[meta-networking,12/20] mtr: patch CVE-2026-14461

Message ID	20261019183407.1037972-12-ankur.tyagi85@gmail.com
State	New
Headers	show Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1763.1792434883369004727 for <openembedded-devel@lists.openembedded.org>; Mon, 19 Oct 2026 11:34:43 -0700 ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi <ankur.tyagi85@gmail.com> Subject: [oe][meta-networking][PATCH 12/20] mtr: patch CVE-2026-14461 Date: Tue, 20 Oct 2026 07:33:58 +1300 Message-ID: <20261019183407.1037972-12-ankur.tyagi85@gmail.com> In-Reply-To: <20261019183407.1037972-1-ankur.tyagi85@gmail.com> References: <20261019183407.1037972-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="utf-8"
Series	[meta-webserver,1/20] netdata: mark CVE-2026-83602 fixed \| expand [meta-webserver,1/20] netdata: mark CVE-2026-83602 fixed [meta-multimedia,2/20] pjproject: mark CVE-2026-26967 fixed [meta-multimedia,3/20] pjproject: patch CVE-2026-57160 [meta-multimedia,4/20] pjproject: patch CVE-2026-57161 [meta-multimedia,5/20] pjproject: patch CVE-2026-57162 [meta-multimedia,6/20] pjproject: patch CVE-2026-57163 [meta-multimedia,7/20] pjproject: patch CVE-2026-57164 [meta-multimedia,8/20] pjproject: patch CVE-2026-57165 [meta-multimedia,9/20] pjproject: patch CVE-2026-57166 [meta-multimedia,10/20] pjproject: patch CVE-2026-77396 [meta-multimedia,11/20] pjproject: patch CVE-2026-84975 [meta-networking,12/20] mtr: patch CVE-2026-14461 [meta-networking,13/20] ncp: ignore CVE-2025-14577 and CVE-2026-35087 [meta-oe,14/20] opensc: patch CVE-2026-103531 [meta-oe,15/20] opensc: include tag in the SRC_URI [meta-webserver,16/20] swagger-ui: upgrade 5.33.2 -> 5.33.3 [meta-filesystems,17/20] unionfs-fuse: upgrade 3.7 -> 3.8 [meta-networking,18/20] open-isns: upgrade 0.102 -> 0.103 [meta-oe,19/20] imagemagick: upgrade 7.1.2-33 -> 7.1.2-34 [meta-multimedia,20/20] mpd: upgrade 0.24.15 -> 0.24.16

Message ID

20261019183407.1037972-12-ankur.tyagi85@gmail.com

State

New

Headers

From: ankur.tyagi85@gmail.com
To: openembedded-devel@lists.openembedded.org
Cc: Ankur Tyagi <ankur.tyagi85@gmail.com>
Subject: [oe][meta-networking][PATCH 12/20] mtr: patch CVE-2026-14461
Date: Tue, 20 Oct 2026 07:33:58 +1300
Message-ID: <20261019183407.1037972-12-ankur.tyagi85@gmail.com>
In-Reply-To: <20261019183407.1037972-1-ankur.tyagi85@gmail.com>
References: <20261019183407.1037972-1-ankur.tyagi85@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset="utf-8"

Series

[meta-webserver,1/20] netdata: mark CVE-2026-83602 fixed | expand

Commit Message

Ankur Tyagi Oct. 19, 2026, 6:33 p.m. UTC

From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-14461

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
(cherry picked from commit a5e913980f0107c4fe1ccde6a5e4a10780bd60a9)
---
 .../mtr/mtr/CVE-2026-14461.patch              | 32 +++++++++++++++++++
 .../recipes-support/mtr/mtr_0.96.bb           |  4 ++-
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch

diff --git a/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch b/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch
new file mode 100644
index 0000000000..6628d9d7be
--- /dev/null
+++ b/meta-networking/recipes-support/mtr/mtr/CVE-2026-14461.patch
@@ -0,0 +1,32 @@ 
+From 4c75fae93d9515f3ecdfecc966b8c6471efb7ea5 Mon Sep 17 00:00:00 2001
+From: "R.E. Wolff" <R.E.Wolff@BitWizard.nl>
+Date: Tue, 16 Jun 2026 11:03:39 +0200
+Subject: [PATCH] =?UTF-8?q?Fixed=20possible=20buffer=20overrun=20in=20asn?=
+ =?UTF-8?q?=20code--=20Micha=C5=82=20Majchrowicz?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(cherry picked from commit 48e1794414d338ce47abc0f27c25ade8788af9c3)
+
+CVE: CVE-2026-14461
+Upstream-Status: Backport [https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ ui/asn.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/ui/asn.c b/ui/asn.c
+index 111c394..487d9e8 100644
+--- a/ui/asn.c
++++ b/ui/asn.c
+@@ -94,6 +94,8 @@ static char *ipinfo_lookup(
+             DEB_syslog(LOG_INFO, "Malloc-txt: %s", UNKN);
+         return xstrdup(UNKN);
+     }
++    // Clip len to PACKETSZ. -- Michał Majchrowicz
++    if (len > PACKETSZ) len = PACKETSZ;
+ 
+     pt = answer + sizeof(HEADER);
+ 
diff --git a/meta-networking/recipes-support/mtr/mtr_0.96.bb b/meta-networking/recipes-support/mtr/mtr_0.96.bb
index 9008223264..2716ca92aa 100644
--- a/meta-networking/recipes-support/mtr/mtr_0.96.bb
+++ b/meta-networking/recipes-support/mtr/mtr_0.96.bb
@@ -9,7 +9,9 @@  LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
                     file://ui/mtr.c;beginline=5;endline=16;md5=00a894a39d53726a27386534d1c4e468"
 
 SRCREV = "f392168771570b0fdc104c38dea6bbc2ce585710"
-SRC_URI = "git://github.com/traviscross/mtr;branch=master;protocol=https;tag=v${PV}"
+SRC_URI = "git://github.com/traviscross/mtr;branch=master;protocol=https;tag=v${PV} \
+           file://CVE-2026-14461.patch \
+"
 
 
 inherit autotools pkgconfig

[meta-networking,12/20] mtr: patch CVE-2026-14461

Commit Message

Patch