */
++ old_spalettes = info_ptr->splt_palettes;
+
+ info_ptr->splt_palettes = np;
+ info_ptr->free_me |= PNG_FREE_SPLT;
+@@ -1360,6 +1371,8 @@ png_set_sPLT(png_const_structrp png_ptr,
+ }
+ while (--nentries);
+
++ png_free(png_ptr, old_spalettes);
++
+ if (nentries > 0)
+ png_chunk_report(png_ptr, "sPLT out of memory", PNG_CHUNK_WRITE_ERROR);
+ }
+@@ -1408,6 +1421,7 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
+ png_inforp info_ptr, png_const_unknown_chunkp unknowns, int num_unknowns)
+ {
+ png_unknown_chunkp np;
++ png_unknown_chunkp old_unknowns;
+
+ if (png_ptr == NULL || info_ptr == NULL || num_unknowns <= 0 ||
+ unknowns == NULL)
+@@ -1454,7 +1468,10 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
+ return;
+ }
+
+- png_free(png_ptr, info_ptr->unknown_chunks);
++ /* Defer freeing the old array until after the copy loop below,
++ * in case unknowns aliases info_ptr->unknown_chunks (getter-to-setter).
++ */
++ old_unknowns = info_ptr->unknown_chunks;
+
+ info_ptr->unknown_chunks = np; /* safe because it is initialized */
+ info_ptr->free_me |= PNG_FREE_UNKN;
+@@ -1500,6 +1517,8 @@ png_set_unknown_chunks(png_const_structrp png_ptr,
+ ++np;
+ ++(info_ptr->unknown_chunks_num);
+ }
++
++ png_free(png_ptr, old_unknowns);
+ }
+
+ void PNGAPI
diff --git a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
index 7ede0a6c8b7..9dbd0d26e06 100644
--- a/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
+++ b/meta/recipes-multimedia/libpng/libpng_1.6.56.bb
@@ -12,7 +12,9 @@ LIBV = "16"
SRC_URI = "${SOURCEFORGE_MIRROR}/${BPN}/${BPN}${LIBV}/${BP}.tar.xz \
file://run-ptest \
-"
+ file://CVE-2026-34757_p1.patch \
+ file://CVE-2026-34757_p2.patch \
+ "
SRC_URI[sha256sum] = "f7d8bf1601b7804f583a254ab343a6549ca6cf27d255c302c47af2d9d36a6f18"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 20/27] openssh: Fix CVE-2026-59999
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (18 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 19/27] libpng: fix CVE-2026-34757 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 21/27] openssh: Fix CVE-2026-59997 Yoann Congal
` (6 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59999. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753
[2] https://www.cve.org/CVERecord?id=CVE-2026-59999
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: patch referenced at https://ubuntu.com/security/CVE-2026-59999]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../openssh/openssh/CVE-2026-59999.patch | 38 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
new file mode 100644
index 00000000000..5907a991b9a
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59999.patch
@@ -0,0 +1,38 @@
+From a83dd105dc407d95c42140ea6f04a1e247aaf2f9 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 31 May 2026 04:47:29 +0000
+Subject: [PATCH] upstream: DisableForwarding=yes didn't override
+ PermitTunnel=yes
+
+Reported independently by Huzaifa Sidhpurwala of Redhat and Marko
+Jevtic; ok markus@
+
+OpenBSD-Commit-ID: b5c13f0746cf079b21f8deba47407fad49ccbf4c
+
+CVE: CVE-2026-59999
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/8dfe7ed6e2fd988de08df508355a196b956b2753]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in serverloop.c and
+ retained the Wrynose OpenSSH 10.3p1 revision because this stable
+ backport carries only the functional security change.
+
+(cherry picked from commit 8dfe7ed6e2fd988de08df508355a196b956b2753)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ serverloop.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/serverloop.c b/serverloop.c
+index 8e63480ec..42c3ce9fe 100644
+--- a/serverloop.c
++++ b/serverloop.c
+@@ -523,7 +523,7 @@ server_request_tun(struct ssh *ssh)
+ ssh_packet_send_debug(ssh, "Unsupported tunnel device mode.");
+ return NULL;
+ }
+- if ((options.permit_tun & mode) == 0) {
++ if ((options.permit_tun & mode) == 0 || options.disable_forwarding) {
+ ssh_packet_send_debug(ssh, "Server has rejected tunnel device "
+ "forwarding");
+ return NULL;
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 8669d080b6e..53704a0cc7e 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -24,6 +24,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://run-ptest \
file://sshd_check_keys \
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
+ file://CVE-2026-59999.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 21/27] openssh: Fix CVE-2026-59997
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (19 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 20/27] openssh: Fix CVE-2026-59999 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 22/27] openssh: Fix CVE-2026-59996 Yoann Congal
` (5 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59997. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014
[2] https://www.cve.org/CVERecord?id=CVE-2026-59997
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: patch referenced at https://ubuntu.com/security/CVE-2026-59997]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../openssh/openssh/CVE-2026-59997.patch | 60 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 61 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
new file mode 100644
index 00000000000..7d77fbcc9eb
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59997.patch
@@ -0,0 +1,60 @@
+From 91ce99061c78d0ae84dafc96409c8ea9746f70c0 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Fri, 5 Jun 2026 08:53:07 +0000
+Subject: [PATCH] upstream: pass >9 commandline arguments to the internal-sftp
+ server,
+
+previously they were silently dropped; reported by Steve Caffrey ok deraadt@
+
+OpenBSD-Commit-ID: ee6cd5430a3ca027c3223af54b58ad3cc7ccd624
+
+CVE: CVE-2026-59997
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e9916c44c1324ab9ab022719e4df08a390a83014]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in session.c and
+ retained the Wrynose OpenSSH 10.3p1 revision because this stable
+ backport carries only the functional security change.
+
+(cherry picked from commit e9916c44c1324ab9ab022719e4df08a390a83014)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ session.c | 19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+diff --git a/session.c b/session.c
+index 93de35d7c..b1f125a3c 100644
+--- a/session.c
++++ b/session.c
+@@ -1607,21 +1607,22 @@ do_child(struct ssh *ssh, Session *s, const char *command)
+ exit(1);
+ } else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) {
+ extern int optind, optreset;
+- int i;
+- char *p, *args;
++ int sftp_argc;
++ char **sftp_argv;
+
+ setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME);
+- args = xstrdup(command ? command : "sftp-server");
+- for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " ")))
+- if (i < ARGV_MAX - 1)
+- argv[i++] = p;
+- argv[i] = NULL;
++ if (argv_split(command == NULL ? "sftp-server" : command,
++ &sftp_argc, &sftp_argv, 1) != 0) {
++ error("internal error: can't split internal-sftp "
++ "arguments");
++ exit(1);
++ }
+ optind = optreset = 1;
+- __progname = argv[0];
++ __progname = sftp_argv[0];
+ #ifdef WITH_SELINUX
+ ssh_selinux_change_context("sftpd_t");
+ #endif
+- exit(sftp_server_main(i, argv, s->pw));
++ exit(sftp_server_main(sftp_argc, sftp_argv, s->pw));
+ }
+
+ fflush(NULL);
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 53704a0cc7e..e611db65ff8 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -25,6 +25,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://sshd_check_keys \
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
file://CVE-2026-59999.patch \
+ file://CVE-2026-59997.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 22/27] openssh: Fix CVE-2026-59996
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (20 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 21/27] openssh: Fix CVE-2026-59997 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 23/27] openssh: Fix CVE-2026-59995 Yoann Congal
` (4 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59996. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78
[2] https://www.cve.org/CVERecord?id=CVE-2026-59996
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: patch referenced in https://ubuntu.com/security/CVE-2026-59996]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../openssh/openssh/CVE-2026-59996.patch | 39 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 40 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
new file mode 100644
index 00000000000..9db9988690b
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59996.patch
@@ -0,0 +1,39 @@
+From f479595f7498e8c83d3df9d3eddb6e555497ff5b Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Sun, 28 Jun 2026 23:47:16 +0000
+Subject: [PATCH] upstream: resist that return ".." via remote glob during
+
+remote/remote copies, similar to fixes for bz3871 for remote/local copies.
+From Swival scanner
+
+OpenBSD-Commit-ID: c0c20a1b746db55c08e53658bf21ea9405b300a5
+
+CVE: CVE-2026-59996
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/36480181fa22f98e180b4f9e10203480c0346c78]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in scp.c and retained
+ the Wrynose OpenSSH 10.3p1 revision because this stable backport carries
+ only the functional security change.
+
+(cherry picked from commit 36480181fa22f98e180b4f9e10203480c0346c78)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ scp.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/scp.c b/scp.c
+index 1faa9a555..bd01ebffd 100644
+--- a/scp.c
++++ b/scp.c
+@@ -2039,6 +2039,10 @@ throughlocal_sftp(struct sftp_conn *from, struct sftp_conn *to,
+ goto out;
+ }
+
++ /* Special handling for source of '..' */
++ if (strcmp(filename, "..") == 0)
++ filename = "."; /* Download to dest, not dest/.. */
++
+ if (targetisdir)
+ abs_dst = sftp_path_append(target, filename);
+ else
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index e611db65ff8..0f4839f7675 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -26,6 +26,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://0001-regress-banner.sh-log-input-and-output-files-on-erro.patch \
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
+ file://CVE-2026-59996.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 23/27] openssh: Fix CVE-2026-59995
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (21 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 22/27] openssh: Fix CVE-2026-59996 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 24/27] openssh: Fix CVE-2026-60001 Yoann Congal
` (3 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-59995. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b
[2] https://www.cve.org/CVERecord?id=CVE-2026-59995
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: patch referenced in https://ubuntu.com/security/CVE-2026-59995]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../openssh/openssh/CVE-2026-59995.patch | 44 +++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 45 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
new file mode 100644
index 00000000000..ac1712eec2f
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-59995.patch
@@ -0,0 +1,44 @@
+From 02e4b3cfd0bef64381921cdb9d6a21b1f50fdb74 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 29 Jun 2026 01:47:21 +0000
+Subject: [PATCH] upstream: avoid download to server-controlled path when
+ performing
+
+download on the commandline. From Swival scanner
+
+OpenBSD-Commit-ID: d1b2c44305fdfe6d51eed9ecc727e59478bf311f
+
+CVE: CVE-2026-59995
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/1b39f39657d2e58f8ec57341581a39bbf0be645b]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in sftp.c and retained
+ the Wrynose OpenSSH 10.3p1 revision because this stable backport carries
+ only the functional security change.
+
+(cherry picked from commit 1b39f39657d2e58f8ec57341581a39bbf0be645b)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ sftp.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/sftp.c b/sftp.c
+index eebb166e8..33c8364e3 100644
+--- a/sftp.c
++++ b/sftp.c
+@@ -2287,13 +2287,8 @@ interactive_loop(struct sftp_conn *conn, char *file1, char *file2)
+ return (-1);
+ }
+ } else {
+- /* XXX this is wrong wrt quoting */
+- snprintf(cmd, sizeof cmd, "get%s %s%s%s",
+- global_aflag ? " -a" : "", dir,
+- file2 == NULL ? "" : " ",
+- file2 == NULL ? "" : file2);
+- err = parse_dispatch_command(conn, cmd,
+- &remote_path, startdir, 1, 0);
++ err = process_get(conn, dir, file2, remote_path, 0, 0,
++ global_aflag, 0);
+ free(dir);
+ free(startdir);
+ free(remote_path);
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 0f4839f7675..c3b8d910dd7 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -27,6 +27,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59999.patch \
file://CVE-2026-59997.patch \
file://CVE-2026-59996.patch \
+ file://CVE-2026-59995.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 24/27] openssh: Fix CVE-2026-60001
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (22 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 23/27] openssh: Fix CVE-2026-59995 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 25/27] openssh: Fix CVE-2026-60002 Yoann Congal
` (2 subsequent siblings)
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-60001. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454
[2] https://www.cve.org/CVERecord?id=CVE-2026-60001
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: patch referenced in https://ubuntu.com/security/CVE-2026-60001]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../openssh/openssh/CVE-2026-60001.patch | 130 ++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 131 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
new file mode 100644
index 00000000000..aa32484b17d
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60001.patch
@@ -0,0 +1,130 @@
+From 6bc7dd87d543c882994f95c8309846dfda9ab503 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:44:48 +0000
+Subject: [PATCH] upstream: Fix cases in GSSAPI and keyboard-interactive
+
+authentication where the minimum per-attempt delay was not being enforced.
+
+Reported by Orange Cyberdefense Vulnerability Team
+
+OpenBSD-Commit-ID: c40bd35cc2428fcaccad7a141703c28baa6da01e
+
+CVE: CVE-2026-60001
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/d43ba60c91cb323ca921049b7d43b1908c318454]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunks in auth.h,
+ auth2-chall.c, auth2-gss.c, and auth2.c and retained the Wrynose
+ OpenSSH 10.3p1 revisions because this stable backport carries only the
+ functional security changes.
+
+(cherry picked from commit d43ba60c91cb323ca921049b7d43b1908c318454)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth.h | 1 +
+ auth2-chall.c | 4 ++++
+ auth2-gss.c | 7 +++++++
+ auth2.c | 10 ++++++++--
+ 4 files changed, 20 insertions(+), 2 deletions(-)
+
+diff --git a/auth.h b/auth.h
+index 634a84aa8..c2cfa5ed8 100644
+--- a/auth.h
++++ b/auth.h
+@@ -175,6 +175,7 @@ void auth_log(struct ssh *, int, int, const char *, const char *);
+ void auth_maxtries_exceeded(struct ssh *) __attribute__((noreturn));
+ void userauth_finish(struct ssh *, int, const char *, const char *);
+ int auth_root_allowed(struct ssh *, const char *);
++void auth_failure_delay(Authctxt *, double);
+
+ char *auth2_read_banner(void);
+ int auth2_methods_valid(const char *, int);
+diff --git a/auth2-chall.c b/auth2-chall.c
+index f3889079b..4687ca8e2 100644
+--- a/auth2-chall.c
++++ b/auth2-chall.c
+@@ -300,6 +300,7 @@ input_userauth_info_response(int type, uint32_t seq, struct ssh *ssh)
+ u_int i, nresp;
+ const char *devicename = NULL;
+ char **response = NULL;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal_f("no authctxt");
+@@ -358,6 +359,9 @@ input_userauth_info_response(int type, uint32_t seq, struct ssh *ssh)
+ auth2_challenge_start(ssh);
+ }
+ }
++
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+ userauth_finish(ssh, authenticated, "keyboard-interactive",
+ devicename);
+ return 0;
+diff --git a/auth2-gss.c b/auth2-gss.c
+index 053548527..f27ac9221 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -255,6 +255,7 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh)
+ {
+ Authctxt *authctxt = ssh->authctxt;
+ int r, authenticated;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+@@ -268,6 +269,8 @@ input_gssapi_exchange_complete(int type, uint32_t plen, struct ssh *ssh)
+ fatal_fr(r, "parse packet");
+
+ authenticated = mm_ssh_gssapi_userok(authctxt->user);
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
+
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+@@ -288,6 +291,7 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+ gss_buffer_desc mic, gssbuf;
+ u_char *p;
+ size_t len;
++ double tstart = monotime_double();
+
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+@@ -315,6 +319,9 @@ input_gssapi_mic(int type, uint32_t plen, struct ssh *ssh)
+ sshbuf_free(b);
+ free(mic.value);
+
++ if (!authenticated)
++ auth_failure_delay(authctxt, tstart);
++
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+diff --git a/auth2.c b/auth2.c
+index 3a1682746..7ba611c02 100644
+--- a/auth2.c
++++ b/auth2.c
+@@ -265,6 +265,12 @@ ensure_minimum_time_since(double start, double seconds)
+ nanosleep(&ts, NULL);
+ }
+
++void
++auth_failure_delay(Authctxt *authctxt, double tstart)
++{
++ ensure_minimum_time_since(tstart, user_specific_delay(authctxt->user));
++}
++
+ static int
+ input_userauth_request(int type, uint32_t seq, struct ssh *ssh)
+ {
+@@ -346,8 +352,8 @@ input_userauth_request(int type, uint32_t seq, struct ssh *ssh)
+ authenticated = m->userauth(ssh, method);
+ }
+ if (!authctxt->authenticated && strcmp(method, "none") != 0)
+- ensure_minimum_time_since(tstart,
+- user_specific_delay(authctxt->user));
++ auth_failure_delay(authctxt, tstart);
++
+ userauth_finish(ssh, authenticated, method, NULL);
+ r = 0;
+ out:
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index c3b8d910dd7..d8d73ee5dd0 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -28,6 +28,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59997.patch \
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
+ file://CVE-2026-60001.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 25/27] openssh: Fix CVE-2026-60002
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (23 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 24/27] openssh: Fix CVE-2026-60001 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 26/27] openssh: Fix CVE-2026-60000 Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 27/27] gzip: Fix CVE-2026-41991 Yoann Congal
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-60002. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23
[2] https://www.cve.org/CVERecord?id=CVE-2026-60002
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: Patch referenced in https://ubuntu.com/security/CVE-2026-60002]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../openssh/openssh/CVE-2026-60002.patch | 225 ++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 226 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
new file mode 100644
index 00000000000..85937279a20
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60002.patch
@@ -0,0 +1,225 @@
+From b571549bc93e95f0d3d563094f825544228501de Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:49:58 +0000
+Subject: [PATCH] upstream: fix ownership and lifetime of several bits of
+ client
+
+state that need to persist for the life of the connection, especially the
+cached hostkey that was being incorrectly freed early on some paths, possibly
+allowing its use after free.
+
+Reported by Zhenpeng (Leo) Lin from depthfirst.com
+
+OpenBSD-Commit-ID: faaa6ad72e7d69d41fa8b197b606265b7d9bc73f
+
+CVE: CVE-2026-60002
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/e8bdfb151a356d0171fea4194dd205fbb252be23]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunks in ssh.c,
+ sshconnect.c, sshconnect.h, and sshconnect2.c and retained the Wrynose
+ OpenSSH 10.3p1 revisions because this stable backport carries only the
+ functional security changes.
+
+(cherry picked from commit e8bdfb151a356d0171fea4194dd205fbb252be23)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ ssh.c | 24 ++----------------------
+ sshconnect.c | 47 +++++++++++++++++++++++++++++++++++++++++++++--
+ sshconnect.h | 7 +++++--
+ sshconnect2.c | 20 +++++++++++---------
+ 4 files changed, 63 insertions(+), 35 deletions(-)
+
+diff --git a/ssh.c b/ssh.c
+index 531f28eb2..efb8930f4 100644
+--- a/ssh.c
++++ b/ssh.c
+@@ -612,26 +612,6 @@ set_addrinfo_port(struct addrinfo *addrs, int port)
+ }
+ }
+
+-static void
+-ssh_conn_info_free(struct ssh_conn_info *cinfo)
+-{
+- if (cinfo == NULL)
+- return;
+- free(cinfo->conn_hash_hex);
+- free(cinfo->shorthost);
+- free(cinfo->uidstr);
+- free(cinfo->keyalias);
+- free(cinfo->thishost);
+- free(cinfo->host_arg);
+- free(cinfo->portstr);
+- free(cinfo->remhost);
+- free(cinfo->remuser);
+- free(cinfo->homedir);
+- free(cinfo->locuser);
+- free(cinfo->jmphost);
+- free(cinfo);
+-}
+-
+ /*
+ * Main program for the ssh client.
+ */
+@@ -1799,8 +1779,8 @@ main(int ac, char **av)
+ ssh_signal(SIGCHLD, main_sigchld_handler);
+
+ /* Log into the remote system. Never returns if the login fails. */
+- ssh_login(ssh, &sensitive_data, host, (struct sockaddr *)&hostaddr,
+- options.port, pw, timeout_ms, cinfo);
++ ssh_login(ssh, &sensitive_data, host, &hostaddr, options.port,
++ pw, timeout_ms, cinfo);
+
+ /* We no longer need the private host keys. Clear them now. */
+ if (sensitive_data.nkeys != 0) {
+diff --git a/sshconnect.c b/sshconnect.c
+index 4384277a6..3d338ff23 100644
+--- a/sshconnect.c
++++ b/sshconnect.c
+@@ -70,6 +70,49 @@ extern char *__progname;
+ static int show_other_keys(struct hostkeys *, struct sshkey *);
+ static void warn_changed_key(struct sshkey *);
+
++void
++ssh_conn_info_free(struct ssh_conn_info *cinfo)
++{
++ if (cinfo == NULL)
++ return;
++ free(cinfo->conn_hash_hex);
++ free(cinfo->shorthost);
++ free(cinfo->uidstr);
++ free(cinfo->keyalias);
++ free(cinfo->thishost);
++ free(cinfo->host_arg);
++ free(cinfo->portstr);
++ free(cinfo->remhost);
++ free(cinfo->remuser);
++ free(cinfo->homedir);
++ free(cinfo->locuser);
++ free(cinfo->jmphost);
++ freezero(cinfo, sizeof(*cinfo));
++}
++
++struct ssh_conn_info *
++ssh_conn_info_dup(const struct ssh_conn_info *cinfo)
++{
++ struct ssh_conn_info *ret;
++
++ if (cinfo == NULL)
++ return NULL;
++ ret = xcalloc(1, sizeof(*ret));
++ ret->conn_hash_hex = xstrdup(cinfo->conn_hash_hex);
++ ret->shorthost = xstrdup(cinfo->shorthost);
++ ret->uidstr = xstrdup(cinfo->uidstr);
++ ret->keyalias = xstrdup(cinfo->keyalias);
++ ret->thishost = xstrdup(cinfo->thishost);
++ ret->host_arg = xstrdup(cinfo->host_arg);
++ ret->portstr = xstrdup(cinfo->portstr);
++ ret->remhost = xstrdup(cinfo->remhost);
++ ret->remuser = xstrdup(cinfo->remuser);
++ ret->homedir = xstrdup(cinfo->homedir);
++ ret->locuser = xstrdup(cinfo->locuser);
++ ret->jmphost = xstrdup(cinfo->jmphost);
++ return ret;
++}
++
+ /* Expand a proxy command */
+ static char *
+ expand_proxy_command(const char *proxy_command, const char *user,
+@@ -1585,8 +1628,8 @@ warn_nonpq_kex(void)
+ */
+ void
+ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
+- struct sockaddr *hostaddr, u_short port, struct passwd *pw, int timeout_ms,
+- const struct ssh_conn_info *cinfo)
++ struct sockaddr_storage *hostaddr, u_short port, struct passwd *pw,
++ int timeout_ms, const struct ssh_conn_info *cinfo)
+ {
+ char *host;
+ char *server_user, *local_user;
+diff --git a/sshconnect.h b/sshconnect.h
+index 4c19490da..8da0e04b9 100644
+--- a/sshconnect.h
++++ b/sshconnect.h
+@@ -76,7 +76,7 @@ int ssh_connect(struct ssh *, const char *, const char *,
+ void ssh_kill_proxy_command(void);
+
+ void ssh_login(struct ssh *, Sensitive *, const char *,
+- struct sockaddr *, u_short, struct passwd *, int,
++ struct sockaddr_storage *, u_short, struct passwd *, int,
+ const struct ssh_conn_info *);
+
+ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+@@ -85,7 +85,7 @@ int verify_host_key(char *, struct sockaddr *, struct sshkey *,
+ void get_hostfile_hostname_ipaddr(char *, struct sockaddr *, u_short,
+ char **, char **);
+
+-void ssh_kex2(struct ssh *ssh, char *, struct sockaddr *, u_short,
++void ssh_kex2(struct ssh *ssh, char *, struct sockaddr_storage *, u_short,
+ const struct ssh_conn_info *);
+
+ void ssh_userauth2(struct ssh *ssh, const char *, const char *,
+@@ -101,3 +101,6 @@ void load_hostkeys_command(struct hostkeys *, const char *,
+ const struct sshkey *, const char *);
+
+ int hostkey_accepted_by_hostkeyalgs(const struct sshkey *);
++
++void ssh_conn_info_free(struct ssh_conn_info *);
++struct ssh_conn_info *ssh_conn_info_dup(const struct ssh_conn_info *);
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 478a9a52f..50ac6b89d 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -83,7 +83,7 @@ extern Options options;
+ */
+
+ static char *xxx_host;
+-static struct sockaddr *xxx_hostaddr;
++static struct sockaddr_storage xxx_hostaddr;
+ static const struct ssh_conn_info *xxx_conn_info;
+ static int key_type_allowed(struct sshkey *, const char *);
+
+@@ -99,7 +99,7 @@ verify_host_key_callback(struct sshkey *hostkey, struct ssh *ssh)
+ fatal("Server host key %s not in HostKeyAlgorithms",
+ sshkey_ssh_name(hostkey));
+ }
+- if (verify_host_key(xxx_host, xxx_hostaddr, hostkey,
++ if (verify_host_key(xxx_host, (struct sockaddr *)&xxx_hostaddr, hostkey,
+ xxx_conn_info) != 0)
+ fatal("Host key verification failed.");
+ return 0;
+@@ -216,16 +216,16 @@ order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port,
+ }
+
+ void
+-ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+- const struct ssh_conn_info *cinfo)
++ssh_kex2(struct ssh *ssh, char *host, struct sockaddr_storage *hostaddr,
++ u_short port, const struct ssh_conn_info *cinfo)
+ {
+ char *myproposal[PROPOSAL_MAX];
+ char *all_key, *hkalgs = NULL;
+ int r, use_known_hosts_order = 0;
+
+- xxx_host = host;
+- xxx_hostaddr = hostaddr;
+- xxx_conn_info = cinfo;
++ xxx_host = xstrdup(host);
++ xxx_hostaddr = *hostaddr;
++ xxx_conn_info = ssh_conn_info_dup(cinfo);
+
+ if (options.rekey_limit || options.rekey_interval)
+ ssh_packet_set_rekey_limits(ssh, options.rekey_limit,
+@@ -248,8 +248,10 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port,
+ fatal_fr(r, "kex_assemble_namelist");
+ free(all_key);
+
+- if (use_known_hosts_order)
+- hkalgs = order_hostkeyalgs(host, hostaddr, port, cinfo);
++ if (use_known_hosts_order) {
++ hkalgs = order_hostkeyalgs(host, (struct sockaddr *)hostaddr,
++ port, cinfo);
++ }
+
+ kex_proposal_populate_entries(ssh, myproposal,
+ options.kex_algorithms, options.ciphers, options.macs,
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index d8d73ee5dd0..8edb1440fe0 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -29,6 +29,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59996.patch \
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
+ file://CVE-2026-60002.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 26/27] openssh: Fix CVE-2026-60000
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (24 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 25/27] openssh: Fix CVE-2026-60002 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
2026-07-22 17:23 ` [OE-core][wrynose 27/27] gzip: Fix CVE-2026-41991 Yoann Congal
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Devansh Patel <devanshp@cisco.com>
This patch applies the upstream OpenSSH 10.4p1 backport for
CVE-2026-60000. The upstream fix commit is referenced in [1],
and the public CVE advisory is referenced in [2].
[1] https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192
[2] https://www.cve.org/CVERecord?id=CVE-2026-60000
Signed-off-by: Devansh Patel <devanshp@cisco.com>
[YC: Patch referenced in https://ubuntu.com/security/CVE-2026-60000]
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../openssh/openssh/CVE-2026-60000.patch | 140 ++++++++++++++++++
.../openssh/openssh_10.3p1.bb | 1 +
2 files changed, 141 insertions(+)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
diff --git a/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
new file mode 100644
index 00000000000..e9b62e64545
--- /dev/null
+++ b/meta/recipes-connectivity/openssh/openssh/CVE-2026-60000.patch
@@ -0,0 +1,140 @@
+From 884e94fafb20259c78bf394611b9929a7683e2b3 Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Mon, 6 Jul 2026 07:53:30 +0000
+Subject: [PATCH] upstream: Fix multiple RFC 4462 (GSSAPIAuthentication)
+ compliance
+
+problems
+
+1) Remove an early failure return for GSSAPI authentication attempts
+made for invalid accounts that yielded different behaviour for
+valid vs invalid accounts.
+
+2) Fix a situation where some GSSAPI requestes were not correctly
+subjected to MaxAuthTries.
+
+3) Fix a moderate pre-authentication resource DoS related to #2.
+
+Add missing logging for error cases.
+
+Report and fixes from Manfred Kaiser, milCERT AT
+
+OpenBSD-Commit-ID: ca0acdd64eea435d6f89534538a9eb404a5629d3
+
+CVE: CVE-2026-60000
+Upstream-Status: Backport [https://github.com/openssh/openssh-portable/commit/5d04ca6af739b82fd30d84d2783ca802ebfa1192]
+
+Backport Changes:
+- Omitted the upstream OpenBSD revision-only hunk in auth2-gss.c and
+ retained the Wrynose OpenSSH 10.3p1 revision because this stable
+ backport carries only the functional security change.
+
+(cherry picked from commit 5d04ca6af739b82fd30d84d2783ca802ebfa1192)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ auth2-gss.c | 53 ++++++++++++++++++++++++-----------------------------
+ 1 file changed, 24 insertions(+), 29 deletions(-)
+
+diff --git a/auth2-gss.c b/auth2-gss.c
+index f27ac9221..54c96fe4b 100644
+--- a/auth2-gss.c
++++ b/auth2-gss.c
+@@ -111,12 +111,6 @@ userauth_gssapi(struct ssh *ssh, const char *method)
+ return (0);
+ }
+
+- if (!authctxt->valid || authctxt->user == NULL) {
+- debug2_f("disabled because of invalid user");
+- free(doid);
+- return (0);
+- }
+-
+ if (GSS_ERROR(mm_ssh_gssapi_server_ctx(&ctxt, &goid))) {
+ if (ctxt != NULL)
+ ssh_gssapi_delete_ctx(&ctxt);
+@@ -178,8 +172,14 @@ input_gssapi_token(int type, uint32_t plen, struct ssh *ssh)
+ (r = sshpkt_send(ssh)) != 0)
+ fatal_fr(r, "send ERRTOK packet");
+ }
++ logit("Failed gssapi-with-mic for %s%.100s "
++ "from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
+ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ } else {
+ if (send_tok.length != 0) {
+@@ -191,14 +191,18 @@ input_gssapi_token(int type, uint32_t plen, struct ssh *ssh)
+ fatal_fr(r, "send TOKEN packet");
+ }
+ if (maj_status == GSS_S_COMPLETE) {
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+- if (flags & GSS_C_INTEG_FLAG)
+- ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC,
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
++ /* note: keep ERRTOK handler as per RFC 4462 s3.4 */
++ if (flags & GSS_C_INTEG_FLAG) {
++ ssh_dispatch_set(ssh,
++ SSH2_MSG_USERAUTH_GSSAPI_MIC,
+ &input_gssapi_mic);
+- else
++ } else {
+ ssh_dispatch_set(ssh,
+ SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE,
+ &input_gssapi_exchange_complete);
++ }
+ }
+ }
+
+@@ -210,10 +214,6 @@ static int
+ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh)
+ {
+ Authctxt *authctxt = ssh->authctxt;
+- Gssctxt *gssctxt;
+- gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
+- gss_buffer_desc recv_tok;
+- OM_uint32 maj_status;
+ int r;
+ u_char *p;
+ size_t len;
+@@ -221,26 +221,21 @@ input_gssapi_errtok(int type, uint32_t plen, struct ssh *ssh)
+ if (authctxt == NULL)
+ fatal("No authentication or GSSAPI context");
+
+- gssctxt = authctxt->methoddata;
+- if ((r = sshpkt_get_string(ssh, &p, &len)) != 0 ||
++ /* Minimal error handling - just cancel auth and return FAILURE */
++ if ((r = sshpkt_get_string_direct(ssh, NULL, NULL)) != 0 ||
+ (r = sshpkt_get_end(ssh)) != 0)
+ fatal_fr(r, "parse packet");
+- recv_tok.value = p;
+- recv_tok.length = len;
+-
+- /* Push the error token into GSSAPI to see what it says */
+- maj_status = mm_ssh_gssapi_accept_ctx(gssctxt, &recv_tok,
+- &send_tok, NULL);
+-
+- free(recv_tok.value);
+
+- /* We can't return anything to the client, even if we wanted to */
++ logit("Failed gssapi-with-mic for %s%.100s from %.200s port %d ssh2",
++ authctxt->valid ? "" : "invalid user ",
++ authctxt->user,
++ ssh_remote_ipaddr(ssh), ssh_remote_port(ssh));
++ authctxt->postponed = 0;
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
+ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, NULL);
+-
+- /* The client will have already moved on to the next auth */
+-
+- gss_release_buffer(&maj_status, &send_tok);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_MIC, NULL);
++ ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE, NULL);
++ userauth_finish(ssh, 0, "gssapi-with-mic", NULL);
+ return 0;
+ }
+
diff --git a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
index 8edb1440fe0..f5184b1fce3 100644
--- a/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_10.3p1.bb
@@ -30,6 +30,7 @@ SRC_URI = "https://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.ta
file://CVE-2026-59995.patch \
file://CVE-2026-60001.patch \
file://CVE-2026-60002.patch \
+ file://CVE-2026-60000.patch \
"
SRC_URI[sha256sum] = "56682a36bb92dcf4b4f016fd8ec8e74059b79a8de25c15d670d731e7d18e45f4"
^ permalink raw reply related [flat|nested] 28+ messages in thread* [OE-core][wrynose 27/27] gzip: Fix CVE-2026-41991
2026-07-22 17:23 [OE-core][wrynose 00/27] Patch review Yoann Congal
` (25 preceding siblings ...)
2026-07-22 17:23 ` [OE-core][wrynose 26/27] openssh: Fix CVE-2026-60000 Yoann Congal
@ 2026-07-22 17:23 ` Yoann Congal
26 siblings, 0 replies; 28+ messages in thread
From: Yoann Congal @ 2026-07-22 17:23 UTC (permalink / raw)
To: openembedded-core
From: Darsh Kelaiya <dkelaiya@cisco.com>
This patch applies the upstream fix for CVE-2026-41991 as referenced
in [2], using the upstream commit identified in [1].
[1] https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-41991
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
.../gzip/gzip-1.14/CVE-2026-41991.patch | 75 +++++++++++++++++++
meta/recipes-extended/gzip/gzip_1.14.bb | 1 +
2 files changed, 76 insertions(+)
create mode 100644 meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch
diff --git a/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch
new file mode 100644
index 00000000000..20c35fe352e
--- /dev/null
+++ b/meta/recipes-extended/gzip/gzip-1.14/CVE-2026-41991.patch
@@ -0,0 +1,75 @@
+From b1545c47cddc9948cb0743b2ceb140a63c88acbc Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Thu, 16 Apr 2026 12:11:44 -0700
+Subject: [PATCH] gzexe: use -C if lacking mktemp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(Problem reported by Michał Majchrowicz.)
+* gzexe.in: If mktemp is needed but not installed,
+use ‘set -C’ to avoid a race when creating a temporary file.
+* zdiff.in: Use the same pattern here, even though the old
+code was probably OK anyway.
+
+CVE: CVE-2026-41991
+Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269]
+
+(cherry picked from commit 4e6f8b24ab823146ab8776f0b7fe486ab34d4269)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ NEWS | 5 +++++
+ gzexe.in | 1 +
+ zdiff.in | 7 +++----
+ 3 files changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/NEWS b/NEWS
+index 53bdf56..2d2eb81 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,5 +1,10 @@
+ GNU gzip NEWS -*- outline -*-
+
++ On old-fashioned or limited platforms lacking mktemp, gzexe and
++ zdiff no longer have a race when creating a temporary file.
++ [bug present since the beginning]
++
++
+ * Noteworthy changes in release 1.14 (2025-04-09) [stable]
+
+ ** Bug fixes
+diff --git a/gzexe.in b/gzexe.in
+index 1267d6e..09a2571 100644
+--- a/gzexe.in
++++ b/gzexe.in
+@@ -127,6 +127,7 @@ for i do
+ tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
+ else
+ tmp=${dir}gzexe$$
++ (umask 77; set -C; > "$tmp")
+ fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
+ res=$?
+ printf >&2 '%s\n' "$0: cannot copy $file"
+diff --git a/zdiff.in b/zdiff.in
+index a8689a0..c04a8c0 100644
+--- a/zdiff.in
++++ b/zdiff.in
+@@ -156,12 +156,11 @@ case $file2 in
+ *) TMPDIR=/tmp/;;
+ esac
+ if command -v mktemp >/dev/null 2>&1; then
+- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
+- exit 2
++ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
+ else
+- set -C
+ tmp=${TMPDIR}zdiff$$
+- fi
++ (umask 77; set -C; > "$tmp")
++ fi &&
+ 'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
+ gzip_status=$(
+ exec 4>&1
+--
+2.53.0
+
diff --git a/meta/recipes-extended/gzip/gzip_1.14.bb b/meta/recipes-extended/gzip/gzip_1.14.bb
index 99174a58c53..d6bd36f89f9 100644
--- a/meta/recipes-extended/gzip/gzip_1.14.bb
+++ b/meta/recipes-extended/gzip/gzip_1.14.bb
@@ -7,6 +7,7 @@ LICENSE = "GPL-3.0-or-later"
SRC_URI = "${GNU_MIRROR}/gzip/${BP}.tar.gz \
file://run-ptest \
file://CVE-2026-41992.patch \
+ file://CVE-2026-41991.patch \
"
SRC_URI:append:class-target = " file://wrong-path-fix.patch"
^ permalink raw reply related [flat|nested] 28+ messages in thread