[meta-oe][scarthgap][PATCH 1/4] audiofile: patch CVE-2019-13147 and CVE-2022-24599

[meta-oe][scarthgap][PATCH 1/4] audiofile: patch CVE-2019-13147 and CVE-2022-24599

[Gyorgy Sarvari]

Details: https://nvd.nist.gov/vuln/detail/CVE-2019-13147
https://nvd.nist.gov/vuln/detail/CVE-2022-24599

These patches are used by opensuse to mitigate the corresponding vulnerabulities.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8ef997336aec6f51318f1a7fa55d57e3990914e8)
---
 .../audiofile/audiofile_0.3.6.bb              |  2 +
 .../audiofile/files/CVE-2019-13147.patch      | 31 ++++++++++++
 .../audiofile/files/CVE-2022-24599.patch      | 50 +++++++++++++++++++
 3 files changed, 83 insertions(+)
 create mode 100644 meta-oe/recipes-multimedia/audiofile/files/CVE-2019-13147.patch
 create mode 100644 meta-oe/recipes-multimedia/audiofile/files/CVE-2022-24599.patch

diff --git a/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb b/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
index d10c7a8b49..d44ce5c004 100644
--- a/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
+++ b/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
@@ -18,6 +18,8 @@ SRC_URI = " \
     file://0006-Check-for-multiplication-overflow-in-sfconvert.patch \
     file://0007-Actually-fail-when-error-occurs-in-parseFormat.patch \
     file://0008-Check-for-multiplication-overflow-in-MSADPCM-decodeS.patch \
+    file://CVE-2019-13147.patch \
+    file://CVE-2022-24599.patch \
 "
 SRC_URI[md5sum] = "235dde14742317328f0109e9866a8008"
 SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782"
diff --git a/meta-oe/recipes-multimedia/audiofile/files/CVE-2019-13147.patch b/meta-oe/recipes-multimedia/audiofile/files/CVE-2019-13147.patch
new file mode 100644
index 0000000000..19f6892f69
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/CVE-2019-13147.patch
@@ -0,0 +1,31 @@
+This patch is taken from opensuse: 
+https://build.opensuse.org/package/show/multimedia:libs/audiofile
+
+CVE: CVE-2019-13147
+Upstream-Status: Inactive-Upstream [lastcommit: 2016-Aug-30]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+
+diff --unified --recursive --text --new-file --color audiofile-0.3.6/libaudiofile/NeXT.cpp audiofile-0.3.6.new/libaudiofile/NeXT.cpp
+--- audiofile-0.3.6/libaudiofile/NeXT.cpp	2013-03-06 13:30:03.000000000 +0800
++++ audiofile-0.3.6.new/libaudiofile/NeXT.cpp	2025-05-14 10:45:11.685700984 +0800
+@@ -32,6 +32,7 @@
+ #include <stdint.h>
+ #include <stdlib.h>
+ #include <string.h>
++#include <limits.h>
+ 
+ #include "File.h"
+ #include "Setup.h"
+@@ -122,6 +123,12 @@
+ 		_af_error(AF_BAD_CHANNELS, "invalid file with 0 channels");
+ 		return AF_FAIL;
+ 	}
++	/* avoid overflow of INT for double size rate */
++	if (channelCount > (INT32_MAX / (sizeof(double))))
++	{
++		_af_error(AF_BAD_CHANNELS, "invalid file with %i channels", channelCount);
++		return AF_FAIL;
++	}
+ 
+ 	Track *track = allocateTrack();
+ 	if (!track)
diff --git a/meta-oe/recipes-multimedia/audiofile/files/CVE-2022-24599.patch b/meta-oe/recipes-multimedia/audiofile/files/CVE-2022-24599.patch
new file mode 100644
index 0000000000..9214d80172
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/CVE-2022-24599.patch
@@ -0,0 +1,50 @@
+This patch is taken from opensuse:
+https://build.opensuse.org/package/show/multimedia:libs/audiofile
+
+CVE: CVE-2022-24599
+Upstream-Status: Inactive-Upstream [lastcommit: 2016-Aug-30]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+
+diff --unified --recursive --text --new-file --color audiofile-0.3.6.old/sfcommands/printinfo.c audiofile-0.3.6.new/sfcommands/printinfo.c
+--- audiofile-0.3.6.old/sfcommands/printinfo.c	2013-03-06 13:30:03.000000000 +0800
++++ audiofile-0.3.6.new/sfcommands/printinfo.c	2025-04-30 15:18:24.778177640 +0800
+@@ -37,6 +37,7 @@
+ #include <stdint.h>
+ #include <stdio.h>
+ #include <stdlib.h>
++#include <limits.h>
+ 
+ static char *copyrightstring (AFfilehandle file);
+ 
+@@ -147,7 +148,11 @@
+ 	int		i, misccount;
+ 
+ 	misccount = afGetMiscIDs(file, NULL);
+-	miscids = (int *) malloc(sizeof (int) * misccount);
++	if (!misccount)
++	    return NULL;
++	miscids = (int *)calloc(misccount, sizeof(int));
++	if (!miscids)
++	    return NULL;
+ 	afGetMiscIDs(file, miscids);
+ 
+ 	for (i=0; i<misccount; i++)
+@@ -159,13 +164,16 @@
+ 			If this code executes, the miscellaneous chunk is a
+ 			copyright chunk.
+ 		*/
+-		int datasize = afGetMiscSize(file, miscids[i]);
+-		char *data = (char *) malloc(datasize);
++		size_t datasize = afGetMiscSize(file, miscids[i]);
++		if (datasize >= INT_MAX - 1)
++		    goto error;
++		char *data = (char *)calloc(datasize + 1, sizeof(char));
+ 		afReadMisc(file, miscids[i], data, datasize);
+ 		copyright = data;
+ 		break;
+ 	}
+ 
++error:
+ 	free(miscids);
+ 
+ 	return copyright;

[meta-oe][scarthgap][PATCH 2/4] audiofile: patch CVE-2018-13440 and CVE-2018-17059

[Gyorgy Sarvari]

Details:
https://nvd.nist.gov/vuln/detail/CVE-2018-13440
https://nvd.nist.gov/vuln/detail/CVE-2018-17059

The patches have been backported from Debian - upstream
has been inactive for almost a decade by now.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e16a7d11d1dc0c577cb17652085b0c183c791883)
---
 .../audiofile/audiofile_0.3.6.bb              |  2 ++
 .../audiofile/files/CVE-2018-13440.patch      | 36 +++++++++++++++++++
 .../audiofile/files/CVE-2018-17059.patch      | 35 ++++++++++++++++++
 3 files changed, 73 insertions(+)
 create mode 100644 meta-oe/recipes-multimedia/audiofile/files/CVE-2018-13440.patch
 create mode 100644 meta-oe/recipes-multimedia/audiofile/files/CVE-2018-17059.patch

diff --git a/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb b/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
index d44ce5c004..f992104e4f 100644
--- a/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
+++ b/meta-oe/recipes-multimedia/audiofile/audiofile_0.3.6.bb
@@ -20,6 +20,8 @@ SRC_URI = " \
     file://0008-Check-for-multiplication-overflow-in-MSADPCM-decodeS.patch \
     file://CVE-2019-13147.patch \
     file://CVE-2022-24599.patch \
+    file://CVE-2018-13440.patch \
+    file://CVE-2018-17059.patch \
 "
 SRC_URI[md5sum] = "235dde14742317328f0109e9866a8008"
 SRC_URI[sha256sum] = "ea2449ad3f201ec590d811db9da6d02ffc5e87a677d06b92ab15363d8cb59782"
diff --git a/meta-oe/recipes-multimedia/audiofile/files/CVE-2018-13440.patch b/meta-oe/recipes-multimedia/audiofile/files/CVE-2018-13440.patch
new file mode 100644
index 0000000000..f468696845
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/CVE-2018-13440.patch
@@ -0,0 +1,36 @@
+From fde6d79fb8363c4a329a184ef0b107156602b225 Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Thu, 27 Sep 2018 10:48:45 +0200
+Subject: [PATCH] ModuleState: handle compress/decompress init failure
+
+When the unit initcompress or initdecompress function fails,
+m_fileModule is NULL. Return AF_FAIL in that case instead of
+causing NULL pointer dereferences later.
+
+Fixes #49
+
+This patch has been backported from Debian:
+https://sources.debian.org/src/audiofile/0.3.6-7/debian/patches/11_CVE-2018-13440.patch
+
+CVE: CVE-2018-13440
+Upstream-Status: Inactive-Upstream [lastcommit: 2016-Aug-30]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+
+---
+ libaudiofile/modules/ModuleState.cpp | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/libaudiofile/modules/ModuleState.cpp b/libaudiofile/modules/ModuleState.cpp
+index 0c29d7a..070fd9b 100644
+--- a/libaudiofile/modules/ModuleState.cpp
++++ b/libaudiofile/modules/ModuleState.cpp
+@@ -75,6 +75,9 @@ status ModuleState::initFileModule(AFfilehandle file, Track *track)
+ 		m_fileModule = unit->initcompress(track, file->m_fh, file->m_seekok,
+ 			file->m_fileFormat == AF_FILE_RAWDATA, &chunkFrames);
+ 
++	if (!m_fileModule)
++		return AF_FAIL;
++
+ 	if (unit->needsRebuffer)
+ 	{
+ 		assert(unit->nativeSampleFormat == AF_SAMPFMT_TWOSCOMP);
diff --git a/meta-oe/recipes-multimedia/audiofile/files/CVE-2018-17059.patch b/meta-oe/recipes-multimedia/audiofile/files/CVE-2018-17059.patch
new file mode 100644
index 0000000000..e9b560102a
--- /dev/null
+++ b/meta-oe/recipes-multimedia/audiofile/files/CVE-2018-17059.patch
@@ -0,0 +1,35 @@
+From 822b732fd31ffcb78f6920001e9b1fbd815fa712 Mon Sep 17 00:00:00 2001
+From: Wim Taymans <wtaymans@redhat.com>
+Date: Thu, 27 Sep 2018 12:11:12 +0200
+Subject: [PATCH] SimpleModule: set output chunk framecount after pull
+
+After pulling the data, set the output chunk to the amount of
+frames we pulled so that the next module in the chain has the correct
+frame count.
+
+Fixes #50 and #51
+
+This patch has been backported from Debian:
+https://sources.debian.org/src/audiofile/0.3.6-7/debian/patches/12_CVE-2018-17095.patch
+
+CVE: CVE-2018-17095
+
+Upstream-Status: Inactive-Upstream [lastcommit: 2016-Aug-30]
+Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
+
+---
+ libaudiofile/modules/SimpleModule.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/libaudiofile/modules/SimpleModule.cpp b/libaudiofile/modules/SimpleModule.cpp
+index 2bae1eb..e87932c 100644
+--- a/libaudiofile/modules/SimpleModule.cpp
++++ b/libaudiofile/modules/SimpleModule.cpp
+@@ -26,6 +26,7 @@
+ void SimpleModule::runPull()
+ {
+ 	pull(m_outChunk->frameCount);
++	m_outChunk->frameCount = m_inChunk->frameCount;
+ 	run(*m_inChunk, *m_outChunk);
+ }
+ 

[meta-oe][scarthgap][PATCH 3/4] audiofile: mark CVE-2020-18781 as patched

[Gyorgy Sarvari]

From: Peter Marko <peter.marko@siemens.com>

Per [1] this CVE is already patched by commit [2].

This can be also verified with yocto build.

Running without this patch:
root@qemux86-64:~# sfconvert poc.wav output format wave
malloc(): corrupted top size
Aborted

Running with it:
root@qemux86-64:~# sfconvert poc.wav output format wave
Audio File Library: Bad number of coefficients [error 62]
Could not open file 'poc.wav' for reading.

[1] https://github.com/mpruett/audiofile/issues/56
[2] https://github.com/antlarr/audiofile/commit/c48e4c6503f7dabd41f11d4c9c7b7f8960e7f2c0

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 68f55c158e15a5d35702ae5c730586001e487f86)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 .../files/0004-Always-check-the-number-of-coefficients.patch     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch b/meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch
index 282f4c01b9..17a97163f5 100644
--- a/meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch
+++ b/meta-oe/recipes-multimedia/audiofile/files/0004-Always-check-the-number-of-coefficients.patch
@@ -17,6 +17,7 @@ CVE: CVE-2017-6832
 CVE: CVE-2017-6833
 CVE: CVE-2017-6835
 CVE: CVE-2017-6837
+CVE: CVE-2020-18781
 Upstream-Status: Inactive-Upstream [lastrelease: 2013]
 Signed-off-by: Peter Marko <peter.marko@siemens.com>
 ---

[meta-oe][scarthgap][PATCH 4/4] rsyslog: set status for CVE-2015-3243

[Gyorgy Sarvari]

Details: https://nvd.nist.gov/vuln/detail/CVE-2015-3243

The issue is about file permissions: by default rsyslog creates world-readable
files. In case a log message contains some sensitive information, then that's
exposed to every user on the system.

However the rsyslog.conf file that is shipped with the recipe solves it: it
already sets non-world-readable default permissions on all files, so this
vulnerability is fixed in the default OE recipe.

See also this package in OpenSuse[1], where it is solved the same way.

[1]: https://build.opensuse.org/requests/619439/changes (rsyslog.conf.in)

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
 meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf | 3 ++-
 meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb  | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf b/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
index dbfefb7597..6316efb629 100644
--- a/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
+++ b/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
@@ -13,7 +13,8 @@ $ModLoad imklog   # kernel logging (formerly provided by rklogd)
 
 #
 # Set the default permissions
-#
+# Setting the $FileCreateMode not world readable fixes CVE-2015-3243
+# 
 $FileOwner root
 $FileGroup adm
 $FileCreateMode 0640
diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
index af46cc14d7..59944cd70c 100644
--- a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
+++ b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
@@ -37,6 +37,8 @@ SRC_URI[sha256sum] = "acbdd8579489df36b4a383dc6909a61b7623807f0aff54c062115f2de7
 UPSTREAM_CHECK_URI = "https://github.com/rsyslog/rsyslog/releases"
 UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)"
 
+CVE_STATUS[CVE-2015-3243] = "fix-file-included: The shipped default rsyslog.conf contains the fix"
+
 inherit autotools pkgconfig systemd update-rc.d ptest
 
 EXTRA_OECONF += "--disable-generate-man-pages ap_cv_atomic_builtins=yes"

Re: [oe] [meta-oe][scarthgap][PATCH 4/4] rsyslog: set status for CVE-2015-3243

[Anuj Mittal]

[-- Attachment #1: Type: text/plain, Size: 2327 bytes --]

On Sat, Nov 15, 2025 at 9:00 PM Gyorgy Sarvari via lists.openembedded.org
<skandigraun=gmail.com@lists.openembedded.org> wrote:

> Details: https://nvd.nist.gov/vuln/detail/CVE-2015-3243
>
> The issue is about file permissions: by default rsyslog creates
> world-readable
> files. In case a log message contains some sensitive information, then
> that's
> exposed to every user on the system.
>
> However the rsyslog.conf file that is shipped with the recipe solves it: it
> already sets non-world-readable default permissions on all files, so this
> vulnerability is fixed in the default OE recipe.
>
> See also this package in OpenSuse[1], where it is solved the same way.
>
> [1]: https://build.opensuse.org/requests/619439/changes (rsyslog.conf.in)
>
> Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
> ---
>  meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf | 3 ++-
>  meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb  | 2 ++
>  2 files changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
> b/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
> index dbfefb7597..6316efb629 100644
> --- a/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
> +++ b/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
> @@ -13,7 +13,8 @@ $ModLoad imklog   # kernel logging (formerly provided by
> rklogd)
>
>  #
>  # Set the default permissions
> -#
> +# Setting the $FileCreateMode not world readable fixes CVE-2015-3243
> +#
>  $FileOwner root
>  $FileGroup adm
>  $FileCreateMode 0640
> diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
> b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
> index af46cc14d7..59944cd70c 100644
> --- a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
> +++ b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
> @@ -37,6 +37,8 @@ SRC_URI[sha256sum] =
> "acbdd8579489df36b4a383dc6909a61b7623807f0aff54c062115f2de7
>  UPSTREAM_CHECK_URI = "https://github.com/rsyslog/rsyslog/releases"
>  UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)"
>
> +CVE_STATUS[CVE-2015-3243] = "fix-file-included: The shipped default
> rsyslog.conf contains the fix"
> +
>
>
 fix-file-included isn't available in scarthgap so we will have to use
something else.

[-- Attachment #2: Type: text/html, Size: 3713 bytes --]

Re: [oe] [meta-oe][scarthgap][PATCH 4/4] rsyslog: set status for CVE-2015-3243

[Gyorgy Sarvari]

On 11/17/25 06:50, Anuj Mittal wrote:
>
>
>
> On Sat, Nov 15, 2025 at 9:00 PM Gyorgy Sarvari via
> lists.openembedded.org <http://lists.openembedded.org>
> <skandigraun=gmail.com@lists.openembedded.org> wrote:
>
>     Details: https://nvd.nist.gov/vuln/detail/CVE-2015-3243
>
>     The issue is about file permissions: by default rsyslog creates
>     world-readable
>     files. In case a log message contains some sensitive information,
>     then that's
>     exposed to every user on the system.
>
>     However the rsyslog.conf file that is shipped with the recipe
>     solves it: it
>     already sets non-world-readable default permissions on all files,
>     so this
>     vulnerability is fixed in the default OE recipe.
>
>     See also this package in OpenSuse[1], where it is solved the same way.
>
>     [1]: https://build.opensuse.org/requests/619439/changes
>     (rsyslog.conf.in <http://rsyslog.conf.in>)
>
>     Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
>     ---
>      meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf | 3 ++-
>      meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
>     <http://rsyslog_8.2402.0.bb>  | 2 ++
>      2 files changed, 4 insertions(+), 1 deletion(-)
>
>     diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
>     b/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
>     index dbfefb7597..6316efb629 100644
>     --- a/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
>     +++ b/meta-oe/recipes-extended/rsyslog/rsyslog/rsyslog.conf
>     @@ -13,7 +13,8 @@ $ModLoad imklog   # kernel logging (formerly
>     provided by rklogd)
>
>      #
>      # Set the default permissions
>     -#
>     +# Setting the $FileCreateMode not world readable fixes CVE-2015-3243
>     +#
>      $FileOwner root
>      $FileGroup adm
>      $FileCreateMode 0640
>     diff --git a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
>     <http://rsyslog_8.2402.0.bb>
>     b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
>     <http://rsyslog_8.2402.0.bb>
>     index af46cc14d7..59944cd70c 100644
>     --- a/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
>     <http://rsyslog_8.2402.0.bb>
>     +++ b/meta-oe/recipes-extended/rsyslog/rsyslog_8.2402.0.bb
>     <http://rsyslog_8.2402.0.bb>
>     @@ -37,6 +37,8 @@ SRC_URI[sha256sum] =
>     "acbdd8579489df36b4a383dc6909a61b7623807f0aff54c062115f2de7
>      UPSTREAM_CHECK_URI = "https://github.com/rsyslog/rsyslog/releases"
>      UPSTREAM_CHECK_REGEX = "(?P<pver>\d+(\.\d+)+)"
>
>     +CVE_STATUS[CVE-2015-3243] = "fix-file-included: The shipped
>     default rsyslog.conf contains the fix"
>     +
>
>
>  fix-file-included isn't available in scarthgap so we will have to use
> something else.

Right, it seems there isn't any that would really fit... will pick a
"Patched" status in a few moments.