* [PATCH 01/82] readme: update maintainer
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 02/82] Revert "libpwquality: remove recipe (moved to oe-core)" ankur.tyagi85
` (81 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
README.md | 2 +-
meta-filesystems/README.md | 10 +++++-----
meta-gnome/README.md | 10 +++++-----
meta-initramfs/README.md | 8 ++++----
meta-multimedia/README.md | 10 +++++-----
meta-networking/README.md | 8 ++++----
meta-oe/README.md | 8 ++++----
meta-perl/README.md | 10 ++++------
meta-python/README.md | 12 +++++-------
meta-webserver/README.md | 10 +++++-----
meta-xfce/README.md | 11 +++++------
11 files changed, 47 insertions(+), 52 deletions(-)
diff --git a/README.md b/README.md
index 9fc30bda95..f445aed152 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
Collection of layers for the OE-core universe
-Main layer maintainer: Khem Raj <raj.khem@gmail.com>
+Main layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
This repository is a collection of layers to supplement OE-Core
with additional packages, Each layer have designated maintainer
diff --git a/meta-filesystems/README.md b/meta-filesystems/README.md
index 78a4429ce2..28c2f14733 100644
--- a/meta-filesystems/README.md
+++ b/meta-filesystems/README.md
@@ -11,26 +11,26 @@
URI: git://git.openembedded.org/openembedded-core
layers: meta
- branch: master
+ branch: blacksail
URI: git://git.openembedded.org/meta-openembedded
layers: meta-oe
- branch: master
+ branch: blacksail
Patches
=======
Please submit any patches against the filesystems layer to the
OpenEmbedded development mailing list (openembedded-devel@lists.openembedded.org)
-with '[meta-filesystems]' in the subject.
+with '[meta-filesystems][blacksail]' in the subject.
-Layer maintainer: Khem Raj <raj.khem@gmail.com>
+Layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
When sending single patches, please use something like:
git send-email -1 -M \
--to openembedded-devel@lists.openembedded.org \
- --subject-prefix='meta-filesystems][PATCH'
+ --subject-prefix='meta-filesystems][blacksail][PATCH'
Table of Contents
diff --git a/meta-gnome/README.md b/meta-gnome/README.md
index 6c23b4e671..7d66dfce27 100644
--- a/meta-gnome/README.md
+++ b/meta-gnome/README.md
@@ -3,14 +3,14 @@
This layer depends on:
URI: git://git.openembedded.org/openembedded-core
-branch: master
+branch: blacksail
URI: git://git.openembedded.org/meta-openembedded
-branch: master
+branch: blacksail
-Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-gnome]' in the subject'
+Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-gnome][blacksail]' in the subject'
When sending single patches, please use something like:
-git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-gnome][PATCH'
+git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-gnome][blacksail][PATCH'
-Layer maintainer: Khem Raj <raj.khem@gmail.com>
+Layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
diff --git a/meta-initramfs/README.md b/meta-initramfs/README.md
index e074142be7..cca1b5f174 100644
--- a/meta-initramfs/README.md
+++ b/meta-initramfs/README.md
@@ -12,19 +12,19 @@
This layer depends on:
URI: git://git.openembedded.org/meta-openembedded
-branch: master
+branch: blacksail
Maintenance
-----------
Send patches / pull requests to openembedded-devel@lists.openembedded.org
-with '[meta-initramfs]' in the subject.
+with '[meta-initramfs][blacksail]' in the subject.
When sending single patches, please use something like:
-git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-initramfs][PATCH'
+git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-initramfs][blacksail][PATCH'
-Interim layer maintainer: Khem Raj <raj.khem@gmail.com>
+Interim layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
License
diff --git a/meta-multimedia/README.md b/meta-multimedia/README.md
index bda470a6f6..5f847c259c 100644
--- a/meta-multimedia/README.md
+++ b/meta-multimedia/README.md
@@ -1,17 +1,17 @@
This layer depends on:
URI: git://git.openembedded.org/openembedded-core
-branch: master
+branch: blacksail
URI: git://git.openembedded.org/meta-openembedded
layers: meta-oe
-branch: master
+branch: blacksail
-Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-multimedia]' in the subject
+Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-multimedia][blacksail]' in the subject
When sending single patches, please use something like:
-git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-multimedia][PATCH'
+git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-multimedia][blacksail][PATCH'
You are encouraged to fork the mirror on github https://github.com/openembedded/meta-openembedded to share your patches, this is preferred for patch sets consisting of more than one patch. Other services like GitLab, repo.or.cz or self hosted setups are of course accepted as well, 'git fetch <remote>' works the same on all of them. We recommend github because it is free, easy to use, has been proven to be reliable and has a really good web GUI.
-Layer maintainer: Khem Raj <raj.khem@gmail.com>
+Layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
diff --git a/meta-networking/README.md b/meta-networking/README.md
index f8337b0c5b..094a85b9d9 100644
--- a/meta-networking/README.md
+++ b/meta-networking/README.md
@@ -18,21 +18,21 @@
This layer depends on:
URI: git://git.openembedded.org/openembedded-core
-branch: master
+branch: blacksail
For some recipes, the meta-oe layer is required:
URI: git://git.openembedded.org/meta-openembedded
subdirectory: meta-oe
-branch: master
+branch: blacksail
URI: git://git.openembedded.org/meta-openembedded
subdirectory: meta-python
-branch: master
+branch: blacksail
Maintenance
-----------
-Layer maintainers: Khem Raj <raj.khem@gmail.com>
+Layer maintainers: Ankur Tyagi <ankur.tyagi85@gmail.com>
Please see the MAINTAINERS file for information on contacting the
diff --git a/meta-oe/README.md b/meta-oe/README.md
index da6c4cbe79..345b3ca903 100644
--- a/meta-oe/README.md
+++ b/meta-oe/README.md
@@ -4,7 +4,7 @@
This layer depends on:
URI: git://github.com/openembedded/openembedded-core.git
-branch: master
+branch: blacksail
luajit recipe requires host compiler to be able to generate 32bit code when target is 32bit
e.g. arm, so ensure that $CC -m32 is functional on build host, if building this recipe, needed
@@ -16,10 +16,10 @@
Ubuntu
sudo apt-get install gcc-multilib linux-libc-dev:i386
-Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-oe]' in the subject'
+Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-oe][blacksail]' in the subject'
When sending single patches, please use something like:
-'git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-oe][PATCH"'
+'git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-oe][blacksail][PATCH"'
You are encouraged to fork the mirror on GitHub https://github.com/openembedded/meta-openembedded
to share your patches, this is preferred for patch sets consisting of more than one patch.
@@ -33,4 +33,4 @@
'git fetch <remote>' works the same on all of them. We recommend GitHub because it is free, easy
to use, has been proven to be reliable and has a really good web GUI.
-Layer maintainer: Khem Raj <raj.khem@gmail.com>
+Layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
diff --git a/meta-perl/README.md b/meta-perl/README.md
index 9d56dbe8c6..9fb1d7d864 100644
--- a/meta-perl/README.md
+++ b/meta-perl/README.md
@@ -52,7 +52,7 @@
This layer depends on:
URI: git://git.openembedded.org/openembedded-core
- branch: master
+ branch: blacksail
Adding the meta-perl layer to your build
---------------------------------------
@@ -73,14 +73,12 @@
-----------
Send patches / pull requests to openembedded-devel@lists.openembedded.org with
-'[meta-perl]' in the subject.
+'[meta-perl][blacksail]' in the subject.
When sending single patches, please use something like:
-git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-perl][PATCH'
+git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-perl][blacksail][PATCH'
-Layer maintainers:
- Hongxu Jia <hongxu.jia@windriver.com>
- Tim "moto-timo" Orling <ticotimo@gmail.com>
+Layer maintainers: Ankur Tyagi <ankur.tyagi85@gmail.com>
License
-------
diff --git a/meta-python/README.md b/meta-python/README.md
index 36c193957c..36255167b6 100644
--- a/meta-python/README.md
+++ b/meta-python/README.md
@@ -13,11 +13,11 @@
URI: git://git.openembedded.org/openembedded-core
layers: meta
- branch: master
+ branch: blacksail
URI: git://git.openembedded.org/meta-openembedded
layers: meta-oe
- branch: master
+ branch: blacksail
Contributing
-------------------------
@@ -28,14 +28,12 @@
before posting.
Send pull requests to openembedded-devel@lists.openembedded.org with
-'[meta-python]' in the subject.
+'[meta-python][blacksail]' in the subject.
When sending single patches, please use something like:
-git send-email -M -1 --to=openembedded-devel@lists.openembedded.org --subject-prefix='meta-python][PATCH'
+git send-email -M -1 --to=openembedded-devel@lists.openembedded.org --subject-prefix='meta-python][blacksail][PATCH'
Maintenance
-------------------------
-Layer maintainers:
- Tim "moto-timo" Orling <TicoTimo@gmail.com>
- Derek Straka <derek@asterius.io>
+Layer maintainers: Ankur Tyagi <ankur.tyagi85@gmail.com>
diff --git a/meta-webserver/README.md b/meta-webserver/README.md
index 565269648d..1562365e47 100644
--- a/meta-webserver/README.md
+++ b/meta-webserver/README.md
@@ -13,13 +13,13 @@
URI: git://git.openembedded.org/openembedded-core
subdirectory: meta
-branch: master
+branch: blacksail
For some recipes, the meta-oe layer is required:
URI: git://git.openembedded.org/meta-openembedded
subdirectory: meta-oe
-branch: master
+branch: blacksail
@@ -50,14 +50,14 @@
-----------
Send patches / pull requests to openembedded-devel@lists.openembedded.org
-with '[meta-webserver]' in the subject.
+with '[meta-webserver][blacksail]' in the subject.
When sending single patches, please use something like:
```
-git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-webserver][PATCH"
+git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix="meta-webserver][blacksail][PATCH"
```
-Layer maintainer: Derek Straka <derek@asterius.io>
+Layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
License
diff --git a/meta-xfce/README.md b/meta-xfce/README.md
index 564590ff39..d032d1b076 100644
--- a/meta-xfce/README.md
+++ b/meta-xfce/README.md
@@ -1,10 +1,10 @@
This layer depends on:
URI: git://git.openembedded.org/openembedded-core
-branch: master
+branch: blacksail
URI: git://git.openembedded.org/meta-openembedded
-branch: master
+branch: blacksail
meta-xfce depends on meta-oe, meta-gnome and meta-multimedia in this repository.
@@ -13,10 +13,9 @@
BBMASK = "meta-xfce/recipes-multimedia"
-Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-xfce]' in the subject'
+Send pull requests to openembedded-devel@lists.openembedded.org with '[meta-xfce][blacksail]' in the subject'
When sending single patches, please use something like:
-git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-xfce][PATCH'
+git send-email -M -1 --to openembedded-devel@lists.openembedded.org --subject-prefix='meta-xfce][blacksail][PATCH'
-Layer maintainer: Kai Kang <kai.kang@windriver.com>
-Layer maintainer: Khem Raj <raj.khem@gmail.com>
+Layer maintainer: Ankur Tyagi <ankur.tyagi85@gmail.com>
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 02/82] Revert "libpwquality: remove recipe (moved to oe-core)"
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
2026-10-15 5:40 ` [PATCH 01/82] readme: update maintainer ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 03/82] pcsc-lite: create pcscd user and group also via useradd ankur.tyagi85
` (80 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Markus Volk <f_l_k@t-online.de>
This reverts commit 50d5f23e07431865470d16aeaeb8e442f690186b.
The import into oe-core (3d295bef38 "libpwquality: import recipe from
meta-oe") is only in oe-core master, not in blacksail, so on blacksail
the recipe is missing and gnome-disk-utility, gnome-control-center,
cryptsetup and others fail with "Nothing PROVIDES 'libpwquality'".
AI-Generated: Uses Claude Code (Claude Opus 4.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../packagegroups/packagegroup-meta-oe.bb | 1 +
...-Use-setuptools-instead-of-distutils.patch | 78 +++++++++++++++++++
...02-Makefile.am-respect-PYTHONSITEDIR.patch | 26 +++++++
.../libpwquality/libpwquality_1.4.5.bb | 39 ++++++++++
4 files changed, 144 insertions(+)
create mode 100644 meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch
create mode 100644 meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch
create mode 100644 meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb
diff --git a/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb b/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb
index cc3f7cf064..225cd95604 100644
--- a/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb
+++ b/meta-oe/recipes-core/packagegroups/packagegroup-meta-oe.bb
@@ -368,6 +368,7 @@ RDEPENDS:packagegroup-meta-oe-extended = "\
liblognorm \
libmodbus \
libplist \
+ libpwquality \
libqb \
librelp \
${@bb.utils.contains("DISTRO_FEATURES", "systemd", "libreport", "", d)} \
diff --git a/meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch b/meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch
new file mode 100644
index 0000000000..7eaca66b5c
--- /dev/null
+++ b/meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch
@@ -0,0 +1,78 @@
+From ad95b7684365dea8335c34527d4c1463c1668af0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Fri, 31 Mar 2023 14:52:19 +0200
+Subject: [PATCH] Use setuptools instead of distutils
+
+distutils is removed from Python 3.12+:
+https://peps.python.org/pep-0632/
+
+Upstream-Status: Backport [https://github.com/libpwquality/libpwquality/commit/7b5e0f0097faebdcc6a8b783237bbba7a983147a]
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ libpwquality.spec.in | 11 ++---------
+ python/Makefile.am | 2 +-
+ python/setup.py.in | 6 +++---
+ 3 files changed, 6 insertions(+), 13 deletions(-)
+
+diff --git a/libpwquality.spec.in b/libpwquality.spec.in
+index 70a6f53..0809126 100644
+--- a/libpwquality.spec.in
++++ b/libpwquality.spec.in
+@@ -33,9 +33,11 @@ BuildRequires: gettext
+ BuildRequires: pam-devel
+ %if %{with python2}
+ BuildRequires: python2-devel
++BuildRequires: python2-setuptools
+ %endif
+ %if %{with python3}
+ BuildRequires: python3-devel
++BuildRequires: python3-setuptools
+ %endif
+
+ URL: https://github.com/libpwquality/libpwquality/
+@@ -103,15 +105,6 @@ cp -a . %{py3dir}
+ pushd %{py3dir}
+ %endif
+ %if %{with python3}
+-# setuptools >= 60 changes the environment to use its bundled copy of distutils
+-# by default, not the Python-bundled one. To run the Python's standard library
+-# distutils, the environment variable must be set.
+-# Although technically setuptools is not needed for this package, if it's
+-# pulled by another package, it changes the environment and consequently,
+-# the build fails. This was reported in:
+-# https://github.com/pypa/setuptools/issues/3143
+-export SETUPTOOLS_USE_DISTUTILS=stdlib
+-
+ %configure \
+ --with-securedir=%{_moduledir} \
+ --with-pythonsitedir=%{python3_sitearch} \
+diff --git a/python/Makefile.am b/python/Makefile.am
+index 1d00c0c..6e51744 100644
+--- a/python/Makefile.am
++++ b/python/Makefile.am
+@@ -14,7 +14,7 @@ all-local:
+ CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV)
+
+ install-exec-local:
+- CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --prefix=${DESTDIR}${prefix}
++ CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${DESTDIR} --prefix=${prefix}
+
+ clean-local:
+ rm -rf py$(PYTHONREV)
+diff --git a/python/setup.py.in b/python/setup.py.in
+index a741b91..f934c50 100755
+--- a/python/setup.py.in
++++ b/python/setup.py.in
+@@ -6,9 +6,9 @@
+
+ import os
+
+-from distutils.core import setup, Extension
+-from distutils.command.build_ext import build_ext as _build_ext
+-from distutils.command.sdist import sdist as _sdist
++from setuptools import setup, Extension
++from setuptools.command.build_ext import build_ext as _build_ext
++from setuptools.command.sdist import sdist as _sdist
+
+ def genconstants(headerfile, outputfile):
+ hf = open(headerfile, 'r')
diff --git a/meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch b/meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch
new file mode 100644
index 0000000000..cd59a6d887
--- /dev/null
+++ b/meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch
@@ -0,0 +1,26 @@
+From edc51ba1b446913232cdf2945f485392bca72dc7 Mon Sep 17 00:00:00 2001
+From: Hongxu Jia <hongxu.jia@windriver.com>
+Date: Mon, 3 Aug 2015 13:43:14 +0800
+Subject: [PATCH] Makefile.am: respect ${PYTHONSITEDIR}
+
+Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
+Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
+---
+Upstream-Status: Backport [https://github.com/libpwquality/libpwquality/commit/5192eab011ada47b0157f8d0524bf5b18bba3bd0]
+
+ python/Makefile.am | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/python/Makefile.am b/python/Makefile.am
+index 6e51744..0a3bad5 100644
+--- a/python/Makefile.am
++++ b/python/Makefile.am
+@@ -14,7 +14,7 @@ all-local:
+ CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV)
+
+ install-exec-local:
+- CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${DESTDIR} --prefix=${prefix}
++ CFLAGS="${CFLAGS} -fno-strict-aliasing" @PYTHONBINARY@ setup.py build --build-base py$(PYTHONREV) install --root ${DESTDIR} --prefix=${prefix} --install-lib=$(pythonsitedir)
+
+ clean-local:
+ rm -rf py$(PYTHONREV)
diff --git a/meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb b/meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb
new file mode 100644
index 0000000000..b7c673be52
--- /dev/null
+++ b/meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb
@@ -0,0 +1,39 @@
+DESCRIPTION = "Library for password quality checking and generating random passwords"
+HOMEPAGE = "https://github.com/libpwquality/libpwquality"
+SECTION = "devel/lib"
+
+LICENSE = "GPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=6bd2f1386df813a459a0c34fde676fc2"
+
+DEPENDS = "cracklib"
+
+SRC_URI = "git://github.com/libpwquality/libpwquality;branch=master;protocol=https \
+ file://0001-Use-setuptools-instead-of-distutils.patch \
+ file://0002-Makefile.am-respect-PYTHONSITEDIR.patch \
+"
+SRCREV = "5490e96a3dd6ed7371435ca5b3ccef98bdb48b5a"
+
+
+inherit autotools-brokensep gettext
+inherit_defer ${@bb.utils.contains('PACKAGECONFIG', 'python3', 'setuptools3-base', '', d)}
+
+do_configure:prepend() {
+ cp ${STAGING_DATADIR_NATIVE}/gettext/ABOUT-NLS ${AUTOTOOLS_AUXDIR}/
+}
+
+export PYTHON_DIR
+export BUILD_SYS
+export HOST_SYS
+
+EXTRA_OECONF += "--libdir=${libdir} \
+ --with-securedir=${base_libdir}/security \
+"
+
+PACKAGECONFIG ??= "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam', '', d)} python3"
+PACKAGECONFIG[pam] = "--enable-pam,--disable-pam,libpam"
+PACKAGECONFIG[python3] = "--enable-python-bindings --with-python-rev=${PYTHON_BASEVERSION} --with-python-binary=${STAGING_BINDIR_NATIVE}/python3-native/python3 --with-pythonsitedir=${PYTHON_SITEPACKAGES_DIR},--disable-python-bindings,python3-setuptools-native"
+
+FILES:${PN} += "${base_libdir}/security/pam_pwquality.so"
+FILES:${PN}-dbg += "${base_libdir}/security/.debug"
+FILES:${PN}-staticdev += "${base_libdir}/security/pam_pwquality.a"
+FILES:${PN}-dev += "${base_libdir}/security/pam_pwquality.la"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 03/82] pcsc-lite: create pcscd user and group also via useradd
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
2026-10-15 5:40 ` [PATCH 01/82] readme: update maintainer ankur.tyagi85
2026-10-15 5:40 ` [PATCH 02/82] Revert "libpwquality: remove recipe (moved to oe-core)" ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 04/82] Revert "gnome-shell-extensions: upgrade 50.3 -> 51.0" ankur.tyagi85
` (79 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Bastian Krause <bst@pengutronix.de>
The recipe currently only does this via systemd-sysusers. This does not
work for read-only root filesystems, though. So use useradd to create
the pcscd user and group.
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb b/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb
index a8735a449f..daa1b78304 100644
--- a/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb
+++ b/meta-oe/recipes-support/pcsc-lite/pcsc-lite_2.5.1.bb
@@ -14,7 +14,7 @@ DEPENDS = "autoconf-archive-native flex-native"
SRC_URI = "https://pcsclite.apdu.fr/files/${BP}.tar.xz"
SRC_URI[sha256sum] = "bfcfe38a20afc49849c6bf55325e38f449fc4b26d3923fdc32b969ae41a8741b"
-inherit meson systemd pkgconfig perlnative
+inherit meson systemd pkgconfig perlnative useradd
EXTRA_OEMESON = " \
-Dlibusb=false \
@@ -37,6 +37,9 @@ RRECOMMENDS:${PN} = "ccid"
RRECOMMENDS:${PN}:class-native = ""
RPROVIDES:${PN}:append:class-native = " pcsc-lite-lib-native"
+USERADD_PACKAGES = "${PN}"
+USERADD_PARAM:${PN} = "--system --no-create-home --shell /sbin/nologin --user-group pcscd"
+
FILES:${PN} = "${sbindir}/pcscd \
${datadir}/polkit-1 \
${systemd_system_unitdir}/pcscd.service \
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 04/82] Revert "gnome-shell-extensions: upgrade 50.3 -> 51.0"
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (2 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 03/82] pcsc-lite: create pcscd user and group also via useradd ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 05/82] Revert "gnome-shell: upgrade 50.4 " ankur.tyagi85
` (78 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Markus Volk <f_l_k@t-online.de>
This reverts commit 89448d167e9e672609801802286c432ad0b88218.
The extensions follow gnome-shell, which goes back to 50.4 on blacksail.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
...-shell-extensions_51.0.bb => gnome-shell-extensions_50.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-gnome/recipes-gnome/gnome-shell/{gnome-shell-extensions_51.0.bb => gnome-shell-extensions_50.3.bb} (85%)
diff --git a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_51.0.bb b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_50.3.bb
similarity index 85%
rename from meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_51.0.bb
rename to meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_50.3.bb
index 9b58d976ef..a7a5b06fb9 100644
--- a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_51.0.bb
+++ b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell-extensions_50.3.bb
@@ -6,7 +6,7 @@ inherit gnomebase gettext gsettings features_check
REQUIRED_DISTRO_FEATURES = "x11 polkit systemd pam gobject-introspection-data"
-SRC_URI[archive.sha256sum] = "3c078d7b88faee3d0f68adcee1392b1bed84731b91a337ec894cc88aa8a8b813"
+SRC_URI[archive.sha256sum] = "68fc74306f88f697a6bcdb8243cb32a9ec0cd3f6e2bb92249b24b60fc57450b6"
EXTRA_OEMESON += " \
-Dextension_set=all \
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 05/82] Revert "gnome-shell: upgrade 50.4 -> 51.0"
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (3 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 04/82] Revert "gnome-shell-extensions: upgrade 50.3 -> 51.0" ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 06/82] Revert "mutter: " ankur.tyagi85
` (77 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Markus Volk <f_l_k@t-online.de>
This reverts commit d22efe5c4c2252226b8644ee805863d3c3b5e446.
gnome-shell 51.0 needs mutter >= 51.0, which goes back to 50.4 on
blacksail.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
...ver-Fix-build-failure-with-libical-4.patch | 44 +++++++++++++++++++
...nome-shell_51.0.bb => gnome-shell_50.4.bb} | 7 ++-
2 files changed, 50 insertions(+), 1 deletion(-)
create mode 100644 meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch
rename meta-gnome/recipes-gnome/gnome-shell/{gnome-shell_51.0.bb => gnome-shell_50.4.bb} (86%)
diff --git a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch
new file mode 100644
index 0000000000..d64cf38ccc
--- /dev/null
+++ b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch
@@ -0,0 +1,44 @@
+From 91eaa9221b45b506d7a5d84a9ec8c204b5c8c34f Mon Sep 17 00:00:00 2001
+From: Xi Ruoyao <xry111@xry111.site>
+Date: Fri, 8 May 2026 13:13:37 +0800
+Subject: [PATCH] calendar-server: Fix build failure with libical 4
+
+Fix the following build error with libical 4 due to function signature changes:
+
+ error: passing argument 4 of 'get_time_from_property' from incompatible pointer type [-Wincompatible-pointer-types]
+ note: expected 'ICalTime * (*)(ICalProperty *)' but argument is of type 'ICalTime * (*)(const ICalProperty *)'
+
+Link: https://github.com/libical/libical/blob/4.0/docs/MigrationGuide_to_4.md
+Part-of: <https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/4215>
+
+Only the gnome-shell-calendar-server.c hunk of the upstream commit is taken;
+src/calendar-server/reminder-watcher.c does not exist in the 50.x series.
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/b34766f3992c7616b7816a47249fb463c053e5fa]
+---
+ src/calendar-server/gnome-shell-calendar-server.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/src/calendar-server/gnome-shell-calendar-server.c b/src/calendar-server/gnome-shell-calendar-server.c
+index 0b2f88eb7..622c16181 100644
+--- a/src/calendar-server/gnome-shell-calendar-server.c
++++ b/src/calendar-server/gnome-shell-calendar-server.c
+@@ -112,11 +112,17 @@ typedef struct
+ time_t end_time;
+ } CalendarAppointment;
+
++#if ICAL_CHECK_VERSION(4, 0, 0)
++typedef ICalTime * (* GetICalPropFunc) (const ICalProperty *prop);
++#else
++typedef ICalTime * (* GetICalPropFunc) (ICalProperty *prop);
++#endif
++
+ static gboolean
+ get_time_from_property (ECalClient *cal,
+ ICalComponent *icomp,
+ ICalPropertyKind prop_kind,
+- ICalTime * (* get_prop_func) (ICalProperty *prop),
++ GetICalPropFunc get_prop_func,
+ ICalTimezone *default_zone,
+ ICalTime **out_itt,
+ ICalTimezone **out_timezone)
diff --git a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_51.0.bb b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_50.4.bb
similarity index 86%
rename from meta-gnome/recipes-gnome/gnome-shell/gnome-shell_51.0.bb
rename to meta-gnome/recipes-gnome/gnome-shell/gnome-shell_50.4.bb
index 549a3d5971..f39d72532e 100644
--- a/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_51.0.bb
+++ b/meta-gnome/recipes-gnome/gnome-shell/gnome-shell_50.4.bb
@@ -31,7 +31,8 @@ GIR_MESON_OPTION = ""
REQUIRED_DISTRO_FEATURES += "gobject-introspection-data"
SRC_URI += "file://0001-shell-app-usage.c-only-include-x11-headers-if-HAVE_X.patch"
-SRC_URI[archive.sha256sum] = "2179bab13af353427065096af8bf3d30da7b86e0c516e5ba86a14998af9575f6"
+SRC_URI += "file://0002-calendar-server-Fix-build-failure-with-libical-4.patch"
+SRC_URI[archive.sha256sum] = "c531939539db316a41aef23670370abd1330d3254f84bcb0f9f4dae5d6e362cf"
PACKAGECONFIG ??= " \
camera-monitor \
@@ -43,6 +44,7 @@ PACKAGECONFIG ??= " \
"
PACKAGECONFIG[bluetooth] = ",,gnome-bluetooth"
PACKAGECONFIG[camera-monitor] = "-Dcamera_monitor=true, -Dcamera_monitor=false, pipewire"
+PACKAGECONFIG[extensions-app] = "-Dextensions_app=true, -Dextensions_app=false"
PACKAGECONFIG[extensions-tool] = "-Dextensions_tool=true, -Dextensions_tool=false, gnome-autoar json-glib libsoup-3.0"
PACKAGECONFIG[nm] = "-Dnetworkmanager=true, -Dnetworkmanager=false, networkmanager libsecret, networkmanager"
PACKAGECONFIG[portal-helper] = "-Dportal_helper=true, -Dportal_helper=false"
@@ -96,6 +98,9 @@ RDEPENDS:${PN} += " \
librsvg-gtk \
"
+# The extensions app is a GJS application and pulls libadwaita at runtime only.
+RDEPENDS:${PN} += "${@bb.utils.contains('PACKAGECONFIG', 'extensions-app', 'libadwaita', '', d)}"
+
PACKAGES =+ "${PN}-tools ${PN}-gsettings"
FILES:${PN}-tools = "${bindir}/*-tool"
RDEPENDS:${PN}-tools = "python3-core"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 06/82] Revert "mutter: upgrade 50.4 -> 51.0"
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (4 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 05/82] Revert "gnome-shell: upgrade 50.4 " ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 07/82] libwebsockets: patch CVE-2026-19773 ankur.tyagi85
` (76 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Markus Volk <f_l_k@t-online.de>
This reverts commit 6f735ce8ac29f1e57dc463bac8c34f3c439a7fb7.
mutter 51.0 needs gsettings-desktop-schemas >= 51.rc, but oe-core
blacksail has 50.1. Tested by building gnome-image against oe-core
blacksail.
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../mutter/{mutter_51.0.bb => mutter_50.4.bb} | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
rename meta-gnome/recipes-gnome/mutter/{mutter_51.0.bb => mutter_50.4.bb} (85%)
diff --git a/meta-gnome/recipes-gnome/mutter/mutter_51.0.bb b/meta-gnome/recipes-gnome/mutter/mutter_50.4.bb
similarity index 85%
rename from meta-gnome/recipes-gnome/mutter/mutter_51.0.bb
rename to meta-gnome/recipes-gnome/mutter/mutter_50.4.bb
index 6604865f67..f9b3e9d5e5 100644
--- a/meta-gnome/recipes-gnome/mutter/mutter_51.0.bb
+++ b/meta-gnome/recipes-gnome/mutter/mutter_50.4.bb
@@ -17,17 +17,12 @@ DEPENDS = " \
libdisplay-info \
libdrm \
libei \
- libgudev \
- libinput \
- libxcvt-native \
libxkbcommon \
pango \
pixman \
python3-argcomplete-native \
python3-docutils-native \
- udev \
virtual/egl \
- virtual/libgbm \
virtual/libgles2 \
wayland \
wayland-native \
@@ -37,7 +32,7 @@ DEPENDS = " \
inherit gnomebase gsettings gobject-introspection gettext features_check
SRC_URI += "file://0001-Dont-use-system-sysprof-dbus-folder.patch"
-SRC_URI[archive.sha256sum] = "5d28f3ae225692428fcafb96500d673f34328b698b86960c9c1460d0b1d983b3"
+SRC_URI[archive.sha256sum] = "273d33c875abcb4b6cbea3f4ec045d18155fbc510c3521fc7e47926371310988"
REQUIRED_DISTRO_FEATURES = "wayland polkit"
ANY_OF_DISTRO_FEATURES = "opengl vulkan"
@@ -45,10 +40,10 @@ ANY_OF_DISTRO_FEATURES = "opengl vulkan"
# systemd can be replaced by libelogind (not available atow - make systemd
# mandatory distro feature)
LOGIND ?= "systemd"
-DEPENDS += "${LOGIND}"
REQUIRED_DISTRO_FEATURES += "systemd"
PACKAGECONFIG ??= " \
+ native-backend \
egl \
gles2 \
${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'opengl', '', d)} \
@@ -56,11 +51,17 @@ PACKAGECONFIG ??= " \
bash-completion \
gnome-desktop \
${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'xwayland', '', d)} \
+ ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'logind udev', '', d)} \
"
+PACKAGECONFIG[native-backend] = "-Dnative_backend=true -Dudev=true, -Dnative_backend=false -Dudev=false, libdrm virtual/libgbm libinput ${LOGIND} virtual/egl virtual/libgles2 udev libxcvt-native"
PACKAGECONFIG[opengl] = "-Dopengl=true, -Dopengl=false, virtual/libgl"
PACKAGECONFIG[gles2] = "-Dgles2=true, -Dgles2=false, virtual/libgles2"
PACKAGECONFIG[egl] = "-Degl=true, -Degl=false, virtual/egl"
+PACKAGECONFIG[egl-device] = "-Degl_device=true, -Degl_device=false"
+PACKAGECONFIG[wayland-eglstream] = "-Dwayland_eglstream=true, -Dwayland_eglstream=false, wayland-eglstream-protocols"
+PACKAGECONFIG[udev] = "-Dudev=true, -Dudev=false, udev"
+PACKAGECONFIG[logind] = "-Dlogind=true, -Dlogind=false, systemd"
PACKAGECONFIG[libwacom] = "-Dlibwacom=true, -Dlibwacom=false, libwacom"
PACKAGECONFIG[remote-desktop] = "-Dremote_desktop=true, -Dremote_desktop=false, pipewire"
PACKAGECONFIG[gnome-desktop] = "-Dlibgnome_desktop=true, -Dlibgnome_desktop=false, gnome-desktop gnome-settings-daemon"
@@ -87,7 +88,7 @@ EXTRA_OEMESON += " \
-Dverbose=true \
"
-MUTTER_API_NAME = "mutter-${@oe.utils.trim_version('${PV}', 1)}"
+MUTTER_API_NAME = "mutter-18"
do_install:prepend() {
sed -i -e 's|${B}/||g' ${B}/cogl/cogl/cogl-enum-types.c
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 07/82] libwebsockets: patch CVE-2026-19773
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (5 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 06/82] Revert "mutter: " ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 08/82] libwebsockets: patch CVE-2026-78161 ankur.tyagi85
` (75 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-19773
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(From meta-oe rev: b8399ae07ae1958eced847a3d5e8a4227c2e3aa2)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libwebsockets/CVE-2026-19773.patch | 31 +++++++++++++++++++
.../libwebsockets/libwebsockets_4.5.8.bb | 1 +
2 files changed, 32 insertions(+)
create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch
new file mode 100644
index 0000000000..74908c5437
--- /dev/null
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch
@@ -0,0 +1,31 @@
+From 998a9af40aa6c2ddcb91c662d6585ea80ab52f85 Mon Sep 17 00:00:00 2001
+From: Andy Green <andy@warmcat.com>
+Date: Fri, 3 Jul 2026 18:43:25 +0100
+Subject: [PATCH] zdi-can-31036: h2 bounds check on server
+
+This vulnerability was discovered by:
+Maher Azzouzi working with TrendAI Zero Day Initiative
+
+(cherry picked from commit 824151862f37bc72f46d9a3e01d5b9408d313a0b)
+
+CVE: CVE-2026-19773
+Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ lib/roles/h2/hpack.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/roles/h2/hpack.c b/lib/roles/h2/hpack.c
+index 1025faa6f..863eb88c9 100644
+--- a/lib/roles/h2/hpack.c
++++ b/lib/roles/h2/hpack.c
+@@ -274,6 +274,9 @@ static int lws_frag_append(struct lws *wsi, unsigned char c)
+ {
+ struct allocated_headers *ah = wsi->http.ah;
+
++ if ((unsigned int)ah->pos >= wsi->a.context->max_http_header_data)
++ return 1;
++
+ ah->data[ah->pos++] = (char)c;
+ ah->frags[ah->nfrag].len++;
+
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
index 005729dcac..11da4b299c 100644
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
@@ -10,6 +10,7 @@ SRCREV = "fbb0baf6af9c4324f0f1591734c78b0089b599d4"
SRC_URI = " \
git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.5-stable;tag=v${PV} \
file://CVE-2026-10650.patch \
+ file://CVE-2026-19773.patch \
"
UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 08/82] libwebsockets: patch CVE-2026-78161
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (6 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 07/82] libwebsockets: patch CVE-2026-19773 ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 09/82] nginx: set status for CVE-2026-90439 ankur.tyagi85
` (74 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Peter Marko <peter.marko@siemens.com>
Pick patch per [1].
[1] https://security-tracker.debian.org/tracker/CVE-2026-78161
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libwebsockets/CVE-2026-78161.patch | 45 +++++++++++++++++++
.../libwebsockets/libwebsockets_4.5.8.bb | 1 +
2 files changed, 46 insertions(+)
create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch
new file mode 100644
index 0000000000..ab978811d8
--- /dev/null
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch
@@ -0,0 +1,45 @@
+From 1d44554a1bb262db63ff4e240152a9deecd99054 Mon Sep 17 00:00:00 2001
+From: Biniam F Demissie <biniamfd@gmail.com>
+Date: Mon, 6 Jul 2026 04:33:45 +0100
+Subject: [PATCH] cbor: overflow
+
+CVE: CVE-2026-78161
+Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/1d44554a1bb262db63ff4e240152a9deecd99054]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ lib/misc/lecp.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/lib/misc/lecp.c b/lib/misc/lecp.c
+index 44a7ac667..13e6ba476 100644
+--- a/lib/misc/lecp.c
++++ b/lib/misc/lecp.c
+@@ -325,11 +325,11 @@ report_raw_cbor(struct lecp_ctx *ctx)
+ if (!ctx->cbor_pos)
+ return 0;
+
++ ctx->cbor_pos = 0; /* reset BEFORE callback */
++
+ if (pst->cb(ctx, LECPCB_LITERAL_CBOR))
+ return 1;
+
+- ctx->cbor_pos = 0;
+-
+ return 0;
+ }
+
+@@ -388,10 +388,11 @@ lecp_parse(struct lecp_ctx *ctx, const uint8_t *cbor, size_t len)
+ */
+
+ if (ctx->literal_cbor_report) {
++ if (ctx->cbor_pos >= sizeof(ctx->cbor)) {
++ if (report_raw_cbor(ctx))
++ goto reject_callback;
++ }
+ ctx->cbor[ctx->cbor_pos++] = c;
+- if (ctx->cbor_pos == sizeof(ctx->cbor) &&
+- report_raw_cbor(ctx))
+- goto reject_callback;
+ }
+
+ switch (st->s) {
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
index 11da4b299c..0b612c6f4f 100644
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
@@ -11,6 +11,7 @@ SRC_URI = " \
git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.5-stable;tag=v${PV} \
file://CVE-2026-10650.patch \
file://CVE-2026-19773.patch \
+ file://CVE-2026-78161.patch \
"
UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 09/82] nginx: set status for CVE-2026-90439
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (7 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 08/82] libwebsockets: patch CVE-2026-78161 ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 10/82] capnproto: ignore CVE-2026-59704 ankur.tyagi85
` (73 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Peter Marko <peter.marko@siemens.com>
CVE information now contains separate version range for mainline and
stable nginx version.
Problem is that mainline version range includes stable verion fix and
since cve-check marks CVE as applicable if one of ranges contains
current recipe version, it's reported as vulnerable.
* Affected 1.29.2 < 1.31.6 (semver) < matches 1.30.5, so false positive
* Affected 1.30.4 < 1.30.5 (semver) < correct fix version, but overridden
Add also a note to remove these explicit entries when new minor stable
version is available which does not fall into the mainline version range
(for all 3 currently explicitly handled CVEs).
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(From meta-oe rev: 13915b76c5411a7f3992ecfa7001bf9b9d32e5a6)
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
index 4dda52c62d..6b638cdd96 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.30.5.bb
@@ -6,5 +6,7 @@ SRC_URI[sha256sum] = "6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11
inherit upstream-version-is-even
+# Remove following entries when upgrading recipe to 1.32
CVE_STATUS[CVE-2026-42055] = "fixed-version: Fixed since 1.30.3"
CVE_STATUS[CVE-2026-48142] = "fixed-version: Fixed since 1.30.3"
+CVE_STATUS[CVE-2026-90439] = "fixed-version: Fixed since 1.30.5"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 10/82] capnproto: ignore CVE-2026-59704
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (8 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 09/82] nginx: set status for CVE-2026-90439 ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:40 ` [PATCH 11/82] civetweb: ignore CVE-2026-5789 ankur.tyagi85
` (72 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59704
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb
index 9909afb0e9..1149913c2b 100644
--- a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb
+++ b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb
@@ -41,3 +41,4 @@ BBCLASSEXTEND = "native nativesdk"
CVE_STATUS[CVE-2026-32239] = "fixed-version: fixed in 1.4.0"
CVE_STATUS[CVE-2026-32240] = "fixed-version: fixed in 1.4.0"
+CVE_STATUS[CVE-2026-59704] = "cpe-incorrect: this vulnerability is for CapSoftware Cap"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 11/82] civetweb: ignore CVE-2026-5789
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (9 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 10/82] capnproto: ignore CVE-2026-59704 ankur.tyagi85
@ 2026-10-15 5:40 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 12/82] dovecot: ignore already fixed CVEs ankur.tyagi85
` (71 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:40 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-5789
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit db080436aa68c50b0500aadd33a366916b12c782)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb
index d9ca7ccd53..df64d4cd35 100644
--- a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb
+++ b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/civetweb/civetweb.git;branch=master;protocol=https \
CVE_STATUS[CVE-2025-55763] = "fixed-version: The vulnerability is fixed in the used revision"
CVE_STATUS[CVE-2025-9648] = "fixed-version: The vulnerability is fixed in the used revision"
+CVE_STATUS[CVE-2026-5789] = "not-applicable-platform: Issue only applies on Windows"
# civetweb supports building with make or cmake (although cmake lacks few features)
inherit cmake
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 12/82] dovecot: ignore already fixed CVEs
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (10 preceding siblings ...)
2026-10-15 5:40 ` [PATCH 11/82] civetweb: ignore CVE-2026-5789 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 13/82] eject: ignore CVE-2026-28065 ankur.tyagi85
` (70 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Upstream has confirmed that these vulnerabilities are fixed,
and Debian has also identified the relevant commits:
CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028
CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032
CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859
CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851
CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603
CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016
CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020
CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 86a9ad852a7180edf8b03fca7d0a69e9f1d9e550)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb
index 993453eaa3..06e6ee39fa 100644
--- a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb
+++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb
@@ -89,3 +89,11 @@ CVE_STATUS[CVE-2026-0394] = "fixed-version: fixed since v2.4.1"
CVE_STATUS[CVE-2026-24031] = "fixed-version: fixed since v2.4.3"
CVE_STATUS[CVE-2026-27855] = "fixed-version: fixed since v2.4.3"
CVE_STATUS[CVE-2026-27860] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2025-59028] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2025-59032] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2026-27859] = "fixed-version: fixed since v2.4.3"
+CVE_STATUS[CVE-2026-27851] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-33603] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-40016] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-40020] = "fixed-version: fixed in v2.4.4"
+CVE_STATUS[CVE-2026-42006] = "fixed-version: fixed in v2.4.4"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 13/82] eject: ignore CVE-2026-28065
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (11 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 12/82] dovecot: ignore already fixed CVEs ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 14/82] gpsd: patch CVE-2026-58459 ankur.tyagi85
` (69 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-28065
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit e6d111c16938dab4a377826147bfc86b72bca8a1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/eject/eject_2.1.5.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-support/eject/eject_2.1.5.bb b/meta-oe/recipes-support/eject/eject_2.1.5.bb
index aa0e86db12..90630ff791 100644
--- a/meta-oe/recipes-support/eject/eject_2.1.5.bb
+++ b/meta-oe/recipes-support/eject/eject_2.1.5.bb
@@ -34,3 +34,5 @@ ALTERNATIVE_PRIORITY[eject] = "100"
ALTERNATIVE:${PN}-doc = "eject.1"
ALTERNATIVE_LINK_NAME[eject.1] = "${mandir}/man1/eject.1"
+
+CVE_STATUS[CVE-2026-28065] = "cpe-incorrect: this CVE is for WordPress plugin or theme"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 14/82] gpsd: patch CVE-2026-58459
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (12 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 13/82] eject: ignore CVE-2026-28065 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 15/82] bcc: correct CVE_PRODUCT mapping ankur.tyagi85
` (68 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-58459
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 57e1f7d3d255e7b2eb55e9bca152f189ad8cdd09)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../gpsd/gpsd/CVE-2026-58459-1.patch | 48 +++++++++++++++
.../gpsd/gpsd/CVE-2026-58459-2.patch | 46 +++++++++++++++
.../gpsd/gpsd/CVE-2026-58459-3.patch | 58 +++++++++++++++++++
.../recipes-navigation/gpsd/gpsd_3.27.5.bb | 3 +
4 files changed, 155 insertions(+)
create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch
create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch
create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch
new file mode 100644
index 0000000000..aec3acdeb2
--- /dev/null
+++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch
@@ -0,0 +1,48 @@
+From 485b793ee3a54865ff9d8efffd2fe9a309666be0 Mon Sep 17 00:00:00 2001
+From: "Gary E. Miller" <gem@rellim.com>
+Date: Wed, 1 Jul 2026 17:55:57 -0700
+Subject: [PATCH 1/1] clients/gpsprof.py.in: Quote double quotes in title.
+
+Someone could use the double quote to break out of the
+string and add gnuplot commnds.
+
+For issue 404.
+Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
+
+(cherry picked from commit 5581ba196d826a984fbfaf792b7d58535f9911ce)
+
+CVE: CVE-2026-58459
+Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ clients/gpsprof.py.in | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index 5c18f50ff..261e72665 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -198,6 +198,10 @@ class plotter(object):
+ if 'subtype' in self.device:
+ desc += "\\n%s" % self.device['subtype']
+
++ # escape ", and \n, for gnuplot, to not break strings
++ desc = desc.replace('"', '\\042')
++ desc = desc.replace('\n', '')
++
+ return desc
+
+ def collect(self, verb, log_fp=None):
+@@ -1262,10 +1266,10 @@ if __name__ == '__main__':
+ # Ship the plot to standard output
+ if not options.title:
+ options.title = plot.whatami()
+- # escape " for gnuplot
+- options.title = options.title.replace('"', '\\"')
+ if options.subtitle:
+ options.title += '\\n' + options.subtitle
++ # escape " for gnuplot, to not break strings
++ options.title = options.title.replace('"', '\\042')
+ term_opts = ""
+ truecolor_terms = ['png', 'sixelgd', 'wxt']
+ if options.terminal in truecolor_terms:
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch
new file mode 100644
index 0000000000..dd50d27695
--- /dev/null
+++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch
@@ -0,0 +1,46 @@
+From 6031dc96603d5537a650068a2f8d42ef90d9d32d Mon Sep 17 00:00:00 2001
+From: "Gary E. Miller" <gem@rellim.com>
+Date: Tue, 7 Jul 2026 13:41:54 -0700
+Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title.
+
+Someone could use the back tick to break out of the string and add
+gnuplot commnds.
+
+For issue 404.
+Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
+
+(cherry picked from commit 1a6bb7bcbdf58aa940132e630870af061dc88537)
+
+CVE: CVE-2026-58459
+Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ clients/gpsprof.py.in | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index 261e72665..202214769 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -198,8 +198,9 @@ class plotter(object):
+ if 'subtype' in self.device:
+ desc += "\\n%s" % self.device['subtype']
+
+- # escape ", and \n, for gnuplot, to not break strings
++ # escape ", `, and \n, for gnuplot, to not break strings
+ desc = desc.replace('"', '\\042')
++ desc = desc.replace('`', '\\140')
+ desc = desc.replace('\n', '')
+
+ return desc
+@@ -1268,8 +1269,9 @@ if __name__ == '__main__':
+ options.title = plot.whatami()
+ if options.subtitle:
+ options.title += '\\n' + options.subtitle
+- # escape " for gnuplot, to not break strings
++ # escape ", and`, for gnuplot, to not break strings
+ options.title = options.title.replace('"', '\\042')
++ options.title = options.title.replace('"', '\\140')
+ term_opts = ""
+ truecolor_terms = ['png', 'sixelgd', 'wxt']
+ if options.terminal in truecolor_terms:
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch
new file mode 100644
index 0000000000..a40edfe6d1
--- /dev/null
+++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch
@@ -0,0 +1,58 @@
+From 54484dccf7265e51368eef03d99ea7a370c15e06 Mon Sep 17 00:00:00 2001
+From: "Gary E. Miller" <gem@rellim.com>
+Date: Tue, 7 Jul 2026 14:23:56 -0700
+Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title.
+
+Second try. Also quote "terminal".
+
+Someone could use the back tick to break out of the string and add
+gnuplot commnds.
+
+For issue 404.
+Reported by: CuB3y0nd, and Wade Sparks <wsparks@vulncheck.com>
+
+(cherry picked from commit 4c06658e988f4ced1a7a574ce082a22ef625df56)
+
+CVE: CVE-2026-58459
+Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ clients/gpsprof.py.in | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index 202214769..e91367ee3 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -200,7 +200,7 @@ class plotter(object):
+
+ # escape ", `, and \n, for gnuplot, to not break strings
+ desc = desc.replace('"', '\\042')
+- desc = desc.replace('`', '\\140')
++ desc = desc.replace("\x60", '\\140')
+ desc = desc.replace('\n', '')
+
+ return desc
+@@ -1271,13 +1271,19 @@ if __name__ == '__main__':
+ options.title += '\\n' + options.subtitle
+ # escape ", and`, for gnuplot, to not break strings
+ options.title = options.title.replace('"', '\\042')
+- options.title = options.title.replace('"', '\\140')
++ options.title = options.title.replace("\x60", '\\140')
+ term_opts = ""
+ truecolor_terms = ['png', 'sixelgd', 'wxt']
+ if options.terminal in truecolor_terms:
+ term_opts = 'truecolor'
+- sys.stdout.write("set terminal %s size 800,950 %s\n"
+- "set termoption enhanced\n"
++
++ # escape ", `, and \n, for gnuplot, to not break strings
++ options.terminal = options.terminal.replace('"', '\\042')
++ options.terminal = options.terminal.replace("\x60", '\\140')
++ options.terminal = options.terminal.replace('\n', '')
++
++ sys.stdout.write('set terminal "%s" size 800,950 %s\n'
++ 'set termoption enhanced\n'
+ % (options.terminal, term_opts))
+ # double quotes on title so \n is parsed by gnuplot
+ sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title)
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb
index fa3df89b27..52d86503a1 100644
--- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb
+++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb
@@ -8,6 +8,9 @@ BUGTRACKER = "https://gitlab.com/gpsd/gpsd/-/issues"
HOMEPAGE = "https://gpsd.io/"
SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \
+ file://CVE-2026-58459-1.patch \
+ file://CVE-2026-58459-2.patch \
+ file://CVE-2026-58459-3.patch \
file://gpsd.init \
"
SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 15/82] bcc: correct CVE_PRODUCT mapping
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (13 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 14/82] gpsd: patch CVE-2026-58459 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 16/82] dool: patch CVE-2026-56651 ankur.tyagi85
` (67 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use "iovisor:bpf_compiler_collection", the exact NVD identity for the
https://github.com/iovisor/bcc source.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../meta-python/recipes-devtools/bcc/bcc_0.37.0.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb
index 8caeef90bf..eec8ef4a32 100644
--- a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb
+++ b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb
@@ -91,3 +91,5 @@ FILES:${PN}-doc += "${datadir}/${PN}/man"
OEQA_BUILDPATHS_SKIP = "/home/ubuntu"
COMPATIBLE_HOST = "(x86_64.*|aarch64.*|powerpc64.*|riscv64.*)-linux"
+
+CVE_PRODUCT = "iovisor:bpf_compiler_collection"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 16/82] dool: patch CVE-2026-56651
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (14 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 15/82] bcc: correct CVE_PRODUCT mapping ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 17/82] dool: patch CVE-2026-56652 ankur.tyagi85
` (66 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56651
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2e1445decda0c68cc6889777c6f648cdaaef082c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../dool/dool/CVE-2026-56651.patch | 47 +++++++++++++++++++
meta-oe/recipes-support/dool/dool_1.3.8.bb | 4 +-
2 files changed, 50 insertions(+), 1 deletion(-)
create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch
diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch
new file mode 100644
index 0000000000..e367884ca9
--- /dev/null
+++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch
@@ -0,0 +1,47 @@
+From f5eb4fbf3977d919a2e9da8b73985a29d2878e56 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= <sectroyer@gmail.com>
+Date: Thu, 18 Jun 2026 10:52:27 +0200
+Subject: [PATCH] Neutralize formula-prefixed CSV output
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Michał Majchrowicz <sectroyer@gmail.com>
+(cherry picked from commit d5aa93b3d1939a83b2b10a7cd8af3c819930aea1)
+
+CVE: CVE-2026-56651
+Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/d5aa93b3d1939a83b2b10a7cd8af3c819930aea1]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ dool | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/dool b/dool
+index 634ed9d..fc1015d 100755
+--- a/dool
++++ b/dool
+@@ -3030,7 +3030,10 @@ def perform(update):
+
+ # Prep the line for the CSV file
+ if op.output and step == op.delay:
+- oline = oline + o.showcsv() + o.showcsvend(totlist, vislist)
++ csv_cell = o.showcsv()
++ if o.type == 's' and len(o.vars) == 1:
++ csv_cell = csv_quote_string_cell(csv_cell)
++ oline = oline + csv_cell + o.showcsvend(totlist, vislist)
+
+ ### Put the output in the csv file
+ if op.output and step == op.delay:
+@@ -3170,6 +3173,12 @@ def file_slurp(filename, size = -1):
+
+ return ret
+
++def csv_quote_string_cell(text):
++ "Quote free-form CSV string cells and neutralize spreadsheet formulas"
++ if text and text[0] in ('=', '+', '-', '@'):
++ text = "'" + text
++ return '"' + text.replace('"', '""') + '"'
++
+ # Make human readable device names that are shorter
+ #
+ # Example mappings:
diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb
index 8a057effdf..5118eadad6 100644
--- a/meta-oe/recipes-support/dool/dool_1.3.8.bb
+++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb
@@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=1ebbd3e34237af26da5dc08a4e440464"
DEPENDS += "asciidoc-native xmlto-native"
RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell python3-unixadmin"
-SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV}"
+SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \
+ file://CVE-2026-56651.patch \
+"
SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 17/82] dool: patch CVE-2026-56652
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (15 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 16/82] dool: patch CVE-2026-56651 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 18/82] haveged: ignore CVE-2026-41054 ankur.tyagi85
` (65 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-56652
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 53bbf2771b13ae1d2c856975ea8f8712b329cb30)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../dool/dool/CVE-2026-56652.patch | 35 +++++++++++++++++++
meta-oe/recipes-support/dool/dool_1.3.8.bb | 1 +
2 files changed, 36 insertions(+)
create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch
diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch
new file mode 100644
index 0000000000..c6806ae0c5
--- /dev/null
+++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch
@@ -0,0 +1,35 @@
+From d20ba041a0f4968fdbc2745827f9af676339924f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= <sectroyer@gmail.com>
+Date: Thu, 18 Jun 2026 19:20:30 +0200
+Subject: [PATCH] Refuse symlinked devel log files
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Michał Majchrowicz <sectroyer@gmail.com>
+(cherry picked from commit 259fe40c7fa519020ef7a3f8ef8d61586b72ecc3)
+
+CVE: CVE-2026-56652
+Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/259fe40c7fa519020ef7a3f8ef8d61586b72ecc3]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ dool | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/dool b/dool
+index fc1015d..2df407d 100755
+--- a/dool
++++ b/dool
+@@ -2132,7 +2132,11 @@ def devel_log(msg):
+ if not DEBUG_FH:
+ log_file = "/tmp/dool-devel.log"
+ print("Writing devel log: '%s'" % log_file)
+- DEBUG_FH = open(log_file, "w", 1)
++ flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
++ if hasattr(os, 'O_NOFOLLOW'):
++ flags |= os.O_NOFOLLOW
++ fd = os.open(log_file, flags, 0o600)
++ DEBUG_FH = os.fdopen(fd, "w", 1)
+
+ # Print out the header line for the devel log
+ DEBUG_FH.write("|Time |Since Prev |Description|\n");
diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb
index 5118eadad6..06484c5475 100644
--- a/meta-oe/recipes-support/dool/dool_1.3.8.bb
+++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb
@@ -11,6 +11,7 @@ RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell pyth
SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \
file://CVE-2026-56651.patch \
+ file://CVE-2026-56652.patch \
"
SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 18/82] haveged: ignore CVE-2026-41054
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (16 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 17/82] dool: patch CVE-2026-56652 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 19/82] gpm: ignore CVE-2025-4558 ankur.tyagi85
` (64 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Debian[1] also confirms the fixed version.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41054
[1] https://security-tracker.debian.org/tracker/CVE-2026-41054
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 086a780db02e001946bba0ecd337ee7834da1823)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-extended/haveged/haveged_1.9.26.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb
index fbebb158ee..727f856379 100644
--- a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb
+++ b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb
@@ -21,3 +21,5 @@ EXTRA_OECONF = "\
"
MIPS_INSTRUCTION_SET = "mips"
+
+CVE_STATUS[CVE-2026-41054] = "fixed-version: fixed since v1.9.21"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 19/82] gpm: ignore CVE-2025-4558
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (17 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 18/82] haveged: ignore CVE-2026-41054 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 20/82] gerbera: ignore CVE-2025-23386 ankur.tyagi85
` (63 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-4558
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit e134adc8f3e5ff7359d7df04c4a841e4d5eeff15)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/gpm/gpm_git.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-support/gpm/gpm_git.bb b/meta-oe/recipes-support/gpm/gpm_git.bb
index 155e56bdef..9c07f334b0 100644
--- a/meta-oe/recipes-support/gpm/gpm_git.bb
+++ b/meta-oe/recipes-support/gpm/gpm_git.bb
@@ -42,3 +42,5 @@ do_install:append () {
}
SYSTEMD_SERVICE:${PN} = "gpm.service"
+
+CVE_STATUS[CVE-2025-4558] = "cpe-incorrect: this CVE is for GPM from WormHole Tech"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 20/82] gerbera: ignore CVE-2025-23386
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (18 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 19/82] gpm: ignore CVE-2025-4558 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 21/82] libde265: patch CVE-2026-49295 ankur.tyagi85
` (62 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-23386
This vulnerability is due to openSUSE specific packaging issue.
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 369d9629673fd4282cc88fc9b7435de5d1a0ceeb)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb
index 3d28273f30..ca54cf2315 100644
--- a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb
+++ b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb
@@ -29,3 +29,5 @@ PACKAGECONFIG[js] = "-DWITH_JS=TRUE,-DWITH_JS=FALSE,duktape"
PACKAGECONFIG[zip] = "-DWITH_ZIP=TRUE,-DWITH_ZIP=FALSE,libzippp libzip"
SECURITY_CFLAGS:riscv64 = "${SECURITY_NOPIE_CFLAGS}"
+
+CVE_STATUS[CVE-2025-23386] = "not-applicable-platform: The vulnerability is openSUSE specific"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 21/82] libde265: patch CVE-2026-49295
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (19 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 20/82] gerbera: ignore CVE-2025-23386 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 22/82] libde265: patch CVE-2026-49337 ankur.tyagi85
` (61 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49295
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit bd09bb41b41ee12aeb181bf04e5f5961b00123ef)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libde265/libde265/CVE-2026-49295.patch | 41 +++++++++++++++++++
.../libde265/libde265_1.0.19.bb | 4 +-
2 files changed, 44 insertions(+), 1 deletion(-)
create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch
new file mode 100644
index 0000000000..189d330b9a
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch
@@ -0,0 +1,41 @@
+From 7d5e48dbf9324691ba3ce4cd8ffa089d735b0b70 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Mon, 25 May 2026 20:14:07 +0200
+Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594)
+
+(cherry picked from commit 691f3a3c55b3d32478c4a49895dee061a282652b)
+
+CVE: CVE-2026-49295
+Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libde265/refpic.cc | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+diff --git a/libde265/refpic.cc b/libde265/refpic.cc
+index ea4db4b0..dcd2b214 100644
+--- a/libde265/refpic.cc
++++ b/libde265/refpic.cc
+@@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue,
+
+ out_set->compute_derived_values();
+
++ // The unused short-term references are all collected into a single PocStFoll array
++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set).
++ // While each individual list is bounded above, the predicted-RPS construction can
++ // append the current-picture delta to an already-full source set, pushing the
++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds
++ // write when filling PocStFoll.
++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) {
++ out_set->NumNegativePics = 0;
++ out_set->NumPositivePics = 0;
++ out_set->NumDeltaPocs = 0;
++ out_set->NumPocTotalCurr_shortterm_only = 0;
++
++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false);
++ return false;
++ }
++
+ return true;
+ }
+
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
index ca05e9099e..6bed3250fa 100644
--- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
@@ -8,7 +8,9 @@ LICENSE = "LGPL-3.0-only AND MIT"
LICENSE_FLAGS = "commercial"
LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
-SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV}"
+SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \
+ file://CVE-2026-49295.patch \
+"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 22/82] libde265: patch CVE-2026-49337
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (20 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 21/82] libde265: patch CVE-2026-49295 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 23/82] libde265: patch CVE-2026-49346 ankur.tyagi85
` (60 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49337
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c83399f83fbbbb855c5a272c9702e8aff4328ce4)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libde265/libde265/CVE-2026-49337.patch | 53 +++++++++++++++++++
.../libde265/libde265_1.0.19.bb | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch
new file mode 100644
index 0000000000..88e0e32949
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch
@@ -0,0 +1,53 @@
+From 2f0c53241cb9bf2f5acded53c25f1b74db536de7 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Mon, 25 May 2026 20:29:40 +0200
+Subject: [PATCH] free orphaned slice header when no active image unit
+ (GHSA-g5hj-rf9f-7vxm)
+
+(cherry picked from commit 683cb9fa603e35840642f98765ab95cdb71cadf9)
+
+CVE: CVE-2026-49337
+Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libde265/decctx.cc | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/libde265/decctx.cc b/libde265/decctx.cc
+index fbb3baa1..5deddc37 100644
+--- a/libde265/decctx.cc
++++ b/libde265/decctx.cc
+@@ -478,10 +478,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+ shdr->entry_point_offset[i] -= skipped;
+ }
+
+- this->img->add_slice_segment_header(shdr);
+-
+-
+-
+ // --- start a new image if this is the first slice ---
+
+ if (shdr->first_slice_segment_in_pic_flag) {
+@@ -495,6 +491,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+
+ if ( ! image_units.empty() ) {
+
++ // Hand the slice header to the picture (which takes ownership and frees it
++ // on release). Only do this when there is an active image unit to decode
++ // the slice; otherwise the header would be retained on img->slices forever,
++ // which a crafted stream of non-first slice NALs can exploit to grow memory
++ // without bound.
++ this->img->add_slice_segment_header(shdr);
++
+ slice_unit* sliceunit = new slice_unit(this);
+ sliceunit->nal = nal;
+ sliceunit->shdr = shdr;
+@@ -507,6 +510,7 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na
+ }
+ else {
+ nal_parser.free_NAL_unit(nal);
++ delete shdr;
+ }
+
+ bool did_work;
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
index 6bed3250fa..5fcf641113 100644
--- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
@@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \
file://CVE-2026-49295.patch \
+ file://CVE-2026-49337.patch \
"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 23/82] libde265: patch CVE-2026-49346
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (21 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 22/82] libde265: patch CVE-2026-49337 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 24/82] libde265: patch CVE-2026-54240 and CVE-2026-54241 ankur.tyagi85
` (59 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-49346
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 4a63a2afa1c984b82a663ed8951b62f0ae5da093)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libde265/libde265/CVE-2026-49346.patch | 102 ++++++++++++++++++
.../libde265/libde265_1.0.19.bb | 1 +
2 files changed, 103 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch
new file mode 100644
index 0000000000..288295b08a
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch
@@ -0,0 +1,102 @@
+From 1667c33f2778a04f08ba4f7d6c1c16508350a779 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Tue, 26 May 2026 00:59:08 +0200
+Subject: [PATCH] fix integer overflow in image plane allocation size
+ (GHSA-vv8h-932h-7r86)
+
+(cherry picked from commit 8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8)
+
+CVE: CVE-2026-49346
+Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libde265/image.cc | 46 +++++++++++++++++++++++++++-------------------
+ 1 file changed, 27 insertions(+), 19 deletions(-)
+
+diff --git a/libde265/image.cc b/libde265/image.cc
+index 0b6071ba..94f3c974 100644
+--- a/libde265/image.cc
++++ b/libde265/image.cc
+@@ -70,10 +70,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx,
+ void* inputdata, int inputstride, void *userdata)
+ {
+ int alignment = STANDARD_ALIGNMENT;
+- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
+- int height = img->get_height(cIdx);
++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment;
++ uint32_t height = img->get_height(cIdx);
+
+- uint8_t* p = static_cast<uint8_t*>(ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING));
++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes
++ uint8_t* p = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(stride) * height + MEMORY_PADDING));
+
+ if (p==nullptr) { return nullptr; }
+
+@@ -82,12 +83,14 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx,
+ // copy input data if provided
+
+ if (inputdata != nullptr) {
+- if (inputstride == stride) {
+- memcpy(p, inputdata, stride*height);
++ if (inputstride == static_cast<int>(stride)) {
++ memcpy(p, inputdata, static_cast<size_t>(stride) * height);
+ }
+ else {
+- for (int y=0;y<height;y++) {
+- memcpy(p+y*stride, static_cast<char*>(inputdata) + inputstride*y, inputstride);
++ for (uint32_t y=0;y<height;y++) {
++ memcpy(p + static_cast<size_t>(y) * stride,
++ static_cast<char*>(inputdata) + static_cast<size_t>(inputstride) * y,
++ inputstride);
+ }
+ }
+ }
+@@ -107,30 +110,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx)
+ static int de265_image_get_buffer(de265_decoder_context* ctx,
+ de265_image_spec* spec, de265_image* img, void* userdata)
+ {
+- const int rawChromaWidth = spec->width / img->SubWidthC;
+- const int rawChromaHeight = spec->height / img->SubHeightC;
++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC;
++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC;
+
+- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment;
+- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment;
++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment;
++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment;
+
+ assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16);
+ assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16);
+
+- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8);
+- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8);
++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8);
++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8);
+
+- int luma_height = spec->height;
+- int chroma_height = rawChromaHeight;
++ uint32_t luma_height = spec->height;
++ uint32_t chroma_height = rawChromaHeight;
+
+ bool alloc_failed = false;
+
+- uint8_t* p[3] = { 0,0,0 };
+- p[0] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING));
++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the
++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so
++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps
++ // the allocation size to a small value while fill_image() later writes the
++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86).
++ uint8_t* p[3] = { nullptr,nullptr,nullptr };
++ p[0] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(luma_height) * luma_bpl + MEMORY_PADDING));
+ if (p[0]==nullptr) { alloc_failed=true; }
+
+ if (img->get_chroma_format() != de265_chroma_mono) {
+- p[1] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING));
+- p[2] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING));
++ p[1] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(chroma_height) * chroma_bpl + MEMORY_PADDING));
++ p[2] = static_cast<uint8_t*>(ALLOC_ALIGNED_16(static_cast<size_t>(chroma_height) * chroma_bpl + MEMORY_PADDING));
+
+ if (p[1]==nullptr || p[2]==nullptr) { alloc_failed=true; }
+ }
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
index 5fcf641113..a02d6dd5d8 100644
--- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
@@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f"
SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \
file://CVE-2026-49295.patch \
file://CVE-2026-49337.patch \
+ file://CVE-2026-49346.patch \
"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 24/82] libde265: patch CVE-2026-54240 and CVE-2026-54241
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (22 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 23/82] libde265: patch CVE-2026-49346 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 25/82] hdf5: patch CVE-2026-17572 ankur.tyagi85
` (58 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Debian identified same commit as fix for both CVEs[1][2].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54240
https://nvd.nist.gov/vuln/detail/cve-2026-54241
[1]https://security-tracker.debian.org/tracker/CVE-2026-54240
[2]https://security-tracker.debian.org/tracker/CVE-2026-54241
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../CVE-2026-54240-CVE-2026-54241.patch | 426 ++++++++++++++++++
.../libde265/libde265_1.0.19.bb | 1 +
2 files changed, 427 insertions(+)
create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch
new file mode 100644
index 0000000000..6f5c526f17
--- /dev/null
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch
@@ -0,0 +1,426 @@
+From 3986aba8dec43bc539e5f7c349826cea902f9ee3 Mon Sep 17 00:00:00 2001
+From: Dirk Farin <dirk.farin@gmail.com>
+Date: Wed, 3 Jun 2026 16:44:32 +0200
+Subject: [PATCH] fix pixel-accessor integer overflow on large frames
+ (GHSA-ccfw-29x7-rrx3)
+
+The de265_image::get_image_plane_at_pos*() accessors computed the pixel
+offset `xpos + ypos*stride` in signed 32-bit int. For frames where
+width*height exceeds INT32_MAX (e.g. 46344x46344, both within the existing
+<=65535 limit), ypos*stride wraps negative and the returned pointer lands
+~2 GB before the buffer -> heap out-of-bounds read/write. This is independent
+of the earlier allocation fix (GHSA-vv8h-932h-7r86), which only widened the
+buffer size, not the offset arithmetic.
+
+Widen the image stride to ptrdiff_t (members, get_image_stride/get_luma_stride/
+get_chroma_stride, set_image_plane) so all pixel-offset math is evaluated in
+64 bits. The public C API (de265_get/set_image_plane) keeps int for ABI; the
+narrowing at that boundary is safe (stride <= ~65552).
+
+The same 32-bit-stride / absolute-coordinate pattern existed in several scalar
+paths that the accessors don't cover; widen those too:
+ - sao.cc: SAO offset indexing, and the inputCopy allocation+memcpy size
+ (an int size_t under-allocation -> heap write)
+ - motion.cc: mc_luma/mc_chroma reference-plane access (ref_stride, src_stride)
+ - intrapred.h: intra reference-border fill
+ - sei.cc: decoded-picture-hash MD5/CRC/checksum
+ - image-io.cc: YUV plane read and write
+The deblock kernels, SIMD layer (acceleration.h) and per-block code already
+use ptrdiff_t or only small block-local offsets and need no change.
+
+Also store pic_width/height_in_luma_samples as uint16_t (the value is
+provably <= MAX_PICTURE_WIDTH = 65535 after validation) so PicSizeInSamplesY
+needs only a single uint32_t cast instead of int*int (which was signed-overflow
+UB on the same trigger); add static_asserts tying the limits to the storage.
+
+Verified: girlshy bit-exact single- and multi-threaded; ASan+UBSan PoC against
+the get_image_plane_at_pos sink crashes pre-fix (UBSan signed-overflow at the
+accessor + ASan wild write) and is clean post-fix.
+
+(cherry picked from commit bdca87569b9c63c2a7054d90ae4462dbb78d159a)
+
+CVE: CVE-2026-54240 CVE-2026-54241
+Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/bdca87569b9c63c2a7054d90ae4462dbb78d159a]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ libde265/de265.cc | 2 +-
+ libde265/image-io.cc | 4 ++--
+ libde265/image.cc | 2 +-
+ libde265/image.h | 21 +++++++++++----------
+ libde265/intrapred.h | 2 +-
+ libde265/motion.cc | 8 ++++----
+ libde265/sao.cc | 18 +++++++++---------
+ libde265/sei.cc | 18 ++++++++++--------
+ libde265/sps.cc | 4 ++--
+ libde265/sps.h | 11 +++++++++--
+ 10 files changed, 50 insertions(+), 40 deletions(-)
+
+diff --git a/libde265/de265.cc b/libde265/de265.cc
+index 48e38a01..02b2d5fd 100644
+--- a/libde265/de265.cc
++++ b/libde265/de265.cc
+@@ -678,7 +678,7 @@ LIBDE265_API const uint8_t* de265_get_image_plane(const de265_image* img, int ch
+
+ uint8_t* data = img->pixels_confwin[channel];
+
+- if (stride) *stride = img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8);
++ if (stride) *stride = static_cast<int>(img->get_image_stride(channel) * ((de265_get_bits_per_pixel(img, channel)+7) / 8));
+
+ return data;
+ }
+diff --git a/libde265/image-io.cc b/libde265/image-io.cc
+index f15234b6..14ca95f0 100644
+--- a/libde265/image-io.cc
++++ b/libde265/image-io.cc
+@@ -76,7 +76,7 @@ de265_image* ImageSource_YUV::read_next_image()
+ // --- load image ---
+
+ uint8_t* p;
+- int stride;
++ ptrdiff_t stride;
+
+ p = img->get_image_plane(0); stride = img->get_image_stride(0);
+ for (uint32_t y=0;y<height;y++) {
+@@ -174,7 +174,7 @@ void ImageSink_YUV::send_image(const de265_image* img)
+ // --- write image ---
+
+ const uint8_t* p;
+- int stride;
++ ptrdiff_t stride;
+
+ int width = img->get_width();
+ int height= img->get_height();
+diff --git a/libde265/image.cc b/libde265/image.cc
+index 94f3c974..59a19184 100644
+--- a/libde265/image.cc
++++ b/libde265/image.cc
+@@ -184,7 +184,7 @@ de265_image_allocation de265_image::default_image_allocation = {
+ };
+
+
+-void de265_image::set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata)
++void de265_image::set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata)
+ {
+ pixels[cIdx] = mem;
+ plane_user_data[cIdx] = userdata;
+diff --git a/libde265/image.h b/libde265/image.h
+index e0f1db24..114f41e4 100644
+--- a/libde265/image.h
++++ b/libde265/image.h
+@@ -26,6 +26,7 @@
+ #endif
+
+ #include <assert.h>
++#include <stddef.h>
+ #include <stdint.h>
+ #include <stdlib.h>
+ #include <string.h>
+@@ -235,11 +236,11 @@ struct de265_image {
+ /* */ uint8_t* get_image_plane(int cIdx) { return pixels[cIdx]; }
+ const uint8_t* get_image_plane(int cIdx) const { return pixels[cIdx]; }
+
+- void set_image_plane(int cIdx, uint8_t* mem, int stride, void *userdata);
++ void set_image_plane(int cIdx, uint8_t* mem, ptrdiff_t stride, void *userdata);
+
+ uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos)
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + xpos + ypos*stride;
+ }
+
+@@ -248,38 +249,38 @@ struct de265_image {
+ template <class pixel_t>
+ pixel_t* get_image_plane_at_pos_NEW(int cIdx, int xpos,int ypos)
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return (pixel_t*)(pixels[cIdx] + (xpos + ypos*stride)*sizeof(pixel_t));
+ }
+
+ const uint8_t* get_image_plane_at_pos(int cIdx, int xpos,int ypos) const
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + xpos + ypos*stride;
+ }
+
+ void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos)
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]);
+ }
+
+ const void* get_image_plane_at_pos_any_depth(int cIdx, int xpos,int ypos) const
+ {
+- int stride = get_image_stride(cIdx);
++ ptrdiff_t stride = get_image_stride(cIdx);
+ return pixels[cIdx] + ((xpos + ypos*stride) << bpp_shift[cIdx]);
+ }
+
+ /* Number of pixels in one row (not number of bytes).
+ */
+- int get_image_stride(int cIdx) const
++ ptrdiff_t get_image_stride(int cIdx) const
+ {
+ if (cIdx==0) return stride;
+ else return chroma_stride;
+ }
+
+- int get_luma_stride() const { return stride; }
+- int get_chroma_stride() const { return chroma_stride; }
++ ptrdiff_t get_luma_stride() const { return stride; }
++ ptrdiff_t get_chroma_stride() const { return chroma_stride; }
+
+ int get_width (int cIdx=0) const { return cIdx==0 ? width : chroma_width; }
+ int get_height(int cIdx=0) const { return cIdx==0 ? height : chroma_height; }
+@@ -333,7 +334,7 @@ private:
+ int width = 0, height = 0; // size in luma pixels
+
+ int chroma_width = 0, chroma_height = 0;
+- int stride = 0, chroma_stride = 0;
++ ptrdiff_t stride = 0, chroma_stride = 0;
+
+ public:
+ uint8_t BitDepth_Y = 0, BitDepth_C = 0;
+diff --git a/libde265/intrapred.h b/libde265/intrapred.h
+index 9b17f75b..a256cb3a 100644
+--- a/libde265/intrapred.h
++++ b/libde265/intrapred.h
+@@ -533,7 +533,7 @@ void intra_border_computer<pixel_t>::fill_from_image()
+ assert(nT<=32);
+
+ pixel_t* image;
+- int stride;
++ ptrdiff_t stride;
+ image = (pixel_t*)img->get_image_plane(cIdx);
+ stride = img->get_image_stride(cIdx);
+
+diff --git a/libde265/motion.cc b/libde265/motion.cc
+index c62c24c3..14e920e1 100644
+--- a/libde265/motion.cc
++++ b/libde265/motion.cc
+@@ -50,7 +50,7 @@ void mc_luma(const base_context* ctx,
+ const seq_parameter_set* sps, int mv_x, int mv_y,
+ int xP,int yP,
+ int16_t* out, int out_stride,
+- const pixel_t* ref, int ref_stride,
++ const pixel_t* ref, ptrdiff_t ref_stride,
+ int nPbW, int nPbH, int bitDepth_L)
+ {
+ int xFracL = mv_x & 3;
+@@ -129,7 +129,7 @@ void mc_luma(const base_context* ctx,
+ pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+7)];
+
+ const pixel_t* src_ptr;
+- int src_stride;
++ ptrdiff_t src_stride;
+
+ if (-extra_left + xIntOffsL >= 0 &&
+ -extra_top + yIntOffsL >= 0 &&
+@@ -181,7 +181,7 @@ void mc_chroma(const base_context* ctx,
+ int mv_x, int mv_y,
+ int xP,int yP,
+ int16_t* out, int out_stride,
+- const pixel_t* ref, int ref_stride,
++ const pixel_t* ref, ptrdiff_t ref_stride,
+ int nPbWC, int nPbHC, int bit_depth_C)
+ {
+ // chroma sample interpolation process (8.5.3.2.2.2)
+@@ -227,7 +227,7 @@ void mc_chroma(const base_context* ctx,
+ pixel_t padbuf[(MAX_CU_SIZE+16)*(MAX_CU_SIZE+3)];
+
+ const pixel_t* src_ptr;
+- int src_stride;
++ ptrdiff_t src_stride;
+
+ int extra_top = 1;
+ int extra_left = 1;
+diff --git a/libde265/sao.cc b/libde265/sao.cc
+index a0db84b2..579dcef2 100644
+--- a/libde265/sao.cc
++++ b/libde265/sao.cc
+@@ -28,8 +28,8 @@
+ template <class pixel_t>
+ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
+ const slice_segment_header* shdr, int cIdx, int nSW,int nSH,
+- const pixel_t* in_img, int in_stride,
+- /* */ pixel_t* out_img, int out_stride)
++ const pixel_t* in_img, ptrdiff_t in_stride,
++ /* */ pixel_t* out_img, ptrdiff_t out_stride)
+ {
+ const sao_info* saoinfo = img->get_sao_info(xCtb,yCtb);
+
+@@ -77,7 +77,7 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
+
+ if (SaoTypeIdx==2) {
+ int hPos[2], vPos[2];
+- int vPosStride[2]; // vPos[] multiplied by image stride
++ ptrdiff_t vPosStride[2]; // vPos[] multiplied by image stride
+ int SaoEoClass = (saoinfo->SaoEoClass >> (2*cIdx)) & 0x3;
+
+ switch (SaoEoClass) {
+@@ -266,8 +266,8 @@ void apply_sao_internal(de265_image* img, int xCtb,int yCtb,
+ template <class pixel_t>
+ void apply_sao(de265_image* img, int xCtb,int yCtb,
+ const slice_segment_header* shdr, int cIdx, int nSW,int nSH,
+- const pixel_t* in_img, int in_stride,
+- /* */ pixel_t* out_img, int out_stride)
++ const pixel_t* in_img, ptrdiff_t in_stride,
++ /* */ pixel_t* out_img, ptrdiff_t out_stride)
+ {
+ if (img->high_bit_depth(cIdx)) {
+ apply_sao_internal<uint16_t>(img,xCtb,yCtb, shdr,cIdx,nSW,nSH,
+@@ -332,8 +332,8 @@ void apply_sample_adaptive_offset_sequential(de265_image* img)
+ return;
+ }
+
+- int lumaImageSize = img->get_image_stride(0) * img->get_height(0) * img->get_bytes_per_pixel(0);
+- int chromaImageSize = img->get_image_stride(1) * img->get_height(1) * img->get_bytes_per_pixel(1);
++ size_t lumaImageSize = static_cast<size_t>(img->get_image_stride(0)) * img->get_height(0) * img->get_bytes_per_pixel(0);
++ size_t chromaImageSize = static_cast<size_t>(img->get_image_stride(1)) * img->get_height(1) * img->get_bytes_per_pixel(1);
+
+ uint8_t* inputCopy = new uint8_t[ libde265_max(lumaImageSize, chromaImageSize) ];
+ if (inputCopy == nullptr) {
+@@ -347,10 +347,10 @@ void apply_sample_adaptive_offset_sequential(de265_image* img)
+
+ for (int cIdx=0;cIdx<nChannels;cIdx++) {
+
+- int stride = img->get_image_stride(cIdx);
++ ptrdiff_t stride = img->get_image_stride(cIdx);
+ int height = img->get_height(cIdx);
+
+- memcpy(inputCopy, img->get_image_plane(cIdx), stride * height * img->get_bytes_per_pixel(cIdx));
++ memcpy(inputCopy, img->get_image_plane(cIdx), static_cast<size_t>(stride) * height * img->get_bytes_per_pixel(cIdx));
+
+ for (int yCtb=0; yCtb<sps.PicHeightInCtbsY; yCtb++)
+ for (int xCtb=0; xCtb<sps.PicWidthInCtbsY; xCtb++)
+diff --git a/libde265/sei.cc b/libde265/sei.cc
+index 17b7f8b5..8a3d80a7 100644
+--- a/libde265/sei.cc
++++ b/libde265/sei.cc
+@@ -99,7 +99,7 @@ static void dump_sei_decoded_picture_hash(const sei_message* sei,
+ class raw_hash_data
+ {
+ public:
+- raw_hash_data(int w, int stride);
++ raw_hash_data(int w, ptrdiff_t stride);
+ ~raw_hash_data();
+
+ struct data_chunk {
+@@ -111,13 +111,14 @@ public:
+ data_chunk prepare_16bit(const uint8_t* data,int y);
+
+ private:
+- int mWidth, mStride;
++ int mWidth;
++ ptrdiff_t mStride;
+
+ uint8_t* mMem;
+ };
+
+
+-raw_hash_data::raw_hash_data(int w, int stride)
++raw_hash_data::raw_hash_data(int w, ptrdiff_t stride)
+ {
+ mWidth=w;
+ mStride=stride;
+@@ -157,7 +158,7 @@ raw_hash_data::data_chunk raw_hash_data::prepare_16bit(const uint8_t* data,int y
+ }
+
+
+-static uint32_t compute_checksum(uint8_t* data,int w,int h,int stride, int bit_depth)
++static uint32_t compute_checksum(uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth)
+ {
+ uint32_t sum = 0;
+
+@@ -170,7 +171,7 @@ static uint32_t compute_checksum(uint8_t* data,int w,int h,int stride, int bit_d
+ }
+ else {
+ auto* data16 = reinterpret_cast<uint16_t*>(data);
+- int stride16 = stride / 2;
++ ptrdiff_t stride16 = stride / 2;
+ for (int y=0; y<h; y++)
+ for(int x=0; x<w; x++) {
+ uint8_t xorMask = ( x & 0xFF ) ^ ( y & 0xFF ) ^ ( x >> 8 ) ^ ( y >> 8 );
+@@ -224,7 +225,7 @@ static inline uint16_t crc_process_byte_parallel(uint16_t crc, uint8_t byte)
+ (t << 12)) & 0xFFFF;
+ }
+
+-static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride, int bit_depth)
++static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,ptrdiff_t stride, int bit_depth)
+ {
+ raw_hash_data raw_data(w,stride);
+
+@@ -250,7 +251,7 @@ static uint32_t compute_CRC_8bit_fast(const uint8_t* data,int w,int h,int stride
+ }
+
+
+-static void compute_MD5(uint8_t* data,int w,int h,int stride, uint8_t* result, int bit_depth)
++static void compute_MD5(uint8_t* data,int w,int h,ptrdiff_t stride, uint8_t* result, int bit_depth)
+ {
+ MD5_CTX md5;
+ MD5_Init(&md5);
+@@ -289,7 +290,8 @@ static de265_error process_sei_decoded_picture_hash(const sei_message* sei, de26
+ int nHashes = img->get_sps().chroma_format_idc==0 ? 1 : 3;
+ for (int i=0;i<nHashes;i++) {
+ uint8_t* data;
+- int w,h,stride;
++ int w,h;
++ ptrdiff_t stride;
+
+ w = img->get_width(i);
+ h = img->get_height(i);
+diff --git a/libde265/sps.cc b/libde265/sps.cc
+index aa871a09..a29a3c0a 100644
+--- a/libde265/sps.cc
++++ b/libde265/sps.cc
+@@ -570,7 +570,7 @@ de265_error seq_parameter_set::compute_derived_values(bool sanitize_values)
+ PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY);
+ PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY;
+ PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY;
+- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples;
++ PicSizeInSamplesY = static_cast<uint32_t>(pic_width_in_luma_samples) * pic_height_in_luma_samples;
+
+ if (chroma_format_idc==0 || separate_colour_plane_flag) {
+ CtbWidthC = 0;
+@@ -1325,7 +1325,7 @@ de265_error seq_parameter_set::write(error_queue* errqueue, CABAC_encoder& out)
+ PicHeightInCtbsY = ceil_div(pic_height_in_luma_samples,CtbSizeY);
+ PicSizeInMinCbsY = PicWidthInMinCbsY * PicHeightInMinCbsY;
+ PicSizeInCtbsY = PicWidthInCtbsY * PicHeightInCtbsY;
+- PicSizeInSamplesY = pic_width_in_luma_samples * pic_height_in_luma_samples;
++ PicSizeInSamplesY = static_cast<uint32_t>(pic_width_in_luma_samples) * pic_height_in_luma_samples;
+ if (chroma_format_idc==0 || separate_colour_plane_flag) {
+ CtbWidthC = 0;
+ CtbHeightC = 0;
+diff --git a/libde265/sps.h b/libde265/sps.h
+index c8be9788..5cb0b46c 100644
+--- a/libde265/sps.h
++++ b/libde265/sps.h
+@@ -39,6 +39,13 @@ constexpr int MAX_NUM_LT_REF_PICS_SPS = 32;
+ constexpr int MAX_PICTURE_WIDTH = 65535;
+ constexpr int MAX_PICTURE_HEIGHT = 65535;
+
++// pic_width/height_in_luma_samples are stored as uint16_t and PicSizeInSamplesY as uint32_t,
++// so these limits must keep width/height in 16 bits and their product in 32 bits.
++static_assert(MAX_PICTURE_WIDTH <= 0xFFFF, "picture width must fit in uint16_t");
++static_assert(MAX_PICTURE_HEIGHT <= 0xFFFF, "picture height must fit in uint16_t");
++static_assert((uint64_t)MAX_PICTURE_WIDTH * MAX_PICTURE_HEIGHT <= 0xFFFFFFFFu,
++ "total luma sample count must fit in uint32_t");
++
+ enum {
+ CHROMA_MONO = 0,
+ CHROMA_420 = 1,
+@@ -111,8 +118,8 @@ public:
+ uint8_t chroma_format_idc; // [0;3]
+
+ bool separate_colour_plane_flag;
+- int pic_width_in_luma_samples;
+- int pic_height_in_luma_samples;
++ uint16_t pic_width_in_luma_samples; // <= MAX_PICTURE_WIDTH (validated on parse)
++ uint16_t pic_height_in_luma_samples; // <= MAX_PICTURE_HEIGHT (validated on parse)
+ bool conformance_window_flag;
+
+ int conf_win_left_offset;
diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
index a02d6dd5d8..8e145cf8dd 100644
--- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
+++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb
@@ -12,6 +12,7 @@ SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https
file://CVE-2026-49295.patch \
file://CVE-2026-49337.patch \
file://CVE-2026-49346.patch \
+ file://CVE-2026-54240-CVE-2026-54241.patch \
"
SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 25/82] hdf5: patch CVE-2026-17572
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (23 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 24/82] libde265: patch CVE-2026-54240 and CVE-2026-54241 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 26/82] hdf5: patch CVE-2026-17573 ankur.tyagi85
` (57 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.
[1] https://github.com/HDFGroup/hdf5/pull/6499
[2] https://github.com/HDFGroup/hdf5/issues/6501
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17572
[4] https://security-tracker.debian.org/tracker/CVE-2026-17572
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c279e9e68822db77648667093bcbf3013269c791)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../hdf5/files/CVE-2026-17572.patch | 253 ++++++++++++++++++
meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 +
2 files changed, 254 insertions(+)
create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch
diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch
new file mode 100644
index 0000000000..373a6c374e
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch
@@ -0,0 +1,253 @@
+From 606bb0a0282d0b056a3bdda1d489a608deee78d2 Mon Sep 17 00:00:00 2001
+From: Nayyar <nayyar@bugqore.com>
+Date: Tue, 14 Jul 2026 23:39:56 +0530
+Subject: [PATCH] reject SOHM list message count exceeding list_max (#6499)
+
+* bound SOHM list decode to list_max messages
+
+* Add tsohm test for out-of-range SOHM list message count
+
+Create a file with a shared-message list index, corrupt the on-disk
+message count so it exceeds list_max (repairing the table checksum),
+and confirm reopening rejects the file instead of overrunning the
+list image buffer and message array.
+
+---------
+
+Co-authored-by: H. Joe Lee <hyoklee@hdfgroup.org>
+Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
+
+CVE: CVE-2026-17572
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552]
+
+Dropped changes to the CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/H5SMcache.c | 14 ++++
+ test/tsohm.c | 173 ++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 187 insertions(+)
+
+diff --git a/src/H5SMcache.c b/src/H5SMcache.c
+index eb6d612a78..96687ffed9 100644
+--- a/src/H5SMcache.c
++++ b/src/H5SMcache.c
+@@ -489,6 +489,12 @@ H5SM__cache_list_verify_chksum(const void *_image, size_t H5_ATTR_UNUSED len, vo
+ assert(image);
+ assert(udata);
+
++ /* The buffer only holds list_max messages; a corrupted header whose message
++ * count exceeds that would size the checksum region past the end of it.
++ */
++ if (udata->header->num_messages > udata->header->list_max)
++ HGOTO_ERROR(H5E_SOHM, H5E_BADVALUE, FAIL, "number of SOHM messages exceeds list size");
++
+ /* Exact size with checksum at the end */
+ chk_size = H5SM_LIST_SIZE(udata->f, udata->header->num_messages);
+
+@@ -552,6 +558,14 @@ H5SM__cache_list_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED le
+ HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "bad SOHM list signature");
+ image += H5_SIZEOF_MAGIC;
+
++ /* The message array is sized for list_max entries; a list index always
++ * holds at most that many before it is promoted to a B-tree. Reject a
++ * corrupted header whose message count would drive the decode loop past
++ * the allocation and the input buffer.
++ */
++ if (udata->header->num_messages > udata->header->list_max)
++ HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "number of SOHM messages exceeds list size");
++
+ /* Read messages into the list array */
+ ctx.sizeof_addr = H5F_SIZEOF_ADDR(udata->f);
+ for (u = 0; u < udata->header->num_messages; u++) {
+diff --git a/test/tsohm.c b/test/tsohm.c
+index 1652c9b044..61036e7dc3 100644
+--- a/test/tsohm.c
++++ b/test/tsohm.c
+@@ -3702,6 +3702,175 @@ test_sohm_external_dtype(void)
+ free(orig);
+ } /* test_sohm_external_dtype */
+
++/*-------------------------------------------------------------------------
++ * Function: test_sohm_reject_bad_count
++ *
++ * Purpose: A shared-message list index holds at most list_max messages
++ * on disk before it is promoted to a B-tree, and both the list
++ * image buffer and the in-memory message array are sized for
++ * list_max entries. Corrupt the on-disk message count so it
++ * exceeds list_max and verify the list load rejects the file
++ * instead of sizing a read or indexing the array past its end.
++ *
++ *-------------------------------------------------------------------------
++ */
++static void
++test_sohm_reject_bad_count(void)
++{
++ hid_t fcpl_id = H5I_INVALID_HID;
++ hid_t fid = H5I_INVALID_HID;
++ hid_t sid = H5I_INVALID_HID;
++ hid_t did = H5I_INVALID_HID;
++ hsize_t dims[1] = {4};
++ FILE *fp = NULL;
++ uint8_t *buf = NULL;
++ long fsize = 0;
++ long table_off = -1;
++ unsigned list_max = 100;
++ uint32_t chksum;
++ size_t pos;
++ int i;
++ herr_t ret;
++
++ /* On-disk shared-message table layout for a file with a single index and
++ * 8-byte addresses: a 4-byte "SMTB" signature, one index record, then a
++ * 4-byte checksum. Within the record the 16-bit message count follows the
++ * (version, index type, message types, minimum size) prefix and the 16-bit
++ * list and B-tree cutoffs.
++ */
++ const size_t rec_size = 1 + 1 + 2 + 4 + 3 * 2 + 8 + 8; /* 30 */
++ const size_t table_body = (size_t)H5_SIZEOF_MAGIC + rec_size; /* 34 */
++ const size_t num_msgs_off = (size_t)H5_SIZEOF_MAGIC + (1 + 1 + 2 + 4 + 2 + 2); /* 16 */
++
++ MESSAGE(5, ("Testing rejection of an out-of-range SOHM list message count\n"));
++
++ /* Create a file whose single shared-message index is a list that can hold
++ * up to list_max messages before converting to a B-tree.
++ */
++ fcpl_id = H5Pcreate(H5P_FILE_CREATE);
++ CHECK_I(fcpl_id, "H5Pcreate");
++ ret = H5Pset_shared_mesg_nindexes(fcpl_id, 1);
++ CHECK_I(ret, "H5Pset_shared_mesg_nindexes");
++ ret = H5Pset_shared_mesg_index(fcpl_id, 0, H5O_SHMESG_SDSPACE_FLAG | H5O_SHMESG_DTYPE_FLAG, 1);
++ CHECK_I(ret, "H5Pset_shared_mesg_index");
++ ret = H5Pset_shared_mesg_phase_change(fcpl_id, list_max, 0);
++ CHECK_I(ret, "H5Pset_shared_mesg_phase_change");
++
++ fid = H5Fcreate(FILENAME, H5F_ACC_TRUNC, fcpl_id, H5P_DEFAULT);
++ CHECK_I(fid, "H5Fcreate");
++
++ /* Several datasets sharing one dataspace and datatype leave the index a
++ * list holding a couple of messages, well under list_max.
++ */
++ sid = H5Screate_simple(1, dims, NULL);
++ CHECK_I(sid, "H5Screate_simple");
++ for (i = 0; i < 5; i++) {
++ char name[16];
++
++ snprintf(name, sizeof(name), "dset%d", i);
++ did = H5Dcreate2(fid, name, H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT);
++ CHECK_I(did, "H5Dcreate2");
++ ret = H5Dclose(did);
++ CHECK_I(ret, "H5Dclose");
++ }
++ ret = H5Sclose(sid);
++ CHECK_I(ret, "H5Sclose");
++ ret = H5Fclose(fid);
++ CHECK_I(ret, "H5Fclose");
++
++ /* Read the whole file so the shared-message table can be located and edited. */
++ fp = fopen(FILENAME, "rb");
++ CHECK_PTR(fp, "fopen");
++ if (fp) {
++ if (fseek(fp, 0, SEEK_END) != 0)
++ TestErrPrintf("fseek failed at line %d\n", __LINE__);
++ fsize = ftell(fp);
++ if (fsize <= (long)(table_body + 4))
++ TestErrPrintf("unexpected file size %ld at line %d\n", fsize, __LINE__);
++ rewind(fp);
++
++ buf = (uint8_t *)malloc((size_t)fsize);
++ CHECK_PTR(buf, "malloc");
++ if (buf && fread(buf, 1, (size_t)fsize, fp) != (size_t)fsize)
++ TestErrPrintf("fread failed at line %d\n", __LINE__);
++ if (fclose(fp) != 0)
++ TestErrPrintf("fclose failed at line %d\n", __LINE__);
++ fp = NULL;
++ }
++
++ /* Find the shared-message table by signature, confirming the match with the
++ * stored checksum so the correct bytes are edited.
++ */
++ for (pos = 0; buf && (pos + table_body + 4) <= (size_t)fsize; pos++) {
++ if (memcmp(buf + pos, H5SM_TABLE_MAGIC, (size_t)H5_SIZEOF_MAGIC) != 0)
++ continue;
++
++ chksum = (uint32_t)buf[pos + table_body] | ((uint32_t)buf[pos + table_body + 1] << 8) |
++ ((uint32_t)buf[pos + table_body + 2] << 16) | ((uint32_t)buf[pos + table_body + 3] << 24);
++ if (chksum == H5_checksum_metadata(buf + pos, table_body, 0)) {
++ table_off = (long)pos;
++ break;
++ }
++ }
++ if (table_off < 0)
++ TestErrPrintf("could not locate the shared-message table in %s\n", FILENAME);
++
++ if (buf && table_off >= 0) {
++ unsigned bad_count = list_max + 200; /* well past the list_max cutoff */
++ size_t base = (size_t)table_off;
++
++ /* Overwrite the 16-bit message count and repair the table checksum so
++ * the table loads and the corruption is only caught at the list.
++ */
++ buf[base + num_msgs_off] = (uint8_t)(bad_count & 0xff);
++ buf[base + num_msgs_off + 1] = (uint8_t)((bad_count >> 8) & 0xff);
++
++ chksum = H5_checksum_metadata(buf + base, table_body, 0);
++ buf[base + table_body] = (uint8_t)(chksum & 0xff);
++ buf[base + table_body + 1] = (uint8_t)((chksum >> 8) & 0xff);
++ buf[base + table_body + 2] = (uint8_t)((chksum >> 16) & 0xff);
++ buf[base + table_body + 3] = (uint8_t)((chksum >> 24) & 0xff);
++
++ fp = fopen(FILENAME, "r+b");
++ CHECK_PTR(fp, "fopen");
++ if (fp) {
++ if (fwrite(buf, 1, (size_t)fsize, fp) != (size_t)fsize)
++ TestErrPrintf("fwrite failed at line %d\n", __LINE__);
++ if (fclose(fp) != 0)
++ TestErrPrintf("fclose failed at line %d\n", __LINE__);
++ fp = NULL;
++ }
++
++ /* Reopen and share a new message, which protects the list and drives
++ * the vulnerable decode. The load should reject the file cleanly.
++ */
++ fid = H5Fopen(FILENAME, H5F_ACC_RDWR, H5P_DEFAULT);
++ CHECK_I(fid, "H5Fopen");
++ sid = H5Screate_simple(1, dims, NULL);
++ CHECK_I(sid, "H5Screate_simple");
++
++ H5E_BEGIN_TRY
++ {
++ did = H5Dcreate2(fid, "trigger", H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT);
++ }
++ H5E_END_TRY
++
++ if (did >= 0) {
++ TestErrPrintf("dataset creation succeeded on a corrupted SOHM list at line %d\n", __LINE__);
++ H5Dclose(did);
++ }
++
++ ret = H5Sclose(sid);
++ CHECK_I(ret, "H5Sclose");
++ ret = H5Fclose(fid);
++ CHECK_I(ret, "H5Fclose");
++ }
++
++ free(buf);
++ ret = H5Pclose(fcpl_id);
++ CHECK_I(ret, "H5Pclose");
++} /* test_sohm_reject_bad_count */
++
+ /****************************************************************
+ **
+ ** test_sohm(): Main Shared Object Header Message testing routine.
+@@ -3755,6 +3924,10 @@ test_sohm(void H5_ATTR_UNUSED *params)
+
+ test_sohm_extend_dset(); /* Test extending shared datasets */
+ test_sohm_external_dtype(); /* Test using datatype in another file */
++
++ /* Editing the on-disk table in place needs the single-file sec2 layout */
++ if (default_driver)
++ test_sohm_reject_bad_count(); /* Test rejecting a bad SOHM list message count */
+ } /* test_sohm */
+
+ /*-------------------------------------------------------------------------
diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
index 7860931e7e..c83bb832de 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
@@ -18,6 +18,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://0001-cmake-remove-build-flags.patch \
file://CVE-2026-26199.patch \
file://CVE-2026-26197.patch \
+ file://CVE-2026-17572.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 26/82] hdf5: patch CVE-2026-17573
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (24 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 25/82] hdf5: patch CVE-2026-17572 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 27/82] hdf5: patch CVE-2026-17574 ankur.tyagi85
` (56 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
Debian[4] has also identified the commit.
[1] https://github.com/HDFGroup/hdf5/pull/6160
[2] https://github.com/HDFGroup/hdf5/issues/6124
[3] https://nvd.nist.gov/vuln/detail/cve-2026-17573
[4] https://security-tracker.debian.org/tracker/CVE-2026-17573
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit f46990293cf684add8cc2ee7e71738e97889bcc3)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../hdf5/files/CVE-2026-17573.patch | 53 +++++++++++++++++++
meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch
diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch
new file mode 100644
index 0000000000..3cfb52de42
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch
@@ -0,0 +1,53 @@
+From 856e7f1dd23e466ebeab5e454a5891b12e188f6a Mon Sep 17 00:00:00 2001
+From: jhendersonHDF <jhenderson@hdfgroup.org>
+Date: Tue, 27 Jan 2026 05:55:38 -0600
+Subject: [PATCH] Fix double-free issue in H5D__chunk_copy (#6160)
+
+Fix double-free caused by loss of buffer pointer after re-allocation
+
+Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
+
+CVE: CVE-2026-17573
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262]
+
+Dropped changes to the CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/H5Dchunk.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c
+index f2a0e85c03..5ff537ebde 100644
+--- a/src/H5Dchunk.c
++++ b/src/H5Dchunk.c
+@@ -7034,7 +7034,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
+ const H5S_extent_t *ds_extent_src, H5T_t *dt_src, const H5O_pline_t *pline_src,
+ H5O_copy_t *cpy_info)
+ {
+- H5D_chunk_it_ud3_t udata; /* User data for iteration callback */
++ H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */
+ H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */
+ H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */
+ int sndims; /* Rank of dataspace */
+@@ -7202,7 +7202,6 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
+ HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for raw data chunk");
+
+ /* Initialize the callback structure for the source */
+- memset(&udata, 0, sizeof udata);
+ udata.common.layout = &layout_src->u.chunk;
+ udata.common.storage = &layout_src->storage.u.chunk;
+ udata.file_src = f_src;
+@@ -7253,11 +7252,11 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout
+ } /* end for */
+ }
+
++done:
+ /* I/O buffers may have been re-allocated */
+ buf = udata.buf;
+ bkg = udata.bkg;
+
+-done:
+ if (dt_dst && (H5T_close(dt_dst) < 0))
+ HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype");
+ if (dt_mem && (H5T_close(dt_mem) < 0))
diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
index c83bb832de..df0192a091 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
@@ -19,6 +19,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://CVE-2026-26199.patch \
file://CVE-2026-26197.patch \
file://CVE-2026-17572.patch \
+ file://CVE-2026-17573.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 27/82] hdf5: patch CVE-2026-17574
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (25 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 26/82] hdf5: patch CVE-2026-17573 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 28/82] hdf5: patch CVE-2026-19025 ankur.tyagi85
` (55 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-17574
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 637f437de908d10e8a3118888740a286c2cd1f06)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../hdf5/files/CVE-2026-17574.patch | 65 +++++++++++++++++++
meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 +
2 files changed, 66 insertions(+)
create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch
diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch
new file mode 100644
index 0000000000..0ae79a2811
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch
@@ -0,0 +1,65 @@
+From e374b227c277e100d9bfa3b1fe5c0b60cdff6c43 Mon Sep 17 00:00:00 2001
+From: tbeu <tbeu@users.noreply.github.com>
+Date: Thu, 28 May 2026 17:26:57 +0200
+Subject: [PATCH] Validate VL datatype type during decode and check file
+ pointer in H5T_set_loc (#6395)
+
+H5O__dtype_decode_helper() reads vlen.type from the file without
+validation. With corrupted HDF5 files (e.g. from fuzzing), this field
+can have an invalid value that is neither H5T_VLEN_SEQUENCE nor
+H5T_VLEN_STRING, which later triggers assert(0) in H5T__vlen_set_loc()
+(debug builds) or a NULL pointer dereference / SEGV in release builds.
+
+Fix by:
+1. Adding a validation check in H5O__dtype_decode_helper() immediately
+ after reading the vlen.type field, returning an error if the value
+ is invalid.
+2. Adding a NULL file pointer check in H5T_set_loc() before calling
+ H5T__vlen_set_loc() when loc == H5T_LOC_DISK, so the low-level
+ assert(file) invariant is never violated.
+
+This fixes the root cause at the decode level where the bad value
+enters the system, as requested in review of #6378 and #6385.
+
+Found by OSS-Fuzz via the matio fuzzer (ClusterFuzz testcase
+5366895365914624).
+
+(cherry picked from commit 3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc)
+
+CVE: CVE-2026-17574
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/H5Odtype.c | 2 ++
+ src/H5T.c | 5 +++++
+ 2 files changed, 7 insertions(+)
+
+diff --git a/src/H5Odtype.c b/src/H5Odtype.c
+index d6405cdb86..6e622f3ebc 100644
+--- a/src/H5Odtype.c
++++ b/src/H5Odtype.c
+@@ -751,6 +751,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t
+ */
+ /* Set the type of VL information, either sequence or string */
+ dt->shared->u.vlen.type = (H5T_vlen_type_t)(flags & 0x0f);
++ if (dt->shared->u.vlen.type != H5T_VLEN_SEQUENCE && dt->shared->u.vlen.type != H5T_VLEN_STRING)
++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "invalid VL datatype type");
+ if (dt->shared->u.vlen.type == H5T_VLEN_STRING) {
+ dt->shared->u.vlen.pad = (H5T_str_t)((flags >> 4) & 0x0f);
+ dt->shared->u.vlen.cset = (H5T_cset_t)((flags >> 8) & 0x0f);
+diff --git a/src/H5T.c b/src/H5T.c
+index 3b2e391a53..e2c9ba9791 100644
+--- a/src/H5T.c
++++ b/src/H5T.c
+@@ -6953,6 +6953,11 @@ H5T_set_loc(H5T_t *dt, H5VL_object_t *file, H5T_loc_t loc)
+ ret_value = changed;
+ } /* end if */
+
++ /* Validate file pointer for disk-based VL types */
++ if (loc == H5T_LOC_DISK && NULL == file)
++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL,
++ "NULL file pointer for disk-based VL datatype");
++
+ /* Mark this VL sequence */
+ if ((changed = H5T__vlen_set_loc(dt, file, loc)) < 0)
+ HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "Unable to set VL location");
diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
index df0192a091..12c9852fd0 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
@@ -20,6 +20,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://CVE-2026-26197.patch \
file://CVE-2026-17572.patch \
file://CVE-2026-17573.patch \
+ file://CVE-2026-17574.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 28/82] hdf5: patch CVE-2026-19025
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (26 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 27/82] hdf5: patch CVE-2026-17574 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 29/82] iniparser: mark CVE-2025-0633 pached ankur.tyagi85
` (54 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3].
[1] https://github.com/HDFGroup/hdf5/pull/6508
[2] https://github.com/HDFGroup/hdf5/issues/6491
[3] https://nvd.nist.gov/vuln/detail/cve-2026-19025
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit df3f814ab84f9cbdcdaeb7cc745e0c61c90c55e8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../hdf5/files/CVE-2026-19025.patch | 112 ++++++++++++++++++
meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 +
2 files changed, 113 insertions(+)
create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch
diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch
new file mode 100644
index 0000000000..075bcf7653
--- /dev/null
+++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch
@@ -0,0 +1,112 @@
+From 0cb26cd769d1da3f2ad2c3836dc1732309f935a7 Mon Sep 17 00:00:00 2001
+From: Matt L <124107509+mattjala@users.noreply.github.com>
+Date: Fri, 28 Aug 2026 13:49:02 -0500
+Subject: [PATCH] Fix CVE-2026-19025 (Reject chunked datasets with mismatched
+ chunk/dspace rank at open time) (#6508)
+
+* Reject chunked datasets with mismatched chunk/dspace rank
+
+H5D__chunk_construct() validates that the chunk layout dimensionality
+matches the dataspace rank, but that runs only at dataset creation time.
+When an existing dataset is opened, H5D__chunk_init() didn't repeat the
+check, so a file whose stored chunk rank disagreed with its dataspace rank
+was accepted. During chunk I/O the memory-selection rank (from the
+dataspace) and the file-selection rank (chunk ndims - 1) then differ, which
+produces a zero stride that causes a divide-by-zero in
+H5S__hyper_iter_get_seq_list().
+
+H5D__chunk_init() now performs the same dimensionality check on open (the
+stored chunk rank includes the extra element-size dimension, so it must be
+exactly one greater than the dataspace rank) and rejects a mismatch with an
+error.
+
+Added test_chunk_dims_mismatch() as a regression test in test/dsets.c
+
+Fixes #6491
+
+* Fix typo
+
+Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
+
+* Clarify element-vs-byte wording
+
+* Validate chunk/dataspace rank at layout decode time
+
+Move the stored-chunk-rank vs dataspace-rank consistency check out of
+H5D__chunk_init() and into H5O__layout_decode(), so a malformed chunked
+layout is rejected as the message is decoded (mirroring the fill/datatype
+size check in the fill message decode).
+
+* Update release_docs/CHANGELOG.md
+
+Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
+
+* Update CHANGELOG
+
+* Pin format version bounds in bad chunk layout generator
+
+---------
+
+Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
+Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
+
+CVE: CVE-2026-19025
+Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/b7b85e7abf9aa9b1dd9693523defa35217684eb2]
+
+Dropped changes to the test and CHANGELOG file.
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/H5Olayout.c | 32 ++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/src/H5Olayout.c b/src/H5Olayout.c
+index d230feb992..5dce35e916 100644
+--- a/src/H5Olayout.c
++++ b/src/H5Olayout.c
+@@ -23,6 +23,7 @@
+ #include "H5FLprivate.h" /* Free Lists */
+ #include "H5MMprivate.h" /* Memory management */
+ #include "H5Opkg.h" /* Object headers */
++#include "H5Sprivate.h" /* Dataspaces */
+
+ /* Local macros */
+
+@@ -561,6 +562,37 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
+ }
+ }
+
++ /* For a chunked layout, the stored dimensionality includes an extra
++ * element-size dimension, so it must be exactly one greater than the
++ * dataspace rank. Validate that here
++ * to reject malformed files before the inconsistent
++ * ranks can cause problems during chunk I/O.
++ */
++ if (mesg->type == H5D_CHUNKED && open_oh != NULL) {
++ htri_t space_exists; /* Whether the dataspace message exists */
++
++ if ((space_exists = H5O_msg_exists_oh(open_oh, H5O_SDSPACE_ID)) < 0)
++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't check for dataspace message");
++ if (space_exists) {
++ H5S_extent_t *extent; /* Dataspace extent from the sibling message */
++ int rank; /* Dataspace rank */
++
++ if (NULL == (extent = (H5S_extent_t *)H5O_msg_read_oh(f, open_oh, H5O_SDSPACE_ID, NULL)))
++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't read dataspace message");
++
++ rank = H5S_extent_get_dims(extent, NULL, NULL);
++
++ /* Done with the sibling dataspace message */
++ H5O_msg_free(H5O_SDSPACE_ID, extent);
++
++ if (rank < 0)
++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't get dataspace rank");
++ if (mesg->u.chunk.ndims != (unsigned)rank + 1)
++ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL,
++ "dimensionality of chunks doesn't match the dataspace");
++ }
++ }
++
+ /* Set return value */
+ ret_value = mesg;
+
\ No newline at end of file
diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
index 12c9852fd0..a0eb5eb155 100644
--- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
+++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb
@@ -21,6 +21,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP
file://CVE-2026-17572.patch \
file://CVE-2026-17573.patch \
file://CVE-2026-17574.patch \
+ file://CVE-2026-19025.patch \
"
SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 29/82] iniparser: mark CVE-2025-0633 pached
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (27 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 28/82] hdf5: patch CVE-2026-19025 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 30/82] jq: ignore already fixed CVEs ankur.tyagi85
` (53 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Also mentioned in the release notes[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-0633
[1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 86fba2b5805f6c8ff0a5f936106a9be630bc54d9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb
index 9ab713ee92..5958ecb9c6 100644
--- a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb
+++ b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb
@@ -15,3 +15,5 @@ EXTRA_OECMAKE = " \
"
FILES_${PN}-staticdev += "${libdir}/cmake/iniparser/iniparser-staticTargets*.cmake"
+
+CVE_STATUS[CVE-2025-0633] = "fixed-version: fixed in v4.2.6"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 30/82] jq: ignore already fixed CVEs
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (28 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 29/82] iniparser: mark CVE-2025-0633 pached ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 31/82] libiec61850: mark CVE-2024-45969 patched ankur.tyagi85
` (52 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
All these CVEs are already fixed in the recipe version[1].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-33948
https://nvd.nist.gov/vuln/detail/cve-2026-39979
https://nvd.nist.gov/vuln/detail/cve-2026-40164
https://nvd.nist.gov/vuln/detail/cve-2026-44777
[1]https://github.com/jqlang/jq/releases/tag/jq-1.8.2
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-devtools/jq/jq_1.8.2.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb
index 0bbe6e009f..9f586eb18d 100644
--- a/meta-oe/recipes-devtools/jq/jq_1.8.2.bb
+++ b/meta-oe/recipes-devtools/jq/jq_1.8.2.bb
@@ -48,3 +48,7 @@ do_install_ptest() {
RDEPENDS:${PN}-ptest += "tzdata"
BBCLASSEXTEND = "native"
+
+CVE_STATUS_GROUPS += "CVE_STATUS_FIXED_ALREADY"
+CVE_STATUS_FIXED_ALREADY[status] = "fixed-version: The issue is fixed in v1.8.2"
+CVE_STATUS_FIXED_ALREADY = "CVE-2026-33948 CVE-2026-39979 CVE-2026-40164 CVE-2026-44777"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 31/82] libiec61850: mark CVE-2024-45969 patched
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (29 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 30/82] jq: ignore already fixed CVEs ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 32/82] libnfs: patch CVE-2026-53689 ankur.tyagi85
` (51 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3]
[1] https://nvd.nist.gov/vuln/detail/cve-2024-45969
[2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33
[3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit a7088b0fda5d269721e5d3f16ae410062b9b2c8e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb
index d2fbbc53fb..51ceb5cf02 100644
--- a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb
+++ b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb
@@ -35,3 +35,5 @@ FILES:${PN} += " \
${PYTHON_SITEPACKAGES_DIR}/pyiec61850.py \
${PYTHON_SITEPACKAGES_DIR}/_pyiec61850.so \
"
+
+CVE_STATUS[CVE-2024-45969] = "fixed-version: fixed since v1.6.0"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 32/82] libnfs: patch CVE-2026-53689
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (30 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 31/82] libiec61850: mark CVE-2024-45969 patched ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 33/82] libnfs: patch CVE-2026-57918 ankur.tyagi85
` (50 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-53689
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6ace2f0b5e54469c5e9fd8b99412e8f412128458)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libnfs/libnfs/CVE-2026-53689.patch | 34 +++++++++++++++++++
.../libnfs/libnfs_6.0.2.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch
diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch
new file mode 100644
index 0000000000..0c624c7219
--- /dev/null
+++ b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch
@@ -0,0 +1,34 @@
+From d45a7d6cdc899ac2a62abc21280d674ae91ae0ae Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+Date: Wed, 10 Jun 2026 11:43:28 +1000
+Subject: [PATCH] ZDR: check the string size for sanity
+
+It could otherwise cause an overflow in the bounds check later.
+
+Reported-by: Nick Hummel <nickhummel@google.com>
+Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+(cherry picked from commit 55c18ea33a83d667f79f0ef209c96895795c729f)
+
+CVE: CVE-2026-53689
+Upstream-Status: Backport [https://github.com/sahlberg/libnfs/commit/55c18ea33a83d667f79f0ef209c96895795c729f]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ lib/libnfs-zdr.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/libnfs-zdr.c b/lib/libnfs-zdr.c
+index bc507eb..cbdb650 100644
+--- a/lib/libnfs-zdr.c
++++ b/lib/libnfs-zdr.c
+@@ -305,7 +305,9 @@ bool_t libnfs_zdr_string(ZDR *zdrs, char **strp, uint32_t maxsize)
+ if (!libnfs_zdr_u_int(zdrs, &size)) {
+ return FALSE;
+ }
+-
++ if (size > zdrs->size) {
++ return FALSE;
++ }
+ if (zdrs->pos + (int)size > zdrs->size) {
+ return FALSE;
+ }
diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb
index 49617eaa29..8068d35e1c 100644
--- a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb
+++ b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb
@@ -5,6 +5,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=825301ba17efc9d188ee0abd4b924ada"
SRC_URI = "git://github.com/sahlberg/libnfs.git;protocol=https;branch=master \
file://0001-CMakeLists.txt-respect-CMAKE_INSTALL_LIBDIR-for-mult.patch \
+ file://CVE-2026-53689.patch \
"
SRCREV = "18c5c73ee88bb7dc8da0d55dc95164bb77e49dc6"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 33/82] libnfs: patch CVE-2026-57918
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (31 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 32/82] libnfs: patch CVE-2026-53689 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 34/82] libssh: ignore CVE-2025-14821 ankur.tyagi85
` (49 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-57918
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit bb3f5628f16b0ccac36287f6355c95000233c57b)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libnfs/libnfs/CVE-2026-57918.patch | 34 +++++++++++++++++++
.../libnfs/libnfs_6.0.2.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch
diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch
new file mode 100644
index 0000000000..27c99b5704
--- /dev/null
+++ b/meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch
@@ -0,0 +1,34 @@
+From 589568b88a06d92b298ecce563ae57b5fad91238 Mon Sep 17 00:00:00 2001
+From: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+Date: Wed, 10 Jun 2026 12:21:58 +1000
+Subject: [PATCH] socket: prevent an underflow in xid
+
+if the expected pdu-size is larger than the absolute pdu size
+from the xid/record-marker.
+
+Reported-by: Nick Hummel <nickhummel@google.com>
+Signed-off-by: Ronnie Sahlberg <ronniesahlberg@gmail.com>
+(cherry picked from commit 935b8db712b3c6649bc57ddc276526c4a31680de)
+
+CVE: CVE-2026-57918
+Upstream-Status: Backport [https://github.com/sahlberg/libnfs/commit/935b8db712b3c6649bc57ddc276526c4a31680de]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ lib/socket.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/socket.c b/lib/socket.c
+index f51ca4d..8e38eb8 100644
+--- a/lib/socket.c
++++ b/lib/socket.c
+@@ -929,6 +929,9 @@ rpc_read_from_socket(struct rpc_context *rpc)
+ break;
+ case READ_IOVEC:
+ rpc->pdu->read_count -= rpc->pdu_size;
++ if (rpc->rm_xid[0] < rpc->pdu_size) {
++ return -1;
++ }
+ rpc->rm_xid[0] -= rpc->pdu_size;
+ if (!rpc->rm_xid[0]) {
+ rpc_finished_pdu(rpc);
diff --git a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb
index 8068d35e1c..ef99118230 100644
--- a/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb
+++ b/meta-oe/recipes-connectivity/libnfs/libnfs_6.0.2.bb
@@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=825301ba17efc9d188ee0abd4b924ada"
SRC_URI = "git://github.com/sahlberg/libnfs.git;protocol=https;branch=master \
file://0001-CMakeLists.txt-respect-CMAKE_INSTALL_LIBDIR-for-mult.patch \
file://CVE-2026-53689.patch \
+ file://CVE-2026-57918.patch \
"
SRCREV = "18c5c73ee88bb7dc8da0d55dc95164bb77e49dc6"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 34/82] libssh: ignore CVE-2025-14821
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (32 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 33/82] libnfs: patch CVE-2026-57918 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 35/82] libssh: mark CVEs patched ankur.tyagi85
` (48 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2025-14821
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6541aefe606686445b5f7c7feb7eb4dd78ce5543)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
index d2f5072d1e..738f8b1731 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
@@ -48,3 +48,5 @@ do_install_ptest () {
}
BBCLASSEXTEND = "native nativesdk"
+
+CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: issue only applies on Windows"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 35/82] libssh: mark CVEs patched
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (33 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 34/82] libssh: ignore CVE-2025-14821 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 36/82] libssh: ignore CVE-2026-59851 ankur.tyagi85
` (47 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog[1] also confirms the fix.
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59843
https://nvd.nist.gov/vuln/detail/cve-2026-59844
https://nvd.nist.gov/vuln/detail/cve-2026-59845
https://nvd.nist.gov/vuln/detail/cve-2026-59846
https://nvd.nist.gov/vuln/detail/cve-2026-59848
https://nvd.nist.gov/vuln/detail/cve-2026-59850
[1]https://gitlab.com/libssh/libssh-mirror/-/blob/libssh-0.11.5/CHANGELOG?ref_type=tags
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
index 738f8b1731..a99c4ee788 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
@@ -50,3 +50,9 @@ do_install_ptest () {
BBCLASSEXTEND = "native nativesdk"
CVE_STATUS[CVE-2025-14821] = "not-applicable-platform: issue only applies on Windows"
+CVE_STATUS[CVE-2026-59843] = "fixed-version: fixed in v0.11.5"
+CVE_STATUS[CVE-2026-59844] = "fixed-version: fixed in v0.11.5"
+CVE_STATUS[CVE-2026-59845] = "fixed-version: fixed in v0.11.5"
+CVE_STATUS[CVE-2026-59846] = "fixed-version: fixed in v0.11.5"
+CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5"
+CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 36/82] libssh: ignore CVE-2026-59851
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (34 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 35/82] libssh: mark CVEs patched ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 37/82] miniupnpd: patch CVE-2026-107159 ankur.tyagi85
` (46 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
GSSAPI Key Exchange was introduced in v0.12.0[1].
Debian also confirmed the same[2].
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-59851
[1]https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.12.0
[2]https://security-tracker.debian.org/tracker/CVE-2026-59851
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/libssh/libssh_0.11.5.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
index a99c4ee788..a67956df88 100644
--- a/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
+++ b/meta-oe/recipes-support/libssh/libssh_0.11.5.bb
@@ -56,3 +56,4 @@ CVE_STATUS[CVE-2026-59845] = "fixed-version: fixed in v0.11.5"
CVE_STATUS[CVE-2026-59846] = "fixed-version: fixed in v0.11.5"
CVE_STATUS[CVE-2026-59848] = "fixed-version: fixed in v0.11.5"
CVE_STATUS[CVE-2026-59850] = "fixed-version: fixed in v0.11.5"
+CVE_STATUS[CVE-2026-59851] = "cpe-incorrect: vulnerability doesn't exist in v0.11.5"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 37/82] miniupnpd: patch CVE-2026-107159
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (35 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 36/82] libssh: ignore CVE-2026-59851 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 38/82] libyang: patch CVE-2026-41401 ankur.tyagi85
` (45 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-107159
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../miniupnpd/files/CVE-2026-107159.patch | 78 +++++++++++++++++++
.../miniupnpd/miniupnpd_2.3.11.bb | 1 +
2 files changed, 79 insertions(+)
create mode 100644 meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
new file mode 100644
index 0000000000..fa2401e039
--- /dev/null
+++ b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
@@ -0,0 +1,78 @@
+From 8a3e282b22b16fc90740d62fe213c51696e8dc01 Mon Sep 17 00:00:00 2001
+From: Thomas Bernard <miniupnp@free.fr>
+Date: Sat, 3 Oct 2026 23:42:55 +0200
+Subject: [PATCH] minissdp.c: MX: 0 is invalid as well. 1 is the minimum
+ accepted
+
+(cherry picked from commit 8f13b7a5843f5270db684099c0a083f98869636a)
+
+CVE: CVE-2026-107159
+Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ minissdp.c | 22 +++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/minissdp.c b/minissdp.c
+index afb11ec..d825bf6 100644
+--- a/minissdp.c
++++ b/minissdp.c
+@@ -2,7 +2,7 @@
+ /* vim: tabstop=4 shiftwidth=4 noexpandtab
+ * MiniUPnP project
+ * http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/
+- * (c) 2006-2025 Thomas Bernard
++ * (c) 2006-2026 Thomas Bernard
+ * This software is subject to the conditions detailed
+ * in the LICENCE file provided within the distribution */
+
+@@ -1015,7 +1015,7 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ #endif
+ #endif
+ #if defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE)
+- int mx_value = -1;
++ int mx_value = -1; /* -1 => not set, -2 => invalid value (0 or negative) */
+ #endif
+ unsigned int delay = 50; /* Non-zero default delay to prevent flooding */
+ /* UPnP Device Architecture v1.1. 1.3.3 Search response :
+@@ -1113,7 +1113,16 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ memset(atoi_buffer, 0, sizeof(atoi_buffer));
+ memcpy(atoi_buffer, mx, MIN((int)(sizeof(atoi_buffer) - 1), mx_len));
+ mx_value = atoi(atoi_buffer);
+- syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value);
++ /* UPnP Device Architechture v2.0 :
++ * MX
++ * Required. Field value contains maximum wait time in seconds.
++ * shall be greater than or equal to 1 and should be less than
++ * 5 inclusive. */
++ if (mx_value <= 0) {
++ syslog(LOG_WARNING, "MX: %.*s (value=%d) INVALID (must be between 1 and 5 incl.)", mx_len, mx, mx_value);
++ } else {
++ syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value);
++ }
+ }
+ #endif /* defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) */
+ #if defined(UPNP_STRICT)
+@@ -1140,9 +1149,12 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ /* For multicast M-SEARCH requests, if the search request does
+ * not contain an MX header field, the device MUST silently
+ * discard and ignore the search request. */
+- if(mx_value < 0) {
++ if(mx_value == -1) {
+ syslog(LOG_INFO, "ignoring SSDP packet missing MX: header");
+ return;
++ } else if(mx_value <= 0) {
++ syslog(LOG_WARNING, "ignoring SSDP packet with invalid value for MX: header");
++ return;
+ } else if(mx_value > 5) {
+ /* If the MX header field specifies a field value greater
+ * than 5, the device SHOULD assume that it contained the
+@@ -1150,7 +1162,7 @@ ProcessSSDPData(int s, const char *bufr, int n,
+ mx_value = 5;
+ }
+ #elif defined(DELAY_MSEARCH_RESPONSE)
+- if(mx_value < 0) {
++ if(mx_value <= 0) {
+ mx_value = 1;
+ } else if(mx_value > 5) {
+ /* If the MX header field specifies a field value greater
diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb
index 42a654e327..920d33da94 100644
--- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb
+++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb
@@ -13,6 +13,7 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl"
SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \
file://miniupnpd.service \
+ file://CVE-2026-107159.patch \
"
SRC_URI[sha256sum] = "91994b127da735b2c97f19992e34420648c0e8c4ace8a4bcb0596e7685c48678"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 38/82] libyang: patch CVE-2026-41401
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (36 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 37/82] miniupnpd: patch CVE-2026-107159 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 39/82] tinyproxy: patch CVE-2026-31842 ankur.tyagi85
` (44 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport patch identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-41401
[1]https://security-tracker.debian.org/tracker/CVE-2026-41401
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 6b06704ac1bae4ef4831384f0c28d14e98c804b8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../libyang/libyang/CVE-2026-41401.patch | 43 +++++++++++++++++++
.../libyang/libyang_3.13.6.bb | 1 +
2 files changed, 44 insertions(+)
create mode 100644 meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch
diff --git a/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch
new file mode 100644
index 0000000000..06537acbb8
--- /dev/null
+++ b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch
@@ -0,0 +1,43 @@
+From 34b2a26ee86716e2b593c44e51e38ee15d4e8434 Mon Sep 17 00:00:00 2001
+From: Michal Vasko <mvasko@cesnet.cz>
+Date: Thu, 26 Mar 2026 08:33:44 +0100
+Subject: [PATCH] parser common BUGFIX invalid metadata removal
+
+(cherry picked from commit 54c3276d871023da266d4ed3ceaee7e8d71d0b04)
+
+CVE: CVE-2026-41401
+Upstream-Status: Backport [https://github.com/CESNET/libyang/commit/54c3276d871023da266d4ed3ceaee7e8d71d0b04]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/parser_common.c | 4 ++--
+ tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 | 5 +++++
+ 2 files changed, 7 insertions(+), 2 deletions(-)
+ create mode 100644 tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26
+
+diff --git a/src/parser_common.c b/src/parser_common.c
+index 0b221af72..fefe723eb 100644
+--- a/src/parser_common.c
++++ b/src/parser_common.c
+@@ -413,8 +413,8 @@ lyd_parser_set_data_flags(struct lyd_node *node, struct lyd_meta **meta, struct
+ next_meta = meta2->next;
+
+ /* delete the metadata */
+- if (meta != &node->meta) {
+- *meta = (*meta)->next;
++ if ((meta != &node->meta) && (meta2 == *meta)) {
++ *meta = next_meta;
+ }
+ lyd_free_meta_single(meta2);
+ if (prev_meta) {
+diff --git a/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26
+new file mode 100644
+index 000000000..7e3b6c39e
+--- /dev/null
++++ b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26
+@@ -0,0 +1,5 @@
++<int32 xmlns="urn:tests:types"
++ xmlns:yang="urn:ietf:params:xml:ns:yang:1"
++ xmlns:dflt="urn:ietf:params:xml:ns:netconf:default:1.0"
++ yang:operation="create"
++ dflt:default="true">5</int32>
diff --git a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb
index 822c30ba24..7724b4c218 100644
--- a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb
+++ b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb
@@ -11,6 +11,7 @@ SRCREV = "c2ddd01b9b810a30d6a7d6749a3bc9adeb7b01fb"
SRC_URI = "git://github.com/CESNET/libyang.git;branch=master;protocol=https;tag=v${PV} \
file://0001-test_context-skip-test-case-test_searchdirs.patch \
file://run-ptest \
+ file://CVE-2026-41401.patch \
"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 39/82] tinyproxy: patch CVE-2026-31842
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (37 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 38/82] libyang: patch CVE-2026-41401 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 40/82] tinyproxy: patch CVE-2026-54387 ankur.tyagi85
` (43 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-31842
[1]https://security-tracker.debian.org/tracker/CVE-2026-31842
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 985acd9e7c375e17a674be4c21e9e80d0259eb38)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tinyproxy/tinyproxy/CVE-2026-31842.patch | 33 +++++++++++++++++++
.../tinyproxy/tinyproxy_1.11.3.bb | 1 +
2 files changed, 34 insertions(+)
create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch
new file mode 100644
index 0000000000..6b8c02d629
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch
@@ -0,0 +1,33 @@
+From ed5252d213a68546feaff68e2b40e401d2c2afd4 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Fri, 3 Apr 2026 11:21:23 +0200
+Subject: [PATCH] reqs: fix case-sensitive matching of "chunked" (#605)
+
+the chunked transfer encoding needs to be matched in a case-
+insensitive manner.
+
+closes #604
+
+(cherry picked from commit 879bf844abffa0bf5fae6aff0c73179024dd9f98)
+
+CVE: CVE-2026-31842
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/879bf844abffa0bf5fae6aff0c73179024dd9f98]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/reqs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/reqs.c b/src/reqs.c
+index 7aacfd3..8b68538 100644
+--- a/src/reqs.c
++++ b/src/reqs.c
+@@ -850,7 +850,7 @@ static int is_chunked_transfer (pseudomap *hashofheaders)
+ {
+ char *data;
+ data = pseudomap_find (hashofheaders, "transfer-encoding");
+- return data ? !strcmp (data, "chunked") : 0;
++ return data ? !strcasecmp (data, "chunked") : 0;
+ }
+
+ /*
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
index 2555d2132d..a0ef5fd62f 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
@@ -9,6 +9,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
file://run-ptest \
file://CVE-2026-3945-1.patch \
file://CVE-2026-3945-2.patch \
+ file://CVE-2026-31842.patch \
"
SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 40/82] tinyproxy: patch CVE-2026-54387
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (38 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 39/82] tinyproxy: patch CVE-2026-31842 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 41/82] tinyproxy: patch CVE-2026-55202 ankur.tyagi85
` (42 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-54387
[1]https://security-tracker.debian.org/tracker/CVE-2026-54387
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 33649b065762429d18d1d9e9ec94deedb6edb63a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tinyproxy/tinyproxy/CVE-2026-54387.patch | 37 +++++++++++++++++++
.../tinyproxy/tinyproxy_1.11.3.bb | 1 +
2 files changed, 38 insertions(+)
create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch
new file mode 100644
index 0000000000..c0199c1713
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch
@@ -0,0 +1,37 @@
+From a9602e492cedd5d5d18dd3675d9be90e9b0d9e66 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Thu, 7 May 2026 16:33:11 +0000
+Subject: [PATCH] reqs: prevent request smuggling via both content-length and
+ chunked
+
+addressing point 1 of #609
+
+(cherry picked from commit 623bfc093df009296f0b85d40bc677ef9d5c09bb)
+
+CVE: CVE-2026-54387
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/reqs.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/src/reqs.c b/src/reqs.c
+index 8b68538..e3cfe76 100644
+--- a/src/reqs.c
++++ b/src/reqs.c
+@@ -942,8 +942,13 @@ process_client_headers (struct conn_s *connptr, pseudomap *hashofheaders)
+ connptr->content_length.client = get_content_length (hashofheaders);
+
+ /* Check whether client sends chunked data. */
+- if (connptr->content_length.client == -1 && is_chunked_transfer (hashofheaders))
++ if (is_chunked_transfer (hashofheaders)) {
++ if (connptr->content_length.client != -1)
++ /* request smuggling, see GH issue #609 */
++ pseudomap_remove (hashofheaders, "content-length");
++
+ connptr->content_length.client = -2;
++ }
+
+ /*
+ * See if there is a "Connection" header. If so, we need to do a bit
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
index a0ef5fd62f..e84aeae53c 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
@@ -10,6 +10,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
file://CVE-2026-3945-1.patch \
file://CVE-2026-3945-2.patch \
file://CVE-2026-31842.patch \
+ file://CVE-2026-54387.patch \
"
SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 41/82] tinyproxy: patch CVE-2026-55202
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (39 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 40/82] tinyproxy: patch CVE-2026-54387 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 42/82] wolfssl: mark CVEs patched ankur.tyagi85
` (41 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport commit identified by Debian[1]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-55202
[1]https://security-tracker.debian.org/tracker/CVE-2026-55202
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 233e6a56e5311eff91c8a46c36a790db1fb38933)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tinyproxy/tinyproxy/CVE-2026-55202.patch | 107 ++++++++++++++++++
.../tinyproxy/tinyproxy_1.11.3.bb | 1 +
2 files changed, 108 insertions(+)
create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch
new file mode 100644
index 0000000000..4e446542e2
--- /dev/null
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch
@@ -0,0 +1,107 @@
+From 04b34f814076d790db26925d7df7c30798910c99 Mon Sep 17 00:00:00 2001
+From: rofl0r <rofl0r@users.noreply.github.com>
+Date: Sat, 18 Apr 2026 00:03:15 +0200
+Subject: [PATCH] reqs: improve stathost detection (#606)
+
+until now, only the basicauth code checked the host header, regular connections didn't.
+
+- add a new helper function to compare a hostname with optional
+ trailingcolon/port against the stathost.
+- add stathost check via host header before transparent proxy check,
+ else stathost might be misdetected as a trans host request.
+- refactor existing stathost checks to use the new helper
+
+this should make it easier to access the stathost, for example by
+injecting a host header into a curl command line with -H:
+
+ $ curl -H "Host: tinyproxy.stats" 127.0.0.1:8080
+
+the stathost can also be specified as an ip address, e.g.
+Stathost "127.0.0.10" + a separate Listen statement for that ip.
+in such a case e.g.
+
+ $ curl http://127.0.0.10:8080
+
+would work too, even if curl didn't add a Host header (but it does anyway).
+
+(cherry picked from commit 09312a185ae25cc486b4ff5987638a7917a48bce)
+
+CVE: CVE-2026-55202
+Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/reqs.c | 37 +++++++++++++++++++++++++------------
+ 1 file changed, 25 insertions(+), 12 deletions(-)
+
+diff --git a/src/reqs.c b/src/reqs.c
+index e3cfe76..d5037cf 100644
+--- a/src/reqs.c
++++ b/src/reqs.c
+@@ -316,6 +316,17 @@ static int send_connect_method_response (struct conn_s *connptr)
+ connptr->protocol.minor);
+ }
+
++/* determine whether a hostname with optional trailing colon/port is the
++ stathost */
++static int is_stathost (const char* host)
++{
++ const char *p = config->stathost;
++ const char *q = host;
++ if (!p || !q) return 0;
++ while (*p && *(p++) == *(q++));
++ return *p == 0 && (*q == 0 || *q == ':');
++}
++
+ /*
+ * Break the request line apart and figure out where to connect and
+ * build a new request line. Finally connect to the remote server.
+@@ -384,6 +395,16 @@ BAD_REQUEST_ERROR:
+ goto fail;
+ }
+
++ /*
++ * Check to see if they're requesting the stat host
++ */
++ if (is_stathost (pseudomap_find (hashofheaders, "host"))) {
++got_stathost:
++ log_message (LOG_NOTICE, "Request for the stathost.");
++ connptr->show_stats = TRUE;
++ goto fail;
++ }
++
+ #ifdef REVERSE_SUPPORT
+ if (config->reversepath_list != NULL) {
+ /*
+@@ -497,19 +518,11 @@ BAD_REQUEST_ERROR:
+ }
+ }
+ #endif
+-
+-
+- /*
+- * Check to see if they're requesting the stat host
+- */
+- if (config->stathost && strcmp (config->stathost, request->host) == 0) {
+- log_message (LOG_NOTICE, "Request for the stathost.");
+- connptr->show_stats = TRUE;
+- goto fail;
+- }
++ /* check whether hostname from url is the stathost */
++ if (is_stathost (request->host))
++ goto got_stathost;
+
+ safefree (url);
+-
+ return request;
+
+ fail:
+@@ -1688,7 +1701,7 @@ void handle_connection (struct conn_s *connptr, union sockaddr_union* addr)
+
+ if (!authstring && config->stathost) {
+ authstring = pseudomap_find (hashofheaders, "host");
+- if (authstring && !strncmp(authstring, config->stathost, strlen(config->stathost))) {
++ if (authstring && is_stathost(authstring)) {
+ authstring = pseudomap_find (hashofheaders, "authorization");
+ stathost_connect = 1;
+ } else authstring = 0;
diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
index e84aeae53c..25df44301b 100644
--- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
+++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb
@@ -11,6 +11,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz
file://CVE-2026-3945-2.patch \
file://CVE-2026-31842.patch \
file://CVE-2026-54387.patch \
+ file://CVE-2026-55202.patch \
"
SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 42/82] wolfssl: mark CVEs patched
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (40 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 41/82] tinyproxy: patch CVE-2026-55202 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 43/82] python3-gunicorn: mark CVE-2024-1135 patched ankur.tyagi85
` (40 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version.
Details:
https://nvd.nist.gov/vuln/detail/cve-2023-6937
https://nvd.nist.gov/vuln/detail/cve-2024-5814
[1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities
[2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit c12fcc9b481d5fcd94db96cd062042301a4f24b1)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb
index 8fc6068560..a2b41b2d3c 100644
--- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb
+++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb
@@ -72,3 +72,5 @@ CVE_STATUS[CVE-2026-5504] = "fixed-version: fixed in 5.9.1"
CVE_STATUS[CVE-2026-5507] = "fixed-version: fixed in 5.9.1"
CVE_STATUS[CVE-2026-5772] = "fixed-version: fixed in 5.9.1"
CVE_STATUS[CVE-2026-5778] = "fixed-version: fixed in 5.9.1"
+CVE_STATUS[CVE-2023-6937] = "fixed-version: fixed since v5.6.6"
+CVE_STATUS[CVE-2024-5814] = "fixed-version: fixed since v5.7.2"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 43/82] python3-gunicorn: mark CVE-2024-1135 patched
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (41 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 42/82] wolfssl: mark CVEs patched ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 44/82] pgpool2: upgrade 4.7.2 -> 4.7.3 ankur.tyagi85
` (39 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Debian[1] also identified the commit.
Details:
https://nvd.nist.gov/vuln/detail/cve-2024-1135
[1]https://security-tracker.debian.org/tracker/CVE-2024-1135
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb
index 545947446c..e19be89360 100644
--- a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb
+++ b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb
@@ -41,3 +41,5 @@ EOF
}
RDEPENDS:${PN} += "python3-setuptools python3-fcntl"
+
+CVE_STATUS[CVE-2024-1135] = "fixed-version: fixed since v22.0.0"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 44/82] pgpool2: upgrade 4.7.2 -> 4.7.3
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (42 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 43/82] python3-gunicorn: mark CVE-2024-1135 patched ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 45/82] smarty: upgrade 5.8.4 -> 5.8.5 ankur.tyagi85
` (38 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://www.pgpool.net/docs/latest/en/html/release-4-7-3.html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 192d012d9a1f40061901ad4302a4d90fc08769aa)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../pgpool2/{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-networking/recipes-support/pgpool2/{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} (95%)
diff --git a/meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb b/meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb
similarity index 95%
rename from meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb
rename to meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb
index c6b6a22c64..2648cc1f9f 100644
--- a/meta-networking/recipes-support/pgpool2/pgpool2_4.7.2.bb
+++ b/meta-networking/recipes-support/pgpool2/pgpool2_4.7.3.bb
@@ -16,7 +16,7 @@ SRC_URI = "https://www.pgpool.net/source/pgpool-II-${PV}.tar.gz \
file://pgpool.sysconfig \
file://pgpool.service \
"
-SRC_URI[sha256sum] = "e72b9d0ff3620f7da7e33a58dda44b77919d056752dc9bd86b2985c4988d1938"
+SRC_URI[sha256sum] = "4bf9df3e13feb8e64bee486b4ea54c9076296c2d9406165b0b68d32086fce250"
S = "${UNPACKDIR}/pgpool-II-${PV}"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 45/82] smarty: upgrade 5.8.4 -> 5.8.5
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (43 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 44/82] pgpool2: upgrade 4.7.2 -> 4.7.3 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 46/82] python3-astroid: upgrade 4.3.2 -> 4.3.3 ankur.tyagi85
` (37 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/smarty-php/smarty/releases/tag/v5.8.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 3fe4c2247419cbe376ad010e2e56536bec3faab0)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-oe/recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} (95%)
diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb
similarity index 95%
rename from meta-oe/recipes-support/smarty/smarty_5.8.4.bb
rename to meta-oe/recipes-support/smarty/smarty_5.8.5.bb
index dcb7c85a80..83f428d388 100644
--- a/meta-oe/recipes-support/smarty/smarty_5.8.4.bb
+++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=2c0f216b2120ffc367e20f2b56df51b3"
SRC_URI = "git://github.com/smarty-php/smarty.git;protocol=https;branch=master;tag=v${PV}"
-SRCREV = "94a27cbbc7820198d7adc17a2be8d457fb267753"
+SRCREV = "0ae663525dcbc9e996feb2a867e43bc85f960938"
INHIBIT_DEFAULT_DEPS = "1"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 46/82] python3-astroid: upgrade 4.3.2 -> 4.3.3
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (44 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 45/82] smarty: upgrade 5.8.4 -> 5.8.5 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 47/82] python3-django: upgrade 6.0.8 -> 6.0.9 ankur.tyagi85
` (36 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/pylint-dev/astroid/releases/tag/v4.3.3
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 486ef820db2ec71ff8da90f4c9634a200d6a15bf)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../{python3-astroid_4.3.2.bb => python3-astroid_4.3.3.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-astroid_4.3.2.bb => python3-astroid_4.3.3.bb} (89%)
diff --git a/meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb b/meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb
similarity index 89%
rename from meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb
rename to meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb
index 55f4d01194..c9a209aba0 100644
--- a/meta-python/recipes-devtools/python/python3-astroid_4.3.2.bb
+++ b/meta-python/recipes-devtools/python/python3-astroid_4.3.3.bb
@@ -4,7 +4,7 @@ SECTION = "devel/python"
LICENSE = "LGPL-2.1-only"
LIC_FILES_CHKSUM = "file://LICENSE;md5=a70cf540abf41acb644ac3b621b2fad1"
-SRC_URI[sha256sum] = "8cdaf5b7f3f4f39557ae05ed8b0852136b43a04ab686db7d39255b206233677a"
+SRC_URI[sha256sum] = "d03854b09d92c08e18d8e7d9185d393961186ed0747136d8fcb2d1c008a504ec"
inherit pypi python_setuptools_build_meta
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 47/82] python3-django: upgrade 6.0.8 -> 6.0.9
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (45 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 46/82] python3-astroid: upgrade 4.3.2 -> 4.3.3 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 48/82] python3-django: upgrade 5.2.17 -> 5.2.18 ankur.tyagi85
` (35 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://docs.djangoproject.com/en/dev/releases/6.0.9/
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit c39562d398bdde11ba32c9144a8189f87ef922d7)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../python/{python3-django_6.0.8.bb => python3-django_6.0.9.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-django_6.0.8.bb => python3-django_6.0.9.bb} (75%)
diff --git a/meta-python/recipes-devtools/python/python3-django_6.0.8.bb b/meta-python/recipes-devtools/python/python3-django_6.0.9.bb
similarity index 75%
rename from meta-python/recipes-devtools/python/python3-django_6.0.8.bb
rename to meta-python/recipes-devtools/python/python3-django_6.0.9.bb
index 0c7fb2197d..acdd2c21d0 100644
--- a/meta-python/recipes-devtools/python/python3-django_6.0.8.bb
+++ b/meta-python/recipes-devtools/python/python3-django_6.0.9.bb
@@ -1,7 +1,7 @@
require python3-django.inc
inherit python_setuptools_build_meta
-SRC_URI[sha256sum] = "cb0bd962d27fc866f3c514b20aae6a7df56ec80b488f9899da46d675cd051526"
+SRC_URI[sha256sum] = "8ce037c971f421cfb47d38c097ca233a8f6dd42d9e9501a37e02dd7d08c5cb3f"
# Set DEFAULT_PREFERENCE so that the LTS version of django is built by
# default. To build the 6.x branch,
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 48/82] python3-django: upgrade 5.2.17 -> 5.2.18
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (46 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 47/82] python3-django: upgrade 6.0.8 -> 6.0.9 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 49/82] python3-tzdata: upgrade 2026.4 -> 2026.5 ankur.tyagi85
` (34 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://docs.djangoproject.com/en/dev/releases/5.2.18/
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0640fa901df7783fc9f544a6bbfde5b771e22b96)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../{python3-django_5.2.17.bb => python3-django_5.2.18.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-django_5.2.17.bb => python3-django_5.2.18.bb} (61%)
diff --git a/meta-python/recipes-devtools/python/python3-django_5.2.17.bb b/meta-python/recipes-devtools/python/python3-django_5.2.18.bb
similarity index 61%
rename from meta-python/recipes-devtools/python/python3-django_5.2.17.bb
rename to meta-python/recipes-devtools/python/python3-django_5.2.18.bb
index a9009adaf9..eb84122116 100644
--- a/meta-python/recipes-devtools/python/python3-django_5.2.17.bb
+++ b/meta-python/recipes-devtools/python/python3-django_5.2.18.bb
@@ -2,4 +2,4 @@ require python3-django.inc
inherit python_setuptools_build_meta
SRC_URI += "file://0001-fix-test_msgfmt_error_including_non_ascii-test.patch"
-SRC_URI[sha256sum] = "9d4d93be539a18ab80d058eb515900e10951e04c537c5a6b394fc49528d3251f"
+SRC_URI[sha256sum] = "461c5dd06d2ea16bd5ca37d3f46e4def1d6b0fe7588c6f4e2119517bb0af8b2d"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 49/82] python3-tzdata: upgrade 2026.4 -> 2026.5
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (47 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 48/82] python3-django: upgrade 5.2.17 -> 5.2.18 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 50/82] python3-werkzeug: upgrade 3.1.8 -> 3.1.9 ankur.tyagi85
` (33 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/python/tzdata/releases/tag/2026.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 01bd918ea8c7a391e977b9ab409605fa7fc5d953)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../{python3-tzdata_2026.4.bb => python3-tzdata_2026.5.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-tzdata_2026.4.bb => python3-tzdata_2026.5.bb} (86%)
diff --git a/meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb b/meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb
similarity index 86%
rename from meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb
rename to meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb
index 9bd29afa61..4590cec28d 100644
--- a/meta-python/recipes-devtools/python/python3-tzdata_2026.4.bb
+++ b/meta-python/recipes-devtools/python/python3-tzdata_2026.5.bb
@@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=804220b73c90950be376e7ff7b2066bb \
file://licenses/LICENSE_APACHE;md5=86d3f3a95c324c9479bd8986968f4327 \
"
-SRC_URI[sha256sum] = "f1b8bd365d8d210c55353f4d7f8d6d8561c0ba50d704b700d195a9424bba0d79"
+SRC_URI[sha256sum] = "8cc73c0a0bfca7dbfa59235d60b2eff82231dee33f53d206db1acd9173cfc0a7"
inherit pypi python_setuptools_build_meta ptest-python-pytest
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 50/82] python3-werkzeug: upgrade 3.1.8 -> 3.1.9
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (48 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 49/82] python3-tzdata: upgrade 2026.4 -> 2026.5 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 51/82] python3-zeroconf: upgrade 0.151.3 -> 0.151.5 ankur.tyagi85
` (32 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/pallets/werkzeug/releases/tag/3.1.9
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 0d101e1633262c35907fde6fd2708c0317eedbb5)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../{python3-werkzeug_3.1.8.bb => python3-werkzeug_3.1.9.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-werkzeug_3.1.8.bb => python3-werkzeug_3.1.9.bb} (91%)
diff --git a/meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb b/meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb
similarity index 91%
rename from meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb
rename to meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb
index fae4de2a3f..d3b1598f78 100644
--- a/meta-python/recipes-devtools/python/python3-werkzeug_3.1.8.bb
+++ b/meta-python/recipes-devtools/python/python3-werkzeug_3.1.9.bb
@@ -10,7 +10,7 @@ HOMEPAGE = "https://werkzeug.palletsprojects.com"
LICENSE = "BSD-3-Clause"
LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=5dc88300786f1c214c1e9827a5229462"
-SRC_URI[sha256sum] = "9bad61a4268dac112f1c5cd4630a56ede601b6ed420300677a869083d70a4c44"
+SRC_URI[sha256sum] = "55ca7c70a75689be937aa27f8ff4b018f06ff4838fc73045560bf0f5a1291060"
CVE_PRODUCT = "pallets:werkzeug palletsprojects:werkzeug"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 51/82] python3-zeroconf: upgrade 0.151.3 -> 0.151.5
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (49 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 50/82] python3-werkzeug: upgrade 3.1.8 -> 3.1.9 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 52/82] swagger-ui: upgrade 5.33.0 -> 5.33.1 ankur.tyagi85
` (31 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.4
https://github.com/python-zeroconf/python-zeroconf/releases/tag/0.151.5
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 92fff734092811bbca94ddfa3847a49ef5bea427)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
...{python3-zeroconf_0.151.3.bb => python3-zeroconf_0.151.5.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-python/recipes-devtools/python/{python3-zeroconf_0.151.3.bb => python3-zeroconf_0.151.5.bb} (88%)
diff --git a/meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb b/meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb
similarity index 88%
rename from meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb
rename to meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb
index beadc0b3ed..4111f49a11 100644
--- a/meta-python/recipes-devtools/python/python3-zeroconf_0.151.3.bb
+++ b/meta-python/recipes-devtools/python/python3-zeroconf_0.151.5.bb
@@ -3,7 +3,7 @@ HOMEPAGE = "https://github.com/jstasiak/python-zeroconf"
LICENSE = "LGPL-2.1-or-later"
LIC_FILES_CHKSUM = "file://COPYING;md5=6ede793c8b5508eab1acfad7c0c4e335"
-SRC_URI[sha256sum] = "ce6c548e665759b6150cef4db9ab9d7bdd89857e90c513abd6b7340bdd7dbd6a"
+SRC_URI[sha256sum] = "28c2ec9d772007eedf11b41a9c9fd3d5c684c17b00721ff8f1ee31b20ad286a1"
SRC_URI += "file://run-ptest"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 52/82] swagger-ui: upgrade 5.33.0 -> 5.33.1
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (50 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 51/82] python3-zeroconf: upgrade 0.151.3 -> 0.151.5 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 53/82] openvpn: ignore CVE-2026-84256 ankur.tyagi85
` (30 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Changelog:
https://github.com/swagger-api/swagger-ui/releases/tag/v5.33.1
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 50c590bebc5269b1aadce1d907466c0fee131619)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../swagger-ui/{swagger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} (94%)
diff --git a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb
similarity index 94%
rename from meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb
rename to meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb
index 45a3bb6d17..db2bb498a8 100644
--- a/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.0.bb
+++ b/meta-webserver/recipes-devtools/swagger-ui/swagger-ui_5.33.1.bb
@@ -12,7 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
SRC_URI = "git://github.com/swagger-api/swagger-ui;branch=main;protocol=https;tag=v${PV}"
-SRCREV = "cfd4a6c3cbaeeb7c13a8bada7c754de42d78cd5b"
+SRCREV = "cac3d136b5e37bfbe3288c8591f6f4fcf9870599"
CVE_STATUS[CVE-2016-1000229] = "fixed-version: fixed since 2.2.1"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 53/82] openvpn: ignore CVE-2026-84256
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (51 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 52/82] swagger-ui: upgrade 5.33.0 -> 5.33.1 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 54/82] openvpn: patch CVE-2026-88964 ankur.tyagi85
` (29 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84256
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
index 604162a7f2..9bf699124c 100644
--- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
+++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
@@ -18,6 +18,7 @@ UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"
SRC_URI[sha256sum] = "3ab8f48fd6c26d49ba2333a092433949afdb5c85c0e6a1ff265784fbc04a2463"
CVE_STATUS[CVE-2020-27569] = "not-applicable-config: Applies only Aviatrix OpenVPN client, not openvpn"
+CVE_STATUS[CVE-2026-84256] = "not-applicable-platform: Issue only applies on Windows"
INITSCRIPT_PACKAGES = "${PN}"
INITSCRIPT_NAME:${PN} = "openvpn"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 54/82] openvpn: patch CVE-2026-88964
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (52 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 53/82] openvpn: ignore CVE-2026-84256 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 55/82] openvpn: patch CVE-2026-84790 ankur.tyagi85
` (28 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8
[1]https://security-tracker.debian.org/tracker/CVE-2026-88964
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../openvpn/openvpn/CVE-2026-88964.patch | 78 +++++++++++++++++++
.../recipes-support/openvpn/openvpn_2.7.7.bb | 1 +
2 files changed, 79 insertions(+)
create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch
diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch
new file mode 100644
index 0000000000..a2b9b0ec8a
--- /dev/null
+++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch
@@ -0,0 +1,78 @@
+From 22526848c6606698d6374c496f36009b9c6787ce Mon Sep 17 00:00:00 2001
+From: Cole Munz <Munzzyy1@proton.me>
+Date: Sun, 13 Sep 2026 15:23:17 +0200
+Subject: [PATCH] options: fix unsigned underflow when clearing
+ domain_search_list
+
+remove_option() and update_option() clear the domain search list with
+
+ while (o->domain_search_list_len-- > 0)
+
+domain_search_list_len is unsigned, and the post-decrement runs on the
+final test too. When the length reaches 0 the condition is false but
+the decrement has already wrapped it to UINT_MAX, so the field is left
+corrupted. The next reset then does
+
+ o->domain_search_list[UINT_MAX] = NULL
+
+and walks far out of bounds, writing NULL through each slot. A server
+can drive this reset path against a client with PUSH_UPDATE, so on
+Windows and Android this is a remotely reachable out-of-bounds write.
+
+v2:
+ Change to the semantics used for all the other lists there - set
+ length to 0 and clear the list with CLEAR().
+
+Change-Id: I3724236d4acc3d05d786274d6baf34a21c570594
+Signed-off-by: Cole Munz <Munzzyy1@proton.me>
+Acked-by: Razvan Cojocaru <razvanc@mailbox.org>
+Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1914
+Github: OpenVPN/openvpn-private-issues#178
+CVE: 2026-88964
+Message-Id: <20260913132322.2283-1-gert@greenie.muc.de>
+URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39157.html
+Signed-off-by: Gert Doering <gert@greenie.muc.de>
+(cherry picked from commit aa12dd64b74142bbbff9f37cec05959ba115c06d)
+(cherry picked from commit d586f8ad9bfc582cc7984fcd482dc7cfacc940e2)
+
+CVE: CVE-2026-88964
+Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/d586f8ad9bfc582cc7984fcd482dc7cfacc940e2]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/openvpn/options.c | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/src/openvpn/options.c b/src/openvpn/options.c
+index b7d035b6..847572c2 100644
+--- a/src/openvpn/options.c
++++ b/src/openvpn/options.c
+@@ -5220,12 +5220,12 @@ remove_option(struct context *c, struct options *options, char *p[], bool is_inl
+ memset(o->ntp, 0, sizeof(o->ntp));
+ o->nbdd_len = 0;
+ memset(o->nbdd, 0, sizeof(o->nbdd));
+- while (o->domain_search_list_len-- > 0)
+- {
+- o->domain_search_list[o->domain_search_list_len] = NULL;
+- }
++ o->domain_search_list_len = 0;
++ CLEAR(o->domain_search_list);
+ o->disable_nbt = 0;
+ o->dhcp_options = 0;
++ CLEAR(options->dns_options.from_dhcp);
++
+ #if defined(TARGET_ANDROID)
+ o->http_proxy_port = 0;
+ o->http_proxy = NULL;
+@@ -5524,10 +5524,8 @@ update_option(struct context *c, struct options *options, char *p[], bool is_inl
+ CLEAR(o->ntp);
+ o->nbdd_len = 0;
+ CLEAR(o->nbdd);
+- while (o->domain_search_list_len-- > 0)
+- {
+- o->domain_search_list[o->domain_search_list_len] = NULL;
+- }
++ o->domain_search_list_len = 0;
++ CLEAR(o->domain_search_list);
+ o->disable_nbt = 0;
+ o->dhcp_options = 0;
+
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
index 9bf699124c..6338a0c816 100644
--- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
+++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
@@ -11,6 +11,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar
file://0001-configure.ac-eliminate-build-path-from-openvpn-versi.patch \
file://openvpn \
file://run-ptest \
+ file://CVE-2026-88964.patch \
"
UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 55/82] openvpn: patch CVE-2026-84790
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (53 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 54/82] openvpn: patch CVE-2026-88964 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 56/82] python3-eventlet: mark CVE-2023-29483 fixed ankur.tyagi85
` (27 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Backport commit identified by Debian[1], also mentioned in the release note
https://github.com/OpenVPN/openvpn/releases/tag/v2.7.8
[1]https://security-tracker.debian.org/tracker/CVE-2026-84790
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../openvpn/openvpn/CVE-2026-84790.patch | 361 ++++++++++++++++++
.../recipes-support/openvpn/openvpn_2.7.7.bb | 1 +
2 files changed, 362 insertions(+)
create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch
diff --git a/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch
new file mode 100644
index 0000000000..b6f70d106d
--- /dev/null
+++ b/meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch
@@ -0,0 +1,361 @@
+From 493c3b382a907ff2d5870cd0d21526bd2e866ebb Mon Sep 17 00:00:00 2001
+From: Max Fillinger <maximilian.fillinger@sentyron.com>
+Date: Thu, 17 Sep 2026 14:46:05 +0200
+Subject: [PATCH] Check for null-bytes in certificate subjects
+
+When using the OpenSSL library, we escaped embedded null-bytes in a
+certificate's subject in x509_get_subject(), but in
+extract_x509_field_ssl(), we copied any null-bytes that are contained in
+the field value. When using the option --verify-x509-name, this could
+lead to an incorrect name being accepted. For example, the common name
+"admin\0impersonator" would be accepted when running with
+--verify-x509-name admin name.
+
+To fix this, this commit makes x509_get_subject() return an error if the
+subject contains an embedded null-byte. This way, OpenVPN won't connect
+with peers that present such certificates.
+
+As a defense-in-depth measure, we also check for null-bytes in
+extract_x509_field_ssl() in case a future version of OpenVPN has a code
+path that avoids x509_get_subject().
+
+With Mbed TLS, the x509_get_subject() function already returned an error
+when there is an embedded null-byte. (As of Mbed TLS 3.5.) Here too, we
+added a check for null-bytes to the function where we extract individual
+fields from the subject.
+
+Also, backend_x509_get_username() is changed so that it returns the
+value of the *last* matching field, to be consistent with the behavior
+of the OpenSSL backend.
+
+This is a partial backport of the commit
+"Check for \0 and RFC 2253 chars in cert subjects" from the master
+branch but skipping the part about escaping RFC 2253 characters to avoid
+user-visible changes in a patch release. We do not consider the
+null-byte check "user-visible" because we don't expect users to put
+null-bytes into the common name.
+
+v2: The previous version of the commit unescaped control characters in
+the subject, so it had user-visible changes after all. This version
+escapes any control characters in the subject.
+
+Discovered and reported by BreachX Zero Day Labs, using Typhon AI Mil v2.
+Contributing Researcher: Vivek Parikh.
+
+CVE: 2026-84790
+Reported-by: Vivek Parikh <vivek.parikh@breachx.ai>
+Github: OpenVPN/openvpn-private-issues#163
+
+Change-Id: Iea1481e94ba1abe18c39d81cd797187c88427571
+Signed-off-by: Max Fillinger <maximilian.fillinger@sentyron.com>
+Acked-by: Steffan Karger <steffan@karger.me>
+Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1902
+Message-Id: <20260917124610.14291-1-gert@greenie.muc.de>
+URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg39304.html
+Signed-off-by: Gert Doering <gert@greenie.muc.de>
+(cherry picked from commit cf4384eef4676a01bd3ee98fa602f7b2af8079ea)
+
+CVE: CVE-2026-84790
+Upstream-Status: Backport [https://github.com/OpenVPN/openvpn/commit/cf4384eef4676a01bd3ee98fa602f7b2af8079ea]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/openvpn/ssl_verify_mbedtls.c | 51 ++++++++++------
+ src/openvpn/ssl_verify_openssl.c | 41 ++++++++++---
+ tests/unit_tests/openvpn/test_ssl.c | 92 ++++++++++++++++++++++++++++-
+ 3 files changed, 155 insertions(+), 29 deletions(-)
+
+diff --git a/src/openvpn/ssl_verify_mbedtls.c b/src/openvpn/ssl_verify_mbedtls.c
+index 66cc66e5..1319c079 100644
+--- a/src/openvpn/ssl_verify_mbedtls.c
++++ b/src/openvpn/ssl_verify_mbedtls.c
+@@ -214,6 +214,24 @@ fieldname_to_oid(const char *fieldname)
+ }
+ }
+
++static bool
++asn1_buf_is_cstr_compatible(const mbedtls_asn1_buf *asn1_buf)
++{
++ if (!(asn1_buf->tag == MBEDTLS_ASN1_UTF8_STRING || asn1_buf->tag == MBEDTLS_ASN1_PRINTABLE_STRING
++ || asn1_buf->tag == MBEDTLS_ASN1_IA5_STRING))
++ {
++ return false;
++ }
++ for (size_t i = 0; i < asn1_buf->len; i++)
++ {
++ if (asn1_buf->p[i] == '\0')
++ {
++ return false;
++ }
++ }
++ return true;
++}
++
+ result_t
+ backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mbedtls_x509_crt *cert)
+ {
+@@ -259,16 +277,17 @@ backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mb
+ }
+
+ /* Find field_oid in the subject name. */
+- mbedtls_x509_name *name = &cert->subject;
+- while (name != NULL)
++ mbedtls_x509_name *name = NULL;
++ mbedtls_x509_name *next = &cert->subject;
++ while (next != NULL)
+ {
+- if (strlen(field_oid) == name->oid.len
+- && 0 == memcmp(name->oid.p, field_oid, name->oid.len))
++ if (strlen(field_oid) == next->oid.len
++ && 0 == memcmp(next->oid.p, field_oid, next->oid.len))
+ {
+- break;
++ name = next;
+ }
+
+- name = name->next;
++ next = next->next;
+ }
+
+ /* Not found, return an error if this is the peer's certificate */
+@@ -277,6 +296,11 @@ backend_x509_get_username(char *cn, size_t cn_len, char *x509_username_field, mb
+ goto fail;
+ }
+
++ if (!asn1_buf_is_cstr_compatible(&name->val))
++ {
++ goto fail;
++ }
++
+ /* Check that we have room in the buffer, including the terminating '/0' byte. */
+ if (cn_len <= name->val.len)
+ {
+@@ -586,22 +610,11 @@ do_setenv_x509(struct env_set *es, const char *name, char *value, int depth)
+ static char *
+ asn1_buf_to_c_string(const mbedtls_asn1_buf *orig, struct gc_arena *gc)
+ {
+- size_t i;
+ char *val;
+
+- if (!(orig->tag == MBEDTLS_ASN1_UTF8_STRING || orig->tag == MBEDTLS_ASN1_PRINTABLE_STRING
+- || orig->tag == MBEDTLS_ASN1_IA5_STRING))
++ if (!asn1_buf_is_cstr_compatible(orig))
+ {
+- /* Only support C-string compatible types */
+- return string_alloc("ERROR: unsupported ASN.1 string type", gc);
+- }
+-
+- for (i = 0; i < orig->len; ++i)
+- {
+- if (orig->p[i] == '\0')
+- {
+- return string_alloc("ERROR: embedded null value", gc);
+- }
++ return string_alloc("ERROR: Unsupported string type or embedded null bytes.", gc);
+ }
+ val = gc_malloc(orig->len + 1, false, gc);
+ memcpy(val, orig->p, orig->len);
+diff --git a/src/openvpn/ssl_verify_openssl.c b/src/openvpn/ssl_verify_openssl.c
+index a30099d0..1f2804ff 100644
+--- a/src/openvpn/ssl_verify_openssl.c
++++ b/src/openvpn/ssl_verify_openssl.c
+@@ -196,12 +196,13 @@ extract_x509_field_ssl(const X509_NAME *x509, const char *field_name, char *out,
+ int lastpos = -1;
+ int tmp = -1;
+ unsigned char *buf = NULL;
++ result_t ret = FAILURE;
+
+ ASN1_OBJECT *field_name_obj = OBJ_txt2obj(field_name, 0);
+ if (field_name_obj == NULL)
+ {
+ msg(D_TLS_ERRORS, "Invalid X509 attribute name '%s'", field_name);
+- return FAILURE;
++ goto exit;
+ }
+
+ ASSERT(size > 0);
+@@ -222,28 +223,31 @@ extract_x509_field_ssl(const X509_NAME *x509, const char *field_name, char *out,
+ /* Nothing found */
+ if (lastpos == -1)
+ {
+- return FAILURE;
++ goto exit;
+ }
+
+ const X509_NAME_ENTRY *x509ne = X509_NAME_get_entry(x509, lastpos);
+ if (!x509ne)
+ {
+- return FAILURE;
++ goto exit;
+ }
+
+ const ASN1_STRING *asn1 = X509_NAME_ENTRY_get_data(x509ne);
+ if (!asn1)
+ {
+- return FAILURE;
++ goto exit;
+ }
+- if (ASN1_STRING_to_UTF8(&buf, asn1) < 0)
++ int length = ASN1_STRING_to_UTF8(&buf, asn1);
++ if (length < 0 || (size_t)length != strlen((char *)buf))
+ {
+- return FAILURE;
++ goto exit;
+ }
+
+ strncpynt(out, (char *)buf, size);
+
+- const result_t ret = (strlen((char *)buf) < size) ? SUCCESS : FAILURE;
++ ret = (strlen((char *)buf) < size) ? SUCCESS : FAILURE;
++
++exit:
+ OPENSSL_free(buf);
+ return ret;
+ }
+@@ -384,15 +388,34 @@ x509_get_subject(X509 *cert, struct gc_arena *gc)
+ goto err;
+ }
+
++ /* Get the subject with unescaped control characters so that we can check for null bytes. */
+ X509_NAME_print_ex(subject_bio, X509_get_subject_name(cert), 0,
+- XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT
+- | ASN1_STRFLGS_ESC_CTRL);
++ XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT);
+
+ if (BIO_eof(subject_bio))
+ {
+ goto err;
+ }
+
++ BIO_get_mem_ptr(subject_bio, &subject_mem);
++ if (memchr(subject_mem->data, 0, subject_mem->length) != NULL)
++ {
++ msg(M_WARN, "ERROR: Certificate subject contains a '\\0' byte.");
++ goto err;
++ }
++
++ /* Now output the subject with escaped control characters. */
++ if (BIO_reset(subject_bio) != 1)
++ {
++ goto err;
++ }
++ X509_NAME_print_ex(subject_bio, X509_get_subject_name(cert), 0,
++ XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN | ASN1_STRFLGS_UTF8_CONVERT
++ | ASN1_STRFLGS_ESC_CTRL);
++ if (BIO_eof(subject_bio))
++ {
++ goto err;
++ }
+ BIO_get_mem_ptr(subject_bio, &subject_mem);
+
+ subject = gc_malloc(subject_mem->length + 1, false, gc);
+diff --git a/tests/unit_tests/openvpn/test_ssl.c b/tests/unit_tests/openvpn/test_ssl.c
+index 7e7679c5..adfc07a8 100644
+--- a/tests/unit_tests/openvpn/test_ssl.c
++++ b/tests/unit_tests/openvpn/test_ssl.c
+@@ -884,6 +884,94 @@ crypto_test_print_cert_details(void **state)
+ free_certificate(cert);
+ }
+
++/* Certificate with two CNs, "foo" and "bar".
++ *
++ * Generated with:
++ * openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:secp384r1 -subj "/CN=foo/CN=bar" \
++ * -noenc -out two_cns.crt -keyout two_cns.key
++ */
++static const char *cert_with_two_cns =
++ "-----BEGIN CERTIFICATE-----\n"
++ "MIIByTCCAVCgAwIBAgIUZuvd8Wfnq5jeRc3ohoJ/Vza54wQwCgYIKoZIzj0EAwIw\n"
++ "HDEMMAoGA1UEAwwDZm9vMQwwCgYDVQQDDANiYXIwHhcNMjYwODI4MTU1NjAwWhcN\n"
++ "MjYwOTI3MTU1NjAwWjAcMQwwCgYDVQQDDANmb28xDDAKBgNVBAMMA2JhcjB2MBAG\n"
++ "ByqGSM49AgEGBSuBBAAiA2IABERAfb210NOACy+QVYAu3EXrcGhTJpZDfhpDnE/h\n"
++ "PvPMWGWzqecTYdseArxZc0T/5Xma36IKCjGGsgN9ypZ5oQugQlB/NrVRCJIuHSGA\n"
++ "hGBWFvnUsqdNo765lGwVdBwhY6NTMFEwHQYDVR0OBBYEFPwnD+wK9R81Syk0qyTI\n"
++ "dFT/BNoJMB8GA1UdIwQYMBaAFPwnD+wK9R81Syk0qyTIdFT/BNoJMA8GA1UdEwEB\n"
++ "/wQFMAMBAf8wCgYIKoZIzj0EAwIDZwAwZAIwGxazGb6RRQtXzOWCPLRKId4e+E88\n"
++ "cwoCK3UwzEr8+Ddf54w5cEZC54f5J6AKFUJjAjBpT/JqF41uK57H+8i/16oZkBcm\n"
++ "OyQnlH8W/UzZo3/weTEBTcNW0iuCpIrS6im8pSk=\n"
++ "-----END CERTIFICATE-----\n";
++
++void
++ssl_test_extract_last_matching_field(void **state)
++{
++ /* When there are multiple fields of the same type in the certificate's subject, OpenVPN
++ * should extract the value of the last matching field. This is essentially arbitrary and there
++ * is no correct choice here, but this test exists to make sure that the behavior is consistent
++ * between different backends.
++ */
++ openvpn_x509_cert_t *cert = get_certificate(cert_with_two_cns);
++
++ char username[TLS_USERNAME_LEN + 1] = { 0 };
++ assert_int_equal(backend_x509_get_username(username, sizeof(username), "CN", cert), SUCCESS);
++ assert_string_equal(username, "bar");
++ free_certificate(cert);
++}
++
++/* Certificate with a null-byte embedded in the CN.
++ *
++ * Generated with the following Python script:
++ *
++ * from cryptography import x509
++ * from cryptography.x509.oid import NameOID, ExtensionOID, ExtendedKeyUsageOID
++ * from cryptography.hazmat.primitives import hashes, serialization
++ * from cryptography.hazmat.primitives.asymmetric import ec
++ * import datetime
++ *
++ * private_key = ec.generate_private_key(ec.SECP384R1())
++ * now = datetime.datetime.now(datetime.timezone.utc)
++ * name = "with\x00null"
++ *
++ * cert = (x509.CertificateBuilder()
++ * .subject_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, name)]))
++ * .issuer_name(x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, name)]))
++ * .public_key(private_key.public_key())
++ * .serial_number(x509.random_serial_number())
++ * .not_valid_before(now)
++ * .not_valid_after(now + datetime.timedelta(days=10 * 365))
++ * .sign(private_key, hashes.SHA256()))
++ *
++ * print(str(cert.public_bytes(serialization.Encoding.PEM), encoding='utf-8'))
++ **/
++static const char *cert_with_null =
++ "-----BEGIN CERTIFICATE-----\n"
++ "MIIBZTCB66ADAgECAhRLWdNRl+C20KKBG4QC9HFPWlOtBzAKBggqhkjOPQQDAjAU\n"
++ "MRIwEAYDVQQDDAl3aXRoAG51bGwwHhcNMjYwODI4MTQzMDA4WhcNMzYwODI1MTQz\n"
++ "MDA4WjAUMRIwEAYDVQQDDAl3aXRoAG51bGwwdjAQBgcqhkjOPQIBBgUrgQQAIgNi\n"
++ "AAT7PE+vJCBiB4CVHBcvJVF9n5n/dGQIn4C8HeYE8M2iXYCIRW5wg6/mlPaeiJY/\n"
++ "Ywh3pa8zhto1+aczbJKTvLgRwXn6N5vNpME1c5iWMzY0WHe1dJyVtoRBvkNvy5+k\n"
++ "GuEwCgYIKoZIzj0EAwIDaQAwZgIxAP2ekdQ8muG8Nv2o3PsBp0CqiaSNByGiP75i\n"
++ "k099bUFvHp/3LSp8Wf4JK2iWzc5h6gIxAINBGg2xjlmMgpXxROKA9qQqaM3d92Mp\n"
++ "EzZyRyPM3PGR83ZPbIaYDq8lCVxVlbYr/Q==\n"
++ "-----END CERTIFICATE-----\n";
++
++void
++ssl_test_reject_null_in_cert_subject(void **state)
++{
++ openvpn_x509_cert_t *cert = get_certificate(cert_with_null);
++ struct gc_arena gc = gc_new();
++
++ /* Trying to get the subject as a whole should fail. */
++ assert_ptr_equal(x509_get_subject(cert, &gc), NULL);
++
++ /* Trying to extract the common name should fail. */
++ char username[TLS_USERNAME_LEN + 1] = { 0 };
++ assert_int_equal(backend_x509_get_username(username, sizeof(username), "CN", cert), FAILURE);
++ gc_free(&gc);
++ free_certificate(cert);
++}
+
+ int
+ main(void)
+@@ -908,7 +996,9 @@ main(void)
+ cmocka_unit_test(test_data_channel_roundtrip_bf_cbc),
+ cmocka_unit_test(test_data_channel_known_vectors_epoch),
+ cmocka_unit_test(test_data_channel_known_vectors_shortpktid),
+- cmocka_unit_test(crypto_test_print_cert_details)
++ cmocka_unit_test(crypto_test_print_cert_details),
++ cmocka_unit_test(ssl_test_extract_last_matching_field),
++ cmocka_unit_test(ssl_test_reject_null_in_cert_subject)
+
+ };
+
diff --git a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
index 6338a0c816..f4aa8fce9c 100644
--- a/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
+++ b/meta-networking/recipes-support/openvpn/openvpn_2.7.7.bb
@@ -12,6 +12,7 @@ SRC_URI = "https://github.com/OpenVPN/openvpn/releases/download/v${PV}/${BP}.tar
file://openvpn \
file://run-ptest \
file://CVE-2026-88964.patch \
+ file://CVE-2026-84790.patch \
"
UPSTREAM_CHECK_URI = "https://openvpn.net/community-downloads"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 56/82] python3-eventlet: mark CVE-2023-29483 fixed
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (54 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 55/82] openvpn: patch CVE-2026-84790 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 57/82] cjson: patch CVE-2026-87933 ankur.tyagi85
` (26 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Fix[1] for the CVE is part of the upstream version.
Details:
https://nvd.nist.gov/vuln/detail/cve-2023-29483
[1]https://github.com/eventlet/eventlet/commit/51e3c4928d4938beb576eff34f3bf97e6e64e6b4
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 47b2ce9cc77297c740ecf50d00d6956f5a867144)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb
index 3292950e2c..67a69b1478 100644
--- a/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb
+++ b/meta-python/recipes-devtools/python/python3-eventlet_0.41.2.bb
@@ -17,3 +17,5 @@ RDEPENDS:${PN} += " \
python3-dnspython \
python3-greenlet \
"
+
+CVE_STATUS[CVE-2023-29483] = "fixed-version: fixed since v0.35.2"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 57/82] cjson: patch CVE-2026-87933
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (55 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 56/82] python3-eventlet: mark CVE-2023-29483 fixed ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 58/82] smarty: mark CVE-2026-82531 patched ankur.tyagi85
` (25 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-87933
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2b3f5cbbd85177f06cea6f89f0b6d83bba48da40)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../cjson/cjson/CVE-2026-87933.patch | 110 ++++++++++++++++++
.../recipes-devtools/cjson/cjson_1.7.19.bb | 1 +
2 files changed, 111 insertions(+)
create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch
diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch
new file mode 100644
index 0000000000..3972e5eafc
--- /dev/null
+++ b/meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch
@@ -0,0 +1,110 @@
+From a1b370963c98e1374e5538e97841f9d476a8932e Mon Sep 17 00:00:00 2001
+From: lilu5458 <lilu@kylinos.cn>
+Date: Wed, 16 Sep 2026 09:55:35 +0800
+Subject: [PATCH] Fix: heap-use-after-free in merge_patch when patch is subtree
+ of target (#1065)
+
+When cJSONUtils_MergePatch(target, patch) is called with a non-object
+patch (scalar, array, or NULL) that happens to be a subtree of target,
+merge_patch() called cJSON_Delete(target) first, which freed the patch
+memory, and then cJSON_Duplicate(patch, 1) read the already-freed memory,
+triggering a heap-use-after-free (detected by AddressSanitizer at
+cJSON_Duplicate_rec, cJSON.c:2808).
+
+Fix: duplicate the patch first into a local variable, then delete the
+target, then return the duplicate. This matches the Option B approach
+proposed in issue #1060.
+
+Verified locally:
+- Reproduced the UAF with a minimal PoC under ASan before the fix.
+- After the fix the PoC runs cleanly (exit 0, correct result [1,2,3]).
+- Added a regression unit test
+ (merge_patch_should_not_read_freed_memory_when_patch_is_subtree).
+- Full ctest suite passes (22/22 tests).
+
+Fixes #1060
+
+Signed-off-by: lilu <lilu@kylinos.cn>
+(cherry picked from commit 6d9f2443ab071f86e5d9b43025a40929ec41c46c)
+
+CVE: CVE-2026-87933
+Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/6d9f2443ab071f86e5d9b43025a40929ec41c46c]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ cJSON_Utils.c | 8 ++++++--
+ tests/old_utils_tests.c | 34 ++++++++++++++++++++++++++++++++++
+ 2 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/cJSON_Utils.c b/cJSON_Utils.c
+index 8fa24f8..6f41875 100644
+--- a/cJSON_Utils.c
++++ b/cJSON_Utils.c
+@@ -1324,9 +1324,13 @@ static cJSON *merge_patch(cJSON *target, const cJSON * const patch, const cJSON_
+
+ if (!cJSON_IsObject(patch))
+ {
+- /* scalar value, array or NULL, just duplicate */
++ /* scalar value, array or NULL, just duplicate.
++ * Duplicate the patch first in case it is a subtree of target,
++ * otherwise cJSON_Delete(target) would free the patch memory
++ * and the subsequent cJSON_Duplicate would read freed memory. */
++ cJSON *duplicate = cJSON_Duplicate(patch, 1);
+ cJSON_Delete(target);
+- return cJSON_Duplicate(patch, 1);
++ return duplicate;
+ }
+
+ if (!cJSON_IsObject(target))
+diff --git a/tests/old_utils_tests.c b/tests/old_utils_tests.c
+index 690dbb5..bdc7393 100644
+--- a/tests/old_utils_tests.c
++++ b/tests/old_utils_tests.c
+@@ -189,6 +189,39 @@ static void merge_tests(void)
+ }
+ }
+
++static void merge_patch_should_not_read_freed_memory_when_patch_is_subtree(void)
++{
++ /* When patch is a subtree of target, merge_patch must duplicate the patch
++ * before deleting target. Otherwise cJSON_Delete(target) frees the patch
++ * memory and the subsequent cJSON_Duplicate reads freed memory (UAF).
++ * See CVE candidate: heap-use-after-free in merge_patch (cJSON_Utils.c). */
++ cJSON *target = cJSON_Parse("{\"a\":[1,2,3]}");
++ cJSON *patch = cJSON_GetObjectItem(target, "a");
++ cJSON *result = NULL;
++ cJSON *first = NULL;
++ cJSON *second = NULL;
++ cJSON *third = NULL;
++
++ TEST_ASSERT_NOT_NULL(target);
++ TEST_ASSERT_NOT_NULL(patch);
++
++ /* patch (array [1,2,3]) is a subtree of target. This used to trigger
++ * heap-use-after-free under AddressSanitizer before the fix. */
++ result = cJSONUtils_MergePatch(target, patch);
++ TEST_ASSERT_NOT_NULL(result);
++ TEST_ASSERT_TRUE(cJSON_IsArray(result));
++ TEST_ASSERT_EQUAL_INT(3, cJSON_GetArraySize(result));
++
++ first = cJSON_GetArrayItem(result, 0);
++ second = cJSON_GetArrayItem(result, 1);
++ third = cJSON_GetArrayItem(result, 2);
++ TEST_ASSERT_EQUAL_INT(1, first->valueint);
++ TEST_ASSERT_EQUAL_INT(2, second->valueint);
++ TEST_ASSERT_EQUAL_INT(3, third->valueint);
++
++ cJSON_Delete(result);
++}
++
+ static void generate_merge_tests(void)
+ {
+ size_t i = 0;
+@@ -219,6 +252,7 @@ int main(void)
+ RUN_TEST(misc_tests);
+ RUN_TEST(sort_tests);
+ RUN_TEST(merge_tests);
++ RUN_TEST(merge_patch_should_not_read_freed_memory_when_patch_is_subtree);
+ RUN_TEST(generate_merge_tests);
+
+ return UNITY_END();
diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb
index d914018331..b4e57d7297 100644
--- a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb
+++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb
@@ -7,6 +7,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0"
SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \
file://run-ptest \
file://0001-allow-build-with-cmake-4.patch \
+ file://CVE-2026-87933.patch \
"
SRCREV = "c859b25da02955fef659d658b8f324b5cde87be3"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 58/82] smarty: mark CVE-2026-82531 patched
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (56 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 57/82] cjson: patch CVE-2026-87933 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 59/82] ntopng: patch CVE-2026-84990 ankur.tyagi85
` (24 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-82531
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-support/smarty/smarty_5.8.5.bb | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb
index 83f428d388..c700ed5d93 100644
--- a/meta-oe/recipes-support/smarty/smarty_5.8.5.bb
+++ b/meta-oe/recipes-support/smarty/smarty_5.8.5.bb
@@ -35,3 +35,4 @@ FILES:${PN} += "${datadir}/php/smarty3/"
RDEPENDS:${PN} = "php"
CVE_PRODUCT = "smarty:smarty smarty-php:smarty"
+CVE_STATUS[CVE-2026-82531] = "fixed-version: fixed in v5.8.5"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 59/82] ntopng: patch CVE-2026-84990
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (57 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 58/82] smarty: mark CVE-2026-82531 patched ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 60/82] ntopng: patch CVE-2026-86090 and CVE-2026-86091 ankur.tyagi85
` (23 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-84990
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2d932fa4e349690dc42485b9dd04ab04d19710d9)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../ntopng/files/CVE-2026-84990.patch | 53 +++++++++++++++++++
.../recipes-support/ntopng/ntopng_6.6.bb | 1 +
2 files changed, 54 insertions(+)
create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch
diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch
new file mode 100644
index 0000000000..0b443e3050
--- /dev/null
+++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch
@@ -0,0 +1,53 @@
+From 2f36e393fc35f576d7c447af337848e81990b084 Mon Sep 17 00:00:00 2001
+From: Alfredo Cardigliano <cardigliano@ntop.org>
+Date: Fri, 17 Jul 2026 11:51:03 +0200
+Subject: [PATCH] Add admin check in conf backup listing and download
+
+(cherry picked from commit f912ee93bc143330b6ff3bb946ee7211e5ee9e1a)
+
+CVE: CVE-2026-84990
+Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/f912ee93bc143330b6ff3bb946ee7211e5ee9e1a]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ .../rest/v2/get/system/configurations/download_backup.lua | 5 +++++
+ .../v2/get/system/configurations/list_available_backups.lua | 6 ++++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua
+index 1603a94c48..404b09ed97 100644
+--- a/scripts/lua/rest/v2/get/system/configurations/download_backup.lua
++++ b/scripts/lua/rest/v2/get/system/configurations/download_backup.lua
+@@ -12,6 +12,11 @@ local backup_config = require("backup_config")
+
+ -- ##############################################
+
++if not isAdministratorOrPrintErr() then
++ rest_utils.answer(rest_utils.consts.err.not_granted)
++ return
++end
++
+ local download = _GET["download"]
+ local epoch = _GET["epoch"]
+
+diff --git a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua
+index d901a876b0..8a08ad15d5 100644
+--- a/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua
++++ b/scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua
+@@ -8,11 +8,17 @@ package.path = dirs.installdir .. "/scripts/lua/modules/system_config/?.lua;" ..
+
+ -- ##############################################
+
++require "lua_utils"
+ local backup_config = require("backup_config")
+ local rest_utils = require("rest_utils")
+
+ -- ##############################################
+
++if not isAdministratorOrPrintErr() then
++ rest_utils.answer(rest_utils.consts.err.not_granted)
++ return
++end
++
+ local rc = rest_utils.consts.success.ok
+
+ local order = _GET["order"] or "desc"
diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
index 03350f240c..b4a1ff1883 100644
--- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
+++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
@@ -19,6 +19,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \
file://0001-luaengine-Use-lua-5.5-API-signature-for-lua_newstate.patch \
file://ntopng.service \
file://0001-Fix-build-with-OpenSSL-4.0.patch \
+ file://CVE-2026-84990.patch \
"
# don't use the lua under thirdparty as it supports cross compiling badly
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 60/82] ntopng: patch CVE-2026-86090 and CVE-2026-86091
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (58 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 59/82] ntopng: patch CVE-2026-84990 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 61/82] sngrep: patch CVE-2026-90558 ankur.tyagi85
` (22 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-86090
https://nvd.nist.gov/vuln/detail/cve-2026-86091
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit ae180302f4c7f7dc0ba45c330d55b127aeefaf01)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../files/CVE-2026-86090-CVE-2026-86091.patch | 67 +++++++++++++++++++
.../recipes-support/ntopng/ntopng_6.6.bb | 1 +
2 files changed, 68 insertions(+)
create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch
diff --git a/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch
new file mode 100644
index 0000000000..a8a3ba72ac
--- /dev/null
+++ b/meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch
@@ -0,0 +1,67 @@
+From c6f4d42e1bb029463f927532819c5f5b331ea066 Mon Sep 17 00:00:00 2001
+From: Alfredo Cardigliano <cardigliano@ntop.org>
+Date: Thu, 16 Jul 2026 14:42:29 +0200
+Subject: [PATCH] Fix user capability check for deleting notification endpoints
+ and pools
+
+(cherry picked from commit 7d830f31af367745431c5d92e2e82fc432f6bdd8)
+
+CVE: CVE-2026-86090 CVE-2026-86091
+Upstream-Status: Backport [https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ scripts/lua/modules/pools/pools_rest_utils.lua | 5 +++++
+ scripts/lua/rest/v2/delete/endpoints.lua | 6 ++++++
+ scripts/lua/rest/v2/delete/recipients.lua | 6 ++++++
+ 3 files changed, 17 insertions(+)
+
+diff --git a/scripts/lua/modules/pools/pools_rest_utils.lua b/scripts/lua/modules/pools/pools_rest_utils.lua
+index 9b692ea5db..73f08e0c8d 100644
+--- a/scripts/lua/modules/pools/pools_rest_utils.lua
++++ b/scripts/lua/modules/pools/pools_rest_utils.lua
+@@ -452,6 +452,11 @@ end
+
+ -- @brief Get all pools of all the available (currently implemented) pool instances
+ function pools_rest_utils.delete_all_instances_pools()
++ if not auth.has_capability(auth.capabilities.pools) then
++ rest_utils.answer(rest_utils.consts.err.not_granted)
++ return
++ end
++
+ local all_instances = pools_lua_utils.all_pool_instances_factory()
+
+ for _, instance in pairs(all_instances) do
+diff --git a/scripts/lua/rest/v2/delete/endpoints.lua b/scripts/lua/rest/v2/delete/endpoints.lua
+index 31852cedab..6d25c01953 100644
+--- a/scripts/lua/rest/v2/delete/endpoints.lua
++++ b/scripts/lua/rest/v2/delete/endpoints.lua
+@@ -10,6 +10,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" ..
+ local rest_utils = require "rest_utils"
+ local endpoints = require("endpoints")
+ local recipients = require "recipients"
++local auth = require "auth"
++
++if not auth.has_capability(auth.capabilities.notifications) then
++ rest_utils.answer(rest_utils.consts.err.not_granted)
++ return
++end
+
+ endpoints.reset_configs()
+ recipients.cleanup()
+diff --git a/scripts/lua/rest/v2/delete/recipients.lua b/scripts/lua/rest/v2/delete/recipients.lua
+index cbdffcae4c..14b3956498 100644
+--- a/scripts/lua/rest/v2/delete/recipients.lua
++++ b/scripts/lua/rest/v2/delete/recipients.lua
+@@ -8,6 +8,12 @@ package.path = dirs.installdir .. "/scripts/lua/modules/notifications/?.lua;" ..
+
+ local rest_utils = require "rest_utils"
+ local recipients = require "recipients"
++local auth = require "auth"
++
++if not auth.has_capability(auth.capabilities.notifications) then
++ rest_utils.answer(rest_utils.consts.err.not_granted)
++ return
++end
+
+ recipients.cleanup()
+ rest_utils.answer(rest_utils.consts.success.ok)
diff --git a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
index b4a1ff1883..808967e969 100644
--- a/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
+++ b/meta-networking/recipes-support/ntopng/ntopng_6.6.bb
@@ -20,6 +20,7 @@ SRC_URI = "gitsm://github.com/ntop/ntopng;protocol=https;branch=6.6-stable \
file://ntopng.service \
file://0001-Fix-build-with-OpenSSL-4.0.patch \
file://CVE-2026-84990.patch \
+ file://CVE-2026-86090-CVE-2026-86091.patch \
"
# don't use the lua under thirdparty as it supports cross compiling badly
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 61/82] sngrep: patch CVE-2026-90558
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (59 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 60/82] ntopng: patch CVE-2026-86090 and CVE-2026-86091 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 62/82] strongswan: patch CVE-2026-78123 ankur.tyagi85
` (21 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90558
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 36ddee53b179b5108186cc3e8d76c0f6a5e5d069)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../sngrep/sngrep/CVE-2026-90558.patch | 84 +++++++++++++++++++
.../recipes-support/sngrep/sngrep_1.8.4.bb | 4 +-
2 files changed, 87 insertions(+), 1 deletion(-)
create mode 100644 meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
diff --git a/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
new file mode 100644
index 0000000000..64fd8044a9
--- /dev/null
+++ b/meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
@@ -0,0 +1,84 @@
+From 399346a12ca3bcf7703734fa33b5b3427775b014 Mon Sep 17 00:00:00 2001
+From: Kaian <kaian@irontec.com>
+Date: Fri, 7 Aug 2026 08:45:42 +0200
+Subject: [PATCH] fix: prevent stack buffer overflow in SIP attribute
+ formatting
+
+call_get_attribute() formatted the Call-ID, X-Call-ID and Reason header
+text with an unbounded sprintf("%s"). Call-ID/X-Call-ID can hold up to
+MAX_CALLID_SIZE/MAX_XCALLID_SIZE (1023 bytes) and Reason text is copied
+from the raw payload (up to MAX_SIP_PAYLOAD), while all callers pass a
+255-byte SIP_ATTR_MAXLEN stack buffer (call list rendering, sort compare).
+A SIP message with a long Call-ID, X-Call-ID or Reason header overflowed
+the stack, triggerable via pcap, live capture or HEP/EEP remote capture.
+
+Bound these writes with "%.*s" and SIP_ATTR_MAXLEN - 1. Also fix a
+matching off-by-one in msg_get_attribute(), where the existing "%.*s"
+used SIP_ATTR_MAXLEN as the precision and could write 256 bytes
+(255 chars + NUL) into the 255-byte buffer.
+
+Thanks to TristanInSec for reporting the issue.
+
+(cherry picked from commit 1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b)
+
+CVE: CVE-2026-90558
+Upstream-Status: Backport [https://github.com/irontec/sngrep/commit/1ff74ee3ab5ff280e8ba976aa8c744dca57eb35b]
+
+SIP contract change was dropped during backport as it was introduced in
+v1.8.4[1]
+
+[1]https://github.com/irontec/sngrep/commit/c61a26d90c166f996e31aceefc9c2f8f831ccd86
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/sip_call.c | 6 +++---
+ src/sip_msg.c | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/sip_call.c b/src/sip_call.c
+index bea879a..68ecb50 100644
+--- a/src/sip_call.c
++++ b/src/sip_call.c
+@@ -257,10 +257,10 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value)
+ sprintf(value, "%d", call->index);
+ break;
+ case SIP_ATTR_CALLID:
+- sprintf(value, "%s", call->callid);
++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->callid);
+ break;
+ case SIP_ATTR_XCALLID:
+- sprintf(value, "%s", call->xcallid);
++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->xcallid);
+ break;
+ case SIP_ATTR_MSGCNT:
+ sprintf(value, "%d", vector_count(call->msgs));
+@@ -282,7 +282,7 @@ call_get_attribute(sip_call_t *call, enum sip_attr_id id, char *value)
+ break;
+ case SIP_ATTR_REASON_TXT:
+ if (call->reasontxt)
+- sprintf(value, "%s", call->reasontxt);
++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, call->reasontxt);
+ break;
+ case SIP_ATTR_WARNING:
+ if (call->warning)
+diff --git a/src/sip_msg.c b/src/sip_msg.c
+index 379a40a..6762862 100644
+--- a/src/sip_msg.c
++++ b/src/sip_msg.c
+@@ -136,13 +136,13 @@ msg_get_attribute(sip_msg_t *msg, int id, char *value)
+ }
+ break;
+ case SIP_ATTR_METHOD:
+- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, sip_get_msg_reqresp_str(msg));
++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, sip_get_msg_reqresp_str(msg));
+ break;
+ case SIP_ATTR_SIPFROM:
+- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_from);
++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_from);
+ break;
+ case SIP_ATTR_SIPTO:
+- sprintf(value, "%.*s", SIP_ATTR_MAXLEN, msg->sip_to);
++ sprintf(value, "%.*s", SIP_ATTR_MAXLEN - 1, msg->sip_to);
+ break;
+ case SIP_ATTR_SIPFROMUSER:
+ if (msg->sip_from && (ar = strchr(msg->sip_from, '@'))) {
diff --git a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb
index 5bb30da6db..c7457fd0c0 100644
--- a/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb
+++ b/meta-networking/recipes-support/sngrep/sngrep_1.8.4.bb
@@ -15,7 +15,9 @@ DEPENDS = "\
ncurses \
"
-SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV}"
+SRC_URI = "git://github.com/irontec/sngrep.git;protocol=https;branch=master;tag=v${PV} \
+ file://CVE-2026-90558.patch \
+"
SRCREV = "9c370866afaf5ccb258bf03848b2d22f30cf61bd"
inherit cmake pkgconfig
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 62/82] strongswan: patch CVE-2026-78123
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (60 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 61/82] sngrep: patch CVE-2026-90558 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 63/82] strongswan: patch CVE-2026-78124 ankur.tyagi85
` (20 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78123
[1]https://download.strongswan.org/security/CVE-2026-78123/strongswan-5.0.2-6.0.7_openssl_pkcs7_info_init.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78123).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit aa064e512a7d50e20f8e9c5a5249ee8bb2ee82ea)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78123.patch | 51 +++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 4 +-
2 files changed, 54 insertions(+), 1 deletion(-)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch
new file mode 100644
index 0000000000..36e6eb1289
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch
@@ -0,0 +1,51 @@
+From 23707d346f1f85dba0419c43658a86a80a24f568 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Mon, 1 Jun 2026 17:51:35 +0200
+Subject: [PATCH] openssl: Fix undefined memory access when verifying PKCS#7
+ containers
+
+If the signerInfo or recipientInfo structure doesn't contain
+issuerAndSerialNumber but instead a subjectKeyIdentifier, then the called
+functions will leave the passed name and serial numbers unchanged. While
+openssl_x509_name2id() prevents a NULL-pointer dereference, it tries to
+DER-encode the object at the passed pointer via i2d_X509_NAME().
+Depending on the stack contents, this likely causes a segmentation fault.
+
+Fixes: 3c820cdc232a ("Implement PKCS#7 decryption using openssl")
+Fixes: c61723c69fb5 ("Implement OpenSSL PKCS#7 signed-data parsing and verification")
+Fixes: CVE-2026-78123
+
+CVE: CVE-2026-78123
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/e59b4c96990635a482d6532f7905143f2541d8b5]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+index d9abcf8..b15c8d7 100644
+--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+@@ -222,8 +222,8 @@ static auth_cfg_t *verify_signature(CMS_SignerInfo *si,
+ auth_cfg_t *auth, *found = NULL;
+ identification_t *issuer, *serial;
+ chunk_t attrs = chunk_empty, sig, attr;
+- X509_NAME *name;
+- ASN1_INTEGER *snr;
++ X509_NAME *name = NULL;
++ ASN1_INTEGER *snr = NULL;
+ int i;
+
+ if (CMS_SignerInfo_get0_signer_id(si, NULL, &name, &snr) != 1)
+@@ -628,8 +628,8 @@ static bool decrypt(private_openssl_pkcs7_t *this,
+ identification_t *serial, *issuer;
+ private_key_t *private;
+ X509_ALGOR *alg;
+- X509_NAME *name;
+- ASN1_INTEGER *sn;
++ X509_NAME *name = NULL;
++ ASN1_INTEGER *sn = NULL;
+ u_char zero = 0;
+ int oid;
+
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index 117c148865..a7636554a6 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -8,7 +8,9 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
DEPENDS = "flex-native flex bison-native"
DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss', '', d)}"
-SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2"
+SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
+ file://CVE-2026-78123.patch \
+"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 63/82] strongswan: patch CVE-2026-78124
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (61 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 62/82] strongswan: patch CVE-2026-78123 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 64/82] strongswan: patch CVE-2026-78126 ankur.tyagi85
` (19 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78124
[1]https://download.strongswan.org/security/CVE-2026-78124/strongswan-5.0.2-6.0.7_openssl_pkcs7_certs_leak.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78124).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit dd0ba33ed20b4245c82c19b19c55b3710384ce52)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78124.patch | 34 +++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 35 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch
new file mode 100644
index 0000000000..5e37ed671a
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch
@@ -0,0 +1,34 @@
+From 36ce778a76b4b912699a52cf1109394fce109c83 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Mon, 15 Jun 2026 16:02:01 +0200
+Subject: [PATCH] openssl: Fix memory leaks after enumerating certificates in
+ PKCS#7 container
+
+This can be triggered via IKEv1.
+
+Fixes: 04884be3b5f7 ("Implement openssl PKCS#7 certficiate enumeration")
+Fixes: CVE-2026-78124
+
+CVE: CVE-2026-78124
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/49bf0725fa61198d1e29d5b4c2651c9190b2c10c]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libstrongswan/plugins/openssl/openssl_pkcs7.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+index b15c8d7..cefe1ae 100644
+--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
++++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+@@ -132,6 +132,10 @@ typedef struct {
+ METHOD(enumerator_t, cert_destroy, void,
+ cert_enumerator_t *this)
+ {
++ if (this->certs)
++ {
++ sk_X509_pop_free(this->certs, X509_free);
++ }
+ DESTROY_IF(this->cert);
+ free(this);
+ }
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index a7636554a6..82cd4738fb 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -10,6 +10,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss',
SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78123.patch \
+ file://CVE-2026-78124.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 64/82] strongswan: patch CVE-2026-78126
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (62 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 63/82] strongswan: patch CVE-2026-78124 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 65/82] strongswan: patch CVE-2026-78127 ankur.tyagi85
` (18 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78126
[1]https://download.strongswan.org/security/CVE-2026-78126/strongswan-4.4.0-6.0.7_eap_aka_sync_fail.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78126).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit e228e7711e49349b1342ae2be83530ab34883f98)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78126.patch | 37 +++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 38 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch
new file mode 100644
index 0000000000..307d1a9834
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch
@@ -0,0 +1,37 @@
+From 13aa926cad7ec7f668249b6513c938b8c2e95af4 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Thu, 4 Jun 2026 10:00:02 +0200
+Subject: [PATCH] eap-aka: Only accept AKA-Synchronization-Failure if expected
+
+This fixes a NULL-pointer dereference if the client sends such an error
+before the server issued a challenge and allocated this->rand.
+
+Fixes: 26e246769224 ("ported EAP-AKA branch into trunk")
+Fixes: 4735965fc048 ("EAP servers check if the received EAP message was expected")
+Fixes: CVE-2026-78126
+
+CVE: CVE-2026-78126
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/7bedb451346261370256d390a8c155b86e4b455d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libcharon/plugins/eap_aka/eap_aka_server.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/libcharon/plugins/eap_aka/eap_aka_server.c b/src/libcharon/plugins/eap_aka/eap_aka_server.c
+index 0712ccc..95d4b03 100644
+--- a/src/libcharon/plugins/eap_aka/eap_aka_server.c
++++ b/src/libcharon/plugins/eap_aka/eap_aka_server.c
+@@ -505,6 +505,12 @@ static status_t process_synchronize(private_eap_aka_server_t *this,
+ simaka_attribute_t type;
+ chunk_t data, auts = chunk_empty;
+
++ if (this->pending != AKA_CHALLENGE)
++ {
++ DBG1(DBG_IKE, "received %N, but not expected",
++ simaka_subtype_names, AKA_SYNCHRONIZATION_FAILURE);
++ return FAILED;
++ }
+ if (this->synchronized)
+ {
+ DBG1(DBG_IKE, "received %N, but peer did already resynchronize",
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index 82cd4738fb..2abc616c37 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -11,6 +11,7 @@ DEPENDS:append = "${@bb.utils.contains('DISTRO_FEATURES', 'tpm2', ' tpm2-tss',
SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78123.patch \
file://CVE-2026-78124.patch \
+ file://CVE-2026-78126.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 65/82] strongswan: patch CVE-2026-78127
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (63 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 64/82] strongswan: patch CVE-2026-78126 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 66/82] strongswan: patch CVE-2026-78129 ankur.tyagi85
` (17 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78127
[1]https://download.strongswan.org/security/CVE-2026-78127/strongswan-5.3.1-6.0.7_message_log_leak.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78127).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 7b8fd4df2e4eb82ad4558d6d3ddde57524ce9216)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78127.patch | 115 ++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 116 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch
new file mode 100644
index 0000000000..43def8b9b1
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch
@@ -0,0 +1,115 @@
+From b38d55b7df137e599c0364a8f0e6d3e1ab84ed50 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Mon, 8 Jun 2026 09:19:42 +0200
+Subject: [PATCH] message: Avoid memory leak if string buffer for message is
+ too small
+
+This leaked 40 or 80 bytes per parsed message for the enumerators that
+were not destroyed. While triggering an OOM condition will require quite
+a lot of messages and the DoS protection also helps avoiding that this
+is triggered quickly, it all depends on the memory constraints of the
+system and the time available to the attacker. Also, if IKEv1 is allowed,
+it could get quicker as the lack of message IDs doesn't allow dismissing
+unexpected messages before parsing them.
+
+Fixes: 092958c89d52 ("fixed payload debug message")
+Fixes: 6a4a47511f75 ("Show contents of the CP payload in message_t stringification")
+Fixes: CVE-2026-78127
+
+CVE: CVE-2026-78127
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/4b7108ac0f84fbf40da2b510eb6333afa2a54240]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libcharon/encoding/message.c | 23 ++++++++++++-----------
+ 1 file changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c
+index 8da9a1d..a4bf9cb 100644
+--- a/src/libcharon/encoding/message.c
++++ b/src/libcharon/encoding/message.c
+@@ -1398,7 +1398,7 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ payload->get_type(payload));
+ if (written >= len || written < 0)
+ {
+- return buf;
++ goto err;
+ }
+ pos += written;
+ len -= written;
+@@ -1424,7 +1424,7 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ }
+ if (written >= len || written < 0)
+ {
+- return buf;
++ goto err;
+ }
+ pos += written;
+ len -= written;
+@@ -1454,7 +1454,7 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ eap->get_code(eap), method);
+ if (written >= len || written < 0)
+ {
+- return buf;
++ goto err;
+ }
+ pos += written;
+ len -= written;
+@@ -1495,7 +1495,8 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ attribute->get_type(attribute));
+ if (written >= len || written < 0)
+ {
+- return buf;
++ attributes->destroy(attributes);
++ goto err;
+ }
+ pos += written;
+ len -= written;
+@@ -1507,7 +1508,7 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ written = snprintf(pos, len, ")");
+ if (written >= len || written < 0)
+ {
+- return buf;
++ goto err;
+ }
+ pos += written;
+ len -= written;
+@@ -1529,7 +1530,7 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ }
+ if (written >= len || written < 0)
+ {
+- return buf;
++ goto err;
+ }
+ pos += written;
+ len -= written;
+@@ -1544,7 +1545,7 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ frag->get_total_fragments(frag));
+ if (written >= len || written < 0)
+ {
+- return buf;
++ goto err;
+ }
+ pos += written;
+ len -= written;
+@@ -1557,16 +1558,16 @@ static char* get_string(private_message_t *this, char *buf, int len)
+ written = snprintf(pos, len, "(%d)", unknown->get_type(unknown));
+ if (written >= len || written < 0)
+ {
+- return buf;
++ goto err;
+ }
+ pos += written;
+ len -= written;
+ }
+ }
+- enumerator->destroy(enumerator);
+-
+- /* remove last space */
+ snprintf(pos, len, " ]");
++
++err:
++ enumerator->destroy(enumerator);
+ return buf;
+ }
+ #endif
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index 2abc616c37..d8ed26d841 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -12,6 +12,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78123.patch \
file://CVE-2026-78124.patch \
file://CVE-2026-78126.patch \
+ file://CVE-2026-78127.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 66/82] strongswan: patch CVE-2026-78129
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (64 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 65/82] strongswan: patch CVE-2026-78127 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 67/82] strongswan: patch CVE-2026-78133 ankur.tyagi85
` (16 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78129
[1]https://download.strongswan.org/security/CVE-2026-78129/strongswan-5.6.3-6.0.7_pkcs5_params_dos.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78129).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9ea8363e3055e4b608c0e19d5db87e1fbfcad7e2)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78129.patch | 155 ++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 156 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch
new file mode 100644
index 0000000000..5f327989a0
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch
@@ -0,0 +1,155 @@
+From ec14a504137915cc45080323238c64d348d020eb Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Tue, 23 Jun 2026 11:55:31 +0200
+Subject: [PATCH] pkcs5: Validate parsed parameters to avoid DoS attacks
+
+With the unbounded iterations, an attacker can craft a PKCS#7 file and
+send it during IKEv1 to block the processing thread practically for an
+unlimited amount of time.
+
+As the key length is used for an allocation on the stack, not limiting
+it could cause a crash. We validate it after parsing the params, but
+since `encryption_algorithm_from_oid()` only returns trusted key lengths
+that are lower than the limit, that's fine.
+
+The unlimited salt length had no direct impact (the maximum is bound by
+the accepted message size), but we now limit it as well before cloning.
+
+Fixes: 4076e3ee9121 ("Extract PKCS#5 handling from pkcs8 plugin to separate helper class")
+Fixes: fd1ff46f6143 ("Added support for PKCS#5 v2 schemes when decrypting PKCS#8 files.")
+Fixes: cab127cba66c ("Added support for encrypted PKCS#8 files (for some PKCS#5 v1.5 schemes).")
+Fixes: CVE-2026-78129
+
+CVE: CVE-2026-78129
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/f60a55e36f95e210ab067de295c9f6bacefcdd1a]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libstrongswan/crypto/pkcs5.c | 65 +++++++++++++++++++++++++++++++-
+ 1 file changed, 64 insertions(+), 1 deletion(-)
+
+diff --git a/src/libstrongswan/crypto/pkcs5.c b/src/libstrongswan/crypto/pkcs5.c
+index 822656f..e01010b 100644
+--- a/src/libstrongswan/crypto/pkcs5.c
++++ b/src/libstrongswan/crypto/pkcs5.c
+@@ -14,6 +14,8 @@
+ * for more details.
+ */
+
++#include <inttypes.h>
++
+ #include "pkcs5.h"
+
+ #include <utils/debug.h>
+@@ -22,6 +24,15 @@
+ #include <asn1/asn1_parser.h>
+ #include <credentials/containers/pkcs12.h>
+
++/** maximum accepted length for salts in parsed parameters */
++#define PKCS5_SALT_LEN_MAX 128
++
++/** maximum accepted iteration count in parsed parameters */
++#define PKCS5_ITERATIONS_MAX 1000000
++
++/** maximum key length accepted in parsed parameters */
++#define PKCS5_KEY_LEN_MAX 64
++
+ typedef struct private_pkcs5_t private_pkcs5_t;
+
+ /**
+@@ -379,6 +390,41 @@ METHOD(pkcs5_t, decrypt, bool,
+ keymat, key, iv);
+ }
+
++/**
++ * Make sure the salt has an appropriate length
++ */
++static bool validate_salt_length(chunk_t salt)
++{
++ if (salt.len > PKCS5_SALT_LEN_MAX)
++ {
++ DBG1(DBG_ASN, " salt length %zu exceeds maximum of %zu bytes",
++ salt.len, (size_t)PKCS5_SALT_LEN_MAX);
++ return FALSE;
++ }
++ return TRUE;
++}
++
++/**
++ * Validate that parsed parameters are in an allowed range
++ */
++static bool validate_params(private_pkcs5_t *this)
++{
++ if (!this->iterations || this->iterations > PKCS5_ITERATIONS_MAX)
++ {
++ DBG1(DBG_ASN, " iteration count %" PRIu64 " is out of range "
++ "(1-%" PRIu64 ")", this->iterations,
++ (uint64_t)PKCS5_ITERATIONS_MAX);
++ return FALSE;
++ }
++ if (this->keylen > PKCS5_KEY_LEN_MAX)
++ {
++ DBG1(DBG_ASN, " key length %zu exceeds maximum of %zu bytes",
++ this->keylen, (size_t)PKCS5_KEY_LEN_MAX);
++ return FALSE;
++ }
++ return TRUE;
++}
++
+ /**
+ * ASN.1 definition of a PBEParameter structure
+ */
+@@ -399,7 +445,7 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0)
+ asn1_parser_t *parser;
+ chunk_t object;
+ int objectID;
+- bool success;
++ bool success = FALSE;
+
+ parser = asn1_parser_create(pbeParameterObjects, blob);
+ parser->set_top_level(parser, level0);
+@@ -410,6 +456,10 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0)
+ {
+ case PBEPARAM_SALT:
+ {
++ if (!validate_salt_length(object))
++ {
++ goto end;
++ }
+ this->salt = chunk_clone(object);
+ break;
+ }
+@@ -421,6 +471,11 @@ static bool parse_pbes1_params(private_pkcs5_t *this, chunk_t blob, int level0)
+ }
+ }
+ success = parser->success(parser);
++ if (success)
++ {
++ success = validate_params(this);
++ }
++end:
+ parser->destroy(parser);
+ return success;
+ }
+@@ -471,6 +526,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0)
+ {
+ case PBKDF2_SALT:
+ {
++ if (!validate_salt_length(object))
++ {
++ goto end;
++ }
+ this->salt = chunk_clone(object);
+ break;
+ }
+@@ -500,6 +559,10 @@ static bool parse_pbkdf2_params(private_pkcs5_t *this, chunk_t blob, int level0)
+ }
+ }
+ success = parser->success(parser);
++ if (success)
++ {
++ success = validate_params(this);
++ }
+ end:
+ parser->destroy(parser);
+ return success;
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index d8ed26d841..5a7a12d903 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -13,6 +13,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78124.patch \
file://CVE-2026-78126.patch \
file://CVE-2026-78127.patch \
+ file://CVE-2026-78129.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 67/82] strongswan: patch CVE-2026-78133
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (65 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 66/82] strongswan: patch CVE-2026-78129 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 68/82] strongswan: patch CVE-2026-78131 ankur.tyagi85
` (15 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78133
[1]https://download.strongswan.org/security/CVE-2026-78133/strongswan-6.0.0-6.0.7_ikev2_rekey_collision.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78133).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 7a5589163324a26c8c3569d8e5ec11f078df0ef5)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78133.patch | 620 ++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 621 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch
new file mode 100644
index 0000000000..f009168a9a
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch
@@ -0,0 +1,620 @@
+From 3f5768c48bc9dff62511c91157e0a9bd12b2159b Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Fri, 5 Jun 2026 08:15:46 +0200
+Subject: [PATCH] ikev2: Prevent use-after-free during collision after passive
+ multi-KE rekeying failed
+
+During a multi-KE rekey collision, where the initial response to the
+active rekeying is delayed (or withheld), the active task already keeps
+track of the passive task to eventually resolve the collision (it can
+only do so once all nonces are known).
+
+If the passive task then fails, e.g. due to a missing or invalid KE
+payload, and completes with SUCCESS, `collide()` previously recognized
+that the passive task is not yet complete returned FALSE, which caused
+the task manager to destroy the task. However, the reference in the
+active task would remain. So once the active rekeying progresses and
+the collision is resolved, that dangling pointer would get dereferenced
+for an indirect method call. This happens via the `get_lower_nonce`
+function pointer of the `child_create_t` instance in the private task
+struct. So besides having to be authenticated, an attacker has to get
+two indirections right to exploit this flaw for a potential RCE.
+Otherwise, the effects are a crash or basically undefined behavior
+triggered by the method call.
+
+By passing whether the passive task is done (and would get destroyed),
+the active tasks can properly clear the held reference.
+
+Note that this patch includes another fix for a state change during
+Child SA rekeying that's included in 6.1.0 (4611f41b1e14 ("child-rekey:
+Only reset state of SAs not actively rekeyed if passive rekeying
+fails")).
+
+Fixes: d2b2e1b3fae8 ("ikev2: Make CHILD_SAs properly trackable during rekey collisions")
+Fixes: ca3e6d2d144e ("ike-rekey: Support IKE_SA rekeying with multiple key exchanges")
+Fixes: CVE-2026-78133
+
+CVE: CVE-2026-78133
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/eb615b452539461d57503f50041f01773c1ccf86]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libcharon/sa/ikev2/task_manager_v2.c | 13 +-
+ src/libcharon/sa/ikev2/tasks/child_rekey.c | 47 ++++--
+ src/libcharon/sa/ikev2/tasks/child_rekey.h | 3 +-
+ src/libcharon/sa/ikev2/tasks/ike_rekey.c | 40 +++--
+ src/libcharon/sa/ikev2/tasks/ike_rekey.h | 3 +-
+ src/libcharon/tests/suites/test_child_rekey.c | 136 ++++++++++++++++
+ src/libcharon/tests/suites/test_ike_rekey.c | 147 ++++++++++++++++++
+ 7 files changed, 361 insertions(+), 28 deletions(-)
+
+diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c
+index 0f3b937..5a19ce8 100644
+--- a/src/libcharon/sa/ikev2/task_manager_v2.c
++++ b/src/libcharon/sa/ikev2/task_manager_v2.c
+@@ -927,7 +927,8 @@ static status_t process_response(private_task_manager_t *this,
+ * Handle exchange collisions, returns TRUE if the given passive task was
+ * adopted by the active task and the task manager lost control over it.
+ */
+-static bool handle_collisions(private_task_manager_t *this, task_t *task)
++static bool handle_collisions(private_task_manager_t *this, task_t *task,
++ bool done)
+ {
+ enumerator_t *enumerator;
+ task_t *active;
+@@ -951,7 +952,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task)
+ if (type == TASK_IKE_REKEY || type == TASK_IKE_DELETE)
+ {
+ ike_rekey_t *rekey = (ike_rekey_t*)active;
+- adopted = rekey->collide(rekey, task);
++ adopted = rekey->collide(rekey, task, done);
+ break;
+ }
+ continue;
+@@ -959,7 +960,7 @@ static bool handle_collisions(private_task_manager_t *this, task_t *task)
+ if (type == TASK_CHILD_REKEY)
+ {
+ child_rekey_t *rekey = (child_rekey_t*)active;
+- adopted = rekey->collide(rekey, task);
++ adopted = rekey->collide(rekey, task, done);
+ break;
+ }
+ continue;
+@@ -1011,14 +1012,14 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
+ case SUCCESS:
+ /* task completed, remove it */
+ array_remove_at(this->passive_tasks, enumerator);
+- if (!handle_collisions(this, task))
++ if (!handle_collisions(this, task, TRUE))
+ {
+ task->destroy(task);
+ }
+ break;
+ case NEED_MORE:
+ /* processed, but task needs another exchange */
+- if (handle_collisions(this, task))
++ if (handle_collisions(this, task, FALSE))
+ {
+ array_remove_at(this->passive_tasks, enumerator);
+ }
+@@ -1029,7 +1030,7 @@ static status_t build_response(private_task_manager_t *this, message_t *request)
+ /* FALL */
+ case DESTROY_ME:
+ /* destroy IKE_SA, but SEND response first */
+- if (handle_collisions(this, task))
++ if (handle_collisions(this, task, FALSE))
+ {
+ array_remove_at(this->passive_tasks, enumerator);
+ }
+diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.c b/src/libcharon/sa/ikev2/tasks/child_rekey.c
+index fb3ba2a..e984668 100644
+--- a/src/libcharon/sa/ikev2/tasks/child_rekey.c
++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.c
+@@ -403,7 +403,7 @@ METHOD(task_t, build_r, status_t,
+ child_sa_t *child_sa, *old_replacement;
+ child_sa_state_t state = CHILD_INSTALLED;
+ uint32_t reqid;
+- bool followup_sent = FALSE;
++ bool active, followup_sent = FALSE;
+
+ if (!this->child_sa)
+ {
+@@ -423,7 +423,8 @@ METHOD(task_t, build_r, status_t,
+ message->add_notify(message, TRUE, TEMPORARY_FAILURE, chunk_empty);
+ return SUCCESS;
+ }
+- if (actively_rekeying(this, &followup_sent) && followup_sent)
++ active = actively_rekeying(this, &followup_sent);
++ if (active && followup_sent)
+ {
+ DBG1(DBG_IKE, "peer initiated rekeying, but we did too and already "
+ "sent IKE_FOLLOWUP_KE");
+@@ -483,8 +484,9 @@ METHOD(task_t, build_r, status_t,
+ /* like installing the outbound SA, we only trigger the child-rekey
+ * event once the old SA is deleted */
+ }
+- else if (this->child_sa->get_state(this->child_sa) == CHILD_REKEYING)
+- { /* rekeying failed, reuse old child */
++ else if (!active &&
++ this->child_sa->get_state(this->child_sa) == CHILD_REKEYING)
++ { /* rekeying failed, reuse old child, unless we are actively rekeying */
+ this->child_sa->set_state(this->child_sa, state);
+ }
+ return SUCCESS;
+@@ -1127,8 +1129,22 @@ METHOD(child_rekey_t, handle_delete, child_rekey_collision_t,
+ return CHILD_REKEY_COLLISION_NONE;
+ }
+
++/**
++ * Clear the colliding passive task if it did not complete successfully.
++ */
++static void clear_collision(private_child_rekey_t *this, task_t *other)
++{
++ if (this->collision == other)
++ {
++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} "
++ "failed", this->child_sa->get_name(this->child_sa),
++ this->child_sa->get_unique_id(this->child_sa));
++ this->collision = NULL;
++ }
++}
++
+ METHOD(child_rekey_t, collide, bool,
+- private_child_rekey_t *this, task_t *other)
++ private_child_rekey_t *this, task_t *other, bool done)
+ {
+ private_child_rekey_t *rekey = (private_child_rekey_t*)other;
+ child_sa_t *other_child;
+@@ -1142,16 +1158,25 @@ METHOD(child_rekey_t, collide, bool,
+ other_child = rekey->child_create->get_child(rekey->child_create);
+ if (!other_child)
+ {
+- /* ignore passive tasks that did not successfully create a CHILD_SA */
++ /* ignore passive tasks that did not successfully create a CHILD_SA,
++ * if we are already tracking it in the multi-KE case, clear it */
++ clear_collision(this, other);
+ return FALSE;
+ }
+ if (other_child->get_state(other_child) != CHILD_INSTALLED)
+ {
+- DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is not "
+- "yet complete", this->child_sa->get_name(this->child_sa),
+- this->child_sa->get_unique_id(this->child_sa));
+- /* we do reference the task to check its state later */
+- this->collision = other;
++ if (done)
++ { /* passive task failed, clear it if necessary */
++ clear_collision(this, other);
++ }
++ else
++ {
++ DBG1(DBG_IKE, "colliding passive rekeying for CHILD_SA %s{%u} is "
++ "not yet complete", this->child_sa->get_name(this->child_sa),
++ this->child_sa->get_unique_id(this->child_sa));
++ /* we do reference the task to check its state later */
++ this->collision = other;
++ }
+ return FALSE;
+ }
+ if (this->collision && this->collision != other)
+diff --git a/src/libcharon/sa/ikev2/tasks/child_rekey.h b/src/libcharon/sa/ikev2/tasks/child_rekey.h
+index a8daed7..fef0bba 100644
+--- a/src/libcharon/sa/ikev2/tasks/child_rekey.h
++++ b/src/libcharon/sa/ikev2/tasks/child_rekey.h
+@@ -79,10 +79,11 @@ struct child_rekey_t {
+ * are going on and notifies the active task by passing the passive.
+ *
+ * @param other passive task
++ * @param done passive task is done and gets destroyed if not adopted
+ * @return whether the task was adopted and should be removed from
+ * the task manager's control
+ */
+- bool (*collide)(child_rekey_t* this, task_t *other);
++ bool (*collide)(child_rekey_t* this, task_t *other, bool done);
+ };
+
+ /**
+diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
+index c7e8ffb..f275d2d 100644
+--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c
++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
+@@ -743,8 +743,23 @@ METHOD(ike_rekey_t, did_collide, bool,
+ return this->collision != NULL;
+ }
+
++/**
++ * Clear the colliding passive task if it did not complete successfully.
++ */
++static bool clear_collision(private_ike_rekey_t *this,
++ private_ike_rekey_t *other)
++{
++ if (this->collision == other)
++ {
++ DBG1(DBG_IKE, "colliding passive rekeying failed, ignore");
++ this->collision = NULL;
++ return TRUE;
++ }
++ return FALSE;
++}
++
+ METHOD(ike_rekey_t, collide, bool,
+- private_ike_rekey_t* this, task_t *other)
++ private_ike_rekey_t* this, task_t *other, bool done)
+ {
+ DBG1(DBG_IKE, "detected %N collision with %N", task_type_names,
+ TASK_IKE_REKEY, task_type_names, other->get_type(other));
+@@ -760,23 +775,30 @@ METHOD(ike_rekey_t, collide, bool,
+
+ if (!rekey->ike_init)
+ {
+- DBG1(DBG_IKE, "colliding exchange did not result in an IKE_SA, "
+- "ignore");
+- if (this->collision == rekey)
++ if (!clear_collision(this, rekey))
+ {
+- this->collision = NULL;
++ DBG1(DBG_IKE, "colliding exchange did not result in an "
++ "IKE_SA, ignore");
+ }
+ break;
+ }
+- /* we keep track of the passive exchange in any case, if not
+- * complete yet, this method might be called again later */
+- this->collision = rekey;
++ /* we keep track of the passive exchange, if not complete yet, this
++ * method might be called again later */
+ if (rekey->flags & IKE_REKEY_DONE)
+ {
++ this->collision = rekey;
+ this->flags |= IKE_REKEY_ADOPTED_PASSIVE;
+ return TRUE;
+ }
+- DBG1(DBG_IKE, "colliding passive exchange is not yet complete");
++ else if (done)
++ { /* passive task failed, clear it if necessary */
++ clear_collision(this, rekey);
++ }
++ else
++ {
++ DBG1(DBG_IKE, "colliding passive exchange is not yet complete");
++ this->collision = rekey;
++ }
+ break;
+ }
+ default:
+diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.h b/src/libcharon/sa/ikev2/tasks/ike_rekey.h
+index 5fab349..e68fa62 100644
+--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.h
++++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.h
+@@ -54,10 +54,11 @@ struct ike_rekey_t {
+ * are going on and notifies the active task by passing the passive.
+ *
+ * @param other passive task
++ * @param done passive task is done and gets destroyed if not adopted
+ * @return whether the task was adopted and should be removed from
+ * the task manager's control
+ */
+- bool (*collide)(ike_rekey_t* this, task_t *other);
++ bool (*collide)(ike_rekey_t* this, task_t *other, bool done);
+ };
+
+ /**
+diff --git a/src/libcharon/tests/suites/test_child_rekey.c b/src/libcharon/tests/suites/test_child_rekey.c
+index 1c81e75..4ef081a 100644
+--- a/src/libcharon/tests/suites/test_child_rekey.c
++++ b/src/libcharon/tests/suites/test_child_rekey.c
+@@ -2546,6 +2546,141 @@ START_TEST(test_collision_delayed_response_multi_ke)
+ }
+ END_TEST
+
++/**
++ * Remove the KE payload from the IKE_FOLLOWUP_KE request
++ */
++static bool remove_ke(listener_t *listener, ike_sa_t *ike_sa,
++ message_t *message, bool incoming, bool plain)
++{
++ if (plain && incoming &&
++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE &&
++ message->get_request(message))
++ {
++ enumerator_t *enumerator = message->create_payload_enumerator(message);
++ payload_t *pld;
++
++ while (enumerator->enumerate(enumerator, &pld))
++ {
++ if (pld->get_type(pld) == PLV2_KEY_EXCHANGE)
++ {
++ message->remove_payload_at(message, enumerator);
++ pld->destroy(pld);
++ break;
++ }
++ }
++ enumerator->destroy(enumerator);
++ free(listener);
++ return FALSE;
++ }
++ return TRUE;
++}
++
++#define remove_ke_from_ike_followup_ke() ({ \
++ listener_t *_ke_listener; \
++ INIT(_ke_listener, \
++ .message = remove_ke, \
++ ); \
++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \
++})
++
++/**
++ * This simulates an incorrect behavior by the peer. It triggers a collision by
++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid
++ * IKE_FOLLOWUP_KE (in this case the KE payload is missing). The initiator
++ * has to correctly track and then untrack the passive rekey task.
++ *
++ * Peer A Peer B
++ * rekey ----\ /---- rekey
++ * \-----/----> detect collision and withhold response
++ * detect collision <---------/
++ * ---------------->
++ * handle failure <---------------- send invalid additional KE
++ * handle rekey <---------------- send withheld response
++ */
++START_TEST(test_collision_delayed_response_multi_ke_failure)
++{
++ ike_sa_t *a, *b;
++ message_t *msg;
++
++ assert_track_sas_start();
++
++ exchange_test_helper->establish_sa(exchange_test_helper,
++ &a, &b, &multi_ke_conf);
++
++ /* make sure the responder wins the collision so it continues */
++ exchange_test_helper->nonce_first_byte = 0x00;
++ initiate_rekey(a, 1);
++ assert_ipsec_sas_installed(a, 1, 2);
++ exchange_test_helper->nonce_first_byte = 0xff;
++ initiate_rekey(b, 2);
++ assert_ipsec_sas_installed(b, 1, 2);
++
++ /* these should not get called as no SA goes down or gets rekeyed */
++ assert_hook_not_called(child_updown);
++ assert_hook_not_called(child_rekey);
++
++ /* CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } --> */
++ exchange_test_helper->nonce_first_byte = 0xff;
++ exchange_test_helper->process_message(exchange_test_helper, b, NULL);
++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED);
++ assert_ipsec_sas_installed(b, 1, 2);
++
++ /* <-- CREATE_CHILD_SA { N(REKEY_SA), SA, Ni, [KEi,] TSi, TSr } */
++ exchange_test_helper->nonce_first_byte = 0xff;
++ exchange_test_helper->process_message(exchange_test_helper, a, NULL);
++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED);
++ assert_ipsec_sas_installed(a, 1, 2);
++
++ /* the responder is not responding */
++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender);
++
++ /* CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } --> */
++ exchange_test_helper->process_message(exchange_test_helper, b, NULL);
++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE);
++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE);
++ assert_child_sa_state(b, 2, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED);
++ assert_ipsec_sas_installed(b, 1, 2);
++
++ /* remove the KE payload in the IKE_FOLLOWUP_KE request */
++ remove_ke_from_ike_followup_ke();
++
++ /* <-- IKE_FOLLOWUP_KE { N(ADD_KE) } */
++ assert_no_payload(IN, PLV2_KEY_EXCHANGE);
++ assert_single_notify(OUT, INVALID_SYNTAX);
++ exchange_test_helper->process_message(exchange_test_helper, a, NULL);
++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED);
++ assert_ipsec_sas_installed(a, 1, 2);
++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE);
++
++ /* <-- CREATE_CHILD_SA { SA, Nr, [KEr,] TSi, TSr } (delayed) */
++ exchange_test_helper->process_message(exchange_test_helper, a, msg);
++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE);
++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE);
++ assert_child_sa_state(a, 1, CHILD_REKEYING, CHILD_OUTBOUND_INSTALLED);
++ assert_ipsec_sas_installed(a, 1, 2);
++
++ /* drop the STATE_NOT_FOUND error message from the initiator */
++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender);
++ msg->destroy(msg);
++
++ /* since we explicitly forced the responder to win, it already removed
++ * the passive task it won't accept the request */
++
++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */
++ assert_payload(IN, PLV2_KEY_EXCHANGE);
++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE);
++ exchange_test_helper->process_message(exchange_test_helper, b, NULL);
++
++ /* child_rekey/child_updown */
++ assert_hook();
++ assert_hook();
++ assert_track_sas(2, 2);
++
++ call_ikesa(a, destroy);
++ call_ikesa(b, destroy);
++}
++END_TEST
++
+ /**
+ * In this scenario one of the peers does not notice that there is a
+ * rekey collision:
+@@ -4436,6 +4571,7 @@ Suite *child_rekey_suite_create()
+ tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4);
+ tcase_add_loop_test(tc, test_collision_delayed_response_delete, 0, 4);
+ tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4);
++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure);
+ tcase_add_loop_test(tc, test_collision_delayed_request, 0, 6);
+ tcase_add_loop_test(tc, test_collision_delayed_request_more, 0, 3);
+ tcase_add_loop_test(tc, test_collision_delayed_request_more_delete, 0, 3);
+diff --git a/src/libcharon/tests/suites/test_ike_rekey.c b/src/libcharon/tests/suites/test_ike_rekey.c
+index c6691ac..2c41022 100644
+--- a/src/libcharon/tests/suites/test_ike_rekey.c
++++ b/src/libcharon/tests/suites/test_ike_rekey.c
+@@ -1784,6 +1784,152 @@ START_TEST(test_collision_delayed_response_multi_ke)
+ }
+ END_TEST
+
++/**
++ * Remove the ADDITIONAL_KEY_EXCHANGE notify payload from the IKE_FOLLOWUP_KE
++ * request
++ */
++static bool remove_notify(listener_t *listener, ike_sa_t *ike_sa,
++ message_t *message, bool incoming, bool plain)
++{
++ if (plain && incoming &&
++ message->get_exchange_type(message) == IKE_FOLLOWUP_KE &&
++ message->get_request(message))
++ {
++ enumerator_t *enumerator = message->create_payload_enumerator(message);
++ payload_t *pld;
++
++ while (enumerator->enumerate(enumerator, &pld))
++ { /* we only expect one notify, so just remove the first */
++ if (pld->get_type(pld) == PLV2_NOTIFY)
++ {
++ message->remove_payload_at(message, enumerator);
++ pld->destroy(pld);
++ break;
++ }
++ }
++ enumerator->destroy(enumerator);
++ free(listener);
++ return FALSE;
++ }
++ return TRUE;
++}
++
++#define remove_notify_from_ike_followup_ke() ({ \
++ listener_t *_ke_listener; \
++ INIT(_ke_listener, \
++ .message = remove_notify, \
++ ); \
++ exchange_test_helper->add_listener(exchange_test_helper, _ke_listener); \
++})
++
++/**
++ * This simulates an incorrect behavior by the peer. It triggers a collision by
++ * not responding to the initial CREATE_CHILD_SA and then sends an invalid
++ * IKE_FOLLOWUP_KE (in this case by removing the ADDITIONAL_KEY_EXCHANGE
++ * notify). The initiator has to correctly track and then untrack the passive
++ * rekey task.
++ *
++ * Peer A Peer B
++ * rekey ----\ /---- rekey
++ * \-----/----> detect collision and withhold response
++ * detect collision <---------/
++ * ---------------->
++ * handle failure <---------------- send invalid additional KE
++ * handle rekey <---------------- send withheld response
++ */
++START_TEST(test_collision_delayed_response_multi_ke_failure)
++{
++ ike_sa_t *a, *b;
++ message_t *msg;
++
++ assert_track_sas_start();
++
++ exchange_test_helper->establish_sa(exchange_test_helper,
++ &a, &b, &multi_ke_conf);
++
++ /* these should not get called as no SA goes down or gets rekeyed */
++ assert_hook_not_called(ike_updown);
++ assert_hook_not_called(ike_rekey);
++ assert_hook_not_called(child_updown);
++
++ /* make sure the responder wins the collision so it continues */
++ exchange_test_helper->nonce_first_byte = 0x00;
++ initiate_rekey(a);
++ exchange_test_helper->nonce_first_byte = 0xff;
++ initiate_rekey(b);
++
++ /* CREATE_CHILD_SA { SA, Ni, KEi } --> */
++ exchange_test_helper->nonce_first_byte = 0xff;
++ exchange_test_helper->process_message(exchange_test_helper, b, NULL);
++ assert_ike_sa_state(b, IKE_REKEYING);
++ assert_child_sa_count(b, 1);
++ assert_ike_sa_count(0);
++
++ /* <-- CREATE_CHILD_SA { SA, Ni, KEi } */
++ exchange_test_helper->nonce_first_byte = 0xff;
++ exchange_test_helper->process_message(exchange_test_helper, a, NULL);
++ assert_ike_sa_state(a, IKE_REKEYING);
++ assert_child_sa_count(a, 1);
++ assert_ike_sa_count(0);
++
++ /* the responder is not responding */
++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender);
++
++ /* simplify next steps by checking in original IKE_SAs */
++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, a);
++ charon->ike_sa_manager->checkin(charon->ike_sa_manager, b);
++ assert_ike_sa_count(2);
++
++ /* CREATE_CHILD_SA { SA, Nr, KEr, N(ADD_KE) } --> */
++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE);
++ exchange_test_helper->process_message(exchange_test_helper, b, NULL);
++ assert_num_tasks(b, 0, TASK_QUEUE_PASSIVE);
++ assert_num_tasks(b, 1, TASK_QUEUE_ACTIVE);
++ assert_ike_sa_state(b, IKE_REKEYING);
++ assert_ike_sa_count(2);
++
++ /* remove the ADD_KE notify from the IKE_FOLLOWUP_KE request */
++ remove_notify_from_ike_followup_ke();
++
++ /* <-- IKE_FOLLOWUP_KE { KEi } */
++ assert_payload(IN, PLV2_KEY_EXCHANGE);
++ assert_no_notify(IN, ADDITIONAL_KEY_EXCHANGE);
++ assert_single_notify(OUT, STATE_NOT_FOUND);
++ exchange_test_helper->process_message(exchange_test_helper, a, NULL);
++ assert_ike_sa_state(a, IKE_REKEYING);
++ assert_child_sa_count(a, 1);
++ assert_ike_sa_count(2);
++
++ /* <-- CREATE_CHILD_SA { SA, Nr, KEr } (delayed) */
++ exchange_test_helper->process_message(exchange_test_helper, a, msg);
++ assert_num_tasks(a, 0, TASK_QUEUE_PASSIVE);
++ assert_num_tasks(a, 1, TASK_QUEUE_ACTIVE);
++ assert_ike_sa_state(a, IKE_REKEYING);
++ assert_child_sa_count(a, 1);
++ assert_ike_sa_count(2);
++
++ /* drop the STATE_NOT_FOUND error message from the initiator */
++ msg = exchange_test_helper->sender->dequeue(exchange_test_helper->sender);
++ msg->destroy(msg);
++
++ /* since we explicitly forced the responder to win, it already removed
++ * the passive task it won't accept the request */
++
++ /* IKE_FOLLOWUP_KE { KEi, N(ADD_KE) } --> */
++ assert_payload(IN, PLV2_KEY_EXCHANGE);
++ assert_notify(IN, ADDITIONAL_KEY_EXCHANGE);
++ exchange_test_helper->process_message(exchange_test_helper, b, NULL);
++
++ /* ike_updown/rekey/child_updown */
++ assert_hook();
++ assert_hook();
++ assert_hook();
++ assert_track_sas(2, 2);
++
++ charon->ike_sa_manager->flush(charon->ike_sa_manager);
++}
++END_TEST
++
+ /**
+ * In this scenario one of the peers does not notice that there is a rekey
+ * collision because the other request is dropped:
+@@ -2590,6 +2736,7 @@ Suite *ike_rekey_suite_create()
+ tcase_add_loop_test(tc, test_collision_ke_invalid_delayed_retry, 0, 3);
+ tcase_add_loop_test(tc, test_collision_delayed_response, 0, 4);
+ tcase_add_loop_test(tc, test_collision_delayed_response_multi_ke, 0, 4);
++ tcase_add_test(tc, test_collision_delayed_response_multi_ke_failure);
+ tcase_add_loop_test(tc, test_collision_dropped_request, 0, 3);
+ tcase_add_loop_test(tc, test_collision_delayed_request, 0, 3);
+ tcase_add_loop_test(tc, test_collision_delayed_request_and_delete, 0, 3);
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index 5a7a12d903..bd3191d35d 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -14,6 +14,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78126.patch \
file://CVE-2026-78127.patch \
file://CVE-2026-78129.patch \
+ file://CVE-2026-78133.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 68/82] strongswan: patch CVE-2026-78131
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (66 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 67/82] strongswan: patch CVE-2026-78133 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 69/82] strongswan: patch CVE-2026-78130 ankur.tyagi85
` (14 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78131
[1]https://download.strongswan.org/security/CVE-2026-78131/strongswan-5.5.3-6.0.7_x509_ac_leaks.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78131).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 41cb8cca46d3f97981245f2213942d2006df121f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78131.patch | 86 +++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 87 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch
new file mode 100644
index 0000000000..da53f8e5a0
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch
@@ -0,0 +1,86 @@
+From d1d29ac675b42a8c4a6454db84803bfecf5a0d99 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Fri, 12 Jun 2026 15:55:43 +0200
+Subject: [PATCH] x509: Fix memory leaks when parsing attribute certificates
+
+This can be triggered by an attribute certificate with lots of GeneralName
+entries or AuthorityKeyIdentifier extensions. There is no verification
+before the certificate is parsed.
+
+Fixes: 3134379ac7f1 ("x509: Fix some whitespaces and do some minor style cleanups in acert")
+Fixes: 26930a8c3e42 ("certificate factory can load certs from file")
+Fixes: CVE-2026-78131
+
+CVE: CVE-2026-78131
+Upstream-Status: Backport [1][2]
+
+[1]https://github.com/strongswan/strongswan/commit/23c9b9a2708e4958292d828424523fa63c0be829
+[2]https://github.com/strongswan/strongswan/commit/9762cc3b091b423543510113a5d05215daf16951
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libstrongswan/plugins/x509/x509_ac.c | 33 +++++++-----------------
+ 1 file changed, 9 insertions(+), 24 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
+index 3fc5de2..68b7cf9 100644
+--- a/src/libstrongswan/plugins/x509/x509_ac.c
++++ b/src/libstrongswan/plugins/x509/x509_ac.c
+@@ -186,41 +186,25 @@ extern bool x509_parse_generalNames(chunk_t blob, int level0, bool implicit,
+ static bool parse_directoryName(chunk_t blob, int level, bool implicit,
+ identification_t **name)
+ {
+- identification_t *directoryName;
+- enumerator_t *enumerator;
+- bool first = TRUE;
+ linked_list_t *list;
+
+ list = linked_list_create();
+ if (!x509_parse_generalNames(blob, level, implicit, list))
+ {
+- list->destroy(list);
++ list->destroy_offset(list, offsetof(identification_t, destroy));
+ return FALSE;
+ }
+-
+- enumerator = list->create_enumerator(list);
+- while (enumerator->enumerate(enumerator, &directoryName))
+- {
+- if (first)
+- {
+- *name = directoryName;
+- first = FALSE;
+- }
+- else
+- {
+- DBG1(DBG_ASN, "more than one directory name - first selected");
+- directoryName->destroy(directoryName);
+- break;
+- }
+- }
+- enumerator->destroy(enumerator);
+- list->destroy(list);
+-
+- if (first)
++ if (list->remove_first(list, (void**)name) != SUCCESS)
+ {
+ DBG1(DBG_ASN, "no directoryName found");
++ list->destroy(list);
+ return FALSE;
+ }
++ if (list->get_count(list))
++ {
++ DBG1(DBG_ASN, "more than one directory name - first selected");
++ }
++ list->destroy_offset(list, offsetof(identification_t, destroy));
+ return TRUE;
+ }
+
+@@ -539,6 +523,7 @@ static bool parse_certificate(private_x509_ac_t *this)
+ DBG2(DBG_ASN, " need to parse crlDistributionPoints");
+ break;
+ case OID_AUTHORITY_KEY_ID:
++ chunk_free(&this->authKeyIdentifier);
+ this->authKeyIdentifier =
+ x509_parse_authorityKeyIdentifier(object,
+ level, &this->authKeySerialNumber);
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index bd3191d35d..af687f5e4d 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -15,6 +15,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78127.patch \
file://CVE-2026-78129.patch \
file://CVE-2026-78133.patch \
+ file://CVE-2026-78131.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 69/82] strongswan: patch CVE-2026-78130
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (67 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 68/82] strongswan: patch CVE-2026-78131 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 70/82] strongswan: patch CVE-2026-78132 ankur.tyagi85
` (13 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78130
[1]https://download.strongswan.org/security/CVE-2026-78130/strongswan-5.1.3-6.0.7_x509_ac_issuer_null.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78130).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit d831ff4ac956483745e6df0fe9a4f6fe055440f8)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78130.patch | 49 +++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 50 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch
new file mode 100644
index 0000000000..8fe5c7f278
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch
@@ -0,0 +1,49 @@
+From 254d971bbe7479fe5fffc34cd1dd1e349a48e7aa Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Fri, 19 Jun 2026 11:57:48 +0200
+Subject: [PATCH] x509: Avoid NULL-pointer dereference if issuerName is missing
+ in attribute certificate
+
+If neither authoritiyKeyIdentifier nor issuerName are encoded in an
+attribute certificate, the validation in `acert_validator.c:verify()`
+will cause a NULL-pointer dereference via `issued_by()` (the lookup
+with NULL identity will enumerate all trusted certificates).
+
+Fixes: 26930a8c3e42 ("certificate factory can load certs from file")
+Fixes: CVE-2026-78130
+
+CVE: CVE-2026-78130
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/bee6ce27761e1f38958be36ebe6688ef963c3d22]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libstrongswan/plugins/x509/x509_ac.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
+index 68b7cf9..11a847e 100644
+--- a/src/libstrongswan/plugins/x509/x509_ac.c
++++ b/src/libstrongswan/plugins/x509/x509_ac.c
+@@ -898,7 +898,11 @@ METHOD(certificate_t, has_issuer, id_match_t,
+ {
+ return ID_MATCH_PERFECT;
+ }
+- return this->issuerName->matches(this->issuerName, issuer);
++ if (this->issuerName)
++ {
++ return this->issuerName->matches(this->issuerName, issuer);
++ }
++ return ID_MATCH_NONE;
+ }
+
+ METHOD(certificate_t, issued_by, bool,
+@@ -935,7 +939,8 @@ METHOD(certificate_t, issued_by, bool,
+ }
+ else
+ {
+- if (!this->issuerName->equals(this->issuerName,
++ if (!this->issuerName ||
++ !this->issuerName->equals(this->issuerName,
+ issuer->get_subject(issuer)))
+ {
+ return FALSE;
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index af687f5e4d..4f6a5d2ae7 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -16,6 +16,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78129.patch \
file://CVE-2026-78133.patch \
file://CVE-2026-78131.patch \
+ file://CVE-2026-78130.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 70/82] strongswan: patch CVE-2026-78132
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (68 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 69/82] strongswan: patch CVE-2026-78130 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:41 ` [PATCH 71/82] strongswan: patch CVE-2026-78135 ankur.tyagi85
` (12 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78132
[1]https://download.strongswan.org/security/CVE-2026-78132/strongswan-5.1.3-6.0.7_x509_ac_ietfattr_loop.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78132).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit dd3053a1a3806a37d1297e726d3eababfb539f8e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78132.patch | 75 +++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 76 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch
new file mode 100644
index 0000000000..f3ddd5b61a
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch
@@ -0,0 +1,75 @@
+From d8144c609148eda1ca55eac2ecddcd81bbd799b5 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Wed, 1 Jul 2026 16:24:23 +0200
+Subject: [PATCH] x509: Prevent infinite loop when parsing ietfAttrSyntax in
+ attribute certificates
+
+This is the same issue that was fixed with 407fcca200fd ("asn1-parser:
+Fix CHOICE parsing") for other CHOICE elements. This one was missed and
+can be triggered pre-auth by sending an attribute certificate to a peer.
+Since it's parsed before verifying it, the certificate doesn't have to
+be valid.
+
+For versions older than 5.5.3, this patch requires prior application of
+the fix for CVE-2017-9023, which introduced proper CHOICE handling in
+the ASN.1 parser.
+
+Fixes: a17598bc6992 ("x509: Integrate IETF attribute handling, and obsolete ietf_attributes_t")
+Fixes: CVE-2026-78132
+
+CVE: CVE-2026-78132
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/86bf2cbf5d9941b7ef16a1b25f0baf5589e0b64e]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libstrongswan/plugins/x509/x509_ac.c | 36 +++++++++++-------------
+ 1 file changed, 17 insertions(+), 19 deletions(-)
+
+diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c
+index 11a847e..46c1f58 100644
+--- a/src/libstrongswan/plugins/x509/x509_ac.c
++++ b/src/libstrongswan/plugins/x509/x509_ac.c
+@@ -249,26 +249,24 @@ static void parse_roleSyntax(chunk_t blob, int level0)
+ */
+ static const asn1Object_t ietfAttrSyntaxObjects[] =
+ {
+- { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
+- { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT |
+- ASN1_BODY }, /* 1 */
+- { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */
+- { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */
+- { 2, "octets", ASN1_OCTET_STRING, ASN1_OPT |
+- ASN1_BODY }, /* 4 */
+- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 5 */
+- { 2, "oid", ASN1_OID, ASN1_OPT |
+- ASN1_BODY }, /* 6 */
+- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 7 */
+- { 2, "string", ASN1_UTF8STRING, ASN1_OPT |
+- ASN1_BODY }, /* 8 */
+- { 2, "end choice", ASN1_EOC, ASN1_END }, /* 9 */
+- { 1, "end loop", ASN1_EOC, ASN1_END }, /* 10 */
+- { 0, "exit", ASN1_EOC, ASN1_EXIT }
++ { 0, "ietfAttrSyntax", ASN1_SEQUENCE, ASN1_NONE }, /* 0 */
++ { 1, "policyAuthority", ASN1_CONTEXT_C_0, ASN1_OPT|ASN1_BODY }, /* 1 */
++ { 1, "end opt", ASN1_EOC, ASN1_END }, /* 2 */
++ { 1, "values", ASN1_SEQUENCE, ASN1_LOOP }, /* 3 */
++ { 2, "value choice", ASN1_EOC, ASN1_CHOICE }, /* 4 */
++ { 3, "octets", ASN1_OCTET_STRING, ASN1_OPT|ASN1_BODY }, /* 5 */
++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 6 */
++ { 3, "oid", ASN1_OID, ASN1_OPT|ASN1_BODY }, /* 7 */
++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 8 */
++ { 3, "string", ASN1_UTF8STRING, ASN1_OPT|ASN1_BODY }, /* 9 */
++ { 3, "end choice", ASN1_EOC, ASN1_END|ASN1_CH }, /* 10 */
++ { 2, "end choices", ASN1_EOC, ASN1_END|ASN1_CHOICE }, /* 11 */
++ { 1, "end loop", ASN1_EOC, ASN1_END }, /* 12 */
++ { 0, "exit", ASN1_EOC, ASN1_EXIT }
+ };
+-#define IETF_ATTR_OCTETS 4
+-#define IETF_ATTR_OID 6
+-#define IETF_ATTR_STRING 8
++#define IETF_ATTR_OCTETS 5
++#define IETF_ATTR_OID 7
++#define IETF_ATTR_STRING 9
+
+ /**
+ * Parse group memberships, IETF attributes
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index 4f6a5d2ae7..b070ecf862 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -17,6 +17,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78133.patch \
file://CVE-2026-78131.patch \
file://CVE-2026-78130.patch \
+ file://CVE-2026-78132.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 71/82] strongswan: patch CVE-2026-78135
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (69 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 70/82] strongswan: patch CVE-2026-78132 ankur.tyagi85
@ 2026-10-15 5:41 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 72/82] strongswan: patch CVE-2026-78134 ankur.tyagi85
` (11 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:41 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78135
[1]https://download.strongswan.org/security/CVE-2026-78135/strongswan-5.9.7-6.0.7_early_create_child_sa.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78135).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9b02fe48505f14e351e473e246d971d64eb84ad0)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78135.patch | 72 +++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 73 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch
new file mode 100644
index 0000000000..1b6c472b30
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch
@@ -0,0 +1,72 @@
+From 2c3d63bd7a05f88d25354dfe7805a5a6e474a699 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Mon, 27 Jul 2026 08:53:50 +0200
+Subject: [PATCH] ikev2: Properly reject CREATE_CHILD_SA requests on
+ unestablished IKE_SAs
+
+The previous check was not actually enforced as long as there were still
+tasks in the passive queue (it was originally added to fix an issue on
+initiators, so the passive queue was expected to be empty). This allowed
+an unauthenticated attacker to potentially establish a usable Child SA
+if certain preconditions were met.
+
+First, it required that the initiator is authenticated with EAP so the
+authentication and the creation of the first Child SA is deferred.
+Second, the responder must either not configure an IP address pool or
+an explicit remote TS, otherwise, traffic selector negotiation fails.
+
+Note that the half-open IKE SA and the installed IPsec SA will be removed
+after the default timeout of 30 seconds.
+
+Fixes: 8503077175cd ("ikev2: Reject CREATE_CHILD_SA exchange on unestablished IKE_SAs")
+Fixes: c60c7694d2d8 ("merged tasking branch into trunk")
+Fixes: CVE-2026-78135
+
+CVE: CVE-2026-78135
+Upstream-Status: Backport [https://github.com/strongswan/strongswan/commit/4dcb132266a954202509a3b4b3be99378f3e3b4d]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libcharon/sa/ikev2/task_manager_v2.c | 21 +++++++++++----------
+ 1 file changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/src/libcharon/sa/ikev2/task_manager_v2.c b/src/libcharon/sa/ikev2/task_manager_v2.c
+index 5a19ce8..f9e9ab9 100644
+--- a/src/libcharon/sa/ikev2/task_manager_v2.c
++++ b/src/libcharon/sa/ikev2/task_manager_v2.c
+@@ -1134,9 +1134,18 @@ static status_t process_request(private_task_manager_t *this,
+ delete_payload_t *delete;
+ ike_sa_state_t state;
+
++ state = this->ike_sa->get_state(this->ike_sa);
++ if (message->get_exchange_type(message) == CREATE_CHILD_SA &&
++ (state == IKE_CREATED || state == IKE_CONNECTING))
++ {
++ DBG1(DBG_IKE, "received CREATE_CHILD_SA request for "
++ "unestablished IKE_SA, rejected");
++ return FAILED;
++ }
++
++ /* create tasks depending on request type, if not already some queued */
+ if (array_count(this->passive_tasks) == 0)
+- { /* create tasks depending on request type, if not already some queued */
+- state = this->ike_sa->get_state(this->ike_sa);
++ {
+ switch (message->get_exchange_type(message))
+ {
+ case IKE_SA_INIT:
+@@ -1177,14 +1186,6 @@ static status_t process_request(private_task_manager_t *this,
+ { /* FIXME: we should prevent this on mediation connections */
+ bool notify_found = FALSE, ts_found = FALSE;
+
+- if (state == IKE_CREATED ||
+- state == IKE_CONNECTING)
+- {
+- DBG1(DBG_IKE, "received CREATE_CHILD_SA request for "
+- "unestablished IKE_SA, rejected");
+- return FAILED;
+- }
+-
+ enumerator = message->create_payload_enumerator(message);
+ while (enumerator->enumerate(enumerator, &payload))
+ {
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index b070ecf862..df0333b458 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -18,6 +18,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78131.patch \
file://CVE-2026-78130.patch \
file://CVE-2026-78132.patch \
+ file://CVE-2026-78135.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 72/82] strongswan: patch CVE-2026-78134
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (70 preceding siblings ...)
2026-10-15 5:41 ` [PATCH 71/82] strongswan: patch CVE-2026-78135 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 73/82] tesseract: patch CVE-2026-88052 ankur.tyagi85
` (10 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Use patch[1] provided by strongSwan[2]
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-78134
[1]https://download.strongswan.org/security/CVE-2026-78134/strongswan-5.9.10-6.0.7_eap_inner_auth_cfg.patch
[2]https://www.strongswan.org/blog/2026/09/07/strongswan-vulnerability-(cve-2026-78134).html
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 2352f801006e75c74ac8892d88a38d4a2e3d2f32)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../strongswan/CVE-2026-78134.patch | 712 ++++++++++++++++++
.../strongswan/strongswan_6.0.7.bb | 1 +
2 files changed, 713 insertions(+)
create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch
diff --git a/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch
new file mode 100644
index 0000000000..86646e5e96
--- /dev/null
+++ b/meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch
@@ -0,0 +1,712 @@
+From d95e9d363b0e23d0ba3080bb518695e05a453748 Mon Sep 17 00:00:00 2001
+From: Tobias Brunner <tobias@strongswan.org>
+Date: Mon, 27 Jul 2026 15:05:45 +0200
+Subject: [PATCH] eap-ttls/peap: Return auth-cfg with details on TLS and inner
+ EAP method
+
+This fixes several issues with binding identities to the IKE SA.
+
+If the client is authenticated with a certificate, the previous code still
+used the client's proclaimed inner EAP-Identity when starting the EAP-TNC
+method. So that method would potentially operate on an unverified
+identity.
+
+Second, if the inner EAP method overrides the client identity (the only
+one is currently EAP-MSCHAPV2), the missing merge meant that the outer
+IKE/EAP identity could potentially be unconfirmed.
+
+For inner methods that don't override the identity (e.g. EAP-MD5), not
+propagating the inner EAP-Identity could potentially have the same
+effect.
+
+While the EAP-TTLS implementation returned the auth-cfg of the TLS
+exchange since the first referenced commit, this was mainly intended to
+enforce public key constraints. So it didn't cover the phase 2 EAP
+methods. For some reason EAP-PEAP did not get that method at all in that
+changeset, so we'll add that now.
+
+Additionally, the EAP-PEAP implementation now forwards the phase 2 EAP
+method type to EAP-TNC like the EAP-TTLS implementation already did,
+which allows a more informed decision on the client's identity.
+
+Fixes: 0864a31d13ff ("eap-ttls: Support EAP auth information getter in EAP-TTLS")
+Fixes: 79f2102cb442 ("implemented server side support for EAP-TTLS")
+Fixes: 2a421163bf4f ("make TNC client authentication type available to IMVs")
+Fixes: 1be296dfb2af ("implemented the PEAP tunneling protocol as an EAP plugin")
+Fixes: CVE-2026-78134
+
+CVE: CVE-2026-78134
+Upstream-Status: Backport [1][2]
+
+[1]https://github.com/strongswan/strongswan/commit/e059077d3f3e307e78be7f91e5648aa5f94916a8
+[2]https://github.com/strongswan/strongswan/commit/6a7210731f6dd2889d22bf20310ab0ed7274d0d8
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/libcharon/plugins/eap_peap/eap_peap.c | 49 ++++++++++-
+ .../plugins/eap_peap/eap_peap_peer.c | 20 +++++
+ .../plugins/eap_peap/eap_peap_peer.h | 7 ++
+ .../plugins/eap_peap/eap_peap_server.c | 81 ++++++++++++++++---
+ .../plugins/eap_peap/eap_peap_server.h | 7 ++
+ src/libcharon/plugins/eap_ttls/eap_ttls.c | 43 +++++++++-
+ .../plugins/eap_ttls/eap_ttls_peer.c | 19 +++++
+ .../plugins/eap_ttls/eap_ttls_peer.h | 7 ++
+ .../plugins/eap_ttls/eap_ttls_server.c | 56 +++++++++++--
+ .../plugins/eap_ttls/eap_ttls_server.h | 7 ++
+ 10 files changed, 278 insertions(+), 18 deletions(-)
+
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap.c b/src/libcharon/plugins/eap_peap/eap_peap.c
+index 3573cba..cd942f1 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap.c
++++ b/src/libcharon/plugins/eap_peap/eap_peap.c
+@@ -40,6 +40,25 @@ struct private_eap_peap_t {
+ * TLS stack, wrapped by EAP helper
+ */
+ tls_eap_t *tls_eap;
++
++ /**
++ * Role
++ */
++ bool is_server;
++
++ /**
++ * Actual server/client implementation
++ */
++ union {
++ tls_application_t *application;
++ eap_peap_server_t *server;
++ eap_peap_peer_t *client;
++ } impl;
++
++ /**
++ * Cached auth data for TLS and inner EAP methods
++ */
++ auth_cfg_t *auth;
+ };
+
+ /** Maximum number of EAP-PEAP messages/fragments allowed */
+@@ -113,10 +132,34 @@ METHOD(eap_method_t, is_mutual, bool,
+ return TRUE;
+ }
+
++METHOD(eap_method_t, get_auth, auth_cfg_t*,
++ private_eap_peap_t *this)
++{
++ if (!this->auth)
++ {
++ auth_cfg_t *inner;
++
++ this->auth = auth_cfg_create();
++ this->auth->merge(this->auth,
++ this->tls_eap->get_auth(this->tls_eap), FALSE);
++ if (this->is_server)
++ {
++ inner = this->impl.server->get_auth(this->impl.server);
++ }
++ else
++ {
++ inner = this->impl.client->get_auth(this->impl.client);
++ }
++ this->auth->merge(this->auth, inner, FALSE);
++ }
++ return this->auth;
++}
++
+ METHOD(eap_method_t, destroy, void,
+ private_eap_peap_t *this)
+ {
+ this->tls_eap->destroy(this->tls_eap);
++ DESTROY_IF(this->auth);
+ free(this);
+ }
+
+@@ -135,6 +178,7 @@ static private_eap_peap_t *eap_peap_create_empty(void)
+ .get_type = _get_type,
+ .is_mutual = _is_mutual,
+ .get_msk = _get_msk,
++ .get_auth = _get_auth,
+ .get_identifier = _get_identifier,
+ .set_identifier = _set_identifier,
+ .destroy = _destroy,
+@@ -147,7 +191,7 @@ static private_eap_peap_t *eap_peap_create_empty(void)
+ /**
+ * Generic private constructor
+ */
+-static eap_peap_t *eap_peap_create(private_eap_peap_t * this,
++static eap_peap_t *eap_peap_create(private_eap_peap_t *this,
+ identification_t *server,
+ identification_t *peer, bool is_server,
+ tls_application_t *application)
+@@ -157,6 +201,9 @@ static eap_peap_t *eap_peap_create(private_eap_peap_t * this,
+ bool include_length;
+ tls_t *tls;
+
++ this->is_server = is_server;
++ this->impl.application = application;
++
+ if (is_server && !lib->settings->get_bool(lib->settings,
+ "%s.plugins.eap-peap.request_peer_auth", FALSE,
+ lib->ns))
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.c b/src/libcharon/plugins/eap_peap/eap_peap_peer.c
+index 95213a3..f6c087a 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.c
++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.c
+@@ -52,6 +52,11 @@ struct private_eap_peap_peer_t {
+ */
+ eap_method_t *ph2_method;
+
++ /**
++ * Auth data for phase 2 methods
++ */
++ auth_cfg_t *auth;
++
+ /**
+ * Pending outbound EAP message
+ */
+@@ -166,6 +171,12 @@ METHOD(tls_application_t, process, status_t,
+ switch (status)
+ {
+ case SUCCESS:
++ if (this->ph2_method->get_auth)
++ {
++ this->auth->merge(this->auth,
++ this->ph2_method->get_auth(this->ph2_method),
++ FALSE);
++ }
+ this->ph2_method->destroy(this->ph2_method);
+ this->ph2_method = NULL;
+ /* fall through to NEED_MORE */
+@@ -220,11 +231,18 @@ METHOD(tls_application_t, build, status_t,
+ return INVALID_STATE;
+ }
+
++METHOD(eap_peap_peer_t, get_auth, auth_cfg_t*,
++ private_eap_peap_peer_t *this)
++{
++ return this->auth;
++}
++
+ METHOD(tls_application_t, destroy, void,
+ private_eap_peap_peer_t *this)
+ {
+ this->server->destroy(this->server);
+ this->peer->destroy(this->peer);
++ this->auth->destroy(this->auth);
+ DESTROY_IF(this->ph2_method);
+ DESTROY_IF(this->out);
+ this->avp->destroy(this->avp);
+@@ -247,10 +265,12 @@ eap_peap_peer_t *eap_peap_peer_create(identification_t *server,
+ .build = _build,
+ .destroy = _destroy,
+ },
++ .get_auth = _get_auth,
+ },
+ .server = server->clone(server),
+ .peer = peer->clone(peer),
+ .ph1_method = eap_method,
++ .auth = auth_cfg_create(),
+ .avp = eap_peap_avp_create(FALSE),
+ );
+
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_peer.h b/src/libcharon/plugins/eap_peap/eap_peap_peer.h
+index 53c25cd..7d16957 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_peer.h
++++ b/src/libcharon/plugins/eap_peap/eap_peap_peer.h
+@@ -38,6 +38,13 @@ struct eap_peap_peer_t {
+ * Implements the TLS application data handler.
+ */
+ tls_application_t application;
++
++ /**
++ * Get authentication details of this EAP method and its inner method(s).
++ *
++ * @return auth method, internal data
++ */
++ auth_cfg_t *(*get_auth)(eap_peap_peer_t *this);
+ };
+
+ /**
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.c b/src/libcharon/plugins/eap_peap/eap_peap_server.c
+index 29ab9b4..388c3c6 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_server.c
++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.c
+@@ -20,6 +20,8 @@
+ #include <utils/debug.h>
+ #include <daemon.h>
+
++#include <sa/eap/eap_inner_method.h>
++
+ typedef struct private_eap_peap_server_t private_eap_peap_server_t;
+
+ /**
+@@ -77,6 +79,16 @@ struct private_eap_peap_server_t {
+ */
+ eap_method_t *ph2_method;
+
++ /**
++ * Type of the completed phase 2 EAP method
++ */
++ eap_type_t phase2_type;
++
++ /**
++ * Auth data for phase 2 method
++ */
++ auth_cfg_t *auth;
++
+ /**
+ * Pending outbound EAP message
+ */
+@@ -132,8 +144,11 @@ static status_t start_phase2_auth(private_eap_peap_server_t *this)
+ /**
+ * If configured, start EAP-TNC protocol
+ */
+-static status_t start_phase2_tnc(private_eap_peap_server_t *this)
++static status_t start_phase2_tnc(private_eap_peap_server_t *this,
++ eap_type_t auth_type)
+ {
++ eap_inner_method_t *inner_method;
++
+ if (this->start_phase2_tnc && lib->settings->get_bool(lib->settings,
+ "%s.plugins.eap-peap.phase2_tnc", FALSE, lib->ns))
+ {
+@@ -145,6 +160,8 @@ static status_t start_phase2_tnc(private_eap_peap_server_t *this)
+ DBG1(DBG_IKE, "%N method not available", eap_type_names, EAP_TNC);
+ return FAILED;
+ }
++ inner_method = (eap_inner_method_t *)this->ph2_method;
++ inner_method->set_auth_type(inner_method, auth_type);
+ this->start_phase2_tnc = FALSE;
+
+ /* synchronize EAP message identifiers of inner protocol with outer */
+@@ -218,9 +235,13 @@ METHOD(tls_application_t, process, status_t,
+ DBG1(DBG_IKE, "received tunneled EAP-PEAP AVP [EAP/%N]",
+ eap_code_short_names, code);
+ in->destroy(in);
+- /* if EAP_SUCCESS check if to continue phase2 with EAP-TNC */
+- return (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS) ?
+- start_phase2_tnc(this) : FAILED;
++ if (this->phase2_result == EAP_SUCCESS && code == EAP_SUCCESS)
++ {
++ /* only accept SUCCESS once after a successful inner method */
++ this->phase2_result = EAP_FAILURE;
++ return start_phase2_tnc(this, this->phase2_type);
++ }
++ return FAILED;
+ }
+
+ if (this->ph2_method)
+@@ -245,6 +266,10 @@ METHOD(tls_application_t, process, status_t,
+ if (!received_vendor && received_type == EAP_IDENTITY)
+ {
+ chunk_t eap_id;
++ bool peer_auth;
++
++ peer_auth = lib->settings->get_bool(lib->settings,
++ "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns);
+
+ if (this->ph2_method == NULL)
+ {
+@@ -271,9 +296,22 @@ METHOD(tls_application_t, process, status_t,
+
+ if (this->ph2_method->get_msk(this->ph2_method, &eap_id) == SUCCESS)
+ {
+- this->peer->destroy(this->peer);
+- this->peer = identification_create_from_data(eap_id);
+- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer);
++ identification_t *id;
++
++ id = identification_create_from_data(eap_id);
++ if (peer_auth && !id->equals(id, this->peer))
++ {
++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping "
++ "certificate-authenticated identity '%Y'", id, this->peer);
++ id->destroy(id);
++ }
++ else
++ {
++ DBG1(DBG_IKE, "received EAP identity '%Y'", id);
++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id);
++ this->peer->destroy(this->peer);
++ this->peer = id->clone(id);
++ }
+ }
+
+ in->destroy(in);
+@@ -281,10 +319,9 @@ METHOD(tls_application_t, process, status_t,
+ this->ph2_method = NULL;
+
+ /* Start Phase 2 of EAP-PEAP authentication */
+- if (lib->settings->get_bool(lib->settings,
+- "%s.plugins.eap-peap.request_peer_auth", FALSE, lib->ns))
++ if (peer_auth)
+ {
+- return start_phase2_tnc(this);
++ return start_phase2_tnc(this, EAP_TLS);
+ }
+ else
+ {
+@@ -305,11 +342,26 @@ METHOD(tls_application_t, process, status_t,
+ switch (status)
+ {
+ case SUCCESS:
++ if (this->ph2_method->get_auth)
++ {
++ identification_t *id;
++ auth_cfg_t *auth;
++
++ auth = this->ph2_method->get_auth(this->ph2_method);
++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
++ if (id)
++ {
++ this->peer->destroy(this->peer);
++ this->peer = id->clone(id);
++ }
++ this->auth->merge(this->auth, auth, FALSE);
++ }
+ DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful",
+ eap_type_names, EAP_PEAP, this->peer,
+ eap_type_names, type);
+ this->ph2_method->destroy(this->ph2_method);
+ this->ph2_method = NULL;
++ this->phase2_type = type;
+
+ /* EAP-PEAP requires the sending of an inner EAP_SUCCESS message */
+ this->phase2_result = EAP_SUCCESS;
+@@ -407,11 +459,18 @@ METHOD(eap_peap_server_t, set_tls, void,
+ this->tls = tls;
+ }
+
++METHOD(eap_peap_server_t, get_auth, auth_cfg_t*,
++ private_eap_peap_server_t *this)
++{
++ return this->auth;
++}
++
+ METHOD(tls_application_t, destroy, void,
+ private_eap_peap_server_t *this)
+ {
+ this->server->destroy(this->server);
+ this->peer->destroy(this->peer);
++ this->auth->destroy(this->auth);
+ DESTROY_IF(this->ph2_method);
+ DESTROY_IF(this->out);
+ this->avp->destroy(this->avp);
+@@ -435,10 +494,12 @@ eap_peap_server_t *eap_peap_server_create(identification_t *server,
+ .destroy = _destroy,
+ },
+ .set_tls = _set_tls,
++ .get_auth = _get_auth,
+ },
+ .server = server->clone(server),
+ .peer = peer->clone(peer),
+ .ph1_method = eap_method,
++ .auth = auth_cfg_create(),
+ .start_phase2 = TRUE,
+ .start_phase2_tnc = TRUE,
+ .start_phase2_id = lib->settings->get_bool(lib->settings,
+diff --git a/src/libcharon/plugins/eap_peap/eap_peap_server.h b/src/libcharon/plugins/eap_peap/eap_peap_server.h
+index 3abe88b..8080e9f 100644
+--- a/src/libcharon/plugins/eap_peap/eap_peap_server.h
++++ b/src/libcharon/plugins/eap_peap/eap_peap_server.h
+@@ -47,6 +47,13 @@ struct eap_peap_server_t {
+ * @param tls TLS connection
+ */
+ void (*set_tls)(eap_peap_server_t *this, tls_t *tls);
++
++ /**
++ * Get authentication details of this EAP method and its inner method(s).
++ *
++ * @return auth method, internal data
++ */
++ auth_cfg_t *(*get_auth)(eap_peap_server_t *this);
+ };
+
+ /**
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls.c b/src/libcharon/plugins/eap_ttls/eap_ttls.c
+index d8ad781..3df78bb 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls.c
++++ b/src/libcharon/plugins/eap_ttls/eap_ttls.c
+@@ -40,6 +40,25 @@ struct private_eap_ttls_t {
+ * TLS stack, wrapped by EAP helper
+ */
+ tls_eap_t *tls_eap;
++
++ /**
++ * Role
++ */
++ bool is_server;
++
++ /**
++ * Actual server/client implementation
++ */
++ union {
++ tls_application_t *application;
++ eap_ttls_server_t *server;
++ eap_ttls_peer_t *client;
++ } impl;
++
++ /**
++ * Cached auth data for TLS and inner EAP methods
++ */
++ auth_cfg_t *auth;
+ };
+
+ /** Maximum number of EAP-TTLS messages/fragments allowed */
+@@ -116,13 +135,31 @@ METHOD(eap_method_t, is_mutual, bool,
+ METHOD(eap_method_t, get_auth, auth_cfg_t*,
+ private_eap_ttls_t *this)
+ {
+- return this->tls_eap->get_auth(this->tls_eap);
++ if (!this->auth)
++ {
++ auth_cfg_t *inner;
++
++ this->auth = auth_cfg_create();
++ this->auth->merge(this->auth,
++ this->tls_eap->get_auth(this->tls_eap), FALSE);
++ if (this->is_server)
++ {
++ inner = this->impl.server->get_auth(this->impl.server);
++ }
++ else
++ {
++ inner = this->impl.client->get_auth(this->impl.client);
++ }
++ this->auth->merge(this->auth, inner, FALSE);
++ }
++ return this->auth;
+ }
+
+ METHOD(eap_method_t, destroy, void,
+ private_eap_ttls_t *this)
+ {
+ this->tls_eap->destroy(this->tls_eap);
++ DESTROY_IF(this->auth);
+ free(this);
+ }
+
+@@ -153,6 +190,10 @@ static eap_ttls_t *eap_ttls_create(identification_t *server,
+ .destroy = _destroy,
+ },
+ },
++ .is_server = is_server,
++ .impl = {
++ .application = application,
++ },
+ );
+ if (is_server && !lib->settings->get_bool(lib->settings,
+ "%s.plugins.eap-ttls.request_peer_auth", FALSE,
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
+index 63126a5..f8229f5 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.c
+@@ -54,6 +54,11 @@ struct private_eap_ttls_peer_t {
+ */
+ eap_method_t *method;
+
++ /**
++ * Auth data for phase 2 method
++ */
++ auth_cfg_t *auth;
++
+ /**
+ * Pending outbound EAP message
+ */
+@@ -215,6 +220,11 @@ METHOD(tls_application_t, process, status_t,
+ switch (status)
+ {
+ case SUCCESS:
++ if (this->method->get_auth)
++ {
++ this->auth->merge(this->auth,
++ this->method->get_auth(this->method), FALSE);
++ }
+ this->method->destroy(this->method);
+ this->method = NULL;
+ /* fall through to NEED_MORE */
+@@ -275,11 +285,18 @@ METHOD(tls_application_t, build, status_t,
+ return INVALID_STATE;
+ }
+
++METHOD(eap_ttls_peer_t, get_auth, auth_cfg_t*,
++ private_eap_ttls_peer_t *this)
++{
++ return this->auth;
++}
++
+ METHOD(tls_application_t, destroy, void,
+ private_eap_ttls_peer_t *this)
+ {
+ this->server->destroy(this->server);
+ this->peer->destroy(this->peer);
++ this->auth->destroy(this->auth);
+ DESTROY_IF(this->method);
+ DESTROY_IF(this->out);
+ this->avp->destroy(this->avp);
+@@ -301,10 +318,12 @@ eap_ttls_peer_t *eap_ttls_peer_create(identification_t *server,
+ .build = _build,
+ .destroy = _destroy,
+ },
++ .get_auth = _get_auth,
+ },
+ .server = server->clone(server),
+ .peer = peer->clone(peer),
+ .start_phase2 = TRUE,
++ .auth = auth_cfg_create(),
+ .avp = eap_ttls_avp_create(),
+ );
+
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h
+index 0c3d90a..69a8435 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h
++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_peer.h
+@@ -37,6 +37,13 @@ struct eap_ttls_peer_t {
+ * Implements the TLS application data handler.
+ */
+ tls_application_t application;
++
++ /**
++ * Get authentication details of this EAP method and its inner method(s).
++ *
++ * @return auth method, internal data
++ */
++ auth_cfg_t *(*get_auth)(eap_ttls_peer_t *this);
+ };
+
+ /**
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
+index fc97f81..e1de1bf 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.c
+@@ -60,6 +60,11 @@ struct private_eap_ttls_server_t {
+ */
+ eap_method_t *method;
+
++ /**
++ * Auth data for phase 2 method
++ */
++ auth_cfg_t *auth;
++
+ /**
+ * Pending outbound EAP message
+ */
+@@ -220,6 +225,10 @@ METHOD(tls_application_t, process, status_t,
+ if (!received_vendor && received_type == EAP_IDENTITY)
+ {
+ chunk_t eap_id;
++ bool peer_auth;
++
++ peer_auth = lib->settings->get_bool(lib->settings,
++ "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns);
+
+ if (this->method == NULL)
+ {
+@@ -244,9 +253,22 @@ METHOD(tls_application_t, process, status_t,
+
+ if (this->method->get_msk(this->method, &eap_id) == SUCCESS)
+ {
+- this->peer->destroy(this->peer);
+- this->peer = identification_create_from_data(eap_id);
+- DBG1(DBG_IKE, "received EAP identity '%Y'", this->peer);
++ identification_t *id;
++
++ id = identification_create_from_data(eap_id);
++ if (peer_auth && !id->equals(id, this->peer))
++ {
++ DBG1(DBG_IKE, "received tunneled EAP identity '%Y', keeping "
++ "certificate-authenticated identity '%Y'", id, this->peer);
++ id->destroy(id);
++ }
++ else
++ {
++ DBG1(DBG_IKE, "received EAP identity '%Y'", id);
++ this->auth->add(this->auth, AUTH_RULE_EAP_IDENTITY, id);
++ this->peer->destroy(this->peer);
++ this->peer = id->clone(id);
++ }
+ }
+
+ in->destroy(in);
+@@ -254,8 +276,7 @@ METHOD(tls_application_t, process, status_t,
+ this->method = NULL;
+
+ /* Start Phase 2 of EAP-TTLS authentication */
+- if (lib->settings->get_bool(lib->settings,
+- "%s.plugins.eap-ttls.request_peer_auth", FALSE, lib->ns))
++ if (peer_auth)
+ {
+ return start_phase2_tnc(this, EAP_TLS);
+ }
+@@ -278,6 +299,20 @@ METHOD(tls_application_t, process, status_t,
+ switch (status)
+ {
+ case SUCCESS:
++ if (this->method->get_auth)
++ {
++ identification_t *id;
++ auth_cfg_t *auth;
++
++ auth = this->method->get_auth(this->method);
++ id = auth->get(auth, AUTH_RULE_EAP_IDENTITY);
++ if (id)
++ {
++ this->peer->destroy(this->peer);
++ this->peer = id->clone(id);
++ }
++ this->auth->merge(this->auth, auth, FALSE);
++ }
+ DBG1(DBG_IKE, "%N phase2 authentication of '%Y' with %N successful",
+ eap_type_names, EAP_TTLS, this->peer,
+ eap_type_names, type);
+@@ -348,11 +383,18 @@ METHOD(tls_application_t, build, status_t,
+ return INVALID_STATE;
+ }
+
++METHOD(eap_ttls_server_t, get_auth, auth_cfg_t*,
++ private_eap_ttls_server_t *this)
++{
++ return this->auth;
++}
++
+ METHOD(tls_application_t, destroy, void,
+ private_eap_ttls_server_t *this)
+ {
+ this->server->destroy(this->server);
+ this->peer->destroy(this->peer);
++ this->auth->destroy(this->auth);
+ DESTROY_IF(this->method);
+ DESTROY_IF(this->out);
+ this->avp->destroy(this->avp);
+@@ -374,11 +416,13 @@ eap_ttls_server_t *eap_ttls_server_create(identification_t *server,
+ .build = _build,
+ .destroy = _destroy,
+ },
++ .get_auth = _get_auth,
+ },
+ .server = server->clone(server),
+- .peer = peer->clone(peer),
++ .auth = auth_cfg_create(),
+ .start_phase2 = TRUE,
+ .start_phase2_tnc = TRUE,
++ .peer = peer->clone(peer),
+ .avp = eap_ttls_avp_create(),
+ );
+
+diff --git a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h
+index 1e13f55..3348706 100644
+--- a/src/libcharon/plugins/eap_ttls/eap_ttls_server.h
++++ b/src/libcharon/plugins/eap_ttls/eap_ttls_server.h
+@@ -37,6 +37,13 @@ struct eap_ttls_server_t {
+ * Implements the TLS application data handler.
+ */
+ tls_application_t application;
++
++ /**
++ * Get authentication details of this EAP method and its inner method(s).
++ *
++ * @return auth method, internal data
++ */
++ auth_cfg_t *(*get_auth)(eap_ttls_server_t *this);
+ };
+
+ /**
diff --git a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
index df0333b458..bb6c6bf2a3 100644
--- a/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
+++ b/meta-networking/recipes-support/strongswan/strongswan_6.0.7.bb
@@ -19,6 +19,7 @@ SRC_URI = "https://download.strongswan.org/strongswan-${PV}.tar.bz2 \
file://CVE-2026-78130.patch \
file://CVE-2026-78132.patch \
file://CVE-2026-78135.patch \
+ file://CVE-2026-78134.patch \
"
SRC_URI[sha256sum] = "e518e34e159514f4c6ba80d1f926cb151e0dd4e3a1d94213171234b8b9ae6f55"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 73/82] tesseract: patch CVE-2026-88052
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (71 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 72/82] strongswan: patch CVE-2026-78134 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 74/82] tesseract: patch CVE-2026-88048 ankur.tyagi85
` (9 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88052
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 251dd7f80d1fc19515e162f5afd1eb889839bbaf)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tesseract/tesseract/CVE-2026-88052.patch | 165 ++++++++++++++++++
.../tesseract/tesseract_5.5.3.bb | 5 +-
2 files changed, 168 insertions(+), 2 deletions(-)
create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch
new file mode 100644
index 0000000000..e55968135a
--- /dev/null
+++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch
@@ -0,0 +1,165 @@
+From c60ad589ff3a645a3fdf13cb24fe719313145a06 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 21 Aug 2026 18:34:33 +0200
+Subject: [PATCH] Reject unicharset files whose inserts desync id from unichars
+
+UNICHARSET::load_via_fgets reads the unichar count via sscanf and
+trusts it as the loop bound, indexing the unichars vector with the
+loop index id via the unchecked set_* accessors. unichar_insert is a
+no-op for duplicate (or empty) representations, so once any insert
+no-ops, unichars.size() falls behind id and the subsequent
+set_*(id, ...) and unichars[id].properties writes land past the end
+of the vector - a deterministic heap out-of-bounds write (including a
+std::string assignment via set_normed) for every remaining line, on
+both the LSTM and legacy init paths. A malformed unicharset with a
+duplicate line (e.g. two identical entries) triggers it; a
+non-positive header count likewise loads an empty unicharset
+"successfully".
+
+Key changes:
+- unicharset.cpp: reject unicharset_size <= 0, and after each insert
+ verify the vector actually grew to id + 1; on mismatch report the
+ offending line and reject the file instead of writing out of bounds.
+- unittest: add unicharset_load_test with a duplicate-representation
+ unicharset (on unpatched code the test dies on the
+ container-overflow in load_via_fgets), a zero and a negative count,
+ and a positive control that a valid unicharset still loads.
+
+Reported-by: Zhixi "Jace" Sun <g.mygenie@gmail.com>
+Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+(cherry picked from commit 2d04d640db2e8c7e3bab2369d599343b5a8b8443)
+
+CVE: CVE-2026-88052
+Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/2d04d640db2e8c7e3bab2369d599343b5a8b8443]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ Makefile.am | 5 +++
+ src/ccutil/unicharset.cpp | 12 ++++++
+ unittest/unicharset_load_test.cc | 64 ++++++++++++++++++++++++++++++++
+ 3 files changed, 81 insertions(+)
+ create mode 100644 unittest/unicharset_load_test.cc
+
+diff --git a/Makefile.am b/Makefile.am
+index bec9ab0e..22c2c7a0 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1220,6 +1220,7 @@ check_PROGRAMS += tfile_test
+ if ENABLE_TRAINING
+ check_PROGRAMS += unichar_test
+ check_PROGRAMS += unicharcompress_test
++check_PROGRAMS += unicharset_load_test
+ check_PROGRAMS += unicharset_test
+ check_PROGRAMS += validate_grapheme_test
+ check_PROGRAMS += validate_indic_test
+@@ -1493,6 +1494,10 @@ unicharcompress_test_SOURCES = unittest/unicharcompress_test.cc
+ unicharcompress_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ unicharcompress_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS)
+
++unicharset_load_test_SOURCES = unittest/unicharset_load_test.cc
++unicharset_load_test_CPPFLAGS = $(unittest_CPPFLAGS)
++unicharset_load_test_LDADD = $(TESS_LIBS)
++
+ unicharset_test_SOURCES = unittest/unicharset_test.cc
+ unicharset_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ unicharset_test_LDADD = $(TRAINING_LIBS) $(ICU_UC_LIBS)
+diff --git a/src/ccutil/unicharset.cpp b/src/ccutil/unicharset.cpp
+index b29ec3b7..0e72ae48 100644
+--- a/src/ccutil/unicharset.cpp
++++ b/src/ccutil/unicharset.cpp
+@@ -791,6 +791,9 @@ bool UNICHARSET::load_via_fgets(
+ sscanf(buffer, "%d", &unicharset_size) != 1) {
+ return false;
+ }
++ if (unicharset_size <= 0) {
++ return false;
++ }
+ for (UNICHAR_ID id = 0; id < unicharset_size; ++id) {
+ char unichar[256];
+ unsigned int properties;
+@@ -884,6 +887,15 @@ bool UNICHARSET::load_via_fgets(
+ } else {
+ this->unichar_insert_backwards_compatible(unichar);
+ }
++ // A duplicate or empty representation makes the insert a no-op,
++ // desynchronizing id from the unichars vector; the set_* calls and
++ // unichars[id] below would then write out of bounds. The file is
++ // malformed, so reject it.
++ if (size() != static_cast<size_t>(id) + 1) {
++ fprintf(stderr, "%s:%d unichar %d has a duplicate or empty representation\n",
++ __FILE__, __LINE__, id);
++ return false;
++ }
+
+ this->set_isalpha(id, properties & ISALPHA_MASK);
+ this->set_islower(id, properties & ISLOWER_MASK);
+diff --git a/unittest/unicharset_load_test.cc b/unittest/unicharset_load_test.cc
+new file mode 100644
+index 00000000..d775e233
+--- /dev/null
++++ b/unittest/unicharset_load_test.cc
+@@ -0,0 +1,64 @@
++///////////////////////////////////////////////////////////////////////
++// File: unicharset_load_test.cc
++// Description: Tests that UNICHARSET::load_via_fgets rejects unicharset
++// files whose insertions desynchronize the id loop index
++// from the unichars vector (duplicate or empty
++// representations), which would make the subsequent set_*
++// calls write out of bounds, and non-positive size counts.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++// http://www.apache.org/licenses/LICENSE-2.0
++//
++///////////////////////////////////////////////////////////////////////
++
++#include "include_gunit.h"
++
++#include "serialis.h" // for TFile
++#include "unicharset.h"
++
++#include <cstring>
++
++namespace tesseract {
++namespace {
++
++// Loads the given unicharset text via the TFile-based loader.
++bool LoadUnicharset(const char *text, UNICHARSET *unicharset) {
++ TFile fp;
++ if (!fp.Open(text, std::strlen(text))) {
++ return false;
++ }
++ return unicharset->load_from_file(&fp, false);
++}
++
++// A duplicate representation makes the second insert a no-op, so on
++// unpatched code the set_* calls for the remaining lines write past
++// the end of the unichars vector (ASan container-overflow).
++TEST(UnicharsetLoadTest, RejectsDuplicateRepresentation) {
++ const char *text = "3\nA 0 Latin\nA 0 Latin\nB 0 Latin\n";
++ UNICHARSET unicharset;
++ EXPECT_FALSE(LoadUnicharset(text, &unicharset));
++}
++
++// A non-positive size count must be rejected; on unpatched code a
++// zero or negative count loads an empty unicharset successfully.
++TEST(UnicharsetLoadTest, RejectsNonPositiveCount) {
++ const char *texts[] = {"0\n", "-1\n"};
++ for (const char *text : texts) {
++ UNICHARSET unicharset;
++ EXPECT_FALSE(LoadUnicharset(text, &unicharset));
++ }
++}
++
++// A valid unicharset must still be accepted.
++TEST(UnicharsetLoadTest, AcceptsValidUnicharset) {
++ const char *text = "3\nA 0 Latin\nB 0 Latin\nC 0 Latin\n";
++ UNICHARSET unicharset;
++ ASSERT_TRUE(LoadUnicharset(text, &unicharset));
++ EXPECT_EQ(unicharset.size(), 3u);
++ EXPECT_STREQ(unicharset.id_to_unichar(1), "B");
++}
++
++} // namespace
++} // namespace tesseract
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
index 0d9b178dc9..81359b761b 100644
--- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
+++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
@@ -6,8 +6,9 @@ LICENSE = "Apache-2.0"
LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef"
-SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV}"
-
+SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \
+ file://CVE-2026-88052.patch \
+"
DEPENDS = "leptonica"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 74/82] tesseract: patch CVE-2026-88048
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (72 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 73/82] tesseract: patch CVE-2026-88052 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 75/82] tesseract: patch CVE-2026-88049 ankur.tyagi85
` (8 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88048
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 9e544d6e5087f701a0d6a9d66ae3f87b6dcc8c5e)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tesseract/tesseract/CVE-2026-88048.patch | 227 ++++++++++++++++++
.../tesseract/tesseract_5.5.3.bb | 1 +
2 files changed, 228 insertions(+)
create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch
new file mode 100644
index 0000000000..abfd502667
--- /dev/null
+++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch
@@ -0,0 +1,227 @@
+From b2fbc8282c34f0a5a426622a9eb6a79ad0df0fe4 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 21 Aug 2026 15:23:59 +0200
+Subject: [PATCH] Validate FullyConnected weight matrix dimensions at load
+
+FullyConnected::DeSerialize read the WeightMatrix without checking
+that its dimensions match the layer's declared ni/no. MatrixDotVector
+drives the dot product from the matrix dimensions (writes w.dim1()
+results, reads w.dim2()-1 inputs) while the scratch buffers are sized
+from no_ and ni_, so a crafted .traineddata with a mismatched matrix
+performed a heap out-of-bounds write (up to 65535 rows) and out-of-
+bounds read on the first recognition step (crash, or heap corruption
+with attacker-influenced size and content).
+
+Key changes:
+- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight
+ matrix (int or float), alongside the existing NumOutputs().
+- fullyconnected.cpp: reject the layer in DeSerialize unless
+ Dim1() == no_ and Dim2() == ni_ + 1 (the second dimension
+ includes the bias column), the layout that InitWeightsFloat
+ always produces.
+- unittest: new fullyconnected_test that builds a Softmax network
+ with mismatched matrix dimensions and expects CreateFromFile to
+ return nullptr; on unpatched code the test reaches Forward and
+ ASan catches the out-of-bounds write in MatrixDotVector. A
+ second test verifies that matching dimensions are still accepted.
+
+Reported-by: Zhixi "Jace" Sun <g.mygenie@gmail.com>
+Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+(cherry picked from commit 103dc134eb36411ddc6833ec20aa2c76795bd0ff)
+
+CVE: CVE-2026-88048
+Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/103dc134eb36411ddc6833ec20aa2c76795bd0ff]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ Makefile.am | 5 ++
+ src/lstm/fullyconnected.cpp | 11 ++-
+ src/lstm/weightmatrix.h | 7 ++
+ unittest/fullyconnected_test.cc | 115 ++++++++++++++++++++++++++++++++
+ 4 files changed, 137 insertions(+), 1 deletion(-)
+ create mode 100644 unittest/fullyconnected_test.cc
+
+diff --git a/Makefile.am b/Makefile.am
+index 22c2c7a0..284f8b53 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1158,6 +1158,7 @@ if !DISABLED_LEGACY_ENGINE
+ check_PROGRAMS += equationdetect_test
+ endif # !DISABLED_LEGACY_ENGINE
+ check_PROGRAMS += fileio_test
++check_PROGRAMS += fullyconnected_test
+ check_PROGRAMS += heap_test
+ check_PROGRAMS += imagedata_test
+ if !DISABLED_LEGACY_ENGINE
+@@ -1290,6 +1291,10 @@ fileio_test_SOURCES = unittest/fileio_test.cc
+ fileio_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ fileio_test_LDADD = $(TRAINING_LIBS)
+
++fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc
++fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS)
++fullyconnected_test_LDADD = $(TESS_LIBS)
++
+ heap_test_SOURCES = unittest/heap_test.cc
+ heap_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ heap_test_LDADD = $(TESS_LIBS)
+diff --git a/src/lstm/fullyconnected.cpp b/src/lstm/fullyconnected.cpp
+index a0ee1b02..d999f575 100644
+--- a/src/lstm/fullyconnected.cpp
++++ b/src/lstm/fullyconnected.cpp
+@@ -121,7 +121,16 @@ bool FullyConnected::Serialize(TFile *fp) const {
+
+ // Reads from the given file. Returns false in case of error.
+ bool FullyConnected::DeSerialize(TFile *fp) {
+- return weights_.DeSerialize(IsTraining(), fp);
++ if (!weights_.DeSerialize(IsTraining(), fp)) {
++ return false;
++ }
++ // The weight matrix must match the declared sizes (the second dimension
++ // includes the bias column); otherwise Forward would read or write
++ // outside the scratch buffers sized from ni_ and no_.
++ if (weights_.Dim1() != no_ || weights_.Dim2() != ni_ + 1) {
++ return false;
++ }
++ return true;
+ }
+
+ // Runs forward propagation of activations on the input line.
+diff --git a/src/lstm/weightmatrix.h b/src/lstm/weightmatrix.h
+index eaca3ffb..6c5ab236 100644
+--- a/src/lstm/weightmatrix.h
++++ b/src/lstm/weightmatrix.h
+@@ -107,6 +107,13 @@ public:
+ int NumOutputs() const {
+ return int_mode_ ? wi_.dim1() : wf_.dim1();
+ }
++ // The dimensions of the active weight matrix (wi_ in int mode, else wf_).
++ int Dim1() const {
++ return int_mode_ ? wi_.dim1() : wf_.dim1();
++ }
++ int Dim2() const {
++ return int_mode_ ? wi_.dim2() : wf_.dim2();
++ }
+ // Provides one set of weights. Only used by peep weight maxpool.
+ const TFloat *GetWeights(int index) const {
+ return wf_[index];
+diff --git a/unittest/fullyconnected_test.cc b/unittest/fullyconnected_test.cc
+new file mode 100644
+index 00000000..f9697de4
+--- /dev/null
++++ b/unittest/fullyconnected_test.cc
+@@ -0,0 +1,115 @@
++///////////////////////////////////////////////////////////////////////
++// File: fullyconnected_test.cc
++// Description: Tests that a FullyConnected (softmax) network layer with
++// weight-matrix dimensions that do not match the declared
++// ni/no is rejected at load. Without the check,
++// MatrixDotVector writes w.dim1() results into a scratch
++// buffer sized from no_ and reads w.dim2()-1 inputs from
++// a buffer sized from ni_ (heap out-of-bounds write/read)
++// on the first recognition step.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++// http://www.apache.org/licenses/LICENSE-2.0
++//
++///////////////////////////////////////////////////////////////////////
++
++#include "include_gunit.h"
++
++#include "network.h" // for Network, NetworkType
++#include "networkio.h"
++#include "networkscratch.h"
++#include "serialis.h" // for TFile
++
++#include <cstdint>
++#include <vector>
++
++namespace tesseract {
++namespace {
++
++// Appends raw little-endian values to a byte buffer.
++class ByteWriter {
++public:
++ void PutU8(uint32_t v) { data_.push_back(static_cast<char>(v & 0xFF)); }
++ void PutU32(uint32_t v) {
++ for (int i = 0; i < 4; ++i) {
++ data_.push_back(static_cast<char>((v >> (8 * i)) & 0xFF));
++ }
++ }
++ void PutS32(int32_t v) { PutU32(static_cast<uint32_t>(v)); }
++ const std::vector<char> &data() const { return data_; }
++
++private:
++ std::vector<char> data_;
++};
++
++void PutDoubleLE(ByteWriter *w, double d) {
++ union {
++ double d;
++ uint64_t u;
++ } conv;
++ conv.d = d;
++ w->PutU32(static_cast<uint32_t>(conv.u & 0xFFFFFFFF));
++ w->PutU32(static_cast<uint32_t>(conv.u >> 32));
++}
++
++// Builds a serialized NT_SOFTMAX network: header with the given ni/no,
++// then a float-mode WeightMatrix with the given (corrupt) dimensions.
++// The matrix is stored as doubles on disk (see WeightMatrix::DeSerialize).
++std::vector<char> MakeSoftmaxNetwork(int ni, int no, int32_t dim1, int32_t dim2) {
++ ByteWriter w;
++ w.PutU8(static_cast<uint32_t>(NT_SOFTMAX));
++ w.PutU8(0); // training: TS_DISABLED
++ w.PutU8(0); // needs_to_backprop
++ w.PutU32(0); // network_flags
++ w.PutU32(static_cast<uint32_t>(ni));
++ w.PutU32(static_cast<uint32_t>(no));
++ w.PutU32(0); // num_weights (not cross-checked, kept consistent anyway)
++ w.PutU32(0); // name (empty string)
++ // WeightMatrix::DeSerialize:
++ w.PutU8(128); // mode: kDoubleFlag, float mode
++ w.PutS32(dim1);
++ w.PutS32(dim2);
++ PutDoubleLE(&w, 0.0); // empty_ cell
++ for (int32_t i = 0; i < dim1 * dim2; ++i) {
++ PutDoubleLE(&w, 0.0); // weight data
++ }
++ return w.data();
++}
++
++// A FullyConnected layer whose weight matrix does not match the declared
++// sizes must be rejected by CreateFromFile; on unpatched code the test
++// reaches Forward, where MatrixDotVector performs the out-of-bounds
++// write this regression test guards against.
++TEST(FullyconnectedTest, RejectsWeightMatrixDimensionMismatch) {
++ // ni_=no_=1 but dim1=3 (OOB write of 3 results into a 1-result buffer)
++ // and dim2=5 (OOB read of 4 inputs from a 1-input buffer).
++ std::vector<char> bytes = MakeSoftmaxNetwork(1, 1, 3, 5);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ Network *net = Network::CreateFromFile(&fp);
++ if (net == nullptr) {
++ return; // Fixed: the mismatched layer is rejected at load.
++ }
++ NetworkIO input;
++ input.Resize2d(false, /*width=*/1, /*num_features=*/1);
++ NetworkScratch scratch;
++ NetworkIO output;
++ net->Forward(false, input, nullptr, &scratch, &output);
++ delete net;
++ FAIL() << "crafted FullyConnected layer with mismatched weight matrix was accepted";
++}
++
++// Consistent dimensions must still be accepted.
++TEST(FullyconnectedTest, AcceptsMatchingDimensions) {
++ std::vector<char> bytes = MakeSoftmaxNetwork(1, 2, 2, 2);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ Network *net = Network::CreateFromFile(&fp);
++ ASSERT_NE(net, nullptr);
++ delete net;
++}
++
++} // namespace
++} // namespace tesseract
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
index 81359b761b..bed16f9806 100644
--- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
+++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
@@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57"
SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef"
SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \
file://CVE-2026-88052.patch \
+ file://CVE-2026-88048.patch \
"
DEPENDS = "leptonica"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 75/82] tesseract: patch CVE-2026-88049
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (73 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 74/82] tesseract: patch CVE-2026-88048 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 76/82] tesseract: patch CVE-2026-88050 ankur.tyagi85
` (7 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88049
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 218b6a19b168587a67d1eab85160c302013164db)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tesseract/tesseract/CVE-2026-88049.patch | 315 ++++++++++++++++++
.../tesseract/tesseract_5.5.3.bb | 1 +
2 files changed, 316 insertions(+)
create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch
new file mode 100644
index 0000000000..b6a5e5275d
--- /dev/null
+++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch
@@ -0,0 +1,315 @@
+From 62fabbca097d127e7d5a8fe3869102d2e4918b80 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 21 Aug 2026 16:41:51 +0200
+Subject: [PATCH] Validate LSTM gate matrix dimensions against na_/no_ at load
+
+LSTM::DeSerialize read na_ from the untrusted TESSDATA_LSTM component
+and derived ns_ from the CI gate matrix's dim1, but never checked that
+the deserialized dimensions were mutually consistent. The forward pass
+sizes its buffers from na_, no_ and ns_ while the gate matrices drive
+their own dimensions, so a crafted .traineddata performed heap
+out-of-bounds writes and reads during the first recognition step, e.g.
+WriteTimeStepPart writing ns_ floats at offset ni_+nf_ into a source_
+buffer sized from na_ (up to ~256 KB with an attacker-chosen gate
+matrix dim1).
+
+The bounds assertions added by 2f4d2f4 (CVE-2026-73066) covered only
+NetworkIO::CopyTimeStepGeneral and Randomize, leaving
+WriteTimeStepPart and AddTimeStepPart unguarded.
+
+Key changes:
+- weightmatrix.h: add Dim1()/Dim2() accessors for the active weight
+ matrix (int or float), alongside the existing NumOutputs().
+- lstm.cpp: reject the layer in DeSerialize unless na_ ==
+ ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_, every deserialized gate has
+ Dim1() == ns_ and Dim2() == na_ + 1 (the layout InitWeightsFloat
+ always produces), ns_ == no_ for plain NT_LSTM/NT_LSTM_SUMMARY, and
+ the softmax layer's sizes match ns_/no_ for the softmax variants.
+- networkio.cpp: add the same defense-in-depth bounds assertions to
+ WriteTimeStepPart and AddTimeStepPart as 2f4d2f4 added to
+ CopyTimeStepGeneral and Randomize.
+- unittest: add lstm_layer_test with crafted NT_LSTM layers for the
+ na_ mismatch, gate dim1 mismatch, and gate dim2 mismatch cases
+ (each rejected at load; on unpatched code the tests reach Forward
+ and ASan catches the out-of-bounds write in WriteTimeStepPart),
+ plus a positive control that a consistent layer loads and runs.
+
+Reported-by: Zhixi "Jace" Sun <g.mygenie@gmail.com>
+Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+(cherry picked from commit b494ac18925f9d9aff9ef5815475de9943ab19bf)
+
+CVE: CVE-2026-88049
+Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/b494ac18925f9d9aff9ef5815475de9943ab19bf]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ Makefile.am | 5 +
+ src/lstm/lstm.cpp | 20 ++++
+ src/lstm/networkio.cpp | 2 +
+ unittest/lstm_layer_test.cc | 177 ++++++++++++++++++++++++++++++++++++
+ 4 files changed, 204 insertions(+)
+ create mode 100644 unittest/lstm_layer_test.cc
+
+diff --git a/Makefile.am b/Makefile.am
+index 284f8b53..4bcc858b 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1171,6 +1171,7 @@ check_PROGRAMS += layout_test
+ check_PROGRAMS += ligature_table_test
+ check_PROGRAMS += linlsq_test
+ check_PROGRAMS += list_test
++check_PROGRAMS += lstm_layer_test
+ if ENABLE_TRAINING
+ check_PROGRAMS += lstm_recode_test
+ check_PROGRAMS += lstm_squashed_test
+@@ -1352,6 +1353,10 @@ loadlang_test_SOURCES = unittest/loadlang_test.cc
+ loadlang_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ loadlang_test_LDADD = $(TESS_LIBS) $(LEPTONICA_LIBS)
+
++lstm_layer_test_SOURCES = unittest/lstm_layer_test.cc
++lstm_layer_test_CPPFLAGS = $(unittest_CPPFLAGS)
++lstm_layer_test_LDADD = $(TESS_LIBS)
++
+ lstm_recode_test_SOURCES = unittest/lstm_recode_test.cc
+ lstm_recode_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ lstm_recode_test_LDADD = $(TRAINING_LIBS)
+diff --git a/src/lstm/lstm.cpp b/src/lstm/lstm.cpp
+index 7bfd19b5..bfffa5de 100644
+--- a/src/lstm/lstm.cpp
++++ b/src/lstm/lstm.cpp
+@@ -274,12 +274,32 @@ bool LSTM::DeSerialize(TFile *fp) {
+ is_2d_ = na_ - nf_ == ni_ + 2 * ns_;
+ }
+ }
++ // The deserialized dimensions must be mutually consistent: the forward
++ // pass sizes its buffers from na_, no_ and ns_ while the gate matrices
++ // drive their own dimensions.
++ if (na_ != ni_ + nf_ + (is_2d_ ? 2 : 1) * ns_) {
++ return false;
++ }
++ for (int w = 0; w < WT_COUNT; ++w) {
++ if (w == GFS && !Is2D()) {
++ continue;
++ }
++ if (gate_weights_[w].Dim1() != ns_ || gate_weights_[w].Dim2() != na_ + 1) {
++ return false;
++ }
++ }
++ if ((type_ == NT_LSTM || type_ == NT_LSTM_SUMMARY) && ns_ != no_) {
++ return false;
++ }
+ delete softmax_;
+ if (type_ == NT_LSTM_SOFTMAX || type_ == NT_LSTM_SOFTMAX_ENCODED) {
+ softmax_ = static_cast<FullyConnected *>(Network::CreateFromFile(fp));
+ if (softmax_ == nullptr) {
+ return false;
+ }
++ if (softmax_->NumInputs() != ns_ || softmax_->NumOutputs() != no_) {
++ return false;
++ }
+ } else {
+ softmax_ = nullptr;
+ }
+diff --git a/src/lstm/networkio.cpp b/src/lstm/networkio.cpp
+index 8e1c6679..7a31034b 100644
+--- a/src/lstm/networkio.cpp
++++ b/src/lstm/networkio.cpp
+@@ -641,6 +641,7 @@ void NetworkIO::AddTimeStep(int t, TFloat *inout) const {
+
+ // Adds part of a single timestep to floats.
+ void NetworkIO::AddTimeStepPart(int t, int offset, int num_features, float *inout) const {
++ ASSERT_HOST(offset + num_features <= NumFeatures());
+ if (int_mode_) {
+ const int8_t *line = i_[t] + offset;
+ for (int i = 0; i < num_features; ++i) {
+@@ -662,6 +663,7 @@ void NetworkIO::WriteTimeStep(int t, const TFloat *input) {
+ // Writes a single timestep from floats in the range [-1, 1] writing only
+ // num_features elements of input to (*this)[t], starting at offset.
+ void NetworkIO::WriteTimeStepPart(int t, int offset, int num_features, const TFloat *input) {
++ ASSERT_HOST(offset + num_features <= NumFeatures());
+ if (int_mode_) {
+ int8_t *line = i_[t] + offset;
+ for (int i = 0; i < num_features; ++i) {
+diff --git a/unittest/lstm_layer_test.cc b/unittest/lstm_layer_test.cc
+new file mode 100644
+index 00000000..2c874995
+--- /dev/null
++++ b/unittest/lstm_layer_test.cc
+@@ -0,0 +1,177 @@
++///////////////////////////////////////////////////////////////////////
++// File: lstm_layer_test.cc
++// Description: Tests that an NT_LSTM network layer with mutually
++// inconsistent deserialized dimensions is rejected at
++// load. The forward pass sizes its buffers from na_, no_
++// and ns_ while the gate weight matrices drive their own
++// dimensions, so a crafted .traineddata performs heap
++// out-of-bounds writes/reads during the first
++// recognition step (e.g. WriteTimeStepPart writing ns_
++// floats into a source_ buffer sized from na_).
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++// http://www.apache.org/licenses/LICENSE-2.0
++//
++///////////////////////////////////////////////////////////////////////
++
++#include "include_gunit.h"
++
++#include "network.h" // for Network, NetworkType
++#include "networkio.h"
++#include "networkscratch.h"
++#include "serialis.h" // for TFile
++#include "stridemap.h"
++
++#include <cstdint>
++#include <utility>
++#include <vector>
++
++namespace tesseract {
++namespace {
++
++// Appends raw little-endian values to a byte buffer.
++class ByteWriter {
++public:
++ void PutU8(uint32_t v) { data_.push_back(static_cast<char>(v & 0xFF)); }
++ void PutU32(uint32_t v) {
++ for (int i = 0; i < 4; ++i) {
++ data_.push_back(static_cast<char>((v >> (8 * i)) & 0xFF));
++ }
++ }
++ void PutS32(int32_t v) { PutU32(static_cast<uint32_t>(v)); }
++ const std::vector<char> &data() const { return data_; }
++
++private:
++ std::vector<char> data_;
++};
++
++void PutDoubleLE(ByteWriter *w, double d) {
++ union {
++ double d;
++ uint64_t u;
++ } conv;
++ conv.d = d;
++ w->PutU32(static_cast<uint32_t>(conv.u & 0xFFFFFFFF));
++ w->PutU32(static_cast<uint32_t>(conv.u >> 32));
++}
++
++// A serialized float-mode WeightMatrix with the given dimensions,
++// all weight data zeroed.
++void PutGateMatrix(ByteWriter *w, int32_t dim1, int32_t dim2) {
++ w->PutU8(128); // mode: kDoubleFlag, float mode
++ w->PutS32(dim1);
++ w->PutS32(dim2);
++ PutDoubleLE(w, 0.0); // empty_ cell
++ for (int32_t i = 0; i < dim1 * dim2; ++i) {
++ PutDoubleLE(w, 0.0);
++ }
++}
++
++// A serialized 1-D NT_LSTM network: header with the given ni/no, na_,
++// then the four gates CI, GI, GF1, GO (GFS is not serialized for 1-D).
++std::vector<char> MakeLstmNetwork(int ni, int no, int32_t na,
++ const int32_t gate_dim1[4], const int32_t gate_dim2[4]) {
++ ByteWriter w;
++ w.PutU8(static_cast<uint32_t>(NT_LSTM));
++ w.PutU8(0); // training: TS_DISABLED
++ w.PutU8(0); // needs_to_backprop
++ w.PutU32(0); // network_flags
++ w.PutU32(static_cast<uint32_t>(ni));
++ w.PutU32(static_cast<uint32_t>(no));
++ w.PutU32(0); // num_weights
++ w.PutU32(0); // name (empty string)
++ w.PutS32(na);
++ for (int g = 0; g < 4; ++g) {
++ PutGateMatrix(&w, gate_dim1[g], gate_dim2[g]);
++ }
++ return w.data();
++}
++
++// Builds the input a standalone LSTM layer would receive: one row of
++// the given width with ni features.
++NetworkIO MakeInput(int ni, int width) {
++ StrideMap stride_map;
++ stride_map.SetStride({{1, width}});
++ NetworkIO input;
++ input.ResizeToMap(false, stride_map, ni);
++ return input;
++}
++
++// Runs Forward on the loaded network; on unpatched code the out-of-
++// bounds access this regression test guards against fires here.
++void RunForward(Network *net, int ni, int width) {
++ NetworkIO input = MakeInput(ni, width);
++ NetworkScratch scratch;
++ NetworkIO output;
++ net->Forward(false, input, nullptr, &scratch, &output);
++ delete net;
++}
++
++// na_ must equal ni_ + nf_ + ns_ for a 1-D LSTM; here na_=2 but the
++// CI matrix makes ns_=64, so the layer must be rejected. On unpatched
++// code Forward writes 64 floats at offset ni_=1 into a source_ buffer
++// sized for na_=2 (heap out-of-bounds write).
++TEST(LstmLayerTest, RejectsInconsistentNa) {
++ const int32_t dim1[4] = {64, 64, 64, 64};
++ const int32_t dim2[4] = {3, 3, 3, 3};
++ std::vector<char> bytes = MakeLstmNetwork(1, 1, 2, dim1, dim2);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ Network *net = Network::CreateFromFile(&fp);
++ if (net == nullptr) {
++ return; // Fixed: the inconsistent layer is rejected at load.
++ }
++ RunForward(net, 1, 2);
++ FAIL() << "crafted LSTM layer with inconsistent na_ was accepted";
++}
++
++// All gate matrices must have dim1 == ns_; here the GI matrix has
++// dim1=9 while ns_=5. On unpatched code the GI gate dot product writes
++// 9 results into a temp line sized for 5 (heap out-of-bounds write).
++TEST(LstmLayerTest, RejectsGateDim1Mismatch) {
++ const int32_t dim1[4] = {5, 9, 5, 5};
++ const int32_t dim2[4] = {7, 7, 7, 7};
++ std::vector<char> bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ Network *net = Network::CreateFromFile(&fp);
++ if (net == nullptr) {
++ return; // Fixed: the inconsistent layer is rejected at load.
++ }
++ RunForward(net, 1, 2);
++ FAIL() << "crafted LSTM layer with inconsistent gate dim1 was accepted";
++}
++
++// All gate matrices must have dim2 == na_ + 1; here the GI matrix has
++// dim2=9 while na_=6. On unpatched code the GI gate dot product reads
++// 8 inputs from a buffer sized for 6 (heap out-of-bounds read).
++TEST(LstmLayerTest, RejectsGateDim2Mismatch) {
++ const int32_t dim1[4] = {5, 5, 5, 5};
++ const int32_t dim2[4] = {7, 9, 7, 7};
++ std::vector<char> bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ Network *net = Network::CreateFromFile(&fp);
++ if (net == nullptr) {
++ return; // Fixed: the inconsistent layer is rejected at load.
++ }
++ RunForward(net, 1, 2);
++ FAIL() << "crafted LSTM layer with inconsistent gate dim2 was accepted";
++}
++
++// A fully consistent 1-D LSTM layer must still be accepted and usable.
++TEST(LstmLayerTest, AcceptsConsistentLayer) {
++ const int32_t dim1[4] = {5, 5, 5, 5};
++ const int32_t dim2[4] = {7, 7, 7, 7};
++ std::vector<char> bytes = MakeLstmNetwork(1, 5, 6, dim1, dim2);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ Network *net = Network::CreateFromFile(&fp);
++ ASSERT_NE(net, nullptr);
++ RunForward(net, 1, 2);
++}
++
++} // namespace
++} // namespace tesseract
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
index bed16f9806..24c8312552 100644
--- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
+++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
@@ -9,6 +9,7 @@ SRCREV = "db0ec62f81b0737fbbe184d8fea40af5738f8eef"
SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag=${PV} \
file://CVE-2026-88052.patch \
file://CVE-2026-88048.patch \
+ file://CVE-2026-88049.patch \
"
DEPENDS = "leptonica"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 76/82] tesseract: patch CVE-2026-88050
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (74 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 75/82] tesseract: patch CVE-2026-88049 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 77/82] tesseract: patch CVE-2026-88047 ankur.tyagi85
` (6 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88050
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 4aab0847c2e6b786437d140dd3c589e6773b9224)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tesseract/tesseract/CVE-2026-88050.patch | 209 ++++++++++++++++++
.../tesseract/tesseract_5.5.3.bb | 1 +
2 files changed, 210 insertions(+)
create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch
new file mode 100644
index 0000000000..21fa5e9a67
--- /dev/null
+++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch
@@ -0,0 +1,209 @@
+From 5426c23fe7fe32b62bd5694f68f71772f273c821 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 21 Aug 2026 16:56:51 +0200
+Subject: [PATCH] Reject recoder code values outside the sane range at load
+
+RecodedCharID::DeSerialize (hardened by 82727cc to check length_
+only) still read the individual code values as raw signed int32.
+UnicharCompress::ComputeCodeRange computes code_range_ as 1 plus the
+maximum code using a signed > comparison, so a code value of -1
+never raises the maximum and yields code_range_ = 0. SetupDecoder
+then resizes is_valid_start_ to 0 and writes is_valid_start_[code(0)]
+on the size-0 vector<bool>, an out-of-bounds write at a wild wrapped
+index (deterministic crash) on LSTMRecognizer load. A code value of
+INT32_MAX instead wraps code_range_ negative and makes resize()
+throw.
+
+Key changes:
+- unicharcompress.h: validate each deserialized code value to be
+ within [0, UINT16_MAX), the same arbitrary cap used elsewhere for
+ .traineddata counts; reject the recoder otherwise.
+- unicharcompress.h/.cpp: add defense-in-depth bounds assertions to
+ IsValidFirstCode and SetupDecoder, matching the style of the
+ NetworkIO assertions from 2f4d2f4.
+- unittest: add recoder_test, which feeds a crafted UnicharCompress
+ with a -1 code and an INT32_MAX code and expects DeSerialize to
+ fail (on unpatched code the -1 case dies on the SEGV in
+ SetupDecoder, the huge case on the uncaught length_error), plus a
+ positive control that valid codes load and answer
+ code_range()/IsValidFirstCode() correctly.
+
+Reported-by: Zhixi "Jace" Sun <g.mygenie@gmail.com>
+Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+(cherry picked from commit c94a5532ee04db5a4919542832fd94caee5ea58f)
+
+CVE: CVE-2026-88050
+Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/c94a5532ee04db5a4919542832fd94caee5ea58f]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ Makefile.am | 5 ++
+ src/ccutil/unicharcompress.cpp | 1 +
+ src/ccutil/unicharcompress.h | 13 ++++-
+ unittest/recoder_test.cc | 91 ++++++++++++++++++++++++++++++++++
+ 4 files changed, 109 insertions(+), 1 deletion(-)
+ create mode 100644 unittest/recoder_test.cc
+
+diff --git a/Makefile.am b/Makefile.am
+index 4bcc858b..63ca6686 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1202,6 +1202,7 @@ endif # !DISABLED_LEGACY_ENGINE
+ check_PROGRAMS += progress_test
+ check_PROGRAMS += qrsequence_test
+ check_PROGRAMS += recodebeam_test
++check_PROGRAMS += recoder_test
+ check_PROGRAMS += rect_test
+ check_PROGRAMS += resultiterator_test
+ check_PROGRAMS += scanutils_test
+@@ -1435,6 +1436,10 @@ recodebeam_test_SOURCES = unittest/recodebeam_test.cc
+ recodebeam_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ recodebeam_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS)
+
++recoder_test_SOURCES = unittest/recoder_test.cc
++recoder_test_CPPFLAGS = $(unittest_CPPFLAGS)
++recoder_test_LDADD = $(TESS_LIBS)
++
+ rect_test_SOURCES = unittest/rect_test.cc
+ rect_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ rect_test_LDADD = $(TESS_LIBS)
+diff --git a/src/ccutil/unicharcompress.cpp b/src/ccutil/unicharcompress.cpp
+index f909f76e..b3dd440f 100644
+--- a/src/ccutil/unicharcompress.cpp
++++ b/src/ccutil/unicharcompress.cpp
+@@ -400,6 +400,7 @@ void UnicharCompress::SetupDecoder() {
+ for (unsigned c = 0; c < encoder_.size(); ++c) {
+ const RecodedCharID &code = encoder_[c];
+ decoder_[code] = c;
++ ASSERT_HOST(code(0) >= 0 && code(0) < code_range_);
+ is_valid_start_[code(0)] = true;
+ RecodedCharID prefix = code;
+ uint32_t len = code.length();
+diff --git a/src/ccutil/unicharcompress.h b/src/ccutil/unicharcompress.h
+index 9b696d03..6919b7d2 100644
+--- a/src/ccutil/unicharcompress.h
++++ b/src/ccutil/unicharcompress.h
+@@ -84,7 +84,17 @@ public:
+ if (length_ > kMaxCodeLen) {
+ return false;
+ }
+- return fp->DeSerialize(&code_[0], length_);
++ if (!fp->DeSerialize(&code_[0], length_)) {
++ return false;
++ }
++ // Code values index arrays sized from the maximum code; reject values
++ // that are out of the sane range for a recoded alphabet.
++ for (uint32_t i = 0; i < length_; ++i) {
++ if (code_[i] < 0 || code_[i] >= static_cast<int32_t>(UINT16_MAX)) {
++ return false;
++ }
++ }
++ return true;
+ }
+ bool operator==(const RecodedCharID &other) const {
+ if (length_ != other.length_) {
+@@ -190,6 +200,7 @@ public:
+ int DecodeUnichar(const RecodedCharID &code) const;
+ // Returns true if the given code is a valid start or single code.
+ bool IsValidFirstCode(int code) const {
++ ASSERT_HOST(code >= 0 && code < code_range_);
+ return is_valid_start_[code];
+ }
+ // Returns a list of valid non-final next codes for a given prefix code,
+diff --git a/unittest/recoder_test.cc b/unittest/recoder_test.cc
+new file mode 100644
+index 00000000..48dfa7ea
+--- /dev/null
++++ b/unittest/recoder_test.cc
+@@ -0,0 +1,91 @@
++///////////////////////////////////////////////////////////////////////
++// File: recoder_test.cc
++// Description: Tests that a UnicharCompress (LSTM recoder) with code
++// values outside the sane range is rejected at load.
++// Negative code values leave code_range_ at zero, so
++// SetupDecoder writes is_valid_start_[code(0)] out of
++// bounds on a size-0 vector<bool>; huge code values wrap
++// code_range_ and make resize() throw.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++// http://www.apache.org/licenses/LICENSE-2.0
++//
++///////////////////////////////////////////////////////////////////////
++
++#include "include_gunit.h"
++
++#include "serialis.h" // for TFile
++#include "unicharcompress.h"
++
++#include <cstdint>
++#include <vector>
++
++namespace tesseract {
++namespace {
++
++// Appends raw little-endian values to a byte buffer.
++class ByteWriter {
++public:
++ void PutU8(uint32_t v) { data_.push_back(static_cast<char>(v & 0xFF)); }
++ void PutU32(uint32_t v) {
++ for (int i = 0; i < 4; ++i) {
++ data_.push_back(static_cast<char>((v >> (8 * i)) & 0xFF));
++ }
++ }
++ void PutS32(int32_t v) { PutU32(static_cast<uint32_t>(v)); }
++ const std::vector<char> &data() const { return data_; }
++
++private:
++ std::vector<char> data_;
++};
++
++// A serialized UnicharCompress with one length-1 RecodedCharID per
++// given code value (self-normalizing).
++std::vector<char> MakeRecoder(const std::vector<int32_t> &codes) {
++ ByteWriter w;
++ w.PutU32(codes.size());
++ for (int32_t code : codes) {
++ w.PutU8(1); // self_normalized_
++ w.PutU32(1); // length_
++ w.PutS32(code); // code_[0]
++ }
++ return w.data();
++}
++
++// A recoder code of -1 keeps code_range_ at 0, so on unpatched code
++// SetupDecoder performs an out-of-bounds write into the size-0
++// is_valid_start_ vector<bool>.
++TEST(RecoderTest, RejectsNegativeCode) {
++ std::vector<char> bytes = MakeRecoder({-1});
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ UnicharCompress recoder;
++ EXPECT_FALSE(recoder.DeSerialize(&fp));
++}
++
++// A recoder code of INT32_MAX wraps code_range_ to a negative value,
++// so on unpatched code SetupDecoder's resize() throws.
++TEST(RecoderTest, RejectsHugeCode) {
++ std::vector<char> bytes = MakeRecoder({INT32_MAX});
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ UnicharCompress recoder;
++ EXPECT_FALSE(recoder.DeSerialize(&fp));
++}
++
++// A valid recoder must still be accepted and usable.
++TEST(RecoderTest, AcceptsValidCodes) {
++ std::vector<char> bytes = MakeRecoder({0, 1});
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ UnicharCompress recoder;
++ ASSERT_TRUE(recoder.DeSerialize(&fp));
++ EXPECT_EQ(recoder.code_range(), 2);
++ EXPECT_TRUE(recoder.IsValidFirstCode(0));
++ EXPECT_TRUE(recoder.IsValidFirstCode(1));
++}
++
++} // namespace
++} // namespace tesseract
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
index 24c8312552..6acedcee98 100644
--- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
+++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
@@ -10,6 +10,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag
file://CVE-2026-88052.patch \
file://CVE-2026-88048.patch \
file://CVE-2026-88049.patch \
+ file://CVE-2026-88050.patch \
"
DEPENDS = "leptonica"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 77/82] tesseract: patch CVE-2026-88047
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (75 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 76/82] tesseract: patch CVE-2026-88050 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 78/82] tesseract: patch CVE-2026-88051 ankur.tyagi85
` (5 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88047
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit b8fa7aac9168b6ebfdcc2ea3493c332f0db69491)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tesseract/tesseract/CVE-2026-88047.patch | 225 ++++++++++++++++++
.../tesseract/tesseract_5.5.3.bb | 1 +
2 files changed, 226 insertions(+)
create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch
new file mode 100644
index 0000000000..780f686e61
--- /dev/null
+++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch
@@ -0,0 +1,225 @@
+From e974684acbe3aeb6bc6192b06a048537c345b713 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Mon, 24 Aug 2026 13:39:22 +0200
+Subject: [PATCH] Limit unichar extraction in ReadNormProtos to the buffer size
+
+Classify::ReadNormProtos parsed each normproto line with
+`stream >> unichar >> NumProtos` into a char unichar[2 * UNICHAR_LEN + 1]
+stack buffer, but char* extraction from an istream has no length limit
+(the stream width was never set). A crafted TESSDATA_NORMPROTO component
+in a .traineddata file whose first proto-line token exceeds 60
+characters (the 100-byte line buffer allows up to 99) overflows the
+stack buffer during legacy engine initialization (CWE-121).
+
+Toolchain note: Apple's libc++ provides a C++20 array overload of
+operator>>(basic_istream&, char(&)[N]) that implicitly bounds the
+extraction to the array size, so builds against that standard library
+are incidentally protected. Standard libraries without that overload
+(e.g. libstdc++) still take the unbounded char* overload, so the
+explicit width limit below makes the behavior defined on all
+toolchains.
+
+Key changes:
+- normmatch.cpp: read the unichar token with
+ std::setw(2 * UNICHAR_LEN + 1); char* extraction takes at most
+ width - 1 characters, which fits the buffer exactly. Overlong
+ tokens are truncated and the line is rejected like any other
+ unparseable line.
+- unittest: add normproto_test covering a 99-character token (the
+ maximum a 100-byte line can hold), a token of exactly 2 *
+ UNICHAR_LEN characters, and a well-formed component. A minimal
+ reproduction of the unbounded extraction crashes an ASan build
+ with a stack-buffer-overflow.
+
+Reported-by: Tristan Madani <tristan@talencesecurity.com>
+Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+(cherry picked from commit 1bda5079b1c8a7e25f523486837426903d29ce84)
+
+CVE: CVE-2026-88047
+Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/1bda5079b1c8a7e25f523486837426903d29ce84]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ Makefile.am | 5 ++
+ src/classify/normmatch.cpp | 6 +-
+ unittest/CMakeLists.txt | 1 +
+ unittest/normproto_test.cc | 111 +++++++++++++++++++++++++++++++++++++
+ 4 files changed, 122 insertions(+), 1 deletion(-)
+ create mode 100644 unittest/normproto_test.cc
+
+diff --git a/Makefile.am b/Makefile.am
+index 63ca6686..cc748455 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1184,6 +1184,7 @@ check_PROGRAMS += mastertrainer_test
+ endif # !DISABLED_LEGACY_ENGINE
+ check_PROGRAMS += matrix_test
+ check_PROGRAMS += networkio_test
++check_PROGRAMS += normproto_test
+ if ENABLE_TRAINING
+ check_PROGRAMS += normstrngs_test
+ endif # ENABLE_TRAINING
+@@ -1388,6 +1389,10 @@ networkio_test_SOURCES = unittest/networkio_test.cc
+ networkio_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ networkio_test_LDADD = $(TESS_LIBS)
+
++normproto_test_SOURCES = unittest/normproto_test.cc
++normproto_test_CPPFLAGS = $(unittest_CPPFLAGS)
++normproto_test_LDADD = $(TESS_LIBS)
++
+ normstrngs_test_SOURCES = unittest/normstrngs_test.cc
+ normstrngs_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ normstrngs_test_LDADD = $(TRAINING_LIBS) $(ICU_I18N_LIBS) $(ICU_UC_LIBS)
+diff --git a/src/classify/normmatch.cpp b/src/classify/normmatch.cpp
+index d5bd7e6a..1ce7c928 100644
+--- a/src/classify/normmatch.cpp
++++ b/src/classify/normmatch.cpp
+@@ -28,6 +28,7 @@
+
+ #include <cmath>
+ #include <cstdio>
++#include <iomanip> // for std::setw
+ #include <sstream> // for std::istringstream
+
+ namespace tesseract {
+@@ -190,7 +191,10 @@ NORM_PROTOS *Classify::ReadNormProtos(TFile *fp) {
+ while (fp->FGets(line, kMaxLineSize) != nullptr) {
+ std::istringstream stream(line);
+ stream.imbue(std::locale::classic());
+- stream >> unichar >> NumProtos;
++ // unichar holds at most 2 * UNICHAR_LEN characters; the width limit
++ // (width - 1 characters for char* extraction) keeps the extraction
++ // from overflowing the buffer on overlong lines.
++ stream >> std::setw(2 * UNICHAR_LEN + 1) >> unichar >> NumProtos;
+ if (stream.fail()) {
+ continue;
+ }
+diff --git a/unittest/CMakeLists.txt b/unittest/CMakeLists.txt
+index a660c9b1..4c677a60 100644
+--- a/unittest/CMakeLists.txt
++++ b/unittest/CMakeLists.txt
+@@ -59,6 +59,7 @@ set(LEGACY_TESTS
+ indexmapbidi_test.cc
+ intfeaturemap_test.cc
+ mastertrainer_test.cc
++ normproto_test.cc
+ osd_test.cc
+ params_model_test.cc
+ shapetable_test.cc
+diff --git a/unittest/normproto_test.cc b/unittest/normproto_test.cc
+new file mode 100644
+index 00000000..574b2f3d
+--- /dev/null
++++ b/unittest/normproto_test.cc
+@@ -0,0 +1,111 @@
++///////////////////////////////////////////////////////////////////////
++// File: normproto_test.cc
++// Description: Tests that Classify::ReadNormProtos handles a normproto
++// line whose first (unichar) token exceeds the
++// unichar[2 * UNICHAR_LEN + 1] stack buffer. The
++// istream extraction has no intrinsic length limit, so a
++// crafted NORMPROTO component in a .traineddata file
++// could overflow the stack buffer during legacy engine
++// initialization.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++// http://www.apache.org/licenses/LICENSE-2.0
++//
++///////////////////////////////////////////////////////////////////////
++
++#include "include_gunit.h"
++
++#include "classify.h"
++#include "serialis.h" // for TFile
++
++#include <cstdio>
++#include <cstdlib>
++#include <string>
++#include <vector>
++
++namespace tesseract {
++namespace {
++
++// Minimal unicharset (space and 'a').
++const char kMinUnicharset[] =
++ "2\n"
++ "NULL 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n"
++ "a 1 0,255,0,255,0,0,0,0,0,0 Latin 2 0 2\n";
++
++// Builds a normproto component: a sample-size line (5), five parameter
++// description lines, then the given raw proto lines.
++std::vector<char> MakeNormproto(const std::string &lines) {
++ std::string data = "5\n";
++ for (int i = 0; i < 5; ++i) {
++ data += "e e 0 1\n";
++ }
++ data += lines;
++ return std::vector<char>(data.begin(), data.end());
++}
++
++class NormprotoTest : public testing::Test {
++protected:
++ void SetUp() override {
++ tmpl_ = "/tmp/tess_normproto_test_XXXXXX";
++ char *dir = mkdtemp(tmpl_.data());
++ ASSERT_NE(dir, nullptr);
++ dir_ = dir;
++ std::string uc_path = dir_ + "/eng.unicharset";
++ FILE *f = fopen(uc_path.c_str(), "w");
++ ASSERT_NE(f, nullptr);
++ ASSERT_EQ(fwrite(kMinUnicharset, 1, sizeof(kMinUnicharset) - 1, f),
++ sizeof(kMinUnicharset) - 1);
++ fclose(f);
++ // Load the minimal unicharset into the classifier's inherited
++ // unicharset member.
++ ASSERT_TRUE(classifier_.unicharset.load_from_file(uc_path.c_str()));
++ }
++ void TearDown() override {
++ std::remove((dir_ + "/eng.unicharset").c_str());
++ rmdir(dir_.c_str());
++ }
++ std::string dir_;
++ std::string tmpl_;
++ Classify classifier_;
++};
++
++// A 99-character first token (the maximum FGets can return) overflows
++// unichar[2 * UNICHAR_LEN + 1] on unpatched code; the width-limited
++// extraction must reject the line instead.
++TEST_F(NormprotoTest, ToleratesOverlongUnicharToken) {
++ std::vector<char> bytes = MakeNormproto(std::string(99, 'A') + "\n");
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp);
++ ASSERT_NE(classifier_.NormProtos, nullptr);
++ classifier_.FreeNormProtos();
++ EXPECT_EQ(classifier_.NormProtos, nullptr);
++}
++
++// A token of exactly 2 * UNICHAR_LEN characters is the maximum legitimate
++// size; it must not be truncated or rejected by the width limit.
++TEST_F(NormprotoTest, ToleratesMaxLenUnicharToken) {
++ std::vector<char> bytes = MakeNormproto(std::string(2 * UNICHAR_LEN, 'A') + " 0\n");
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp);
++ ASSERT_NE(classifier_.NormProtos, nullptr);
++ classifier_.FreeNormProtos();
++ EXPECT_EQ(classifier_.NormProtos, nullptr);
++}
++
++// A well-formed normproto component must still parse.
++TEST_F(NormprotoTest, ReadsValidNormprotos) {
++ std::vector<char> bytes = MakeNormproto("a 0\n");
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ classifier_.NormProtos = classifier_.ReadNormProtos(&fp);
++ ASSERT_NE(classifier_.NormProtos, nullptr);
++ classifier_.FreeNormProtos();
++ EXPECT_EQ(classifier_.NormProtos, nullptr);
++}
++
++} // namespace
++} // namespace tesseract
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
index 6acedcee98..25d357d903 100644
--- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
+++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
@@ -11,6 +11,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag
file://CVE-2026-88048.patch \
file://CVE-2026-88049.patch \
file://CVE-2026-88050.patch \
+ file://CVE-2026-88047.patch \
"
DEPENDS = "leptonica"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 78/82] tesseract: patch CVE-2026-88051
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (76 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 77/82] tesseract: patch CVE-2026-88047 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 79/82] tesseract: patch CVE-2026-88054 ankur.tyagi85
` (4 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88051
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 727354dae2ee3075ad388bcfe22156ab1ea6fcf5)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tesseract/tesseract/CVE-2026-88051.patch | 184 ++++++++++++++++++
.../tesseract/tesseract_5.5.3.bb | 1 +
2 files changed, 185 insertions(+)
create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch
new file mode 100644
index 0000000000..1956d49672
--- /dev/null
+++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch
@@ -0,0 +1,184 @@
+From 79bf602b0cd5216c125f86eaf3c768daae256930 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 21 Aug 2026 20:29:37 +0200
+Subject: [PATCH] Validate vector counts in GenericVector::read
+
+The callback form of GenericVector::read read two independent int32
+fields from the file: reserved sized the allocation via reserve(),
+while size_used_ drove the element loop. Neither was capped and no
+size_used_ <= reserved invariant was checked, so a crafted
+.traineddata (e.g. the fontinfo table of a version >= 4 inttemp
+component) performed a heap out-of-bounds write during legacy
+engine initialization.
+
+Key changes:
+- genericvector.h: reject negative or over-limit reserved
+ (matching the 50000000 cap of the DeSerialize overloads) and
+ reject size_used_ < 0 or size_used_ > reserved before entering
+ the read loop. Legit files always satisfy size_used_ <= reserved,
+ as write() persists size_reserved_ first.
+- unittest: add genericvector_test covering size_used_ beyond
+ reserved (on unpatched code the ASan build dies on a
+ heap-buffer-overflow in the read loop), negative counts, and a
+ consistent vector that must still load.
+
+Reported-by: Zhixi "Jace" Sun <g.mygenie@gmail.com>
+Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+(cherry picked from commit 56e09ca12e751623fe796ce1554ce704bffd2ef0)
+
+CVE: CVE-2026-88051
+Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/56e09ca12e751623fe796ce1554ce704bffd2ef0]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ Makefile.am | 5 ++
+ src/ccutil/genericvector.h | 10 ++++
+ unittest/genericvector_test.cc | 91 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 106 insertions(+)
+ create mode 100644 unittest/genericvector_test.cc
+
+diff --git a/Makefile.am b/Makefile.am
+index cc748455..c67f0f63 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1159,6 +1159,7 @@ check_PROGRAMS += equationdetect_test
+ endif # !DISABLED_LEGACY_ENGINE
+ check_PROGRAMS += fileio_test
+ check_PROGRAMS += fullyconnected_test
++check_PROGRAMS += genericvector_test
+ check_PROGRAMS += heap_test
+ check_PROGRAMS += imagedata_test
+ if !DISABLED_LEGACY_ENGINE
+@@ -1298,6 +1299,10 @@ fullyconnected_test_SOURCES = unittest/fullyconnected_test.cc
+ fullyconnected_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ fullyconnected_test_LDADD = $(TESS_LIBS)
+
++genericvector_test_SOURCES = unittest/genericvector_test.cc
++genericvector_test_CPPFLAGS = $(unittest_CPPFLAGS)
++genericvector_test_LDADD = $(TESS_LIBS)
++
+ heap_test_SOURCES = unittest/heap_test.cc
+ heap_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ heap_test_LDADD = $(TESS_LIBS)
+diff --git a/src/ccutil/genericvector.h b/src/ccutil/genericvector.h
+index 4a5bbe12..cbe1e203 100644
+--- a/src/ccutil/genericvector.h
++++ b/src/ccutil/genericvector.h
+@@ -654,10 +654,20 @@ bool GenericVector<T>::read(TFile *f, const std::function<bool(TFile *, T *)> &c
+ if (f->FReadEndian(&reserved, sizeof(reserved), 1) != 1) {
+ return false;
+ }
++ // Arbitrarily limit the number of elements to protect against bad data.
++ const uint32_t limit = 50000000;
++ if (reserved < 0 || static_cast<uint32_t>(reserved) > limit) {
++ return false;
++ }
+ reserve(reserved);
+ if (f->FReadEndian(&size_used_, sizeof(size_used_), 1) != 1) {
+ return false;
+ }
++ // size_used_ is an independent file field; without this check the reads
++ // below land past the end of the buffer sized from reserved.
++ if (size_used_ < 0 || size_used_ > reserved) {
++ return false;
++ }
+ if (cb != nullptr) {
+ for (int i = 0; i < size_used_; ++i) {
+ if (!cb(f, data_ + i)) {
+diff --git a/unittest/genericvector_test.cc b/unittest/genericvector_test.cc
+new file mode 100644
+index 00000000..269b00f0
+--- /dev/null
++++ b/unittest/genericvector_test.cc
+@@ -0,0 +1,91 @@
++///////////////////////////////////////////////////////////////////////
++// File: genericvector_test.cc
++// Description: Tests that the callback form of GenericVector::read
++// rejects vectors whose size_used_ exceeds reserved (or
++// whose counts are negative). reserved sizes the buffer
++// while size_used_ is an independent file field driving
++// the element loop, so a crafted .traineddata (e.g. the
++// fontinfo table of a version >= 4 inttemp component)
++// performs a heap out-of-bounds write during legacy
++// engine initialization.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++// http://www.apache.org/licenses/LICENSE-2.0
++//
++///////////////////////////////////////////////////////////////////////
++
++#include "include_gunit.h"
++
++#include "genericvector.h"
++#include "serialis.h" // for TFile
++
++#include <cstdint>
++#include <vector>
++
++namespace tesseract {
++namespace {
++
++// Appends raw little-endian values to a byte buffer.
++class ByteWriter {
++public:
++ void PutS32(int32_t v) {
++ uint32_t u = static_cast<uint32_t>(v);
++ for (int i = 0; i < 4; ++i) {
++ data_.push_back(static_cast<char>((u >> (8 * i)) & 0xFF));
++ }
++ }
++ const std::vector<char> &data() const { return data_; }
++
++private:
++ std::vector<char> data_;
++};
++
++// A serialized vector header (reserved, size_used_) followed by the
++// given number of int32 elements.
++std::vector<char> MakeVector(int32_t reserved, int32_t size_used, int32_t num_elements) {
++ ByteWriter w;
++ w.PutS32(reserved);
++ w.PutS32(size_used);
++ for (int32_t i = 0; i < num_elements; ++i) {
++ w.PutS32(i);
++ }
++ return w.data();
++}
++
++// reserved=4 but size_used_=0x10000: on unpatched code the callback
++// loop writes 65536 ints past the 4-int buffer (heap out-of-bounds
++// write).
++TEST(GenericVectorTest, RejectsSizeUsedBeyondReserved) {
++ std::vector<char> bytes = MakeVector(4, 0x10000, 0x10000);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ GenericVector<int> v;
++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); }));
++}
++
++// Negative counts must be rejected; on unpatched code the read
++// "succeeds" and leaves size_used_ negative.
++TEST(GenericVectorTest, RejectsNegativeCounts) {
++ std::vector<char> bytes = MakeVector(-1, -1, 0);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ GenericVector<int> v;
++ EXPECT_FALSE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); }));
++}
++
++// A consistent vector must still be accepted.
++TEST(GenericVectorTest, AcceptsConsistentVector) {
++ std::vector<char> bytes = MakeVector(4, 2, 2);
++ TFile fp;
++ ASSERT_TRUE(fp.Open(bytes.data(), bytes.size()));
++ GenericVector<int> v;
++ ASSERT_TRUE(v.read(&fp, [](TFile *f, int *p) { return f->DeSerialize(p); }));
++ EXPECT_EQ(v.size(), 2);
++ EXPECT_EQ(v[0], 0);
++ EXPECT_EQ(v[1], 1);
++}
++
++} // namespace
++} // namespace tesseract
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
index 25d357d903..be6ec1e463 100644
--- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
+++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
@@ -12,6 +12,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag
file://CVE-2026-88049.patch \
file://CVE-2026-88050.patch \
file://CVE-2026-88047.patch \
+ file://CVE-2026-88051.patch \
"
DEPENDS = "leptonica"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 79/82] tesseract: patch CVE-2026-88054
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (77 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 78/82] tesseract: patch CVE-2026-88051 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 80/82] gpsd: patch CVE-2026-60122 ankur.tyagi85
` (3 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-88054
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit 4c00053135fb03b6043c960dc96a839b675f7eec)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../tesseract/tesseract/CVE-2026-88054.patch | 274 ++++++++++++++++++
.../tesseract/tesseract_5.5.3.bb | 1 +
2 files changed, 275 insertions(+)
create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch
new file mode 100644
index 0000000000..32e70c0f6f
--- /dev/null
+++ b/meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch
@@ -0,0 +1,274 @@
+From 83bbac0975f52a5171776fddcc800a2aaa5206a3 Mon Sep 17 00:00:00 2001
+From: Stefan Weil <sw@weilnetz.de>
+Date: Fri, 21 Aug 2026 14:38:55 +0200
+Subject: [PATCH] Reject empty network stacks in LSTM .traineddata
+ deserialization
+
+Plumbing::DeSerialize read the network stack size from the untrusted
+TESSDATA_LSTM component and only rejected size > 10000. A crafted
+.traineddata with a top-level Series/Parallel/Reversed layer with an
+empty stack survived load; LSTMRecognizer initialization then called
+network_->CacheXScaleFactor(network_->XScaleFactor()), which
+dereferences stack_[0] on the empty vector:
+- Series: Series::CacheXScaleFactor (series.cpp)
+- Parallel/Reversed: inherited Plumbing::XScaleFactor
+The virtual call through the wild pointer crashed the process at
+initialization (deterministic denial of service).
+
+Key changes:
+- plumbing.cpp: reject size == 0 for all plumbing types, and
+ size < 2 for NT_SERIES (Series::Forward requires two or more
+ networks and always aborts on one).
+- tessedit.cpp: fail the language load gracefully when the LSTM model
+ cannot be loaded, instead of aborting via ASSERT_HOST, so
+ TessBaseAPI::Init returns -1 on corrupt traineddata.
+- unittest: add plumbing_test, which builds a minimal traineddata
+ with empty/undersized LSTM plumbing stacks and expects a graceful
+ init failure. On unpatched code the tests die on the original
+ SEGV in Series::CacheXScaleFactor / Plumbing::XScaleFactor.
+
+Reported-by: Zhixi "Jace" Sun <g.mygenie@gmail.com>
+Assisted-by: OpenCode / qwen3.8-27b-thinking (Alibaba Cloud)
+Signed-off-by: Stefan Weil <sw@weilnetz.de>
+(cherry picked from commit 552771236b0d80cbdb0c7dd856120fa21a4672e5)
+
+CVE: CVE-2026-88054
+Upstream-Status: Backport [https://github.com/tesseract-ocr/tesseract/commit/552771236b0d80cbdb0c7dd856120fa21a4672e5]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ Makefile.am | 5 ++
+ src/ccmain/tessedit.cpp | 7 +-
+ src/lstm/plumbing.cpp | 6 ++
+ unittest/plumbing_test.cc | 165 ++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 182 insertions(+), 1 deletion(-)
+ create mode 100644 unittest/plumbing_test.cc
+
+diff --git a/Makefile.am b/Makefile.am
+index c67f0f63..a6ee0931 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -1198,6 +1198,7 @@ if ENABLE_TRAINING
+ check_PROGRAMS += pango_font_info_test
+ endif # ENABLE_TRAINING
+ check_PROGRAMS += paragraphs_test
++check_PROGRAMS += plumbing_test
+ if !DISABLED_LEGACY_ENGINE
+ check_PROGRAMS += params_model_test
+ endif # !DISABLED_LEGACY_ENGINE
+@@ -1427,6 +1428,10 @@ paragraphs_test_SOURCES = unittest/paragraphs_test.cc
+ paragraphs_test_CPPFLAGS = $(unittest_CPPFLAGS)
+ paragraphs_test_LDADD = $(TESS_LIBS)
+
++plumbing_test_SOURCES = unittest/plumbing_test.cc
++plumbing_test_CPPFLAGS = $(unittest_CPPFLAGS)
++plumbing_test_LDADD = $(TESS_LIBS)
++
+ if !DISABLED_LEGACY_ENGINE
+ params_model_test_SOURCES = unittest/params_model_test.cc
+ params_model_test_CPPFLAGS = $(unittest_CPPFLAGS)
+diff --git a/src/ccmain/tessedit.cpp b/src/ccmain/tessedit.cpp
+index 7ec89bd9..722ed09b 100644
+--- a/src/ccmain/tessedit.cpp
++++ b/src/ccmain/tessedit.cpp
+@@ -169,7 +169,12 @@ bool Tesseract::init_tesseract_lang_data(const std::string &language, OcrEngineM
+ #endif // ndef DISABLED_LEGACY_ENGINE
+ if (mgr->IsComponentAvailable(TESSDATA_LSTM)) {
+ lstm_recognizer_ = new LSTMRecognizer(language_data_path_prefix.c_str());
+- ASSERT_HOST(lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr));
++ if (!lstm_recognizer_->Load(this->params(), lstm_use_matrix ? language : "", mgr)) {
++ delete lstm_recognizer_;
++ lstm_recognizer_ = nullptr;
++ tprintf("Error: Failed to load the LSTM model from %s\n", tessdata_path.c_str());
++ return false;
++ }
+ } else {
+ #ifdef DISABLED_LEGACY_ENGINE
+ // The legacy engine is compiled out, so we cannot fall back to it.
+diff --git a/src/lstm/plumbing.cpp b/src/lstm/plumbing.cpp
+index f0133148..15cf3d62 100644
+--- a/src/lstm/plumbing.cpp
++++ b/src/lstm/plumbing.cpp
+@@ -226,6 +226,12 @@ bool Plumbing::DeSerialize(TFile *fp) {
+ if (size > 10000) {
+ return false;
+ }
++ // Reject empty stacks: XScaleFactor, CacheXScaleFactor and other methods
++ // unconditionally dereference stack_[0] during network initialization.
++ // A Series needs at least two networks (see Series::Forward).
++ if (size == 0 || (type() == NT_SERIES && size == 1)) {
++ return false;
++ }
+ for (uint32_t i = 0; i < size; ++i) {
+ Network *network = CreateFromFile(fp);
+ if (network == nullptr) {
+diff --git a/unittest/plumbing_test.cc b/unittest/plumbing_test.cc
+new file mode 100644
+index 00000000..27486f86
+--- /dev/null
++++ b/unittest/plumbing_test.cc
+@@ -0,0 +1,165 @@
++///////////////////////////////////////////////////////////////////////
++// File: plumbing_test.cc
++// Description: Tests that a corrupt TESSDATA_LSTM component in a
++// .traineddata file is rejected without crashing. A
++// plumbing layer (Series/Parallel/Reversed) with an
++// empty or undersized network stack would make
++// XScaleFactor/CacheXScaleFactor dereference stack_[0]
++// during engine initialization.
++//
++// Licensed under the Apache License, Version 2.0 (the "License");
++// you may not use this file except in compliance with the License.
++// You may obtain a copy of the License at
++// http://www.apache.org/licenses/LICENSE-2.0
++//
++///////////////////////////////////////////////////////////////////////
++
++#include "include_gunit.h"
++
++#include <tesseract/baseapi.h>
++
++#include "network.h" // for NetworkType
++#include "tessdatamanager.h" // for TessdataManager, TESSDATA_LSTM
++
++#include <cstdint>
++#include <cstdio>
++#include <cstdlib>
++#include <cstring>
++#include <string>
++#include <vector>
++
++namespace tesseract {
++namespace {
++
++// Minimal unicharset with the special codes (space, Joined, Broken) that
++// UNICHARSET::load_from_file expects, as embedded in the TESSDATA_LSTM
++// component by LSTMRecognizer::Serialize.
++const char kMinUnicharset[] =
++ "3\n"
++ "NULL 0 NULL 0\n"
++ "Joined 7 0,69,188,255,486,1218,0,30,486,1188 Latin 26 0 98 Joined\n"
++ "|Broken|0|1 f 0,69,186,255,892,2138,0,80,892,2058 Common 84 10 84 |Broken|0|1\n";
++
++// Appends raw little-endian values to a byte buffer.
++class ByteWriter {
++public:
++ void PutU8(uint32_t v) { data_.push_back(static_cast<char>(v & 0xFF)); }
++ void PutU32(uint32_t v) {
++ for (int i = 0; i < 4; ++i) {
++ data_.push_back(static_cast<char>((v >> (8 * i)) & 0xFF));
++ }
++ }
++ void PutS32(int32_t v) { PutU32(static_cast<uint32_t>(v)); }
++ void PutString(const char *s) {
++ PutU32(static_cast<uint32_t>(std::strlen(s)));
++ data_.insert(data_.end(), s, s + std::strlen(s));
++ }
++ void PutRaw(const char *s) { data_.insert(data_.end(), s, s + std::strlen(s)); }
++ const std::vector<char> &data() const { return data_; }
++
++private:
++ std::vector<char> data_;
++};
++
++// Serialized network header as written by Network::Serialize:
++// int8 type, int8 training, int8 needs_to_backprop, int32 network_flags,
++// int32 ni, int32 no, int32 num_weights, string name.
++void AppendNetworkHeader(ByteWriter *w, NetworkType type) {
++ w->PutU8(static_cast<uint32_t>(type));
++ w->PutU8(0); // training: TS_DISABLED
++ w->PutU8(0); // needs_to_backprop
++ w->PutU32(0); // network_flags
++ w->PutU32(0); // ni
++ w->PutU32(0); // no
++ w->PutU32(0); // num_weights
++ w->PutString(""); // name
++}
++
++// A minimal valid child network (NT_INPUT with a 1x1x1x1 shape).
++void AppendInputChild(ByteWriter *w) {
++ AppendNetworkHeader(w, NT_INPUT);
++ w->PutS32(1); // batch
++ w->PutS32(1); // height
++ w->PutS32(1); // width
++ w->PutS32(1); // depth
++ w->PutS32(0); // loss type
++}
++
++// Builds a TESSDATA_LSTM component whose top-level network is a plumbing
++// layer of the given type with the given (corrupt) stack size, followed by
++// the remaining fields of LSTMRecognizer::DeSerialize.
++std::vector<char> MakeLstmComponent(NetworkType type, uint32_t stack_size) {
++ ByteWriter w;
++ AppendNetworkHeader(&w, type);
++ w.PutU32(stack_size); // Plumbing::DeSerialize reads this as uint32
++ for (uint32_t i = 0; i < stack_size; ++i) {
++ AppendInputChild(&w);
++ }
++ w.PutRaw(kMinUnicharset); // unicharset (raw text, no recoder/unicharset components)
++ w.PutString(""); // network_str_
++ w.PutS32(0); // training_flags_
++ w.PutS32(0); // training_iteration_
++ w.PutS32(0); // sample_iteration_
++ w.PutS32(0); // null_char_
++ w.PutU32(0); // adam_beta_ (float 0.0)
++ w.PutU32(0); // learning_rate_ (float 0.0)
++ w.PutU32(0); // momentum_ (float 0.0)
++ return w.data();
++}
++
++// Writes a traineddata file with the given (corrupt) LSTM component to
++// dir/eng.traineddata.
++bool WriteCorruptTraineddata(const std::string &dir, const std::vector<char> &lstm) {
++ TessdataManager mgr;
++ mgr.OverwriteEntry(TESSDATA_LSTM, lstm.data(), static_cast<int>(lstm.size()));
++ return mgr.SaveFile((dir + "/eng.traineddata").c_str(), nullptr);
++}
++
++class PlumbingTest : public testing::Test {
++protected:
++ void SetUp() override {
++ tmpl_ = "/tmp/tess_plumbing_test_XXXXXX";
++ char *dir = mkdtemp(tmpl_.data());
++ ASSERT_NE(dir, nullptr);
++ dir_ = dir;
++ }
++ void TearDown() override {
++ std::remove((dir_ + "/eng.traineddata").c_str());
++ rmdir(dir_.c_str());
++ }
++ // Expects the LSTM engine to reject the corrupted traineddata
++ // gracefully (init failure) instead of crashing.
++ void ExpectInitFails(const std::vector<char> &lstm) {
++ ASSERT_TRUE(WriteCorruptTraineddata(dir_, lstm));
++ tesseract::TessBaseAPI api;
++ EXPECT_EQ(api.Init(dir_.c_str(), "eng", tesseract::OEM_LSTM_ONLY), -1);
++ }
++ std::string dir_;
++ std::string tmpl_;
++};
++
++// Empty NT_SERIES stack: Series::CacheXScaleFactor would dereference
++// stack_[0] on the empty vector during initialization.
++TEST_F(PlumbingTest, RejectsEmptySeriesStack) {
++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 0));
++}
++
++// Empty NT_PARALLEL stack: Plumbing::XScaleFactor would dereference
++// stack_[0] on the empty vector during initialization.
++TEST_F(PlumbingTest, RejectsEmptyParallelStack) {
++ ExpectInitFails(MakeLstmComponent(NT_PARALLEL, 0));
++}
++
++// Empty NT_XREVERSED stack: same crash as the parallel case.
++TEST_F(PlumbingTest, RejectsEmptyReversedStack) {
++ ExpectInitFails(MakeLstmComponent(NT_XREVERSED, 0));
++}
++
++// A Series with a single network: Series::Forward requires at least two
++// networks, so such a model can never work.
++TEST_F(PlumbingTest, RejectsSingleNetworkSeries) {
++ ExpectInitFails(MakeLstmComponent(NT_SERIES, 1));
++}
++
++} // namespace
++} // namespace tesseract
diff --git a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
index be6ec1e463..c96aca1dde 100644
--- a/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
+++ b/meta-oe/recipes-graphics/tesseract/tesseract_5.5.3.bb
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/${BPN}-ocr/${BPN}.git;branch=main;protocol=https;tag
file://CVE-2026-88050.patch \
file://CVE-2026-88047.patch \
file://CVE-2026-88051.patch \
+ file://CVE-2026-88054.patch \
"
DEPENDS = "leptonica"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 80/82] gpsd: patch CVE-2026-60122
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (78 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 79/82] tesseract: patch CVE-2026-88054 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 81/82] apache2: fix build with OpenSSL 4 ankur.tyagi85
` (2 subsequent siblings)
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Details:
https://nvd.nist.gov/vuln/detail/cve-2026-60122
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
(cherry picked from commit da527bb6ba21025da9ff5eafc758156d659f6c9f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
.../gpsd/gpsd/CVE-2026-60122.patch | 45 +++++++++++++++++++
.../recipes-navigation/gpsd/gpsd_3.27.5.bb | 1 +
2 files changed, 46 insertions(+)
create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch
new file mode 100644
index 0000000000..da8fa5f4d2
--- /dev/null
+++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch
@@ -0,0 +1,45 @@
+From 50bf98d0240b94bbec6ce06be33cdaf99e2f6214 Mon Sep 17 00:00:00 2001
+From: "Gary E. Miller" <gem@rellim.com>
+Date: Mon, 20 Jul 2026 20:12:16 -0700
+Subject: [PATCH] clients/gpsprof.py.in: ensure sats.used is boolean. Issue
+ 406
+
+Prevfent command injection by sates.used. Force to boolean.
+
+(cherry picked from commit 5a9c44a42136b9bb98d460a8a716e9fd344a8d93)
+
+CVE: CVE-2026-60122
+Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5a9c44a42136b9bb98d460a8a716e9fd344a8d93]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ clients/gpsprof.py.in | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in
+index e91367ee3..07123d417 100644
+--- a/clients/gpsprof.py.in
++++ b/clients/gpsprof.py.in
+@@ -334,8 +334,11 @@ class spaceplot(plotter):
+ # get sat used count
+ sats_used = 0
+ for sat in self.session.satellites:
+- if sat.used:
++ if sat.used is True:
+ sats_used += 1
++ else:
++ # ensure it is boolean.
++ sat.used = False
+
+ if 'altHAE' not in self.session.data:
+ self.session.data['altHAE'] = gps.NaN
+@@ -783,6 +786,10 @@ class polarplot(plotter):
+ used += 1
+ if 'polarunused' == self.name:
+ continue
++ else:
++ # ensure it is boolean.
++ sat['used'] = False;
++
+ if (('polarused' == self.name and
+ sat['used'] is False)):
+ continue
diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb
index 52d86503a1..2bb70aca46 100644
--- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb
+++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb
@@ -11,6 +11,7 @@ SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \
file://CVE-2026-58459-1.patch \
file://CVE-2026-58459-2.patch \
file://CVE-2026-58459-3.patch \
+ file://CVE-2026-60122.patch \
file://gpsd.init \
"
SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649"
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 81/82] apache2: fix build with OpenSSL 4
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (79 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 80/82] gpsd: patch CVE-2026-60122 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 5:42 ` [PATCH 82/82] lvgl-demo-fb: fix SRCREV ankur.tyagi85
2026-10-15 17:45 ` [oe] [PATCH 00/82] Blacksail pull request Khem Raj
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Markus Volk <f_l_k@t-online.de>
ASN1_STRING is opaque in OpenSSL 4, so mod_md fails to compile in
md_ocsp.c. Backport the httpd 2.4.x commit that switches to the getter
functions. The fix is part of httpd 2.4.69, which master gets through the
upgrade.
Upstream-Status: Backport [https://github.com/apache/httpd/commit/6cd9ea8dcb5bf68a195e90578c7f05e12eba5468]
AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
---
...mod_md-Add-OpenSSL-4.0-compatibility.patch | 47 +++++++++++++++++++
.../recipes-httpd/apache2/apache2_2.4.68.bb | 1 +
2 files changed, 48 insertions(+)
create mode 100644 meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch
diff --git a/meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch b/meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch
new file mode 100644
index 0000000000..ee127681ec
--- /dev/null
+++ b/meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch
@@ -0,0 +1,47 @@
+From 6cd9ea8dcb5bf68a195e90578c7f05e12eba5468 Mon Sep 17 00:00:00 2001
+From: Rainer Jung <rjung@apache.org>
+Date: Wed, 17 Jun 2026 09:48:52 +0000
+Subject: [PATCH] mod_md: Add OpenSSL 4.0 compatibility
+
+* Use getters instead of direct member access.
+
+* Struct was made opaque in OpenSSL 4. Getters exist since OpenSSL 1.1.0.
+
+* Keep OpenSSL 1.0.2 compatibility.
+
+Merge from icing/md:
+https://github.com/icing/mod_md/commit/9fd90380db0722f0ccc14ff1c4da0ca21d4da75c
+
+Backport of r1935161 from trunk, [mod_md CTR]
+
+
+Upstream-Status: Backport [https://github.com/apache/httpd/commit/6cd9ea8dcb5bf68a195e90578c7f05e12eba5468]
+---
+diff --git a/modules/md/md_ocsp.c b/modules/md/md_ocsp.c
+index aee799a7b39..2e7f14dff31 100644
+--- a/modules/md/md_ocsp.c
++++ b/modules/md/md_ocsp.c
+@@ -533,13 +533,23 @@ static const char *certid_summary(const OCSP_CERTID *certid, apr_pool_t *p)
+ serial = issuer = key = "???";
+ OCSP_id_get0_info(&aname_hash, &amd_nid, &akey_hash, &aserial, (OCSP_CERTID*)certid);
+ if (aname_hash) {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ data.len = (apr_size_t)aname_hash->length;
+ data.data = (const char*)aname_hash->data;
++#else
++ data.len = (apr_size_t)ASN1_STRING_length(aname_hash);
++ data.data = (const char*)ASN1_STRING_get0_data(aname_hash);
++#endif
+ md_data_to_hex(&issuer, 0, p, &data);
+ }
+ if (akey_hash) {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ data.len = (apr_size_t)akey_hash->length;
+ data.data = (const char*)akey_hash->data;
++#else
++ data.len = (apr_size_t)ASN1_STRING_length(akey_hash);
++ data.data = (const char*)ASN1_STRING_get0_data(akey_hash);
++#endif
+ md_data_to_hex(&key, 0, p, &data);
+ }
+ if (aserial) {
diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb
index dc8c0df12d..f178007ab7 100644
--- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb
+++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.68.bb
@@ -16,6 +16,7 @@ SRC_URI = "${APACHE_MIRROR}/httpd/httpd-${PV}.tar.bz2 \
file://0008-Fix-perl-install-directory-to-usr-bin.patch \
file://0009-support-apxs.in-force-destdir-to-be-empty-string.patch \
file://0001-make_exports.awk-not-expose-the-path.patch \
+ file://0011-mod_md-Add-OpenSSL-4.0-compatibility.patch \
"
SRC_URI:append:class-target = " \
^ permalink raw reply related [flat|nested] 85+ messages in thread* [PATCH 82/82] lvgl-demo-fb: fix SRCREV
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (80 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 81/82] apache2: fix build with OpenSSL 4 ankur.tyagi85
@ 2026-10-15 5:42 ` ankur.tyagi85
2026-10-15 17:45 ` [oe] [PATCH 00/82] Blacksail pull request Khem Raj
82 siblings, 0 replies; 85+ messages in thread
From: ankur.tyagi85 @ 2026-10-15 5:42 UTC (permalink / raw)
To: openembedded-devel
From: Ankur Tyagi <ankur.tyagi85@gmail.com>
Previous SRCREV does not belong to any branch on this repository and build
fails with error:
ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Fetcher failure: Unable to find revision 045137cf0fa1781483cb796261a11b5eb21e99d9 in branch release/v9.5 even from upstream
ERROR: lvgl-demo-fb-9.5.0+git-r0 do_fetch: Bitbake Fetcher Error: FetchError('Unable to fetch URL from any source.', 'git://github.com/lvgl/lv_port_linux_frame_buffer.git;protocol=https;branch=release/v9.5;name=demo')
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb b/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb
index cd6441ded7..dc96b999f3 100644
--- a/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb
+++ b/meta-oe/recipes-graphics/lvgl/lvgl-demo-fb_9.5.0.bb
@@ -14,7 +14,7 @@ SRC_URI = "\
git://github.com/lvgl/lvgl;protocol=https;branch=release/v9.5;tag=v9.5.0;name=lvgl;subdir=${BB_GIT_DEFAULT_DESTSUFFIX}/lvgl \
"
-SRCREV_demo = "045137cf0fa1781483cb796261a11b5eb21e99d9"
+SRCREV_demo = "b0aeee00922fdd8f2c5e3409ce464a8f714cf919"
SRCREV_lvgl = "85aa60d18b3d5e5588d7b247abf90198f07c8a63"
SRCREV_FORMAT = "demo_lvgl"
# The version check runs against the first SRC_URI (the demo repo), whose tags
^ permalink raw reply related [flat|nested] 85+ messages in thread* Re: [oe] [PATCH 00/82] Blacksail pull request
2026-10-15 5:40 [PATCH 00/82] Blacksail pull request ankur.tyagi85
` (81 preceding siblings ...)
2026-10-15 5:42 ` [PATCH 82/82] lvgl-demo-fb: fix SRCREV ankur.tyagi85
@ 2026-10-15 17:45 ` Khem Raj
2026-10-15 19:11 ` Ankur Tyagi
82 siblings, 1 reply; 85+ messages in thread
From: Khem Raj @ 2026-10-15 17:45 UTC (permalink / raw)
To: ankur.tyagi85; +Cc: openembedded-devel
[-- Attachment #1: Type: text/plain, Size: 17715 bytes --]
Thanks Ankur, looks good, the patches in this patchset are not having
[blacksail] tag in subject line, please fix that piece next time. I have
installed this PR
-Khem
On Wed, Oct 14, 2026 at 10:42 PM Ankur Tyagi via lists.openembedded.org
<ankur.tyagi85=gmail.com@lists.openembedded.org> wrote:
> From: Ankur Tyagi <ankur.tyagi85@gmail.com>
>
> Please merge these changes in blacksail. Tested locally and on autobuilder.
>
> https://autobuilder.yoctoproject.org/valkyrie/#/builders/81/builds/1860
>
> The following changes since commit
> ca3cf5fe14bed658890bac643cced054932fcb51:
>
> fuse3: Fix ptest for the new test runner (2026-10-01 20:41:15 -0700)
>
> are available in the Git repository at:
>
> https://git.openembedded.org/meta-openembedded-contrib ankurt/blacksail
>
> https://git.openembedded.org/meta-openembedded-contrib/log/?h=ankurt/blacksail
>
> for you to fetch changes up to a9d69bc066bf9498397db27902c287dd666fdfd4:
>
> lvgl-demo-fb: fix SRCREV (2026-10-14 09:26:03 +1300)
>
> ----------------------------------------------------------------
>
> Ankur Tyagi (74):
> readme: update maintainer
> libwebsockets: patch CVE-2026-19773
> capnproto: ignore CVE-2026-59704
> civetweb: ignore CVE-2026-5789
> dovecot: ignore already fixed CVEs
> eject: ignore CVE-2026-28065
> gpsd: patch CVE-2026-58459
> bcc: correct CVE_PRODUCT mapping
> dool: patch CVE-2026-56651
> dool: patch CVE-2026-56652
> haveged: ignore CVE-2026-41054
> gpm: ignore CVE-2025-4558
> gerbera: ignore CVE-2025-23386
> libde265: patch CVE-2026-49295
> libde265: patch CVE-2026-49337
> libde265: patch CVE-2026-49346
> libde265: patch CVE-2026-54240 and CVE-2026-54241
> hdf5: patch CVE-2026-17572
> hdf5: patch CVE-2026-17573
> hdf5: patch CVE-2026-17574
> hdf5: patch CVE-2026-19025
> iniparser: mark CVE-2025-0633 pached
> jq: ignore already fixed CVEs
> libiec61850: mark CVE-2024-45969 patched
> libnfs: patch CVE-2026-53689
> libnfs: patch CVE-2026-57918
> libssh: ignore CVE-2025-14821
> libssh: mark CVEs patched
> libssh: ignore CVE-2026-59851
> miniupnpd: patch CVE-2026-107159
> libyang: patch CVE-2026-41401
> tinyproxy: patch CVE-2026-31842
> tinyproxy: patch CVE-2026-54387
> tinyproxy: patch CVE-2026-55202
> wolfssl: mark CVEs patched
> python3-gunicorn: mark CVE-2024-1135 patched
> pgpool2: upgrade 4.7.2 -> 4.7.3
> smarty: upgrade 5.8.4 -> 5.8.5
> python3-astroid: upgrade 4.3.2 -> 4.3.3
> python3-django: upgrade 6.0.8 -> 6.0.9
> python3-django: upgrade 5.2.17 -> 5.2.18
> python3-tzdata: upgrade 2026.4 -> 2026.5
> python3-werkzeug: upgrade 3.1.8 -> 3.1.9
> python3-zeroconf: upgrade 0.151.3 -> 0.151.5
> swagger-ui: upgrade 5.33.0 -> 5.33.1
> openvpn: ignore CVE-2026-84256
> openvpn: patch CVE-2026-88964
> openvpn: patch CVE-2026-84790
> python3-eventlet: mark CVE-2023-29483 fixed
> cjson: patch CVE-2026-87933
> smarty: mark CVE-2026-82531 patched
> ntopng: patch CVE-2026-84990
> ntopng: patch CVE-2026-86090 and CVE-2026-86091
> sngrep: patch CVE-2026-90558
> strongswan: patch CVE-2026-78123
> strongswan: patch CVE-2026-78124
> strongswan: patch CVE-2026-78126
> strongswan: patch CVE-2026-78127
> strongswan: patch CVE-2026-78129
> strongswan: patch CVE-2026-78133
> strongswan: patch CVE-2026-78131
> strongswan: patch CVE-2026-78130
> strongswan: patch CVE-2026-78132
> strongswan: patch CVE-2026-78135
> strongswan: patch CVE-2026-78134
> tesseract: patch CVE-2026-88052
> tesseract: patch CVE-2026-88048
> tesseract: patch CVE-2026-88049
> tesseract: patch CVE-2026-88050
> tesseract: patch CVE-2026-88047
> tesseract: patch CVE-2026-88051
> tesseract: patch CVE-2026-88054
> gpsd: patch CVE-2026-60122
> lvgl-demo-fb: fix SRCREV
>
> Bastian Krause (1):
> pcsc-lite: create pcscd user and group also via useradd
>
> Markus Volk (5):
> Revert "libpwquality: remove recipe (moved to oe-core)"
> Revert "gnome-shell-extensions: upgrade 50.3 -> 51.0"
> Revert "gnome-shell: upgrade 50.4 -> 51.0"
> Revert "mutter: upgrade 50.4 -> 51.0"
> apache2: fix build with OpenSSL 4
>
> Peter Marko (2):
> libwebsockets: patch CVE-2026-78161
> nginx: set status for CVE-2026-90439
>
> README.md | 2 +-
> meta-filesystems/README.md | 10 +-
> meta-gnome/README.md | 10 +-
> ...51.0.bb => gnome-shell-extensions_50.3.bb} | 2 +-
> ...ver-Fix-build-failure-with-libical-4.patch | 44 ++
> ...nome-shell_51.0.bb => gnome-shell_50.4.bb} | 7 +-
> .../mutter/{mutter_51.0.bb => mutter_50.4.bb} | 17 +-
> meta-initramfs/README.md | 8 +-
> meta-multimedia/README.md | 10 +-
> .../gerbera/gerbera_3.3.0.bb | 2 +
> .../libde265/libde265/CVE-2026-49295.patch | 41 +
> .../libde265/libde265/CVE-2026-49337.patch | 53 ++
> .../libde265/libde265/CVE-2026-49346.patch | 102 +++
> .../CVE-2026-54240-CVE-2026-54241.patch | 426 +++++++++++
> .../libde265/libde265_1.0.19.bb | 7 +-
> meta-networking/README.md | 8 +-
> .../civetweb/civetweb_1.16.bb | 1 +
> .../libiec61850/libiec61850_1.6.2.1.bb | 2 +
> .../miniupnpd/files/CVE-2026-107159.patch | 78 ++
> .../miniupnpd/miniupnpd_2.3.11.bb | 1 +
> .../wolfssl/wolfssl_5.9.4.bb | 2 +
> .../recipes-support/dovecot/dovecot_2.4.5.bb | 8 +
> .../ntopng/files/CVE-2026-84990.patch | 53 ++
> .../files/CVE-2026-86090-CVE-2026-86091.patch | 67 ++
> .../recipes-support/ntopng/ntopng_6.6.bb | 2 +
> .../openvpn/openvpn/CVE-2026-84790.patch | 361 +++++++++
> .../openvpn/openvpn/CVE-2026-88964.patch | 78 ++
> .../recipes-support/openvpn/openvpn_2.7.7.bb | 3 +
> .../{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} | 2 +-
> .../sngrep/sngrep/CVE-2026-90558.patch | 84 +++
> .../recipes-support/sngrep/sngrep_1.8.4.bb | 4 +-
> .../strongswan/CVE-2026-78123.patch | 51 ++
> .../strongswan/CVE-2026-78124.patch | 34 +
> .../strongswan/CVE-2026-78126.patch | 37 +
> .../strongswan/CVE-2026-78127.patch | 115 +++
> .../strongswan/CVE-2026-78129.patch | 155 ++++
> .../strongswan/CVE-2026-78130.patch | 49 ++
> .../strongswan/CVE-2026-78131.patch | 86 +++
> .../strongswan/CVE-2026-78132.patch | 75 ++
> .../strongswan/CVE-2026-78133.patch | 620 +++++++++++++++
> .../strongswan/CVE-2026-78134.patch | 712 ++++++++++++++++++
> .../strongswan/CVE-2026-78135.patch | 72 ++
> .../strongswan/strongswan_6.0.7.bb | 14 +-
> .../tinyproxy/tinyproxy/CVE-2026-31842.patch | 33 +
> .../tinyproxy/tinyproxy/CVE-2026-54387.patch | 37 +
> .../tinyproxy/tinyproxy/CVE-2026-55202.patch | 107 +++
> .../tinyproxy/tinyproxy_1.11.3.bb | 3 +
> meta-oe/README.md | 8 +-
> .../recipes-devtools/bcc/bcc_0.37.0.bb | 2 +
> .../libnfs/libnfs/CVE-2026-53689.patch | 34 +
> .../libnfs/libnfs/CVE-2026-57918.patch | 34 +
> .../libnfs/libnfs_6.0.2.bb | 2 +
> .../libwebsockets/CVE-2026-19773.patch | 31 +
> .../libwebsockets/CVE-2026-78161.patch | 45 ++
> .../libwebsockets/libwebsockets_4.5.8.bb | 2 +
> .../packagegroups/packagegroup-meta-oe.bb | 1 +
> .../capnproto/capnproto_1.5.0.bb | 1 +
> .../cjson/cjson/CVE-2026-87933.patch | 110 +++
> .../recipes-devtools/cjson/cjson_1.7.19.bb | 1 +
> meta-oe/recipes-devtools/jq/jq_1.8.2.bb | 4 +
> .../haveged/haveged_1.9.26.bb | 2 +
> ...-Use-setuptools-instead-of-distutils.patch | 78 ++
> ...02-Makefile.am-respect-PYTHONSITEDIR.patch | 26 +
> .../libpwquality/libpwquality_1.4.5.bb | 39 +
> .../libyang/libyang/CVE-2026-41401.patch | 43 ++
> .../libyang/libyang_3.13.6.bb | 1 +
> .../lvgl/lvgl-demo-fb_9.5.0.bb | 2 +-
> .../tesseract/tesseract/CVE-2026-88047.patch | 225 ++++++
> .../tesseract/tesseract/CVE-2026-88048.patch | 227 ++++++
> .../tesseract/tesseract/CVE-2026-88049.patch | 315 ++++++++
> .../tesseract/tesseract/CVE-2026-88050.patch | 209 +++++
> .../tesseract/tesseract/CVE-2026-88051.patch | 184 +++++
> .../tesseract/tesseract/CVE-2026-88052.patch | 165 ++++
> .../tesseract/tesseract/CVE-2026-88054.patch | 274 +++++++
> .../tesseract/tesseract_5.5.3.bb | 11 +-
> .../gpsd/gpsd/CVE-2026-58459-1.patch | 48 ++
> .../gpsd/gpsd/CVE-2026-58459-2.patch | 46 ++
> .../gpsd/gpsd/CVE-2026-58459-3.patch | 58 ++
> .../gpsd/gpsd/CVE-2026-60122.patch | 45 ++
> .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 4 +
> .../dool/dool/CVE-2026-56651.patch | 47 ++
> .../dool/dool/CVE-2026-56652.patch | 35 +
> meta-oe/recipes-support/dool/dool_1.3.8.bb | 5 +-
> meta-oe/recipes-support/eject/eject_2.1.5.bb | 2 +
> meta-oe/recipes-support/gpm/gpm_git.bb | 2 +
> .../hdf5/files/CVE-2026-17572.patch | 253 +++++++
> .../hdf5/files/CVE-2026-17573.patch | 53 ++
> .../hdf5/files/CVE-2026-17574.patch | 65 ++
> .../hdf5/files/CVE-2026-19025.patch | 112 +++
> meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 4 +
> .../iniparser/iniparser_4.2.6.bb | 2 +
> .../recipes-support/libssh/libssh_0.11.5.bb | 9 +
> .../pcsc-lite/pcsc-lite_2.5.1.bb | 5 +-
> .../{smarty_5.8.4.bb => smarty_5.8.5.bb} | 3 +-
> meta-perl/README.md | 10 +-
> meta-python/README.md | 12 +-
> ...roid_4.3.2.bb => python3-astroid_4.3.3.bb} | 2 +-
> ...ngo_5.2.17.bb => python3-django_5.2.18.bb} | 2 +-
> ...jango_6.0.8.bb => python3-django_6.0.9.bb} | 2 +-
> .../python/python3-eventlet_0.41.2.bb | 2 +
> .../python/python3-gunicorn_26.2.0.bb | 2 +
> ...ata_2026.4.bb => python3-tzdata_2026.5.bb} | 2 +-
> ...eug_3.1.8.bb => python3-werkzeug_3.1.9.bb} | 2 +-
> ...0.151.3.bb => python3-zeroconf_0.151.5.bb} | 2 +-
> meta-webserver/README.md | 10 +-
> ...gger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} | 2 +-
> ...mod_md-Add-OpenSSL-4.0-compatibility.patch | 47 ++
> .../recipes-httpd/apache2/apache2_2.4.68.bb | 1 +
> .../recipes-httpd/nginx/nginx_1.30.5.bb | 2 +
> meta-xfce/README.md | 11 +-
> 110 files changed, 6601 insertions(+), 79 deletions(-)
> rename meta-gnome/recipes-gnome/gnome-shell/{
> gnome-shell-extensions_51.0.bb => gnome-shell-extensions_50.3.bb} (85%)
> create mode 100644
> meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch
> rename meta-gnome/recipes-gnome/gnome-shell/{gnome-shell_51.0.bb =>
> gnome-shell_50.4.bb} (86%)
> rename meta-gnome/recipes-gnome/mutter/{mutter_51.0.bb => mutter_50.4.bb}
> (85%)
> create mode 100644
> meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch
> create mode 100644
> meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch
> create mode 100644
> meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch
> create mode 100644
> meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch
> create mode 100644
> meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
> create mode 100644
> meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch
> create mode 100644
> meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch
> create mode 100644
> meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch
> create mode 100644
> meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch
> rename meta-networking/recipes-support/pgpool2/{pgpool2_4.7.2.bb =>
> pgpool2_4.7.3.bb} (95%)
> create mode 100644
> meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch
> create mode 100644
> meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch
> create mode 100644
> meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch
> create mode 100644
> meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch
> create mode 100644
> meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch
> create mode 100644
> meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch
> create mode 100644
> meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch
> create mode 100644
> meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch
> create mode 100644
> meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch
> create mode 100644
> meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch
> create mode 100644
> meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch
> create mode 100644
> meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch
> create mode 100644 meta-oe/recipes-extended/libpwquality/
> libpwquality_1.4.5.bb
> create mode 100644
> meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch
> create mode 100644
> meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch
> create mode 100644
> meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch
> create mode 100644
> meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch
> create mode 100644
> meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch
> create mode 100644
> meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch
> create mode 100644
> meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch
> create mode 100644
> meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch
> create mode 100644
> meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch
> create mode 100644
> meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch
> create mode 100644
> meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch
> create mode 100644
> meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch
> create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch
> create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch
> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch
> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch
> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch
> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch
> rename meta-oe/recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb}
> (90%)
> rename meta-python/recipes-devtools/python/{python3-astroid_4.3.2.bb =>
> python3-astroid_4.3.3.bb} (89%)
> rename meta-python/recipes-devtools/python/{python3-django_5.2.17.bb =>
> python3-django_5.2.18.bb} (61%)
> rename meta-python/recipes-devtools/python/{python3-django_6.0.8.bb =>
> python3-django_6.0.9.bb} (75%)
> rename meta-python/recipes-devtools/python/{python3-tzdata_2026.4.bb =>
> python3-tzdata_2026.5.bb} (86%)
> rename meta-python/recipes-devtools/python/{python3-werkzeug_3.1.8.bb =>
> python3-werkzeug_3.1.9.bb} (91%)
> rename meta-python/recipes-devtools/python/{python3-zeroconf_0.151.3.bb
> => python3-zeroconf_0.151.5.bb} (88%)
> rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.0.bb
> => swagger-ui_5.33.1.bb} (94%)
> create mode 100644
> meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#130920):
> https://lists.openembedded.org/g/openembedded-devel/message/130920
> Mute This Topic: https://lists.openembedded.org/mt/121765065/1997914
> Group Owner: openembedded-devel+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [
> raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
[-- Attachment #2: Type: text/html, Size: 26699 bytes --]
^ permalink raw reply [flat|nested] 85+ messages in thread* Re: [oe] [PATCH 00/82] Blacksail pull request
2026-10-15 17:45 ` [oe] [PATCH 00/82] Blacksail pull request Khem Raj
@ 2026-10-15 19:11 ` Ankur Tyagi
0 siblings, 0 replies; 85+ messages in thread
From: Ankur Tyagi @ 2026-10-15 19:11 UTC (permalink / raw)
To: Khem Raj; +Cc: openembedded-devel
Thanks Khem, will fix the subject next time.
On Fri, Oct 16, 2026 at 6:46 AM Khem Raj <raj.khem@gmail.com> wrote:
>
> Thanks Ankur, looks good, the patches in this patchset are not having [blacksail] tag in subject line, please fix that piece next time. I have installed this PR
>
> -Khem
>
> On Wed, Oct 14, 2026 at 10:42 PM Ankur Tyagi via lists.openembedded.org <ankur.tyagi85=gmail.com@lists.openembedded.org> wrote:
>>
>> From: Ankur Tyagi <ankur.tyagi85@gmail.com>
>>
>> Please merge these changes in blacksail. Tested locally and on autobuilder.
>>
>> https://autobuilder.yoctoproject.org/valkyrie/#/builders/81/builds/1860
>>
>> The following changes since commit ca3cf5fe14bed658890bac643cced054932fcb51:
>>
>> fuse3: Fix ptest for the new test runner (2026-10-01 20:41:15 -0700)
>>
>> are available in the Git repository at:
>>
>> https://git.openembedded.org/meta-openembedded-contrib ankurt/blacksail
>> https://git.openembedded.org/meta-openembedded-contrib/log/?h=ankurt/blacksail
>>
>> for you to fetch changes up to a9d69bc066bf9498397db27902c287dd666fdfd4:
>>
>> lvgl-demo-fb: fix SRCREV (2026-10-14 09:26:03 +1300)
>>
>> ----------------------------------------------------------------
>>
>> Ankur Tyagi (74):
>> readme: update maintainer
>> libwebsockets: patch CVE-2026-19773
>> capnproto: ignore CVE-2026-59704
>> civetweb: ignore CVE-2026-5789
>> dovecot: ignore already fixed CVEs
>> eject: ignore CVE-2026-28065
>> gpsd: patch CVE-2026-58459
>> bcc: correct CVE_PRODUCT mapping
>> dool: patch CVE-2026-56651
>> dool: patch CVE-2026-56652
>> haveged: ignore CVE-2026-41054
>> gpm: ignore CVE-2025-4558
>> gerbera: ignore CVE-2025-23386
>> libde265: patch CVE-2026-49295
>> libde265: patch CVE-2026-49337
>> libde265: patch CVE-2026-49346
>> libde265: patch CVE-2026-54240 and CVE-2026-54241
>> hdf5: patch CVE-2026-17572
>> hdf5: patch CVE-2026-17573
>> hdf5: patch CVE-2026-17574
>> hdf5: patch CVE-2026-19025
>> iniparser: mark CVE-2025-0633 pached
>> jq: ignore already fixed CVEs
>> libiec61850: mark CVE-2024-45969 patched
>> libnfs: patch CVE-2026-53689
>> libnfs: patch CVE-2026-57918
>> libssh: ignore CVE-2025-14821
>> libssh: mark CVEs patched
>> libssh: ignore CVE-2026-59851
>> miniupnpd: patch CVE-2026-107159
>> libyang: patch CVE-2026-41401
>> tinyproxy: patch CVE-2026-31842
>> tinyproxy: patch CVE-2026-54387
>> tinyproxy: patch CVE-2026-55202
>> wolfssl: mark CVEs patched
>> python3-gunicorn: mark CVE-2024-1135 patched
>> pgpool2: upgrade 4.7.2 -> 4.7.3
>> smarty: upgrade 5.8.4 -> 5.8.5
>> python3-astroid: upgrade 4.3.2 -> 4.3.3
>> python3-django: upgrade 6.0.8 -> 6.0.9
>> python3-django: upgrade 5.2.17 -> 5.2.18
>> python3-tzdata: upgrade 2026.4 -> 2026.5
>> python3-werkzeug: upgrade 3.1.8 -> 3.1.9
>> python3-zeroconf: upgrade 0.151.3 -> 0.151.5
>> swagger-ui: upgrade 5.33.0 -> 5.33.1
>> openvpn: ignore CVE-2026-84256
>> openvpn: patch CVE-2026-88964
>> openvpn: patch CVE-2026-84790
>> python3-eventlet: mark CVE-2023-29483 fixed
>> cjson: patch CVE-2026-87933
>> smarty: mark CVE-2026-82531 patched
>> ntopng: patch CVE-2026-84990
>> ntopng: patch CVE-2026-86090 and CVE-2026-86091
>> sngrep: patch CVE-2026-90558
>> strongswan: patch CVE-2026-78123
>> strongswan: patch CVE-2026-78124
>> strongswan: patch CVE-2026-78126
>> strongswan: patch CVE-2026-78127
>> strongswan: patch CVE-2026-78129
>> strongswan: patch CVE-2026-78133
>> strongswan: patch CVE-2026-78131
>> strongswan: patch CVE-2026-78130
>> strongswan: patch CVE-2026-78132
>> strongswan: patch CVE-2026-78135
>> strongswan: patch CVE-2026-78134
>> tesseract: patch CVE-2026-88052
>> tesseract: patch CVE-2026-88048
>> tesseract: patch CVE-2026-88049
>> tesseract: patch CVE-2026-88050
>> tesseract: patch CVE-2026-88047
>> tesseract: patch CVE-2026-88051
>> tesseract: patch CVE-2026-88054
>> gpsd: patch CVE-2026-60122
>> lvgl-demo-fb: fix SRCREV
>>
>> Bastian Krause (1):
>> pcsc-lite: create pcscd user and group also via useradd
>>
>> Markus Volk (5):
>> Revert "libpwquality: remove recipe (moved to oe-core)"
>> Revert "gnome-shell-extensions: upgrade 50.3 -> 51.0"
>> Revert "gnome-shell: upgrade 50.4 -> 51.0"
>> Revert "mutter: upgrade 50.4 -> 51.0"
>> apache2: fix build with OpenSSL 4
>>
>> Peter Marko (2):
>> libwebsockets: patch CVE-2026-78161
>> nginx: set status for CVE-2026-90439
>>
>> README.md | 2 +-
>> meta-filesystems/README.md | 10 +-
>> meta-gnome/README.md | 10 +-
>> ...51.0.bb => gnome-shell-extensions_50.3.bb} | 2 +-
>> ...ver-Fix-build-failure-with-libical-4.patch | 44 ++
>> ...nome-shell_51.0.bb => gnome-shell_50.4.bb} | 7 +-
>> .../mutter/{mutter_51.0.bb => mutter_50.4.bb} | 17 +-
>> meta-initramfs/README.md | 8 +-
>> meta-multimedia/README.md | 10 +-
>> .../gerbera/gerbera_3.3.0.bb | 2 +
>> .../libde265/libde265/CVE-2026-49295.patch | 41 +
>> .../libde265/libde265/CVE-2026-49337.patch | 53 ++
>> .../libde265/libde265/CVE-2026-49346.patch | 102 +++
>> .../CVE-2026-54240-CVE-2026-54241.patch | 426 +++++++++++
>> .../libde265/libde265_1.0.19.bb | 7 +-
>> meta-networking/README.md | 8 +-
>> .../civetweb/civetweb_1.16.bb | 1 +
>> .../libiec61850/libiec61850_1.6.2.1.bb | 2 +
>> .../miniupnpd/files/CVE-2026-107159.patch | 78 ++
>> .../miniupnpd/miniupnpd_2.3.11.bb | 1 +
>> .../wolfssl/wolfssl_5.9.4.bb | 2 +
>> .../recipes-support/dovecot/dovecot_2.4.5.bb | 8 +
>> .../ntopng/files/CVE-2026-84990.patch | 53 ++
>> .../files/CVE-2026-86090-CVE-2026-86091.patch | 67 ++
>> .../recipes-support/ntopng/ntopng_6.6.bb | 2 +
>> .../openvpn/openvpn/CVE-2026-84790.patch | 361 +++++++++
>> .../openvpn/openvpn/CVE-2026-88964.patch | 78 ++
>> .../recipes-support/openvpn/openvpn_2.7.7.bb | 3 +
>> .../{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} | 2 +-
>> .../sngrep/sngrep/CVE-2026-90558.patch | 84 +++
>> .../recipes-support/sngrep/sngrep_1.8.4.bb | 4 +-
>> .../strongswan/CVE-2026-78123.patch | 51 ++
>> .../strongswan/CVE-2026-78124.patch | 34 +
>> .../strongswan/CVE-2026-78126.patch | 37 +
>> .../strongswan/CVE-2026-78127.patch | 115 +++
>> .../strongswan/CVE-2026-78129.patch | 155 ++++
>> .../strongswan/CVE-2026-78130.patch | 49 ++
>> .../strongswan/CVE-2026-78131.patch | 86 +++
>> .../strongswan/CVE-2026-78132.patch | 75 ++
>> .../strongswan/CVE-2026-78133.patch | 620 +++++++++++++++
>> .../strongswan/CVE-2026-78134.patch | 712 ++++++++++++++++++
>> .../strongswan/CVE-2026-78135.patch | 72 ++
>> .../strongswan/strongswan_6.0.7.bb | 14 +-
>> .../tinyproxy/tinyproxy/CVE-2026-31842.patch | 33 +
>> .../tinyproxy/tinyproxy/CVE-2026-54387.patch | 37 +
>> .../tinyproxy/tinyproxy/CVE-2026-55202.patch | 107 +++
>> .../tinyproxy/tinyproxy_1.11.3.bb | 3 +
>> meta-oe/README.md | 8 +-
>> .../recipes-devtools/bcc/bcc_0.37.0.bb | 2 +
>> .../libnfs/libnfs/CVE-2026-53689.patch | 34 +
>> .../libnfs/libnfs/CVE-2026-57918.patch | 34 +
>> .../libnfs/libnfs_6.0.2.bb | 2 +
>> .../libwebsockets/CVE-2026-19773.patch | 31 +
>> .../libwebsockets/CVE-2026-78161.patch | 45 ++
>> .../libwebsockets/libwebsockets_4.5.8.bb | 2 +
>> .../packagegroups/packagegroup-meta-oe.bb | 1 +
>> .../capnproto/capnproto_1.5.0.bb | 1 +
>> .../cjson/cjson/CVE-2026-87933.patch | 110 +++
>> .../recipes-devtools/cjson/cjson_1.7.19.bb | 1 +
>> meta-oe/recipes-devtools/jq/jq_1.8.2.bb | 4 +
>> .../haveged/haveged_1.9.26.bb | 2 +
>> ...-Use-setuptools-instead-of-distutils.patch | 78 ++
>> ...02-Makefile.am-respect-PYTHONSITEDIR.patch | 26 +
>> .../libpwquality/libpwquality_1.4.5.bb | 39 +
>> .../libyang/libyang/CVE-2026-41401.patch | 43 ++
>> .../libyang/libyang_3.13.6.bb | 1 +
>> .../lvgl/lvgl-demo-fb_9.5.0.bb | 2 +-
>> .../tesseract/tesseract/CVE-2026-88047.patch | 225 ++++++
>> .../tesseract/tesseract/CVE-2026-88048.patch | 227 ++++++
>> .../tesseract/tesseract/CVE-2026-88049.patch | 315 ++++++++
>> .../tesseract/tesseract/CVE-2026-88050.patch | 209 +++++
>> .../tesseract/tesseract/CVE-2026-88051.patch | 184 +++++
>> .../tesseract/tesseract/CVE-2026-88052.patch | 165 ++++
>> .../tesseract/tesseract/CVE-2026-88054.patch | 274 +++++++
>> .../tesseract/tesseract_5.5.3.bb | 11 +-
>> .../gpsd/gpsd/CVE-2026-58459-1.patch | 48 ++
>> .../gpsd/gpsd/CVE-2026-58459-2.patch | 46 ++
>> .../gpsd/gpsd/CVE-2026-58459-3.patch | 58 ++
>> .../gpsd/gpsd/CVE-2026-60122.patch | 45 ++
>> .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 4 +
>> .../dool/dool/CVE-2026-56651.patch | 47 ++
>> .../dool/dool/CVE-2026-56652.patch | 35 +
>> meta-oe/recipes-support/dool/dool_1.3.8.bb | 5 +-
>> meta-oe/recipes-support/eject/eject_2.1.5.bb | 2 +
>> meta-oe/recipes-support/gpm/gpm_git.bb | 2 +
>> .../hdf5/files/CVE-2026-17572.patch | 253 +++++++
>> .../hdf5/files/CVE-2026-17573.patch | 53 ++
>> .../hdf5/files/CVE-2026-17574.patch | 65 ++
>> .../hdf5/files/CVE-2026-19025.patch | 112 +++
>> meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 4 +
>> .../iniparser/iniparser_4.2.6.bb | 2 +
>> .../recipes-support/libssh/libssh_0.11.5.bb | 9 +
>> .../pcsc-lite/pcsc-lite_2.5.1.bb | 5 +-
>> .../{smarty_5.8.4.bb => smarty_5.8.5.bb} | 3 +-
>> meta-perl/README.md | 10 +-
>> meta-python/README.md | 12 +-
>> ...roid_4.3.2.bb => python3-astroid_4.3.3.bb} | 2 +-
>> ...ngo_5.2.17.bb => python3-django_5.2.18.bb} | 2 +-
>> ...jango_6.0.8.bb => python3-django_6.0.9.bb} | 2 +-
>> .../python/python3-eventlet_0.41.2.bb | 2 +
>> .../python/python3-gunicorn_26.2.0.bb | 2 +
>> ...ata_2026.4.bb => python3-tzdata_2026.5.bb} | 2 +-
>> ...eug_3.1.8.bb => python3-werkzeug_3.1.9.bb} | 2 +-
>> ...0.151.3.bb => python3-zeroconf_0.151.5.bb} | 2 +-
>> meta-webserver/README.md | 10 +-
>> ...gger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} | 2 +-
>> ...mod_md-Add-OpenSSL-4.0-compatibility.patch | 47 ++
>> .../recipes-httpd/apache2/apache2_2.4.68.bb | 1 +
>> .../recipes-httpd/nginx/nginx_1.30.5.bb | 2 +
>> meta-xfce/README.md | 11 +-
>> 110 files changed, 6601 insertions(+), 79 deletions(-)
>> rename meta-gnome/recipes-gnome/gnome-shell/{gnome-shell-extensions_51.0.bb => gnome-shell-extensions_50.3.bb} (85%)
>> create mode 100644 meta-gnome/recipes-gnome/gnome-shell/gnome-shell/0002-calendar-server-Fix-build-failure-with-libical-4.patch
>> rename meta-gnome/recipes-gnome/gnome-shell/{gnome-shell_51.0.bb => gnome-shell_50.4.bb} (86%)
>> rename meta-gnome/recipes-gnome/mutter/{mutter_51.0.bb => mutter_50.4.bb} (85%)
>> create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch
>> create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch
>> create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch
>> create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-54240-CVE-2026-54241.patch
>> create mode 100644 meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch
>> create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-84990.patch
>> create mode 100644 meta-networking/recipes-support/ntopng/files/CVE-2026-86090-CVE-2026-86091.patch
>> create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-84790.patch
>> create mode 100644 meta-networking/recipes-support/openvpn/openvpn/CVE-2026-88964.patch
>> rename meta-networking/recipes-support/pgpool2/{pgpool2_4.7.2.bb => pgpool2_4.7.3.bb} (95%)
>> create mode 100644 meta-networking/recipes-support/sngrep/sngrep/CVE-2026-90558.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78123.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78124.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78126.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78127.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78129.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78130.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78131.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78132.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78133.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78134.patch
>> create mode 100644 meta-networking/recipes-support/strongswan/strongswan/CVE-2026-78135.patch
>> create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch
>> create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch
>> create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch
>> create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-53689.patch
>> create mode 100644 meta-oe/recipes-connectivity/libnfs/libnfs/CVE-2026-57918.patch
>> create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch
>> create mode 100644 meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-78161.patch
>> create mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2026-87933.patch
>> create mode 100644 meta-oe/recipes-extended/libpwquality/files/0001-Use-setuptools-instead-of-distutils.patch
>> create mode 100644 meta-oe/recipes-extended/libpwquality/files/0002-Makefile.am-respect-PYTHONSITEDIR.patch
>> create mode 100644 meta-oe/recipes-extended/libpwquality/libpwquality_1.4.5.bb
>> create mode 100644 meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch
>> create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88047.patch
>> create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88048.patch
>> create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88049.patch
>> create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88050.patch
>> create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88051.patch
>> create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88052.patch
>> create mode 100644 meta-oe/recipes-graphics/tesseract/tesseract/CVE-2026-88054.patch
>> create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch
>> create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch
>> create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch
>> create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-60122.patch
>> create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch
>> create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch
>> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch
>> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch
>> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch
>> create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch
>> rename meta-oe/recipes-support/smarty/{smarty_5.8.4.bb => smarty_5.8.5.bb} (90%)
>> rename meta-python/recipes-devtools/python/{python3-astroid_4.3.2.bb => python3-astroid_4.3.3.bb} (89%)
>> rename meta-python/recipes-devtools/python/{python3-django_5.2.17.bb => python3-django_5.2.18.bb} (61%)
>> rename meta-python/recipes-devtools/python/{python3-django_6.0.8.bb => python3-django_6.0.9.bb} (75%)
>> rename meta-python/recipes-devtools/python/{python3-tzdata_2026.4.bb => python3-tzdata_2026.5.bb} (86%)
>> rename meta-python/recipes-devtools/python/{python3-werkzeug_3.1.8.bb => python3-werkzeug_3.1.9.bb} (91%)
>> rename meta-python/recipes-devtools/python/{python3-zeroconf_0.151.3.bb => python3-zeroconf_0.151.5.bb} (88%)
>> rename meta-webserver/recipes-devtools/swagger-ui/{swagger-ui_5.33.0.bb => swagger-ui_5.33.1.bb} (94%)
>> create mode 100644 meta-webserver/recipes-httpd/apache2/apache2/0011-mod_md-Add-OpenSSL-4.0-compatibility.patch
>>
>>
>> -=-=-=-=-=-=-=-=-=-=-=-
>> Links: You receive all messages sent to this group.
>> View/Reply Online (#130920): https://lists.openembedded.org/g/openembedded-devel/message/130920
>> Mute This Topic: https://lists.openembedded.org/mt/121765065/1997914
>> Group Owner: openembedded-devel+owner@lists.openembedded.org
>> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [raj.khem@gmail.com]
>> -=-=-=-=-=-=-=-=-=-=-=-
>>
^ permalink raw reply [flat|nested] 85+ messages in thread