From patchwork Wed Sep 9 08:31:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97706 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD19FC79FB8 for ; Wed, 9 Sep 2026 08:31:55 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6994.1788942715070674758 for ; Wed, 09 Sep 2026 01:31:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=ABKELcj3; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-38ec1402b05so5461203a91.2 for ; Wed, 09 Sep 2026 01:31:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942714; x=1789547514; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Slagt7ZkauVRnXIn4JMpfNJeCX304POspLpIpJGGAHY=; b=ABKELcj3vBdTinsuI2w23aL1cpWKktxl0eS6f0tLogSieY1I8utYKcpYkQyQL37O1o DL8biG7WOmghoA6Ho2PUZwoQlVsIQ5l/oZif2oOQFMJT5rnxDA5yMC0lwEoqg/twIRPB wrFoC4sCjKtOYUhGUmI5zkfiXOWUuGzWfEcV8aVBWlVLWhCguuOws2omctxiF8T233OT WkdUgHX944ObQSE9XfpCp3Vcck1oJO70K136GE+IQzvndonmQ762iT3Bwzhr/jTw6Wy5 1p0v+avlzW+dD+fW/G2Wrg8V7IxOAv+ZTGjri7MwohUF6HCfCxi9sihisrsOB/nd3U44 0tCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942714; x=1789547514; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Slagt7ZkauVRnXIn4JMpfNJeCX304POspLpIpJGGAHY=; b=qpo1t5SDHkG1LpwOX2IkfDU9XiMeWHlW/juG8VEfPm4wfjOrO1m1zTmlzPRie0/06B ++lc2ykRv/rjHksXzX+C9fPiiCUS5XrEC2A/seaW0bwKudEQa0AizyrW9+GVW/kNtPqV 9F3PTGV2gb8j6jGt8WDNX8ONhPrXOXoWt841y7bZ8Ff9XKj+JU3EO/Uv4crKhHBbxLXu K6ccF69tpBqLivU4A3SKhSycNjxecreIxUU1EKx9YZ3Y435SlkRndzFTbVtkS9H5G1DR Bs1v1RkK3iLbEV06dsHH/XZoO7vEZQLSBNBlxfIZrxt1nyxenPRgdh7YkY/DB+wJTCfl Jt4g== X-Gm-Message-State: AFuF++mm5Ogmu/lLvJ3WOkf5RtKI1CtumqsQvvYubdvy+6TxXSB+mDQW ye4meMYUF+1WoOMePsw2+55zgNGev0q3S/8B06/zFj0SP52IKduO/muLZ1ooUw== X-Gm-Gg: AYBFou3qcw2QlUzpB4o4smOwBAivhzuwOxzQDK5MrDVpjHUlOG1isGKWn275UnqlQHl XFoVaE8G4dIQu9X0W2jTDXdNOEO1ur5f3muga1TYivObjP0k9qG+VCqEnVUANMY2HVRenlNG2CY nJgZIDB/mwyNgg89Y58nV9pOH9kBjSQs1AMIGtq20PuBHOQTkHMPLwI1PV9KpctVotmNvawxLdL xoP4HmAtiNEt22cPly7JMLXbwnz/TD3sFZ1WOr7TiDsCAJAzfdq5AGzf98MB7OVNgAoeKH1Y/no cyW49UFHIcP6p5JLbTxgcvFocECaayDkRc+iPjZUmbYRLppN1JukdHSW3yvFGPi/7MLfkt1I/s3 WrAO0i0ly8uyuoerlnxyIawjOuk29sszYa+IFj4f7+MS8qkS4njd/ChwQ60MhOtUC0tAE8aRU+Q 7lKMz5WpNR+bpyFHXup2VUCrh+KZ3/FvwICYF0gAIaqCeHLA0Nr1ct0cbz7YOsqJZWqRwK1znjg w1YC188q67IjSs2Xa+n5Zk= X-Received: by 2002:a17:90b:5807:b0:398:9be9:ab8c with SMTP id 98e67ed59e1d1-39b26229bd7mr52331970a91.17.1788942714163; Wed, 09 Sep 2026 01:31:54 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.31.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:31:53 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 1/15] freerdp3: patch CVE-2026-40254 Date: Wed, 9 Sep 2026 20:31:26 +1200 Message-ID: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:31:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129872 From: Ankur Tyagi Backport commits matching advisory[1] mentioned in the NVD. Details: https://nvd.nist.gov/vuln/detail/cve-2026-40254 [1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3xpj-m4hx-8vmx Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-40254-1.patch | 46 +++++++++++++++++++ .../freerdp/freerdp3/CVE-2026-40254-2.patch | 30 ++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 5 +- 3 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch new file mode 100644 index 0000000000..b758877882 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-1.patch @@ -0,0 +1,46 @@ +From 11b850f6181cb607c7fa4ac7a4fa09d203e0aaf6 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Fri, 10 Apr 2026 08:45:55 +0200 +Subject: [PATCH] [channels,drive] refine bounds checks + +* better logging, fix wrong path component printed +* ensure path does not end with path/.. + +(cherry picked from commit f502dbb8462597fbe5b97f890359dfdecb525bf7) + +CVE: CVE-2026-40254 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/f502dbb8462597fbe5b97f890359dfdecb525bf7] + +Signed-off-by: Ankur Tyagi +--- + channels/drive/client/drive_file.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/channels/drive/client/drive_file.c b/channels/drive/client/drive_file.c +index 8ea7552a7..3d87d8e6b 100644 +--- a/channels/drive/client/drive_file.c ++++ b/channels/drive/client/drive_file.c +@@ -113,6 +113,8 @@ static BOOL contains_dotdot(const WCHAR* path, size_t base_length, size_t path_l + if ((tst[2] == '/') || (tst[2] == '\\')) + return TRUE; + } ++ else ++ return TRUE; + } + tst += 2; + } while (TRUE); +@@ -147,11 +149,10 @@ static WCHAR* drive_file_combine_fullpath(const WCHAR* base_path, const WCHAR* p + /* Ensure the path does not contain sequences like '..' */ + if (contains_dotdot(&fullpath[base_path_length], base_path_length, PathWCharLength)) + { +- char abuffer[MAX_PATH] = WINPR_C_ARRAY_INIT; +- (void)ConvertWCharToUtf8(&fullpath[base_path_length], abuffer, ARRAYSIZE(abuffer)); +- ++ char* abuffer = ConvertWCharToUtf8Alloc(&fullpath[base_path_length], nullptr); + WLog_WARN(TAG, "[rdpdr] received invalid file path '%s' from server, aborting!", +- &abuffer[base_path_length]); ++ abuffer); ++ free(abuffer); + goto fail; + } + } diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch new file mode 100644 index 0000000000..ac727b5235 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-40254-2.patch @@ -0,0 +1,30 @@ +From 3b1f9e5690d60c6a070e40587c5b23e56b172684 Mon Sep 17 00:00:00 2001 +From: Sayed Kaif +Date: Sun, 28 Jun 2026 16:55:01 +0530 +Subject: [PATCH] [channels,drive] reject trailing '..' in contains_dotdot + +The trailing '..' check never fired because PathLength counts the NUL terminator, leaving path_length one WCHAR longer than the string; treat '\0' as a component terminator so a final '..' is rejected like '../'. + +(cherry picked from commit 17543c9ae0a72a5413e19741cf0203ab519fb3fd) + +CVE: CVE-2026-40254 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/17543c9ae0a72a5413e19741cf0203ab519fb3fd] + +Signed-off-by: Ankur Tyagi +--- + channels/drive/client/drive_file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/channels/drive/client/drive_file.c b/channels/drive/client/drive_file.c +index 3d87d8e6b..fa93946e2 100644 +--- a/channels/drive/client/drive_file.c ++++ b/channels/drive/client/drive_file.c +@@ -110,7 +110,7 @@ static BOOL contains_dotdot(const WCHAR* path, size_t base_length, size_t path_l + { + if (tst + 2 < path + path_length) + { +- if ((tst[2] == '/') || (tst[2] == '\\')) ++ if ((tst[2] == '/') || (tst[2] == '\\') || (tst[2] == '\0')) + return TRUE; + } + else diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index a4561495cf..7164a81e9d 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -10,7 +10,10 @@ inherit pkgconfig cmake ptest SRCREV = "3028b706908f81767d9b9c744a90778c28f57d61" SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${PV} \ - file://run-ptest" + file://run-ptest \ + file://CVE-2026-40254-1.patch \ + file://CVE-2026-40254-2.patch \ +" CVE_PRODUCT = "freerdp" From patchwork Wed Sep 9 08:31:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97707 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBD66C79FB9 for ; Wed, 9 Sep 2026 08:32:05 +0000 (UTC) Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6995.1788942717609594245 for ; Wed, 09 Sep 2026 01:31:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=W77gMZvf; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-38dfe7eb825so4630807a91.0 for ; Wed, 09 Sep 2026 01:31:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942717; x=1789547517; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2IqYya7Cy5WjvcmmmdhCTCegyifBW9NJy0t3o8J3/OQ=; b=W77gMZvfoIrFE2jvEHZnS+zFPoA6T7B4SazSfiVk1VBPBOszRqYrd6u9z9CWTJ3q8r s3ygENFhX56Q0hyX//bvs0Vrt+xiWVsxDlkP1+u0ybEMtECRnP313my9K421XhLdcudr xccsHxpQM8e3gO1LrUY3lhcLK8p5EIdOKJ9KdZctwyVSN27Pav/h+tvi2dcOph66gsLO MxdJYkLESnOGeHOY8jcCck1zpOJ+G3zKPa8XXTZLvuCOX5CD3kxqbkkJ1mHTNXck5rxe D5p6u4/86+ja3JnuWhPefajSFpqpXKx6uCaKVZ5RXnN5UEfx+twiiV6qaVcPHYtkI+Ul eUdQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942717; x=1789547517; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=2IqYya7Cy5WjvcmmmdhCTCegyifBW9NJy0t3o8J3/OQ=; b=mAr1iShVDPW10/wJMacC/20b0BQ9tYeJiwoXVm9yqFPzJlPp5ldVCE6SLKfZvmnf6b 14Mm1ESKQy9hayb1jXH9phY8SWSx7kck01ObUAS3nh2dEFQaX5qCI5f2/pY4TpjQaRZD I9OsCWI9frwpQdO9JyXvgAY9yIidJ7W+PXT98M4fxki1HbhEk6uHdULWspIAJJi5gMNq 9e0ad/QabjJVZaWdku8K3qbK4XVjt9igcU+CBobTJXFJxFcvpnB1oARznxSNNAec1RpA Z+ap6SsDSth4TeCP+c44ep4mjfMpD5hyFY2zERwJOQx4C5jZJlkAU+JdBknU+LuypX0L wKpA== X-Gm-Message-State: AFuF++m14+AcZIGjW8mcka8Kie3WU8IqQPQ+ePZYs03NbqneTWMorNRs 892BZl/tK7kTOw/+TSWROd8kcGDu8mPjOqNR/xcA1zHmH4G1Ga32ihpYF1c0Wg== X-Gm-Gg: AYBFou2REQ1dEqgwIUw+9SbEMl0HWujx/929KxlhaZYHRigrLYl0Brjgv/WWBHfhyL/ M6bYmBd30Suo+H2C1j0j3+Gx5cLP+CUQfTY526n52IFti6p/Yqo47wINqsrHyAINdpKVDc484oC 4KkjIJt0Jt11dVVV2C2OsOyhvXxcGIyC0cpY5dfewZHrY03A75V6murCsAGq6m6HUyOMMfM4gyE hO6HP3zkWq+d9eoiFEXDL46FhPZdnMxRVVUcFEaFKz9ahCFs2R0Xgjmyo8B/eqpxsHKaxqcoC2R bPW/jwKp/eYk46Dv1dE/wYnRgR0BIZKqVbFgOBg8plrvg8ZzYyGGRHam1h5V/dXimK7i2bO1D/U fgNBqt0xIjYp+vd1v7WESU1DBRblVpk52TeTBR2t1m/ggyHjeaNriHQi3YzKpBTc4m0kNpRujSA zOi0eGsP/qt329NHP9JJtHpqF5+WGsIvgfWu4f046g7ljAnryyq5ksU1uwgYPC1VPzoc+5RycL0 BYRUjC80e0aXt/09J8KINw= X-Received: by 2002:a17:90b:4fca:b0:38e:5b59:c2ff with SMTP id 98e67ed59e1d1-39b260dd278mr50218984a91.3.1788942716838; Wed, 09 Sep 2026 01:31:56 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.31.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:31:56 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 2/15] freerdp3: patch CVE-2026-55191 Date: Wed, 9 Sep 2026 20:31:27 +1200 Message-ID: <20260909083140.2494932-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129873 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-55191 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-55191.patch | 47 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 48 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch new file mode 100644 index 0000000000..0881d671bf --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55191.patch @@ -0,0 +1,47 @@ +From 4234cf72c4e9095c163405c4b5c5d41dd4775f81 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:10:58 +0200 +Subject: [PATCH] [codec,h264] fix buffer bounds checks + +(cherry picked from commit 97f40b9e766af375f4e41ac6a3f4397d708d249c) + +CVE: CVE-2026-55191 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/97f40b9e766af375f4e41ac6a3f4397d708d249c] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/codec/h264.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/libfreerdp/codec/h264.c b/libfreerdp/codec/h264.c +index 3b837601c..ce7776b40 100644 +--- a/libfreerdp/codec/h264.c ++++ b/libfreerdp/codec/h264.c +@@ -495,14 +495,24 @@ static BOOL avc444_ensure_buffer(H264_CONTEXT* h264, DWORD nDstHeight) + if (pad != 0) + padDstHeight += 16 - pad; + +- if ((piMainStride[0] != piDstStride[0]) || +- (piDstSize[0] != 1ull * piMainStride[0] * padDstHeight)) ++ if ((piMainStride[0] == 0) || (padDstHeight == 0)) ++ return FALSE; ++ ++ const uint64_t dstsize = 1ull * piMainStride[0] * padDstHeight; ++ if (dstsize > UINT32_MAX) ++ return FALSE; ++ ++ if ((piMainStride[0] != piDstStride[0]) || (piDstSize[0] != dstsize)) + { + for (UINT32 x = 0; x < 3; x++) + { + piDstStride[x] = piMainStride[0]; +- piDstSize[x] = piDstStride[x] * padDstHeight; + ++ const uint64_t dstride = 1ull * piDstStride[x] * padDstHeight; ++ if (dstride > UINT32_MAX) ++ return FALSE; ++ ++ piDstSize[x] = WINPR_ASSERTING_INT_CAST(UINT32, dstride); + if (piDstSize[x] == 0) + return FALSE; + diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 7164a81e9d..e014196f18 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://run-ptest \ file://CVE-2026-40254-1.patch \ file://CVE-2026-40254-2.patch \ + file://CVE-2026-55191.patch \ " From patchwork Wed Sep 9 08:31:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97709 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF68DC79FB8 for ; Wed, 9 Sep 2026 08:32:05 +0000 (UTC) Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7110.1788942720497575157 for ; Wed, 09 Sep 2026 01:32:00 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=dk0+CFd1; spf=pass (domain: gmail.com, ip: 209.85.215.180, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-cbee846deecso6474396a12.1 for ; Wed, 09 Sep 2026 01:32:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942719; x=1789547519; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IPpmB4dlXBlZBZznBeaFc/JGnnQgD57KMLFFw6ITG1s=; b=dk0+CFd1nZacU+zE43IacIeyqDel2NPfohFg45sqYGAswbcfbHGIJ30GyG68VYHwwP o/TDRBn+Ozw4/oRJlgMIk3A1zoB+u/0Hg7lG+Pyvxsze3vzT6VAWuanHkfAFMfKZzfAU W52lxMBAxzEreVvKxTMpZ/sDEqal7kidcP98F0sSnVNkVl0BEsdZ/0UdG0Y2k2SLJtcB 5L3Te6ntHO1xg+yqOUp6XP5ioML2kJCDaorOfFxVv74GBloPUfejOI5dkEzVskhewDY4 V3FajJ/90PO654IZa9eZ52RX6s2P4VumhtWL4Hqzf7bXWk1Fm62m0ekalr9fhU6rhqj0 PuCA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942719; x=1789547519; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=IPpmB4dlXBlZBZznBeaFc/JGnnQgD57KMLFFw6ITG1s=; b=V+Wn+rMMS/0xNtNvNac9UPo3+tYRnS1UgnpyKQRIP6kE4p9YHDTkViNE5tyjRFZwVO 39VKKwWG5n97A5fVocDC4B8+fL1X+Na8JA7FBnC1FTrNuJyGlulC4L5BAyPlZgxFrOd2 yiwxcBjl0dwF/Z6nPO5pSBFuhlkk6WEcawQEFoAKMx1aqki/Tp7kOhRDP73WjjTDOkNL sJ9FZ2AoWXdtIOEwIujoArfoJrIloIMCRUyMCKO/LPQ8fT5PEh/oU+sLSmOI85tpYcpg bsPFMmSEAWW2yKsw54ulgliffpTfVAGRWeTKfKdy9k3StwsPyCBw/0uir4/fxGjESMHJ a2fg== X-Gm-Message-State: AFuF++m6ppQBjc0kE8Msg8Uqqn+8fJ6N8CbiY98eh80MZ5UMxz32asKh 4FDt5JWFawZbKaRPEILCTP8q7XNN8APq551HlacENdgfwLhdIUMpE1IN8umeEw== X-Gm-Gg: AYBFou3PuQB8RTNdKx8ig0JNlqHzysDLm0x3KGLMxdKfrqWC/bYmxeZuxj1hMBpzUKc 1pW+NuyXCzx0/MYx+EUkW1YgjDv4RD7tZwVkeZXlyg23yaMO8oe2ZEh0/TbG2io2rzw/+OGQdVl OLF00HV8Sf2KHN5KJ+FuBhYCvzxMNiNFGMTxoXUpymODcQ6nzxYZoDoIGqSFLmk27DSEYjftMZE i9+UFFIENG6esmZJln5kVQ/Q8tpWgPvMTHX6ZrLQLYB8Tg4q5R0nkbSrq2yfFuCF9s1yPgeFCp8 o73mpLIpNdihT+fSmytKzKM06CG7NljbY+f2Aba1YXooJR734uYEeOCPfyT3+goDd7vy3rOhWJz gcGmMhpLxr751VbsZCR0hl9HDUKHPkGYzOgZLm+M383R3IyrI7Ph7F/UFxTMIr0wzrVh3GajT84 TldRvj2QfYvR1XVXd2jhDiKxzns/Ssw2ATWCJoI7casFrS1nwcrIRpLGrLwnPb5cn6OGHsUSMKM pH58UjpG97dq4JmVT8DbhhhuavaTTm+vw== X-Received: by 2002:a17:90a:64f:b0:39b:370e:c807 with SMTP id 98e67ed59e1d1-39b370eca6fmr28943799a91.17.1788942719518; Wed, 09 Sep 2026 01:31:59 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.31.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:31:59 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 3/15] freerdp3: patch CVE-2026-55192 Date: Wed, 9 Sep 2026 20:31:28 +1200 Message-ID: <20260909083140.2494932-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129874 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-55192 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-55192.patch | 79 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 80 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch new file mode 100644 index 0000000000..5cb3fe36d5 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55192.patch @@ -0,0 +1,79 @@ +From 4a8f7a9109a0a2d7c388102d7ad7816d932841c7 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:47:30 +0200 +Subject: [PATCH] [codec,h264] ensure decoded frame size matches expectations + +(cherry picked from commit 0cd45b70bb1fe6befd258ff64c46461947e99adb) + +CVE: CVE-2026-55192 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/0cd45b70bb1fe6befd258ff64c46461947e99adb] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/codec/h264_ffmpeg.c | 4 ++++ + libfreerdp/codec/h264_mediacodec.c | 5 +++++ + libfreerdp/codec/h264_mf.c | 4 ++++ + libfreerdp/codec/h264_openh264.c | 4 ++++ + 4 files changed, 17 insertions(+) + +diff --git a/libfreerdp/codec/h264_ffmpeg.c b/libfreerdp/codec/h264_ffmpeg.c +index 98b8b5e66..5f5e534fa 100644 +--- a/libfreerdp/codec/h264_ffmpeg.c ++++ b/libfreerdp/codec/h264_ffmpeg.c +@@ -359,6 +359,10 @@ static int libavcodec_decompress(H264_CONTEXT* WINPR_RESTRICT h264, + iStride[1] = (UINT32)MAX(0, sys->videoFrame->linesize[1]); + iStride[2] = (UINT32)MAX(0, sys->videoFrame->linesize[2]); + ++ if (sys->videoFrame->width < WINPR_ASSERTING_INT_CAST(int64_t, h264->width)) ++ goto fail; ++ if (sys->videoFrame->height < WINPR_ASSERTING_INT_CAST(int64_t, h264->height)) ++ goto fail; + rc = 1; + } + else +diff --git a/libfreerdp/codec/h264_mediacodec.c b/libfreerdp/codec/h264_mediacodec.c +index ee84f6b84..9e57969ee 100644 +--- a/libfreerdp/codec/h264_mediacodec.c ++++ b/libfreerdp/codec/h264_mediacodec.c +@@ -360,6 +360,11 @@ static int mediacodec_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT3 + pYUVData[1] = outputBuffer + iStride[0] * sys->outputHeight; + pYUVData[2] = outputBuffer + iStride[0] * sys->outputHeight + + iStride[1] * ((sys->outputHeight + 1) / 2); ++ ++ if (sys->outputWidth < h264->width) ++ goto fail; ++ if (sys->outputHeigth < h264->height) ++ goto fail; + break; + } + else if (outputBufferId == AMEDIACODEC_INFO_OUTPUT_FORMAT_CHANGED) +diff --git a/libfreerdp/codec/h264_mf.c b/libfreerdp/codec/h264_mf.c +index ca2eaca68..446f08d5e 100644 +--- a/libfreerdp/codec/h264_mf.c ++++ b/libfreerdp/codec/h264_mf.c +@@ -370,6 +370,10 @@ static int mf_decompress(H264_CONTEXT* h264, const BYTE* pSrcData, UINT32 SrcSiz + } + + outputBuffer->lpVtbl->Release(outputBuffer); ++ if (sys->frameWidth < h264->width) ++ goto error; ++ if (sys->frameHeigth < h264->height) ++ goto error; + } + + inputSample->lpVtbl->Release(inputSample); +diff --git a/libfreerdp/codec/h264_openh264.c b/libfreerdp/codec/h264_openh264.c +index eb8c71310..f4a7e47f0 100644 +--- a/libfreerdp/codec/h264_openh264.c ++++ b/libfreerdp/codec/h264_openh264.c +@@ -177,6 +177,10 @@ static int openh264_decompress(H264_CONTEXT* WINPR_RESTRICT h264, + if (!pYUVData[0] || !pYUVData[1] || !pYUVData[2]) + return -2005; + ++ if (pSystemBuffer->iWidth < WINPR_ASSERTING_INT_CAST(int64_t, h264->width)) ++ return -2006; ++ if (pSystemBuffer->iHeight < WINPR_ASSERTING_INT_CAST(int64_t, h264->height)) ++ return -2007; + return 1; + } + diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index e014196f18..978f950d8d 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -14,6 +14,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-40254-1.patch \ file://CVE-2026-40254-2.patch \ file://CVE-2026-55191.patch \ + file://CVE-2026-55192.patch \ " From patchwork Wed Sep 9 08:31:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97708 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDAB1C79FBD for ; Wed, 9 Sep 2026 08:32:05 +0000 (UTC) Received: from mail-pg1-f182.google.com (mail-pg1-f182.google.com [209.85.215.182]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6996.1788942723188007658 for ; Wed, 09 Sep 2026 01:32:03 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=FjhSev2V; spf=pass (domain: gmail.com, ip: 209.85.215.182, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f182.google.com with SMTP id 41be03b00d2f7-cc1c3c90074so4734007a12.2 for ; Wed, 09 Sep 2026 01:32:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942722; x=1789547522; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4dit5OPoRQ3LL+UPnPe8XGrZtowectMh6HuOW+J/T+A=; b=FjhSev2VyaM6qO7+uSgTHc1kLowmS4RwO3eetrwepe2bdk6TfN5/YhdydkT0HqG6Eq Cy27piCsY69/tyM+Oe29AFMxhcwkzb5ABhcJPJBIV/IG+MeD04Oo09tXLEx1mDfIoS0f afvrVa+tm+IYLuH5M8NLUtSICESpMQU5OJq/eOjosOQqPMxs1UQUH4DzZekXWQ2+4kkp A/Sk9avWI9h7xciqFs1wTOgQ2B5d/XSs8D53ROHqfyi+408l9+A2BCyLcb7aM8s6/PFh v1WaBDy3yi4dC+5NV6Rb3rSoVriyzF5rCfr6y4/G552PV/DqarA9bPsshD/0Et2xFx0x BeZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942722; x=1789547522; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4dit5OPoRQ3LL+UPnPe8XGrZtowectMh6HuOW+J/T+A=; b=CLtih0J1OHFMaTbukM/tJu30oxlm8kwFvnR4xlESI9xRGSFnCeuUCxAMn+lidQuuzw 7jb2lLUnMDMadq7lVRjAWO+vIGVFSZV112T+q7h4BvmrV3OzRKOCireLz+dqA3eeESp8 9TH19u0/P9ug6yMdGE+17qm1TxD9vCrCQYgc/jRM4ZTnntZglEeaY0B45jBOLhHys09U LobO2EsQajQ8Bw2OmvfsEQ0vtxopmyWINtEan2nlnMmkeGWqH8RlOwW6CR4UxwggP7vC rFK9AvLHR70x7PrXtWdfqd9HaCl7ov+1DH8r/aZPYJ3NLRtuFEY8G4BwElTHUU6IITTj 3UMw== X-Gm-Message-State: AFuF++lO0b4A/eP+JWISGp1PdC0/Vco4MEUqEoW1iq/N95GGJQ0aV1l3 PvXnE8W3+9xW8xcyOgSJi1f4wGotalajJ8Hg9Xm7sEM19UlNm5AEmPY8UfdG/Q== X-Gm-Gg: AYBFou2Jbj8ylH1qNRpfBiaJp7/WjZoorQ3Jy7ZkOigeT3Wm3PpDUml4bk9CsfV5pll dEI7TbDL9B0g5esMTatPcUyNI4V4tlfAByI+kRDlltbr3y8aMy9xgsHcPoPrBM9fJqCc20yP4Ip 85CzNPvAJdo0hhoPuVcGkQcYpq3z/CIQhbeO3nWmc4dYn98+dCAOE1MKxs+DtJHB33VcUfR3N4u hvnWM9AxYUnwYoBmfB9b5myYnBL28NL6Ig4olnFDAKmLBuk3wps7yv/2KnLvkoT3WaqFtiLxN46 FWsMnPyboaOwOd+iagIsZVv60WnghSEmTIKrKGB+V5VeezfQE5NXcsXbwfqV85THp90VGjS3XZC XUqjYhQgwFXYjOSNPQ+x1owGLYNDYgpx7+HNBXOHXWC6gRi/cjM+anISS85ujelrQk85V6LQwvg RcHFsoh7Xlm+arvuFfbvNd0+7ZIvcz9OdbRQsFJ7DL5B0P+WhjBvbQbhLUvpYNeQYzfsNC0xX77 nVt0K1v8Iejlp2TYQMPeQI= X-Received: by 2002:a17:90b:39a7:b0:381:cef1:11ac with SMTP id 98e67ed59e1d1-39b26125efemr47069218a91.10.1788942722387; Wed, 09 Sep 2026 01:32:02 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:01 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 4/15] freerdp3: patch CVE-2026-55193 Date: Wed, 9 Sep 2026 20:31:29 +1200 Message-ID: <20260909083140.2494932-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:05 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129875 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-55193 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-55193.patch | 37 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch new file mode 100644 index 0000000000..5fbd142e49 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55193.patch @@ -0,0 +1,37 @@ +From b0b560b3c89e46107092cc8d1abe61ae4c4e7c4d Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:31:09 +0200 +Subject: [PATCH] [core,gateway] rpc header max fragment size checks + +(cherry picked from commit a863ef1cf1cdabf9019280e5658f806e73bb50e8) + +CVE: CVE-2026-55193 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/a863ef1cf1cdabf9019280e5658f806e73bb50e8] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/core/gateway/rpc_bind.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/libfreerdp/core/gateway/rpc_bind.c b/libfreerdp/core/gateway/rpc_bind.c +index cc670d14f..3a055eb50 100644 +--- a/libfreerdp/core/gateway/rpc_bind.c ++++ b/libfreerdp/core/gateway/rpc_bind.c +@@ -342,6 +342,17 @@ BOOL rpc_recv_bind_ack_pdu(rdpRpc* rpc, wStream* s) + WLog_DBG(TAG, header.common.ptype == PTYPE_BIND_ACK ? "Receiving BindAck PDU" + : "Receiving AlterContextResp PDU"); + ++ const UINT16 MAX_VALID_FRAG = 0x0FF8; ++ if ((header.bind_ack.max_xmit_frag > MAX_VALID_FRAG) || ++ (header.bind_ack.max_recv_frag > MAX_VALID_FRAG)) ++ { ++ WLog_ERR(TAG, ++ "bind_ack: invalid fragment size: max_xmit_frag=%" PRIu16 ++ ", max_recv_frag=%" PRIu16 ", maximum=%" PRIu16, ++ header.bind_ack.max_xmit_frag, header.bind_ack.max_recv_frag, MAX_VALID_FRAG); ++ goto fail; ++ } ++ + rpc->max_recv_frag = header.bind_ack.max_xmit_frag; + rpc->max_xmit_frag = header.bind_ack.max_recv_frag; + diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 978f950d8d..4248225379 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -15,6 +15,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-40254-2.patch \ file://CVE-2026-55191.patch \ file://CVE-2026-55192.patch \ + file://CVE-2026-55193.patch \ " From patchwork Wed Sep 9 08:31:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97710 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0731DC79FBD for ; Wed, 9 Sep 2026 08:32:16 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.6998.1788942726247350716 for ; Wed, 09 Sep 2026 01:32:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=X00nJYFZ; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-cc1cc97b84bso4330817a12.1 for ; Wed, 09 Sep 2026 01:32:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942726; x=1789547526; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lHPNaHW8s7ui+5CvLvKsEiOrbKa0nRIi0A5GlRFZasc=; b=X00nJYFZ4iFjXbWF8ug+SYFxD7VZq7HWfW95q7oZkYxFY7KQoxG9y1Kb0ldrHfa5Wt vIHNBiv/MjuuIwnrR+GzcLFo9JtCZLwJ5Z2lI/DnuE+eXg34BgC1Kw+eraRfTIs2YCfb D1xurxN+RA6jSxOXn/LHuZKMudA5ya8mcw25FG+X35oTBL7SoUjrmnFaQPsUccEM44WI NhjrfGajIxSbuSLxQYO9vwU0ErEmlpJnItMrvWHOlPA8kBgKT49LLioCjCznV6eW7xxB zF8sZtyESoCkd+xCCbWnW01YFHul6amxyTl5c7uQmaucraLDc62hEHPf06HhE11v6QKu MrWg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942726; x=1789547526; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=lHPNaHW8s7ui+5CvLvKsEiOrbKa0nRIi0A5GlRFZasc=; b=BbNVJeH0OaDm+UWdPvXhw45UbtCsH4l7NKb6y5D2QQWLHdGSkT/liRRYzMCDffLMkW meppCAbBBRzqgSWrA6SkZhZDkAy5eonpLiiwZkbP+wms905JJ3Mk+8Y5H90rbHl1vNih +xrytzkEwVTDpTcXzswPONXp/Mg5cFcEpK8HjTS/38/ZPI8xiQ9p1S1GX/pnnRvbUCKI 8+ghSsJFTgwjj+fglLGypsNe48kjznh09u6j+uQjh966/ECxPz7x1lyFVSgU53k62JEZ X7ZKXOdju/FF9qN8yK7yKveovISrCnoK6nBjfOmbO9FhjP/+n5eouRt0nPZOuaxQXtfw V81A== X-Gm-Message-State: AFuF++n4MFMfY19p2YIN6qjcFyB8zqp7UZVWXcfp/g/+me7O9TyqWIX8 dcpjnLGLEKiBKLODxHxruLhAEv3OFf+9Ht6OznGRJy9QNohLVOm8wKwbJAnrAZUe X-Gm-Gg: AYBFou2md7JR6c27n786QcI2JKkNtMi8Tvpzvp9XPKfhbrjS1PcpCndMWwWc4r/KrR0 1Wnj8GHREHHqwESdWdrfxdu2D9mBiB4WNnBpMggIyr+RGg6bn9/neNa4KDGLCr85AtnjWEP/sSN 9eOcpo9y4FGrez+MB8wBCDtiMwjAkZqUAkUfNb5o6QGVr2+XSI+kyiAIOt6IknabTnkPqg2hQOX atxkPyoW62QOe4kjrNZ0XPprwzYADWIPwuU4d1OvhzPAUmsGSigC9P8WUMkohqPUzoDnO3gfWnx xwCUlWjlBD1XJHyfb4narwgPPT7Uv+eKvspkIPGdX0kt/k8Vm73+anNVjhvPAiguOo2nNOFp5vC q8eXNqNmcSECuV9jpCCO7nGcAZPkH/dbWb+zVI4AcbNtG1wDODQm1J/bM4AAcHCs6H/ZrKqqC9R Xb+BZSt2OaYkVvvp4ePyddjrk/M3UJVLcjOCPui5tWUpHzZE0YxX+uQV1v8qxHKTgsRLkRsyzEr gG0KpYWhh8d0mfuUKAWECz3wYaOo/sS0g== X-Received: by 2002:a17:90b:4fc5:b0:398:9be6:f996 with SMTP id 98e67ed59e1d1-39b262cee58mr55183869a91.21.1788942725337; Wed, 09 Sep 2026 01:32:05 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:05 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 5/15] freerdp3: patch CVE-2026-55194 Date: Wed, 9 Sep 2026 20:31:30 +1200 Message-ID: <20260909083140.2494932-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129876 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-55194 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-55194.patch | 53 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch new file mode 100644 index 0000000000..da2733ccf0 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55194.patch @@ -0,0 +1,53 @@ +From 7e828b919a8394abd86a174c4943299618e128eb Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 11 Jun 2026 08:22:26 +0200 +Subject: [PATCH] [core,gateway] ensure buffer size for current write + +(cherry picked from commit 9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a) + +CVE: CVE-2026-55194 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/9f2da52c2341cc14a96ad12e69c5b83d0bcd8b5a] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/core/gateway/rpc_client.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/libfreerdp/core/gateway/rpc_client.c b/libfreerdp/core/gateway/rpc_client.c +index 27f3614f1..59e5781f4 100644 +--- a/libfreerdp/core/gateway/rpc_client.c ++++ b/libfreerdp/core/gateway/rpc_client.c +@@ -372,7 +372,6 @@ static int rpc_client_recv_pdu(rdpRpc* rpc, RPC_PDU* pdu) + static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment) + { + int rc = -1; +- RPC_PDU* pdu = nullptr; + size_t StubOffset = 0; + size_t StubLength = 0; + RpcClientCall* call = nullptr; +@@ -382,7 +381,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment) + WINPR_ASSERT(rpc->client); + WINPR_ASSERT(fragment); + +- pdu = rpc->client->pdu; ++ RPC_PDU* pdu = rpc->client->pdu; + WINPR_ASSERT(pdu); + + Stream_SealLength(fragment); +@@ -464,7 +463,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment) + { + const rpcconn_response_hdr_t* response = + (const rpcconn_response_hdr_t*)&header.response; +- if (!Stream_EnsureCapacity(pdu->s, response->alloc_hint)) ++ if (!Stream_EnsureRemainingCapacity(pdu->s, StubLength)) + goto fail; + + if (Stream_Length(fragment) < StubOffset + StubLength) +@@ -472,6 +471,7 @@ static int rpc_client_recv_fragment(rdpRpc* rpc, wStream* fragment) + + if (!Stream_SetPosition(fragment, StubOffset)) + goto fail; ++ + Stream_Write(pdu->s, Stream_ConstPointer(fragment), StubLength); + rpc->StubFragCount++; + diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 4248225379..eefc9ab5d3 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -16,6 +16,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55191.patch \ file://CVE-2026-55192.patch \ file://CVE-2026-55193.patch \ + file://CVE-2026-55194.patch \ " From patchwork Wed Sep 9 08:31:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97711 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7332C79F8C for ; Wed, 9 Sep 2026 08:32:15 +0000 (UTC) Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7112.1788942728987085705 for ; Wed, 09 Sep 2026 01:32:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=PC9JUQoo; spf=pass (domain: gmail.com, ip: 209.85.214.179, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2d032846c95so65054415ad.1 for ; Wed, 09 Sep 2026 01:32:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942728; x=1789547528; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2e3uYQzerlruaGH8fBw6v4MmgJsqXi3+y9BSJRqaFpc=; b=PC9JUQoomse06rb/vBsLJGCd4l13fL/Pi522iFGApRJEWtb+Y8OAImJE1bxnfJdn2K SoXg8WASEoHEFmJqCFmhYvIoFRjynp+9Us7VcCNrA841wugtVvKuG7oBRMBIxtuwDmQC 3wWpyiT7RWtQ7nU9R8CyXr9XPrLfWHPJHVzPYojhK3M6nfT7YlWqxapo63lw3vJW6qmR C7XZoKFTi+H8H/Phldv5UzODFYwLyIQ9Zqbcx7RdH9oT5K1RLofUmcJbsxKT2PfMhmhf r7E85Z3D4X4Tbi31AonALfPJr2PadbGUyTUp/1d2o0fCxdB8+/LqAtiQ31wMMVrCsJyu 2xzw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942728; x=1789547528; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=2e3uYQzerlruaGH8fBw6v4MmgJsqXi3+y9BSJRqaFpc=; b=d5pOwmhDLNyOypmhSRvNliyEFFRv91OvDiGYgqPHg996w8Fp9muGday05wMdjmv+Pn K21hM7sKyVpa/rNu7cyt7+3VzxXptUEWKb7tLN7/a7kjXvlnx5toyxh2HCZcGueSysA7 E9glC/9+o9xrUeBsrCSOB5uTwEYjKSm6xj+bMNztl2KspC1D2ffVd0oKIIkzpXaGEIHQ ohrDJDSl7Rdsc/RccqDwXtwTgkrgtjfv85TP59OwdR7NHRa+EN7yvRWi8Ic/UabNuIAx XKevAF1wnyZL2OqUITwQ7c3aykOTubUVMjgblKCOMwAHu/xmBDC5NJy5wxZS+gPfwJ+a XmKg== X-Gm-Message-State: AFuF++k1dHOu36OUvvhzHKS99tKi0X7CUTtjZD7wA5Yv/6UWFJDq7yj9 Slxsku9p/gURpbFniHYtfew9WzBq+fxfczkhd7FNnEHL/Bd+FrIDeZZCyrgORg== X-Gm-Gg: AYBFou2EPQtvlwFMLGKzJCG7OGYYptxA9ClkLAwlxbgvNZeCUunolITi5pkBM5EIUIR ZJHaHXZwqN2+vslEYyTbFzh/ZLbMGNjr1Kxxy/KUZpQKnF56tdHb8nmP6HOGAwPGsf87rE9DLLN cH4Af+OVLx70GIhaXtXByBkBgcHRo2BDB6wKM2rQHHiuIhfXCLALSpA5zhMhGVoedfJUcghgFJP 6cHKOkgIEwQcFTKmEJuyVHH1+Qp9RqY7meUAu2TieMIm+hDpi+L/7n7G+p5FuhomxMrDbYFVoI8 6M9pPVvwC2edJldKUYmpLiBnb74kESVURUQ0n67LG0JxEWcKKleANiI5lJt+94G65yupd6WffXR +CAvvgGk/jYepvnjUSu3ELbthmNxcKfS9j8eP8EiRQxq7HwEQnCyzBMQUP2EfxLYruLhoieXfgl HlqNoJjkF9F+xMXORrolN223VJfEu8s5wTA1VyoNBulZ7dYCXA2h5bY4PlNlPe1xEv4kNP2s/ud Rp7uZUieI7lGsyIcEXUrU4= X-Received: by 2002:a17:90b:3b8c:b0:398:9bd4:d13 with SMTP id 98e67ed59e1d1-39b26242a75mr46848253a91.18.1788942728172; Wed, 09 Sep 2026 01:32:08 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:07 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 6/15] freerdp3: patch CVE-2026-55564 Date: Wed, 9 Sep 2026 20:31:31 +1200 Message-ID: <20260909083140.2494932-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129877 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-55564 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-55564.patch | 28 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 29 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch new file mode 100644 index 0000000000..de3674b2c4 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55564.patch @@ -0,0 +1,28 @@ +From 8e1a14795ee8c3aec32c2a9d5b2c6bf00793c92f Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Sat, 13 Jun 2026 21:52:18 +0200 +Subject: [PATCH] [cache,glyph] tighten bounds checks + +(cherry picked from commit c29324750e3cbcba8761f147b7a5235cc686930f) + +CVE: CVE-2026-55564 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/c29324750e3cbcba8761f147b7a5235cc686930f] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/cache/glyph.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libfreerdp/cache/glyph.c b/libfreerdp/cache/glyph.c +index 374c6151f..8a0d7f64c 100644 +--- a/libfreerdp/cache/glyph.c ++++ b/libfreerdp/cache/glyph.c +@@ -565,7 +565,7 @@ rdpGlyph* glyph_cache_get(rdpGlyphCache* glyphCache, UINT32 id, UINT32 index) + } + + GLYPH_CACHE* cache = &glyphCache->glyphCache[id]; +- if (index > cache->number) ++ if (index >= cache->number) + { + WLog_ERR(TAG, "index %" PRIu32 " out of range for cache id: %" PRIu32 "", index, id); + return nullptr; diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index eefc9ab5d3..3e891f40d6 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -17,6 +17,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55192.patch \ file://CVE-2026-55193.patch \ file://CVE-2026-55194.patch \ + file://CVE-2026-55564.patch \ " From patchwork Wed Sep 9 08:31:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97712 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED634C79FB8 for ; Wed, 9 Sep 2026 08:32:15 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7000.1788942731839665490 for ; Wed, 09 Sep 2026 01:32:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=F4unEO5a; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3969e82ff8fso5884359a91.0 for ; Wed, 09 Sep 2026 01:32:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942731; x=1789547531; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GKLrWSvqf3a/yL9jG7KC0poyQLiKhFk17C9DrYwoSmQ=; b=F4unEO5ayR44iWEiNcyxOa2tZwcNUWS9XofOeOd3l2cr/c/N7UxgOd3RBamCYbW7cC KxUuTqZIEO+KExk5e3zv9tf6Wpyl2rsNvAt9WXxvEmR1X4WTvreFMmZeNDoZJ8GojOny pyas1FVyVF0NxbhYlJOND/QBIwdbNBjGA5Uhm4QPJg2Vz9+/Yimstg33zEmbl/Y0Ptis fIs8k1njJk3YHxAy6KynLDlFt1UrpNXiSNNth3mBj3PjyvYAszDaLRS/b+eHueDwU2MO 5XSThsPh1fFBr10wVp4mnk+4yfoFVInqJQk6gB11vP16nHGqkPkHqTdYZiD3uSF0i9kJ RdHg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942731; x=1789547531; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=GKLrWSvqf3a/yL9jG7KC0poyQLiKhFk17C9DrYwoSmQ=; b=YN+Hkv0FewTAWHLy2lyUzDucURcH8jWa76u/Cpt1zdsI0lJb1M4RIiiSsFScyWTVMN 32PMc96KGOzqMkbTn5c14oiccm6+He0EImLOYjBotssFgIsgrpQAMFhHITkBIdQy5XDg YNZY0r+pwrHFHd1i7FSlhY+glodw8Hzp5jA9MvCaywsa0IqhYjdF+k74Z1bte6CUblKm 6qekabk7zZqq7ORGEsUN4TwFjqKlWnXUjbiY2oJj+0c9kTDDWnABFhL+lwKLL27V+inO mxoKBbkCG2amMNWR3CPD7uKGa9FZDG9k8zeXjKlsxqSYlEgEB1w/i1zn+ITGDtPcCnoD 2/Sw== X-Gm-Message-State: AFuF++lUrjrZVbOKUrkkk9IuQZOVJO7GShEyEUoevSlrtRNAnMk0hAYo 2IVhsGah489zG6DO92CWckmgX1nnYv6UO9pf/XBN2eu2gNHaa5Ii0JDBWGHAUB67 X-Gm-Gg: AYBFou3tTpsb0mxmOdy2WTn1kZPclzbIzabcDN2NqHpJounJgHVfOZIoerQQBHg0b1Z +JHJHW8gpMCwI4FXgXsZFQT8+6BtTRMcwz00AuFJPX6DG1P9uRcrlikCJC2DcNA/Z8Mbqa6pzew nXudY2+2NzzXZddcVF9Hg1r/URAg+QbC4b92H7HbR8rSHDYhpb1xmZCF8LyvaRhcfIA855tKXXO PIWzeLu68bF8GPXmOOBNfoIjXdeHLPFReNRDPQOH9BkKrRfAAm0MEPTHXntbnadLY25iSkISjL4 lOXWraFnhD94fPk2NXlK5AqigBKerAGYsSMekFJl2vZwa5JV5QrCyO/3SyYrbHEof1tBOjdR/CX +77g6IJMOYgDcdoEOs/bCAKcTG5ai8LIzGageCtQtrsgsrMFCRnp0TPJWtkY1oSnM8gsrGMD/up CpWSdHd6PmWWo+qDU0YCS6AWasn3/Oqwf/yA5P/XGpe/HJ/qSlPOqptf9qKoQmd1ts3mKw3b7pD lMKYM+z6XxUEq54vLooHfQX54c2wJL7KA== X-Received: by 2002:a17:90a:d646:b0:398:9bd5:490d with SMTP id 98e67ed59e1d1-39b26214798mr55277183a91.20.1788942730918; Wed, 09 Sep 2026 01:32:10 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:10 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 7/15] freerdp3: patch CVE-2026-55648 Date: Wed, 9 Sep 2026 20:31:32 +1200 Message-ID: <20260909083140.2494932-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:15 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129878 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-55648 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-55648.patch | 28 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 29 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch new file mode 100644 index 0000000000..ed62b76a94 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-55648.patch @@ -0,0 +1,28 @@ +From dbe40963a661a501a227169690c0b3f413514b07 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Sat, 13 Jun 2026 12:14:26 +0200 +Subject: [PATCH] [codec,color] fix source bounds checks + +(cherry picked from commit e4ae473da2926724d9b6329778797a3bdea79eb3) + +CVE: CVE-2026-55648 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/e4ae473da2926724d9b6329778797a3bdea79eb3] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/codec/color.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libfreerdp/codec/color.c b/libfreerdp/codec/color.c +index 5271cf939..47ef77ab0 100644 +--- a/libfreerdp/codec/color.c ++++ b/libfreerdp/codec/color.c +@@ -451,7 +451,7 @@ BOOL freerdp_image_copy_from_icon_data(BYTE* WINPR_RESTRICT pDstData, UINT32 Dst + } + + /* Ensure we have enough source data bytes for image copy. */ +- if (cbBitsColor < nWidth * nHeight * FreeRDPGetBytesPerPixel(format)) ++ if (cbBitsColor / nHeight < FreeRDPGetBytesPerPixel(format) * nWidth) + { + WLog_ERR(TAG, + "cbBitsColor{%" PRIu32 "} < nWidth{%" PRIu32 "} * nHeight{%" PRIu32 diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 3e891f40d6..4ae18651d4 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -18,6 +18,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55193.patch \ file://CVE-2026-55194.patch \ file://CVE-2026-55564.patch \ + file://CVE-2026-55648.patch \ " From patchwork Wed Sep 9 08:31:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97713 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F11FC79FB9 for ; Wed, 9 Sep 2026 08:32:16 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7115.1788942734615752633 for ; Wed, 09 Sep 2026 01:32:14 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=pgpUp/DS; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-38ea87caafeso4755042a91.3 for ; Wed, 09 Sep 2026 01:32:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942734; x=1789547534; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=QVr+OLzK1GjeabwB8Iw8sniW+GAx8IDB6Doo2Tp5Gv0=; b=pgpUp/DS+pWE/y7l0uoEG2FE/3ANB9nAK6C8OUuNqmZTg5IwKprn+RIFCn9vBLPxvn k/Hltk+m3INxCLbdSY6AkBIJFiEzglGtdHd4Qe0wwrsVXf+NRRKGP2pqnvVl8JeyOVjg 9RIHhgmhyq/Nlz5Niu9hbcLZHcpBcxhgh7YvriSnSrFdIXU92nbzE2wal0N9NDqQ6NRX L80pe5BLhM+7wSxU/RRBB8XqA+2+UWWKixl7Fql9jhvcxgvNFk0VtooZ3V30ywLVfHeb dEpaVHxjmykbI+Ct0OwgUhVhAY6fgOhabwyaqg1grgMAytIVnSQcWjkIETOezJNr/nFi n5xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942734; x=1789547534; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=QVr+OLzK1GjeabwB8Iw8sniW+GAx8IDB6Doo2Tp5Gv0=; b=Fct9Dza0uun4TEkmKnAzv5XsZYS0gBvIu2Md4p0en2urGkefz9ff1Pbo8LIEWCVlP8 bzFV/l6KdE2fbWkPiFtnbuQEGvVpfQMeOFDQJ7/hKkVdWG6bnn5quMZ3fOhMiLR7FtXR tUkqb56DvLRFXPeO0xVwp2JztAZNEKcElGK+cYiLm3bpG5uVESWYk8SV7GAh1uX3dwsH 9dw9NZqtKUwqx4R11XNXG9pu3DMAeKbRBoGtDJN6Z3oQ1oLJlYv4M/Ir6HX8MVQxkOe7 xlbndR3DHm4PyjfVsishxINl/Sn+UvYqwXZyriM26iC9/66LVGbOyFJfdg5oY6tyTCvC vSKQ== X-Gm-Message-State: AFuF++mikJH6qVQkWj5dr/q8vu+ciV2Vow/eFXJFu0m9r4PzSJ5vuem0 YpbDJa96DFswoJgaIhh9JG9frKW30LWywTWKuxSSl3UVKNfK54KPgez1CVGebl96 X-Gm-Gg: AYBFou17HxU2w3vTw7WraD8Dg0IE+HvBb7WTYZNBreO0132KYqB+MN2zvG/ZET3pW9q UR2qAWHYbWupH2NE1OfZApcaHVBYuDel5qQxlnoEi5GRjPbt1vHU7053qG5fOw0IKn3fQnyk2IG 40skl9gkJVe/j6HVDwUWsVqqxcycrMLXcn//HY6pfuIHi74X5+SanaMtLWpAxh1+pop53v53/ti cnMoc2onPmBf3zu5DJ9KLaF+RjnW+g9xfF9I0xfonJ1L4WhcPpJntNOzHzDo6//yaW1qBfpShc7 tMd0PwO6j7lty6Hst6A+IQ3+gnLgzfcB7+LtIyXOPL4ELaUlb2R5CdNyYtAM7JfQvh4IR73T26x shwbV3E3r/LQ6YPD02Q7SCAVN6ofxHK5faau/3Jmhm8f8Cyb9XYgW6fVUOBCALerWup1yqKiIMr 1esTZqVHZMvSdccaiPutr+lX3DMpw4cixOOo5rJRfbMw4VTVOITpRyBFWJh3QO16BxE0E1VXh5k SxIfiScW8IR9i7a9dSTP8JQm8rTsd71yC7X X-Received: by 2002:a17:90b:2d07:b0:398:ceed:6d44 with SMTP id 98e67ed59e1d1-39b262abd26mr49985497a91.25.1788942733788; Wed, 09 Sep 2026 01:32:13 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.11 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:13 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 8/15] freerdp3: patch CVE-2026-63633 Date: Wed, 9 Sep 2026 20:31:33 +1200 Message-ID: <20260909083140.2494932-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:16 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129879 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-63633 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-63633.patch | 28 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 29 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch new file mode 100644 index 0000000000..478df68d50 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63633.patch @@ -0,0 +1,28 @@ +From 926fef2224e60a3d6eed66198ebc3eb677d63194 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Wed, 1 Jul 2026 22:02:25 +0200 +Subject: [PATCH] [codec,dsp] fix opus buffer checks + +(cherry picked from commit 0ed1f95d36913581cf31124f94eb5843d4263eae) + +CVE: CVE-2026-63633 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/codec/dsp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/libfreerdp/codec/dsp.c b/libfreerdp/codec/dsp.c +index b0de39a4c..d07c02635 100644 +--- a/libfreerdp/codec/dsp.c ++++ b/libfreerdp/codec/dsp.c +@@ -680,7 +680,7 @@ static BOOL freerdp_dsp_decode_opus(FREERDP_DSP_CONTEXT* WINPR_RESTRICT context, + + /* Max packet duration is 120ms (5760 at 48KHz) */ + const size_t max_size = OPUS_MAX_FRAMES * context->common.format.nChannels * sizeof(int16_t); +- if (!Stream_EnsureRemainingCapacity(context->common.buffer, max_size)) ++ if (!Stream_EnsureRemainingCapacity(out, max_size)) + return FALSE; + + const opus_int32 frames = diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 4ae18651d4..054d90718e 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -19,6 +19,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55194.patch \ file://CVE-2026-55564.patch \ file://CVE-2026-55648.patch \ + file://CVE-2026-63633.patch \ " From patchwork Wed Sep 9 08:31:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97716 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52E37C79FBD for ; Wed, 9 Sep 2026 08:32:26 +0000 (UTC) Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7001.1788942737206226268 for ; Wed, 09 Sep 2026 01:32:17 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=YAUL7PfD; spf=pass (domain: gmail.com, ip: 209.85.214.181, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2db59f54ccfso18752915ad.2 for ; Wed, 09 Sep 2026 01:32:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942736; x=1789547536; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=j2oegmJAK+3jfsDFbRRXiNUX9wos2TX79uhaVAsMrIw=; b=YAUL7PfDHUBk7ejIwDDzZoPvV/fgSbiXCM76jQ/X6AQvK6lh6qSbeYL/rZ2WQM0gOa Gj/qPEYnqnO5YsLzjVbOH+K5ILezXBNC5nAigB87Og2QUCHmpnLe5aZ4xlShGlT9EPS+ lnZ2Ax5ezJaJ5MYWnivxbOIr7AMN1+Ovns2e4AA998sQXVlXrdZHMUngZI1oAiz8uF6b Jbi6Uo9YmlBRKSBoj/m801NqM4dgcVqLXIwT5vgWmPTHVPfE6pTunl8pOuTbIxWNABwo 5rWccEEYDBgJWZNJpWQOhrX+g7Ac8bAjpN2MNxykM/lhI5I7u9z5la2fXRKf6nRpftDz +aqQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942736; x=1789547536; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=j2oegmJAK+3jfsDFbRRXiNUX9wos2TX79uhaVAsMrIw=; b=h6pHwpPDezZ+DLTA0AbvAK8CkgC6KRzqbzq1X9Fd7ccJZGFsm3E/lERt1/Wuruk7Tt +BDulM1pxe0MBbwTS9m4HWgKopzFkUEA7za0yYfHxRLKQ3LRvdRtoHyVQI7TAqjYOP8u BL9dLkovOEwMie9FOLVTEz5XZeWAKGUmZ3/KzwBgbGygT/Cn7tDjZHV4RZ5l6hjso3bn FdiCYJwLSNUJYjGGrHS1tSFOSWaRwgI/SwRZIqeGCrRvkAfFQ8WMgdwnjX/FhEQCUCuq jvUeanmt2CB1dVPBqo6Ub5IQXZhavtfHiad6jiMomNGVURW+D22NtidZVim5mtTNBqQX 9cgw== X-Gm-Message-State: AFuF++kH+a/P8A1ffFDx+X4fbrNvgbDGuJv3WIoZqBZwkBEDW4T/sLki FhHlEnb/PIrqqIf2EovfbWZMkX2LAa46gsrfymusCYHesQ6J865hOvHU3XMJxygZ X-Gm-Gg: AYBFou2y3dGCe1f8n6SK4dsYT3qwSHeT1laMOOZwz1v4AwJnnc+86mZrV1KF2YFeLZN f+9GJmKvJkYObs+5tWjwdrPj5iYyEipa9/s5xEPIalYRF2aUrULKT95H7yizk7DV8wqjcbwW3Tj 7ClDlJTcaiJtS5LsUbiMnY+LGQ7fMymQejB2BLG2lnaD/lTYqWXBsSN73WaKkGbeJXpCtzEvQT/ hG0HimqYf+blYyAK7n3yP+p0p4c2PfngZ3OnJl2cWmj3MXu2Pxp1v+Yngj/ynejSL8qTH9qlCzT U450KDshUWwRP+NP5fW2NqJF7cS7HsBQAOn8GUrWxWkOkEkSsYTXgfQ6cY6WsHjqWYY2S3I9XTg xyN8aNOmR3px+Sz7xQsiJthuN3lNorVxD/pLz4gau96IglupZLoG9S9zyEtPx6lzXuUuzTgPAgb NCYaEDTMqerYUNUPrvkxq7dyEQNExZkRMRrnHggu+vh5e1B+h+AP757A3cHz5mf8utmedWwXeru it3gMoZfwTIIORuSSBcmx0= X-Received: by 2002:a17:90b:2784:b0:395:4de5:1054 with SMTP id 98e67ed59e1d1-39b26272bdcmr56961856a91.16.1788942736502; Wed, 09 Sep 2026 01:32:16 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:16 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 9/15] freerdp3: patch CVE-2026-63652 Date: Wed, 9 Sep 2026 20:31:34 +1200 Message-ID: <20260909083140.2494932-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129880 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-63652 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-63652.patch | 53 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch new file mode 100644 index 0000000000..2e77b09d5e --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-63652.patch @@ -0,0 +1,53 @@ +From d814e663432dcc8fb485ac91f6106c950d003d9b Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 2 Jul 2026 08:02:29 +0200 +Subject: [PATCH] [channels,rdpsnd] fix free of + RdpsndServerContext::client_formats + +(cherry picked from commit caf653c0ba1c75ec8f298d1baa59770102a5d14c) + +CVE: CVE-2026-63652 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/caf653c0ba1c75ec8f298d1baa59770102a5d14c] + +Signed-off-by: Ankur Tyagi +--- + channels/rdpsnd/server/rdpsnd_main.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/channels/rdpsnd/server/rdpsnd_main.c b/channels/rdpsnd/server/rdpsnd_main.c +index 8322704ff..29778bb2f 100644 +--- a/channels/rdpsnd/server/rdpsnd_main.c ++++ b/channels/rdpsnd/server/rdpsnd_main.c +@@ -181,6 +181,14 @@ static UINT rdpsnd_server_recv_quality_mode(RdpsndServerContext* context, wStrea + return CHANNEL_RC_OK; + } + ++static void rdpsnd_server_client_format_free(RdpsndServerContext* context) ++{ ++ WINPR_ASSERT(context); ++ free(context->client_formats); ++ context->client_formats = nullptr; ++ context->num_client_formats = 0; ++} ++ + /** + * Read Client Audio Formats and Version PDU (2.2.2.2) + * +@@ -260,7 +268,7 @@ static UINT rdpsnd_server_recv_formats(RdpsndServerContext* context, wStream* s) + + return CHANNEL_RC_OK; + out_free: +- free(context->client_formats); ++ rdpsnd_server_client_format_free(context); + return error; + } + +@@ -1140,7 +1148,7 @@ void rdpsnd_server_context_free(RdpsndServerContext* context) + } + + free(context->server_formats); +- free(context->client_formats); ++ rdpsnd_server_client_format_free(context); + free(context->priv); + free(context); + } diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 054d90718e..86999ffe94 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -20,6 +20,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55564.patch \ file://CVE-2026-55648.patch \ file://CVE-2026-63633.patch \ + file://CVE-2026-63652.patch \ " From patchwork Wed Sep 9 08:31:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97714 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14D86C79FB9 for ; Wed, 9 Sep 2026 08:32:26 +0000 (UTC) Received: from mail-pg1-f175.google.com (mail-pg1-f175.google.com [209.85.215.175]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7002.1788942740140842546 for ; Wed, 09 Sep 2026 01:32:20 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=KIxuiTMn; spf=pass (domain: gmail.com, ip: 209.85.215.175, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f175.google.com with SMTP id 41be03b00d2f7-cc1cf287ef8so4513138a12.3 for ; Wed, 09 Sep 2026 01:32:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942739; x=1789547539; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WhFC/KuQeyNYphQFfcWWvnzg7MLCbxVnxmQne32r6tI=; b=KIxuiTMn6tSe6nnkOpEV1YvfrL8Nr0G/xBS8lTnHGh4mbogNHqnDzV34LNJ0WwFFNz Zy+izRN8aJa3pLvnxWeRTpp+GJF+gDV4UDTuibBe/Hi+083XVfy7nyXzzxtdp0+clLy5 Xkql/CopLHiqpvJX//OSdzj09G5W2VZi0hRkw6uHUR69eTbGChbLkqtyyk6LjuDx//Lf kUQkxTS+vzFHLSZyWAV/RogFagOe59nA4fKrf18+rt7Iic2jqsQ485IMi4uwLrbPQ2uP mo1nCYsnYpov+kO8gOHnNKF8aZ9l0WXPhs3efTmSd3DhwnWaF40/+pWeN1d74zzlt2LG +afg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942739; x=1789547539; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=WhFC/KuQeyNYphQFfcWWvnzg7MLCbxVnxmQne32r6tI=; b=lbXiB3raCzQvVioCDIEB3Di0PCaE5lit6FZ8Pbo5itCmRuDP71m9k72qTlgAJ6JAua 4PhcGAMcNmoT/6mrbHOGMZZTrMtTn/m/u7WBW63h2esq6TPIBuMek3WqTI0geQef6zVe y1sP1+klTC6GMF4VSc54LdVOVKR2N+bjELFQuwFMErOSpkH45B6mnkwLthdyBGp/ORhr FCVvfC+gakaO5cDDoRPLPl20XnDxJn96JD8vIvy1C+OUV5yezPQ8jdG5D2aq+P/V0qyJ gDauN6mz10sRv8zY/ebGGkHFsEQMyCv0i5YFPPZ3N+RsRK46EoKb0L8qWzHtJuW4cs+Y hIZQ== X-Gm-Message-State: AFuF++k2XjoKZd1bSVLurynCckPENRJ14uonywyidq0X1F+fn9NJv54b V6g76kTocmYr0Vcg7BuKgLTPazeaSMbJP/YOrZQG8/8SnnzD3v/fdl4o6GzXfw== X-Gm-Gg: AYBFou2G/Ew5eiUnrFnoIYx9DfMxJE2DxcVAdkLDI2T0gQSbFb+i+HAfNIFUfnOOeme vQorZlksDzt8zM+PPgQMLf1bNuFE7UMjYbcgeFfqg/icikSoAV+QpeWA+4KAnT+dZV8c9hhXJUC YdAIwiwsS5pTaSXrCJISIjmzAf2vY2V0SMllTHnZWV7N18aDDzqJntyV4Os3uSlPSxbcbQXXEAt hXGisl89IemSjxyhWnTgE0NWfU52cvCMzj7kcS1Wmd7VDHJE9O+dd6jbyp2qZV4ZB6w58xXw9Wd dLqocbfl7SIZxJSHcVE846lF/SAeHO0EiwQYVwI/N3ZyBcuc7lAd3C8fnInPIEbvU/yZGVEaDya T0WXb+XKbht4THsIJU+nvQ56kDcusamm08DLwAhXuLf9dyRJ2aymB97Oy4aeEX8pUKB8m1UdLOa 477MUibi5XdGNkNVrAWEbi6SdBKxF2xHWNDM8N4mjWhTpLSIIxLiBj90OREMYEYAwmBeYx/oJ7P LW8RMLaJgpvHgygHRHBIUs= X-Received: by 2002:a17:90b:538c:b0:38e:b400:a860 with SMTP id 98e67ed59e1d1-39b26204a3emr52975792a91.13.1788942739410; Wed, 09 Sep 2026 01:32:19 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:18 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 10/15] freerdp3: patch CVE-2026-64620 Date: Wed, 9 Sep 2026 20:31:35 +1200 Message-ID: <20260909083140.2494932-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129881 From: Ankur Tyagi Backport commit matching GitHub advisory[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-64620 [1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjqx-v446-x7fc Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-64620.patch | 37 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch new file mode 100644 index 0000000000..e154a92499 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64620.patch @@ -0,0 +1,37 @@ +From c04d10f9586ce92d7a7a3307744e16d554e20cfd Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 2 Jul 2026 08:02:26 +0200 +Subject: [PATCH] [crypto] fix out buffer check + +(cherry picked from commit 27014741a8c22a34d3040c559c82f4ed82841bef) + +CVE: CVE-2026-64620 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/27014741a8c22a34d3040c559c82f4ed82841bef] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/crypto/crypto.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/libfreerdp/crypto/crypto.c b/libfreerdp/crypto/crypto.c +index 3d210f2d9..60f7c6cee 100644 +--- a/libfreerdp/crypto/crypto.c ++++ b/libfreerdp/crypto/crypto.c +@@ -103,11 +103,14 @@ static SSIZE_T crypto_rsa_common(const BYTE* input, size_t length, UINT32 key_le + goto fail; + if (BN_mod_exp(y, x, exp, mod, ctx) != 1) + goto fail; +- output_length = BN_bn2bin(y, output); ++ { ++ const int len = BN_num_bytes(y); ++ if ((len < 0) || (WINPR_ASSERTING_INT_CAST(size_t, len) > out_length)) ++ goto fail; ++ output_length = BN_bn2bin(y, output); ++ } + if (output_length < 0) + goto fail; +- if (WINPR_ASSERTING_INT_CAST(size_t, output_length) > out_length) +- goto fail; + crypto_reverse(output, WINPR_ASSERTING_INT_CAST(size_t, output_length)); + + if ((size_t)output_length < key_length) diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 86999ffe94..a577916bef 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -21,6 +21,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-55648.patch \ file://CVE-2026-63633.patch \ file://CVE-2026-63652.patch \ + file://CVE-2026-64620.patch \ " From patchwork Wed Sep 9 08:31:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97715 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E722C79F8C for ; Wed, 9 Sep 2026 08:32:26 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7004.1788942742993911573 for ; Wed, 09 Sep 2026 01:32:23 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=LyEmUrp8; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3964dfb5b9aso6713836a91.1 for ; Wed, 09 Sep 2026 01:32:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942742; x=1789547542; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EH62pqO34Cl+szUaf0tM8cDFGRW/UrNQqlLNpmb5z+k=; b=LyEmUrp8xWZb0pm5Siqf5mcVk436cQDhX/qFtwaTrMIow9cHw9qGALA+9bcW+xanTr DDEYxySHp4nD63gTH4w95Rzbyi86rAGNhWvCRkOCXAZjNjM33BElOKcibHjFyCZ0M3e3 Yyxr5WioILPG2EVoaSMGZ0P2biNLNXNZbL/WOHCz10dCkNVRphCII/y4yEHnvCURaOMG Yr1ZyrCgnjcov0kG7KPu1txyGS6wmxyYKFi3tdWSRb0X2qdAl36h0a94OJRhZ5w1BZ1V oAgeVV9aB7uHI8/eT9j5Oj1kNizwKCuKVRHOniMcTigcuMVM+kWRMXgVPjW7yOS/Y5ph LiEQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942742; x=1789547542; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=EH62pqO34Cl+szUaf0tM8cDFGRW/UrNQqlLNpmb5z+k=; b=SF7tqfTpJ62aqw5S/xxRyqSKu3/gTUWI5/mvDh8V1UuP5HnxiHORaz11wbsvi5oVxB LPWTS5i6YyOeUN8W+AT5gaYCxoeZOWcG07Gwk7vPot8QhjoJ91bat8BnpQuP4ztlRlkK 94TRKGkBsPkc/SFwTm0SfVmBsoD2ydl+u8TulNfByGyNe+QTzu28DcTqi8WCpbvBhHSf MPm+E2wqddzlAxCvxG60LJ+lytNBn+YftGZiBeA6OZ5Jon5XsnWa+4cgivGeHqpJToCT 6OxHztTVPZZPtMU0XlGLlrTNIgLmQdWZ0lS7t7nO70TSP/DJOCuR9UK3VG1G9Lpe6ewy BWAQ== X-Gm-Message-State: AFuF++lB1ZiuSQwXHyk8WAyHtowp8KlgNMOsank2ARNe9B56KL/axj3y 5Vjao78FCSMtZ1BcsZ3eoQCDvU0hVtPaLpnhZ4zVGw8sIaLhpJwoPl6pAvDpbhi0 X-Gm-Gg: AYBFou3811WgAeWp4VIL6fiDd/YwrCxLiUCBYJPnQ2EjSc7LChzxB/sHm9Ly1kC+clS rysOSPUgMOQA1sy4Y9hThFZHxZjICoS4fLHKyuRycdFsDQQuUYDZDy/+g9obJ0D+qYZQf55bwLZ cErKnQaPSCJh0646u3rKO4Ppn6wUi4aSCshr3dhCWZqoZws4PvoYyAzrFRQKW0IMJZOl+h9eoX/ eo2evTrgKS8kQTDocUnYPPbnKCK4NNlpqw4nbktwJAo2Cu4Lw5ls1cpvX17QFkuW6VUy/jcKYcO PGJKysTUI7F6BXy6DBoRusgxPqvIgEm0gxjEiS9tMTrhqydWaCPgljwPb/w8XjeY9KZCEQeYRlm LJwNfY1kxB30IqlqZLVnGIMt2l9df5GYFL7eLlVrUQ206fj4ryOMitT1v4RF6RVUwDaW2gKEUpj F/TAv92TdUUdeX3vI3OcyU2lB+fOvVlRGohweobcOqEZUi4YMJJwwRffiY18eFFq0vDpgUlkHGc mN5Xz8bi+GYKL/ee5MS9VeLKJdBuj6UTg== X-Received: by 2002:a17:90a:d64e:b0:38e:2517:5d1f with SMTP id 98e67ed59e1d1-39b2612eb54mr50584465a91.9.1788942742268; Wed, 09 Sep 2026 01:32:22 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:21 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 11/15] freerdp3: patch CVE-2026-64621 Date: Wed, 9 Sep 2026 20:31:36 +1200 Message-ID: <20260909083140.2494932-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129882 From: Ankur Tyagi Backport commit matching GitHub advisory[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-64621 [1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-f27x-frr8-j9hc Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-64621.patch | 27 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 28 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch new file mode 100644 index 0000000000..4fbc7abf4c --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-64621.patch @@ -0,0 +1,27 @@ +From b33dbe41020a6227ad3e89285c27e25e3f8617e9 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Wed, 1 Jul 2026 23:03:29 +0200 +Subject: [PATCH] [client,common] fix double free + +(cherry picked from commit 7696267929ae8ba045c1bbe275b3915653828313) + +CVE: CVE-2026-64621 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/7696267929ae8ba045c1bbe275b3915653828313] + +Signed-off-by: Ankur Tyagi +--- + client/common/file.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/client/common/file.c b/client/common/file.c +index 9fe207731..1ddf9f0ae 100644 +--- a/client/common/file.c ++++ b/client/common/file.c +@@ -2533,7 +2533,6 @@ BOOL freerdp_client_populate_settings_from_rdp_file_unchecked(const rdpFile* fil + if ((val >= UINT32_MAX) && (errno != 0)) + { + CommandLineParserFree(ptr); +- free(list); + return FALSE; + } + list[x] = (UINT32)val; diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index a577916bef..493fa94c4c 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -22,6 +22,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-63633.patch \ file://CVE-2026-63652.patch \ file://CVE-2026-64620.patch \ + file://CVE-2026-64621.patch \ " From patchwork Wed Sep 9 08:31:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97717 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EAB0C79FB8 for ; Wed, 9 Sep 2026 08:32:26 +0000 (UTC) Received: from mail-pz2-f12.google.com (mail-pz2-f12.google.com [74.125.228.12]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7117.1788942745790814258 for ; Wed, 09 Sep 2026 01:32:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=EHpnIglh; spf=pass (domain: gmail.com, ip: 74.125.228.12, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pz2-f12.google.com with SMTP id 41be03b00d2f7-cc1cebcb8d7so553320a12.0 for ; Wed, 09 Sep 2026 01:32:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942745; x=1789547545; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=b5eQs/cJU6umPsOYJkpRIBNMDQxqxysnOnR/ttBPP/c=; b=EHpnIglhnGn2vRAKlS256R8vbGExi3AzubdvBB0Yh0ieXFDAMogE/pUzTo3L0sqWzW E1yD8P/Gra80rJ2NiAVYpsP/apJzb9fybbg9cHuoLQsgC0urZerw9M9/3Nvh1CQXXBJl KkCGR+CdO9Fj6ILV3Qw7q6hHqoTT1VvwYhqRiQBL2VUBiTn4M3AjpXFVLtjahGfeX3tm H/OQgC3hlFSJfLO1AtyDi8ZAkv897zHoH6HQouPw7jfvBpoI0QJxnvb4Aw1O3FUtj4Ui KUm7ce07ciu3qfStUhBR1l66C+JhlCEMmPjkRoSmE3kdpDx6Hrto+5pGdKG9sS2jbdE4 kHnw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942745; x=1789547545; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=b5eQs/cJU6umPsOYJkpRIBNMDQxqxysnOnR/ttBPP/c=; b=RCLH+G/ZYR+37R1IbkbV4k/20PU4mz68U1Lo6380CNQPpS+9KQI94eYz9uomKgCff0 qKyB3WJfdhIzuD2VLAwQFWZy6/gw26+EOsmo3YRO2g6Moim6T5gUa0AFUt070mZm1UXc 6Q37htFekqOr/eMLadDi995aE0kBXWyNx6WynnkOPDWRDxunbiASuG+dRiIhCsFz+0F2 HdqxFcHvfRvDLqs/dN7Ln7HAV32QiREclvGae3mnxaO25g6ihv6qglGYzSJ9Qx7OHfA1 moo4ytt4qTEQryEVG+1mImfVvqnj7vT3KQ1n/DQNqSPt5zyfSRcCF585//DTswfdTF7E MiaQ== X-Gm-Message-State: AFuF++lUd7R1BmkOJsYkqqoNMOtyay1iq/Acah/HDG6wIUr9tUBN+bZQ 1q5TBM86nBnqxxuG3p5zJQor07k/MSbNy8ik5OqdEO1OX+vhw+vh9h2C9dZyE7A0 X-Gm-Gg: AYBFou2CVqUcVNeu3X/rhI1dJPIP2uPdjQ29TSclKEjQ3EvA3wtLO5azHUKR6E6CDS7 IiGM99RtotWJrf6I1BrkQxNTr5BUTvx3PWPXFYe3zrQgBie8NnHCil0z3lasadR22qW31ynUQOs 6aw/ZFrPSondmiQNxFsU0JJF7Q1DjOEfPXEZ7gRhDLSIc7SVveVI7LO47q2TJEyTbEeaf1Gpt+f 1NZnwNi6QcKwTke62uvmkMB21VNvy9QwZdwvMsxK+N78cb4hoFxBdGB2cYTCGoAOQCHgSwNsPF0 0Xa38vzwDLUocH95i88tOcOcoekcsFliG663LE7P2LupG8LrHayfNT1fwSauSSA/gdlSJTb775b beWgt7vr2t3KfhQ0DbKZgxgD8W/aVzSRQktrKvcWf9LixJEWMxG4P//Yyn3gp9wb073s5ZNkcDw 3QOCk6fwKM/8hk8mWPzP/IcIxfqdfjouPd+5BM5dgJpVHp6qTl4k5l5M9HEJ5hLTKx8YXw7PKMb xTK0+BG8sVQbRfBUx6Emj0= X-Received: by 2002:a17:90b:5743:b0:38e:c232:9d2c with SMTP id 98e67ed59e1d1-39b8bc9422emr8683507a91.2.1788942744990; Wed, 09 Sep 2026 01:32:24 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:24 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 12/15] freerdp3: patch CVE-2026-66401 Date: Wed, 9 Sep 2026 20:31:37 +1200 Message-ID: <20260909083140.2494932-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:26 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129883 From: Ankur Tyagi Backport commit matching GitHub advisory[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-66401 [1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jj2-67pg-j6mg Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-66401.patch | 86 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 87 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch new file mode 100644 index 0000000000..480db4836c --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-66401.patch @@ -0,0 +1,86 @@ +From 60d0c34ad36ea163b5937d1c9ce657d23dac0f1e Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Sun, 12 Jul 2026 11:45:50 +0200 +Subject: [PATCH] [channels,rdpecam] fix reading of config descriptor + +(cherry picked from commit 1d35ecb77e2469cbc29da14c180777eb514d70cd) + +CVE: CVE-2026-66401 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/1d35ecb77e2469cbc29da14c180777eb514d70cd] + +Signed-off-by: Ankur Tyagi +--- + channels/rdpecam/client/v4l/uvc_h264.c | 49 +++++++++++++++++--------- + 1 file changed, 33 insertions(+), 16 deletions(-) + +diff --git a/channels/rdpecam/client/v4l/uvc_h264.c b/channels/rdpecam/client/v4l/uvc_h264.c +index 30f0cf4b4..a3c716478 100644 +--- a/channels/rdpecam/client/v4l/uvc_h264.c ++++ b/channels/rdpecam/client/v4l/uvc_h264.c +@@ -23,6 +23,8 @@ + * limitations under the License. + */ + ++#include ++ + #include + + #include +@@ -347,26 +349,41 @@ static uint8_t get_guid_unit_id_from_config_descriptor(struct libusb_config_desc + if (interface->bInterfaceClass != LIBUSB_CLASS_VIDEO || + interface->bInterfaceSubClass != USB_VIDEO_CONTROL) + continue; ++ if (interface->extra_length < 0) ++ continue; + +- const uint8_t* ptr = interface->extra; +- while (ptr < interface->extra + interface->extra_length) ++ size_t offset = 0; ++ const size_t extraLen = WINPR_ASSERTING_INT_CAST(size_t, interface->extra_length); ++ while (offset < extraLen) + { +- const xu_descriptor* desc = (const xu_descriptor*)ptr; +- if (desc->bDescriptorType == USB_VIDEO_CONTROL_INTERFACE && +- desc->bDescriptorSubType == USB_VIDEO_CONTROL_XU_TYPE && +- memcmp(desc->guidExtensionCode, guid, 16) == 0) ++ const size_t remaining = extraLen - offset; ++ if (remaining < 3) ++ break; ++ const xu_descriptor* desc = (const xu_descriptor*)&interface->extra[offset]; ++ ++ WINPR_STATIC_ASSERT(sizeof(xu_descriptor) == 16 + 4); ++ const size_t bLength = WINPR_ASSERTING_INT_CAST(size_t, desc->bLength); ++ if ((desc->bLength <= 0) || (bLength > remaining)) ++ break; ++ ++ if ((desc->bDescriptorType == USB_VIDEO_CONTROL_INTERFACE) && ++ (desc->bDescriptorSubType == USB_VIDEO_CONTROL_XU_TYPE) && ++ (bLength >= sizeof(xu_descriptor))) + { +- int8_t unit_id = desc->bUnitID; +- +- WLog_DBG(TAG, +- "For camera %04" PRIx16 ":%04" PRIx16 +- " found UVCX H264 UnitID %" PRId8, +- ddesc->idVendor, ddesc->idProduct, unit_id); +- if (unit_id < 0) +- return 0; +- return WINPR_CXX_COMPAT_CAST(uint8_t, unit_id); ++ if (memcmp(desc->guidExtensionCode, guid, 16) == 0) ++ { ++ int8_t unit_id = desc->bUnitID; ++ ++ WLog_DBG(TAG, ++ "For camera %04" PRIx16 ":%04" PRIx16 ++ " found UVCX H264 UnitID %" PRId8, ++ ddesc->idVendor, ddesc->idProduct, unit_id); ++ if (unit_id < 0) ++ return 0; ++ return WINPR_CXX_COMPAT_CAST(uint8_t, unit_id); ++ } + } +- ptr += desc->bLength; ++ offset += bLength; + } + } + } diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 493fa94c4c..7051cbeacc 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -23,6 +23,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-63652.patch \ file://CVE-2026-64620.patch \ file://CVE-2026-64621.patch \ + file://CVE-2026-66401.patch \ " From patchwork Wed Sep 9 08:31:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97720 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 675D6C79FAD for ; Wed, 9 Sep 2026 08:32:36 +0000 (UTC) Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7005.1788942748712731685 for ; Wed, 09 Sep 2026 01:32:28 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=KN8j3mHk; spf=pass (domain: gmail.com, ip: 209.85.215.170, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-cc1bc88a20eso6313913a12.3 for ; Wed, 09 Sep 2026 01:32:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942748; x=1789547548; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fcFfUgE0TJ2kWhURQskt5hSX7L1EHQDPcpGaB85yJOI=; b=KN8j3mHkdQ/pJ/T0ECJvBcyuHG26atsZBJdAOFwyDBlNjRTQEzLOrZclRcmDMALqTU T9dU5cUdLdYTYJwPzQe05NOaBa7JLFbJnifcvTQx5sRe/sosbPzEHG568eBlK/rq91jc eEavjv3wIZv6YubVzoMkqUMfCcBWg4+bEemnCNG6ap2ow3j6txPxledWOA7k3V51uOE4 KWyzewS8lGCptL691h6hZQiwQyEeamT+oPHtY81/8+ZKXU8wlRQIVGDdQcF0q+mVUcLf uU3+pt3QOIJfki92NwjX9SzJt1L+H793lND8+wmfs+bpLxkUEl7YImVlIrs7B2sNGdb0 qCVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942748; x=1789547548; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=fcFfUgE0TJ2kWhURQskt5hSX7L1EHQDPcpGaB85yJOI=; b=EkGf9yj1K0txvxBCFSm9JgQF8pd9d4SWif7P+Glac5FFIlEMshF/JurrYPn4lvmFA2 aorP5v7bH5bq7iNOk38JrK4w4J0tIHSSDAVbMJpuFhlPc5LzPHR1IuQ4kv8uvg+I6mrf rROcPPZ1GC1ugg++RRc9AEz/AdOw5YHVhsmttpDXqaUQ2I8fluV9XBK8tcQ5xXV0NVy3 H1v+Slv3hFmWHS6LAN9X3wgfrTsDwTT/ip5xz5ykw4nrNE5IVqFsPfR4inKM0mU2R8B2 rtxuqMWyZrfo/aZKyN24E+wL0oEM+ky7d4+mG1ulMsUEqsY4dQzH+Y23AOT/MZEm4o4q mQ5Q== X-Gm-Message-State: AFuF++lxnGazFATQgR6S/xZUWjQv1h8K85sfuz1RXkYqFgsiD4gF69xr 6g0OwqWec4CBqFPDOfdHkJ9P+9YP1FEOzjuzsBf/RN8pJ7yDL9Gdg26M/PAOywc/ X-Gm-Gg: AYBFou1KNgxU6RE5xworySfb3e3FGZ9Isz1wcveT+PcBDmnuwhvp74vgraFbyri37+n Tlgg4YVhusUfXjnY2YDZ5flTji2IRYPL3Mz4a6xUkxYNIzkHnofuB2SLyqjmdos7xR08M0BnRVW C3hxmIaRAlljDzDZi/NyFL0JyplWt30OMj4nIf5rkOaxwFqunimmaX+JyegqOxMQ2fJyX6/mIQM R9CA2p+IDSSpieeiSQI3t7rZexqCzNzNTLkJlHX3d1+8e/I4G2tml3LzY63i5YKHwxnPnbUtzR7 ED62zJmyOAUt/RuNxDtH4zTviSYlO27Fxjetzu88h6/MxMfUh6w+wHFCYh/a3DsPcOUM4K8qAUV ZFPd0CaHVR9ghq0S2SKK3ZsKPY2sQp8dPHbAA1cbLZtvtGvqJHKGWGJ7/jqEBYwetYX00kVBraC KCE0oPcLJh1lim1on8grzDb/BOp/WKn2XhRRjmXd82muGUrxjwS1mm069hMJ9H5uOTJAzVa4Blv Si48hz+5T5OZ9EZQliMF4c= X-Received: by 2002:a17:90b:28cc:b0:36d:b424:4f17 with SMTP id 98e67ed59e1d1-39b260e13d5mr49977943a91.1.1788942748013; Wed, 09 Sep 2026 01:32:28 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:27 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][wrynose][PATCH 13/15] freerdp3: patch CVE-2026-67288 Date: Wed, 9 Sep 2026 20:31:38 +1200 Message-ID: <20260909083140.2494932-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129884 From: Ankur Tyagi Backport commit matching GitHub advisory[1] also identified by Debian[2] Details: https://nvd.nist.gov/vuln/detail/cve-2026-67288 [1]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-ph3q-f9w8-7jf3 [2]https://security-tracker.debian.org/tracker/CVE-2026-67288 Signed-off-by: Ankur Tyagi --- .../freerdp/freerdp3/CVE-2026-67288.patch | 69 +++++++++++++++++++ .../freerdp/freerdp3_3.24.2.bb | 1 + 2 files changed, 70 insertions(+) create mode 100644 meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch diff --git a/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch new file mode 100644 index 0000000000..9be89cf276 --- /dev/null +++ b/meta-oe/recipes-support/freerdp/freerdp3/CVE-2026-67288.patch @@ -0,0 +1,69 @@ +From 833cb82a82ff59d916c86ae1ac90b84bf8e86c47 Mon Sep 17 00:00:00 2001 +From: Armin Novak +Date: Thu, 9 Jul 2026 08:34:21 +0200 +Subject: [PATCH] [scard] handle nullptr for LookupName + +(cherry picked from commit efe40e15d508f9754b7a3af851de4d2a0b1128d8) + +CVE: CVE-2026-67288 +Upstream-Status: Backport [https://github.com/FreeRDP/FreeRDP/commit/efe40e15d508f9754b7a3af851de4d2a0b1128d8] + +Signed-off-by: Ankur Tyagi +--- + libfreerdp/emu/scard/smartcard_emulate.c | 7 ++++--- + winpr/libwinpr/smartcard/smartcard_pcsc.c | 9 +++++---- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/libfreerdp/emu/scard/smartcard_emulate.c b/libfreerdp/emu/scard/smartcard_emulate.c +index 0be4c4c5d..25e0ee179 100644 +--- a/libfreerdp/emu/scard/smartcard_emulate.c ++++ b/libfreerdp/emu/scard/smartcard_emulate.c +@@ -46,8 +46,8 @@ static size_t g_ReaderNameWLen = 0; + + static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName) + { +- WINPR_ASSERT(CardIdentifier); +- WINPR_ASSERT(LookupName); ++ if (!CardIdentifier || !LookupName) ++ return nullptr; + + size_t len = strlen(LookupName) + 34; + char* id = malloc(len); +@@ -2264,7 +2264,8 @@ LONG WINAPI Emulate_SCardReadCacheA(SmartcardEmulationContext* smartcard, SCARDC + WINPR_ASSERT(value); /* Must be valid after Emulate_SCardIsValidContext */ + + char* id = card_id_and_name_a(CardIdentifier, LookupName); +- data = HashTable_GetItemValue(value->cache, id); ++ if (id) ++ data = HashTable_GetItemValue(value->cache, id); + free(id); + + if (!data) +diff --git a/winpr/libwinpr/smartcard/smartcard_pcsc.c b/winpr/libwinpr/smartcard/smartcard_pcsc.c +index b5cf85e23..58bea94f1 100644 +--- a/winpr/libwinpr/smartcard/smartcard_pcsc.c ++++ b/winpr/libwinpr/smartcard/smartcard_pcsc.c +@@ -2951,8 +2951,8 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardDlgExtendedError(void) + WINPR_ATTR_NODISCARD + static char* card_id_and_name_a(const UUID* CardIdentifier, LPCSTR LookupName) + { +- WINPR_ASSERT(CardIdentifier); +- WINPR_ASSERT(LookupName); ++ if (!CardIdentifier || !LookupName) ++ return nullptr; + + size_t len = strlen(LookupName) + 34; + char* id = malloc(len); +@@ -2991,9 +2991,10 @@ WINPR_ATTR_NODISCARD static LONG WINAPI PCSC_SCardReadCacheA(SCARDCONTEXT hConte + return SCARD_E_INVALID_HANDLE; + + char* id = card_id_and_name_a(CardIdentifier, LookupName); +- +- data = HashTable_GetItemValue(ctx->cache, id); ++ if (id) ++ data = HashTable_GetItemValue(ctx->cache, id); + free(id); ++ + if (!data) + { + *DataLen = 0; diff --git a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb index 7051cbeacc..edd2fddf94 100644 --- a/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb +++ b/meta-oe/recipes-support/freerdp/freerdp3_3.24.2.bb @@ -24,6 +24,7 @@ SRC_URI = "git://github.com/FreeRDP/FreeRDP.git;nobranch=1;protocol=https;tag=${ file://CVE-2026-64620.patch \ file://CVE-2026-64621.patch \ file://CVE-2026-66401.patch \ + file://CVE-2026-67288.patch \ " From patchwork Wed Sep 9 08:31:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97719 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 516D5C79F8C for ; Wed, 9 Sep 2026 08:32:36 +0000 (UTC) Received: from mail-pg1-f180.google.com (mail-pg1-f180.google.com [209.85.215.180]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7118.1788942752011646609 for ; Wed, 09 Sep 2026 01:32:32 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=RdHNZzZw; spf=pass (domain: gmail.com, ip: 209.85.215.180, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f180.google.com with SMTP id 41be03b00d2f7-cc1c8d4a959so3835236a12.3 for ; Wed, 09 Sep 2026 01:32:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942751; x=1789547551; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=oeUq6rGjkHmk/kdFjYx4la3rb3PGg8YohLUcbEqTPRU=; b=RdHNZzZwQxKq19xGa6cFwFtfg5qovcHEOp8a7GgTs7ewLGs7JaqFQyHhhctN2xnQam NJTOc4+wceM+3KYeLAkyMNkL4Ksyka7xVozsmRBe6UH1idqJTRV+MMpMdGQmDkpcN8uo 06lxS9/SV7Ztogz333NqzAmb6pyYAqJpQdAJUcnqaYCRWwdzg7fB15ZBSlQLVF6jNM6B fv5OUrDOyO0swz2l6RikRsp4IBwvrcJmQJd3IEKEJMLlrNsDDBA0lp4cpIEB+t0ujsQr 1qp7IJnVdGhqFj0/h5YgyxQ/J0QFUtCU5tgr9fYjs2u00Q8JQ/6B37s6JlhdZ1y1cbna +qaw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942751; x=1789547551; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=oeUq6rGjkHmk/kdFjYx4la3rb3PGg8YohLUcbEqTPRU=; b=YGL8JYZqb/SH8PR9Yp5wTO44pCmutrXhYFkDWNNp7+8lywSZVtZsORa1/mrqrzN4B4 yRFQ94lMEr1uOjhvDPotihF/oExoZ4IF8ZHEkh46MrrZZLd38FiCoMNCSBo7ZgeBFJQX ElkumFVmTCaK1pkd1xvly1TCcZVEs0Sx4045u5GYMIAGn1zJSoPHHtyXs08M2630757B TNiXijor+GnJHKEIulWLV8WgOsx+atSYgLiwnDH2P6To8/S+KncNZU1NJ/Bce1fhxuuG qlR2T/xfOATRS4iaSyBK1R2tzzTN1z/MUZQsYTogv/U5unhWIo+2nf1YhxSehYx0ZXXZ d+kA== X-Gm-Message-State: AFuF++lhWBKDrBJS/CTk+tqtfpf3EziPaRWIx8lQPAQM58cRMZxf68Q4 DKRuaoAge30AfxKTSjmfFmkPIGugPGoAGELMrPKLC3wYAuiG9lchODN6r+y0kAlY X-Gm-Gg: AYBFou2THF05ialnpqrVXD/pryqQAlB1hGZYtiqgHUioXmk47ZMoPcFN89CE8NR5gnN m/FYfT6dkGUZbEr5SWQ+adoF+nBInLvAkA12cONlqRc1cR267SJFhFU73OU+BQp4oTbeguqjPrs gSK6D5P5OabsfkjMNuLa38mA0DfwcsO83UqvyY0lqti+IhGR9hjz3T4uE5N9mUZNmV0AwPsMauA 9wbBqZ3rbnV86lXUmKrE0a8iR+1hkLrJUpbNgCMrag5Rg7UfIGAVvEQIjCs/e6BVO1gKMV5GLUX IU/A6aC24TSpBo+e4tFiZU9jVHYqVRPU+Kq5husnJqEo7aTAC7Rq4ak/PRDCb/opl4Nt2UilP/U zKlwSxa6hHWLzVsy797sV/d9zTuTGpO0B0lmPshs2gz25YGhKwh7aoJz2o1Vs5QumUf35Aqmx/X 3q14IC59O1fCxvOoiRANKWXjkhZ2a7lBMeeQcKrl5lxep96m8Aos1W/okdEGs1h5wHwcTTt63/y iaX+CsNqtcAe0t3RG/NkTSmuV8e+zO0uw== X-Received: by 2002:a17:90b:1643:b0:380:21b7:e727 with SMTP id 98e67ed59e1d1-39b26272f04mr48861664a91.14.1788942750984; Wed, 09 Sep 2026 01:32:30 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:30 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][wrynose][PATCH 14/15] python3-gunicorn: mark CVE-2024-1135 patched Date: Wed, 9 Sep 2026 20:31:39 +1200 Message-ID: <20260909083140.2494932-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129885 From: Ankur Tyagi Debian[1] also identified the commit. Details: https://nvd.nist.gov/vuln/detail/cve-2024-1135 [1]https://security-tracker.debian.org/tracker/CVE-2024-1135 Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb b/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb index cf41feae70..90a903ea53 100644 --- a/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb +++ b/meta-python/recipes-devtools/python/python3-gunicorn_25.3.0.bb @@ -29,3 +29,5 @@ do_install_ptest() { } RDEPENDS:${PN} += "python3-setuptools python3-fcntl" + +CVE_STATUS[CVE-2024-1135] = "fixed-version: fixed since v22.0.0" From patchwork Wed Sep 9 08:31:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 97718 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5BA73C79FB9 for ; Wed, 9 Sep 2026 08:32:36 +0000 (UTC) Received: from mail-pl1-f178.google.com (mail-pl1-f178.google.com [209.85.214.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.7119.1788942754740506708 for ; Wed, 09 Sep 2026 01:32:34 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=nvoFt8XB; spf=pass (domain: gmail.com, ip: 209.85.214.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f178.google.com with SMTP id d9443c01a7336-2dcff8f44f2so5476575ad.1 for ; Wed, 09 Sep 2026 01:32:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788942754; x=1789547554; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=EJhHMu3WP5axg6wYuj8RUCpXRPX7Im5vhoWxE50p1ng=; b=nvoFt8XBClTSwhk8ArxO6dyGrBGCiHGQhf6vKS7X4Nvotie1hwVprGFeVZGOQLjWEo LLYa/XkrYN1PLgOBZd3+wp9TUXhFu75zRZVjuBhAbUlZTIkPHiTFbIDQZzKtaHdd5EIm JhFdWx7uiGBGdaxmoUMLoU8SitTGA+X3gmJefr7dB7G+52cBZlUoFo1O81v7xZvx3OPF j4wRWbpqg4kFuucWKuVv6ZotJAGS+ddUEjPqon1h7djo6Cr9I2uxx/dcimIJPnVbtLxl uEVjTLXhvupCbNWc2jeYoRGnbjirdOACPqb1aHyLoCfXjwhlvoc35vLuUTNdxp5A5qRy VpxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788942754; x=1789547554; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=EJhHMu3WP5axg6wYuj8RUCpXRPX7Im5vhoWxE50p1ng=; b=OyATYxvknhRRDeN+ht5LxSXuj3Ab4DggzvjV3OQVWGhgEFMVEDMwu4LhFHipcBMUCY xkwvOTa7nJoEsMeRytyGqEXXbcgQd5vvM/ooFZmqUggL5qbnoV2AMmK+7xn6dBSSYKvV 8MMxBSRAGGLOzLBDtOl0yfD14wFJvPf2J8DHj7VnJV7HW43L1hcvHWNzNhSC0vFzeBeS BJL9wmZaW/pHvlLJ/pso0b5pscj5dQjQkTDN8HiX4Pj0k261Zs1xcGjGCfo9F4h5H4+L QzaNbCtIkliV5msKbYhgsNPHnMFAg2qPlFcZGy576TYcP5/Ss4HaN+GU184FF6Mra60a l5RA== X-Gm-Message-State: AFuF++kIW1t2hDQK7USTlzDSKRP+nNZO0bKCZPMkOKY7yz8MQpGw3zlv xD5nMZhzrSK6MPMf2Z7iYBgUWoJg2aFjxlLEi3B5RtHeoC9hR9zJeRqpyVGbeZsM X-Gm-Gg: AYBFou0XcXg19RHEYMnWQlokySJUMtzGLgP2rOYZrPsD9oC4u5z+S1/fiH3PeK3ScVH Fy6SzSimVJ7ScGks86oYcvdGlTTzTdDtdRXMD0y+gb2ElIY9PwfH/OfxXsF2Yxc5ZeC2boPJ3ZD fjJeDU13g0t7x2tX7XyOJF3FGhLeBU4QCA5FBFGuIx8BkE2dujMlc15etLEUnBZVUUO6yxJiOHB R0apmgY81LfGjcmyZj1gKFpHYbH9+7yudTKMNvHUIeWsqVwfxGbSEFZkOr4htYS5Wl3fiw8KJbQ YMYYUGSgF7KyGaLBPvJ073IrTBnzocWq65eRysehuZp3wItb6LxZ6Z4GmwWW0hd1I33JeRcsaZS 1TdiuhefnkCHN9f+uAYeoEydKSRhvoXLDNS+/Eqt/hrdZbSwI3HdZljLReyNhkcNMyop/CrScaN OSdIFDIGERaZf3/0QVTQ+e9aiQkYFYEAwBehHvP8Mh85WEcIZ/jqj5bmi7GoV+C63hCP2hbI3DG 0dcJAlz4RTbKGRtBpJm09E= X-Received: by 2002:a17:90b:4b90:b0:38e:49c0:75a7 with SMTP id 98e67ed59e1d1-39b2610f2fbmr47436302a91.8.1788942754096; Wed, 09 Sep 2026 01:32:34 -0700 (PDT) Received: from NVAPF55DW0D-IPD.. ([203.211.104.195]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39cfa5c1d17sm788649a91.4.2026.09.09.01.32.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Sep 2026 01:32:33 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][wrynose][PATCH 15/15] python3-h11: mark CVE-2025-43859 patched Date: Wed, 9 Sep 2026 20:31:40 +1200 Message-ID: <20260909083140.2494932-15-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> References: <20260909083140.2494932-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 09 Sep 2026 08:32:36 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/129886 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-43859 Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-h11_0.16.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb b/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb index ed1702ff54..0bc1cd5c41 100644 --- a/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb +++ b/meta-python/recipes-devtools/python/python3-h11_0.16.0.bb @@ -10,3 +10,5 @@ SRC_URI[sha256sum] = "4e35b956cf45792e4caa5885e69fba00bdbc6ffafbfa020300e549b208 CVE_PRODUCT = "python-hyper:h11" RDEPENDS:${PN} += "python3-profile" + +CVE_STATUS[CVE-2025-43859] = "fixed-version: fixed in v0.16.0"