From patchwork Mon Oct 12 00:09:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100374 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BC23CA9ED3 for ; Mon, 12 Oct 2026 00:10:23 +0000 (UTC) Received: from mail-pj1-f45.google.com (mail-pj1-f45.google.com [209.85.216.45]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3502.1791763815984555937 for ; Sun, 11 Oct 2026 17:10:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=PNatTSE/; spf=pass (domain: gmail.com, ip: 209.85.216.45, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f45.google.com with SMTP id 98e67ed59e1d1-3ab2bf5e75bso621671a91.3 for ; Sun, 11 Oct 2026 17:10:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763815; x=1792368615; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=JXETLo7OCgtEZvnkhNWh1tg9VjrtfeNUp4d38wajRg4=; b=PNatTSE/TTpK6xxcJm5VcaW7EyBZqeJr1iCS//28/gziL8JxvQRNzE5cW/iIqYz+TJ nS1bStDtsPv+m6jCm0cpOe+K/9XU/4Vlz/nUnT1kMZ48fz2QJs3n2Q1MTMDPEVNVsMtq EsCQO4ZXPxBnQ90gw+qVRMYgQUm1rfayUeIERa2xKN9UdB/8KlKoj9zQE6Dr0y3hsQDm hLAIv/VNhF9c9we5AjbKz6lTjhU4hmgb6FjsTR+2mCNSi4FX4xa0fnUDFN8VplKJLklc UcmvaGaG9oplZeGGzkce88PwmbkteDRuj58QPblD1HNiZEqwYQisOuhBlrlkMG1TbxwW CQvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763815; x=1792368615; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JXETLo7OCgtEZvnkhNWh1tg9VjrtfeNUp4d38wajRg4=; b=ajWxqQ11UVIlJCm+GcjOE8HVJmHovwOED9Vgd7K3PgTYaQQfF4h5GD7JLWWrMzUqQ8 WpLEyd1M1WlARkJT9xHnOcmrsxxyEWA4J0SUknW4DFnpci6n6CA8UN7+5vy1iiQuezh9 yQtQBvNE2hC2gbewHGWHA5ia+OueeU/fqCwQfJqR0VL2rvcbe8vVfePNbcOm/Zm5B77Q uvEwQnZfS7yNpxPFOcW5nkl2zc4wWjOlrnmJemlT1JXQI8msw3E+T+nWRdk3fDt84xWa jP61lOsz5ONAPGxjy3tPqOT4wKvAXsyVqbd54i8bDvPngJLNwLbdtHtnbGZ98rwgOydN 2u1w== X-Gm-Message-State: AFq9FYIfdwLVq/t30+q2VMMTwNXIXT/9p3NpZf5AoJcwDcgqkCKB0Wkn Z64xcU/sx5ZB+bu0fIrUAeue1a+zTCJBKA+TjwyKCJyPHO8pp42/PTqTcSXCsA== X-Gm-Gg: AYBFou1uWPtwEfrAgT3rdLly4pmFh+W5/xvhzQYvgcfyVb4wQ3wWw3q7J4CZG9x4eOx OPvGhIHyqiSeMJ8HnI3JqQXiSW04KLkS6fx4s7NUX2bKYMCt9UzZZLFlmLJIza6QKtJ0eQWbweU cbpXDKXCNWKYE9gk3etk5nhnLlKUkiRdXrjVdkuqsp2fXwu7SIfN5m2qdRiu5FM7BzK9KQYFVN4 aPf7wBbx7GKNbZq1ZNJdUgC2WohoGmx8i7gRhtEpJWCjQWhgFR+GGk9J/1PLy8hEuwA6i3qNyn+ Opn0iDMm4eUbeNsRHxHfaHNBVwVKedfdri/bKrwL+OsKg3C1q8RHt2AkhTXY7yh8teCcjusfOaZ wuXoV+mXMGPVl1MrICX0PDz0+zh3L0a6BNXkWb4fcfoj9pbOa+m37LIDpL8rwFg7sBIXxUV8OeW y7TrfTDPjm4ykLRXqlQrW72mU9OcP9e1TepDKXYGPHmsK9kvnjhuHh8inK5LJLl15zLpfVUM/S9 aCddQ2jKdSpF0kA9vlgAgriseRMkLglEZrbt43bZDakq/Kp7g== X-Received: by 2002:a17:90b:2ec4:b0:3a0:cb48:df6b with SMTP id 98e67ed59e1d1-3ab3a955ad2mr6673403a91.34.1791763815222; Sun, 11 Oct 2026 17:10:15 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:14 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 1/28] capnproto: ignore CVE-2026-59704 Date: Mon, 12 Oct 2026 13:09:39 +1300 Message-ID: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130726 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-59704 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb index 9909afb0e90..1149913c2b7 100644 --- a/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb +++ b/meta-oe/recipes-devtools/capnproto/capnproto_1.5.0.bb @@ -41,3 +41,4 @@ BBCLASSEXTEND = "native nativesdk" CVE_STATUS[CVE-2026-32239] = "fixed-version: fixed in 1.4.0" CVE_STATUS[CVE-2026-32240] = "fixed-version: fixed in 1.4.0" +CVE_STATUS[CVE-2026-59704] = "cpe-incorrect: this vulnerability is for CapSoftware Cap" From patchwork Mon Oct 12 00:09:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100376 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 277FBCA9EBD for ; Mon, 12 Oct 2026 00:10:23 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3480.1791763819033667556 for ; Sun, 11 Oct 2026 17:10:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OJ/2C7Oa; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3ab41538192so976058a91.0 for ; Sun, 11 Oct 2026 17:10:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763818; x=1792368618; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=t3d43JjfWEUFleFcwwuibvfJUhSWCwglxb4hHqHvJmc=; b=OJ/2C7Oa7MvyHopjnFIfC4ZfRN9ohskcNlE2Y39/a8OIQ3XmHEmpb5/I+zWUqRlKR6 plx9BKswt/i7HOWYtk7ppNG42jFO6amKS03UFy0k4MavEAtXlC/3oZUD4gPRd+ZGNjr6 E4o3D4BD7Db+HjuDSvRwjongHj3/wmdSSUhJQpWYHs0AMeDlIS+Cg9YTj5VLaNoGWp63 KZerQzLKMOPJui7pz1FnEoK5Ntm36/EL1jyddTBMQZa5/yPFd/2zzWqYFHlbgcYUXU4x kL/0HiT53FEQU6wF3uRvfpbXSkYSqunyip4X1zmiDF4Q7+R3sKR9qnA4cuD/CzXwOCs0 O6ig== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763818; x=1792368618; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=t3d43JjfWEUFleFcwwuibvfJUhSWCwglxb4hHqHvJmc=; b=jyjpNWZxc3eWhWLNPN5rej7sOi24NAL5mjQUQIBD4c9RDh2AA9uP7kYeWjcY+o0slv WkfbMtA1ECEUc1AKS2Ua2GKOPV7b8VTVUQ2aMrT+egM7EBxhnUbdVD2cgs4hu7O683JY YP7/+41CAIf0z4jZRpUQi68JdgIKJ2K3UFeE+oD/VN5d/c1yCsec5vXIMi6xUU1nElaD Lfxx1nSN3QLyVomKAqK31p5PwRrTHjgETi2XVMTR4MVvQYGtBT3wbAGf3H096zzew68l EI6Mr7CYVFOBA18o/2P2dR6sALdED5m+bB47opbako9ogF+zmqlAcc3d0aDrxPcpffNE Xn0Q== X-Gm-Message-State: AFq9FYJ1wXkQyIZMHoRJOGYYn2itfPfVu+TVPg3toxmnHd6ZqiiIU3/J 6R4wQPpX6YQ2yNCfcVznlIzrL/SowedBxXG6FJ+/JTDr1jSekEfGLJmgLH36xjv0VA8= X-Gm-Gg: AYBFou0pQREEx6bU00PfAEfEGJl3zipE3n6dGd7qHQzc1PNueB9AIr52RovttwZ4uEC BBt4G4evIjFvSgrJ9H+Rw0tdvUxBiEvx8DPbECIQhS8zH2WyMhSqdbRYr9XoBzS27Gm8wLOUzT8 C1PT++ffIsMAT0s95j0APQaUr3uThxofvUxfdn8aDke5rzIYDT3VjIsNtIZiAAkZDTBxVGzlJqj /r+Y3nTi/ihGnhp7bVmDXIein+DPC9FzBl9ex+bEnHgKnHBl8V8AwwauuiSTUSCbJnuGl69Qcrx Po/FPXvJ/ClyLLnk1AMu52MMx4Gv0ybiVmAV1sZjNnKv+ad+kilnZeF9VxaQKuLGm05h4qbLzyK QOTO+kImXey23VROzV0N0FKSMWr8HaVQ1NbJ47gKaCPYxkeoQSZrzGtzZB1B6AivLr0qwAyFdUG 5Xj29GtF0WxvZd/uwuOr3SCNCuPjrkAtWeejlBdc9SJVXZ369CTRwdh+q930D312njTAiCPsiXb 9AVXgKZajEO/D1AxPiWRBHQ9QnpI+4dJnaZyGc= X-Received: by 2002:a17:90a:a8f:b0:3ab:413:49af with SMTP id 98e67ed59e1d1-3ab3a92850dmr5212680a91.49.1791763818332; Sun, 11 Oct 2026 17:10:18 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:17 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 2/28] civetweb: ignore CVE-2026-5789 Date: Mon, 12 Oct 2026 13:09:40 +1300 Message-ID: <20261012001007.2541673-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130727 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-5789 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit db080436aa68c50b0500aadd33a366916b12c782) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb index d9ca7ccd53b..df64d4cd355 100644 --- a/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb +++ b/meta-networking/recipes-connectivity/civetweb/civetweb_1.16.bb @@ -13,6 +13,7 @@ SRC_URI = "git://github.com/civetweb/civetweb.git;branch=master;protocol=https \ CVE_STATUS[CVE-2025-55763] = "fixed-version: The vulnerability is fixed in the used revision" CVE_STATUS[CVE-2025-9648] = "fixed-version: The vulnerability is fixed in the used revision" +CVE_STATUS[CVE-2026-5789] = "not-applicable-platform: Issue only applies on Windows" # civetweb supports building with make or cmake (although cmake lacks few features) inherit cmake From patchwork Mon Oct 12 00:09:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100375 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1AC24CA9ECF for ; Mon, 12 Oct 2026 00:10:23 +0000 (UTC) Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3503.1791763822096179702 for ; Sun, 11 Oct 2026 17:10:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=jTx00P+h; spf=pass (domain: gmail.com, ip: 209.85.216.52, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-383b4a3755fso970130a91.3 for ; Sun, 11 Oct 2026 17:10:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763821; x=1792368621; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=g4h5NSqmncAof+0pUgPXZEK5PPc25rRE+KsDPDf+OJ4=; b=jTx00P+hUfNUiqvUG/igK1Vblw7FOKHYrzjfLd+eYwQVBt/PSfJ8HoFHy9feX5AWA0 DqZ0/IRv/aQ4SVbn2MtaEESagE2KYIv0YvjOZgFl2ovWy6sb4qn0KzSeOANpSDQz+hr8 wxUhO4KVaE2QFV/ssqZUcKMOn0JPPpvhqRSMLJvOlqoyiTmHqMsMLiaK1gzqUGLHYOIO EtJGWp+QqlV3jlqFg47EONMuiMyIqJVSIphrMxGuWmcHzlVmbo0ew9F+5KkWoSUWCpXz 4xBaYJ1t+9kxoMKra4qnTBt4O/WLm4TIEMvVxGwunvHEQcpxHdvj/1ON+Vqf5+QD7q0Y s2LQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763821; x=1792368621; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=g4h5NSqmncAof+0pUgPXZEK5PPc25rRE+KsDPDf+OJ4=; b=c7eei+iUp0Ozxj3PxSV9Zq4eKnbg1ZdcERStGP+xg4sFCVjQdG5P6LYnKB93tVYejR gYVZ9MtBIbt2sZsaVsYgI7B3pKCRA1+PyKAyI+DrSsmGHVUvNtYxTeATX3dfhkVcNYNh GnNeRFdeLDuQU/XGI4kdzWBOgZJ0wxLbaXont5j8You2a1yvqNXWJcD422gHVTsIQb1o l+GAa+Ry2g5Qdc2tsl/Gj5xsW1otrRRIeJNLSm3c9I3J9gGqWYEe4YmLp9rjLQf2/Qj2 CEyWoBb2+FBk4dH/2fnVo9Eg0TeUSdLWAY/KuQCBj9O2VuIHobSRRqOvRrY5k6j8Tic0 dczg== X-Gm-Message-State: AFq9FYLJgQQzVAUE2FJEa9z9D46xCIuLlrxHbZUHEIYQ2j+u5Hbi6Gyd UDBkwn/T7d5IaB+/XgS6aldR3AvlMKRe7xHtzhGmomzXavK/9AdMDUpPAtep8baaMrM= X-Gm-Gg: AYBFou2g7/gAWs5R/2PCkopqRbQMvyuPrWex7OgE7PphLEX+KifeNslgIqeDSamC/Ur 1npdCHm3cMJlySsro4WycfaCU7l1O4I+lGYcP3ruiec4pHfSb06/5gmwoRgzyZN+DUQZZSs5hnF VJ3T9Xn3CnqjYGk/r07Juh1tI7n726EWynqpcFVOFgglp5bzj7SFkClaRaA6V0fyiHvY/uCpYmn WhNnuVo0LnTbc4PGpwEQJldaGYgk1npb337WYhmEn8kolh6xySNcgBiSE46OBhUenI5NtrMmRUq zL4YIb6rwOyggM4m/sl6sB74R5DNCWWVf+cJr0neDliuDpIhECoHNhtsX+x1a9b/4OEncjYbjZ5 EkckqC3FLxwlfaGAAR+xnqjQRSLbFOrkRqinnIEPbOMk1OBmHgJspVhQ3Cf51JpbdiS0fiT1ZIe UBScR07oyNfONCWiEKpvRJ5qkbRqaktm8WftlKwNPiBrSwKDVYkyCOAh+mMFwx6sYDooseUV9Tx SmCqzqGwaloldeUSE6v4RfbeEYg/izYf5a1nQs= X-Received: by 2002:a17:90b:5883:b0:3a7:db88:348d with SMTP id 98e67ed59e1d1-3abcaf0acf4mr2041884a91.54.1791763821481; Sun, 11 Oct 2026 17:10:21 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:20 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 3/28] dovecot: ignore already fixed CVEs Date: Mon, 12 Oct 2026 13:09:41 +1300 Message-ID: <20261012001007.2541673-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130728 From: Ankur Tyagi Upstream has confirmed that these vulnerabilities are fixed, and Debian has also identified the relevant commits: CVE-2025-59028: https://security-tracker.debian.org/tracker/CVE-2025-59028 CVE-2025-59032: https://security-tracker.debian.org/tracker/CVE-2025-59032 CVE-2026-27859: https://security-tracker.debian.org/tracker/CVE-2026-27859 CVE-2026-27851: https://security-tracker.debian.org/tracker/CVE-2026-27851 CVE-2026-33603: https://security-tracker.debian.org/tracker/CVE-2026-33603 CVE-2026-40016: https://security-tracker.debian.org/tracker/CVE-2026-40016 CVE-2026-40020: https://security-tracker.debian.org/tracker/CVE-2026-40020 CVE-2026-42006: https://security-tracker.debian.org/tracker/CVE-2026-42006 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 86a9ad852a7180edf8b03fca7d0a69e9f1d9e550) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb index 993453eaa30..06e6ee39fa3 100644 --- a/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb +++ b/meta-networking/recipes-support/dovecot/dovecot_2.4.5.bb @@ -89,3 +89,11 @@ CVE_STATUS[CVE-2026-0394] = "fixed-version: fixed since v2.4.1" CVE_STATUS[CVE-2026-24031] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27855] = "fixed-version: fixed since v2.4.3" CVE_STATUS[CVE-2026-27860] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59028] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2025-59032] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27859] = "fixed-version: fixed since v2.4.3" +CVE_STATUS[CVE-2026-27851] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-33603] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40016] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-40020] = "fixed-version: fixed in v2.4.4" +CVE_STATUS[CVE-2026-42006] = "fixed-version: fixed in v2.4.4" From patchwork Mon Oct 12 00:09:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100377 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A322CA9ED3 for ; Mon, 12 Oct 2026 00:10:33 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3504.1791763824814094086 for ; Sun, 11 Oct 2026 17:10:24 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JNklg1wS; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3a0aaa0fd13so949489a91.2 for ; Sun, 11 Oct 2026 17:10:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763824; x=1792368624; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=oB7tE+PbDjYkzFxeiwzFxCxaGcxBXKY4yXEBtK1GdQM=; b=JNklg1wSjeMcuU1NzxGtuBv80Q8PJOLGkelbEzry5tOj4VfUbGsq1DTIXV9rd1kY+E J+t2fjzQqnPUFmf2SwiMxoNUtRreVNnzfUpStP3kfy2iGEyMNFDDiqCQupLVutQEQ++c VLg4pTpluiRnVnET6nplJ9Dc5nhZTJgrJwdcxBay6+liE9R0u2GqFZQ1ALb9ooCq4g6h NjrtrKyirHYumuk3WMlcGwTNAEKlTZ8nWgwD9V1MX+H6kaL0fL+ar8JYGle4FgARJWPX FhrXGlIIpFS4luSUIdTGfv2D0OyfQjtaWJXro3ihB9osU5RVe656F1BvLr6gHBmCUItZ XBqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763824; x=1792368624; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=oB7tE+PbDjYkzFxeiwzFxCxaGcxBXKY4yXEBtK1GdQM=; b=029o8jCcWRTUXn7o2jCFk+JGsN7t9KipHKUJQIVnOfy2+avVIehruBERYw/UCldiPE zjHmk2V/bBunsF0Fsnp0uTkLbWfQGs4NkOg4awum4XED78CEvmS5h9o9CRANyobYB/1/ I+jyl1RVNF9Jkot5jtOj4WAN1H0U1OcLX7mHABzHg2rcq+XfsE1aYQKMSQX945Rpuju/ kblIWqwL+9lF1HoiNuWkIho6gvDptNWuDOd0SWMXk/ijc/xiBKxbjUZCUrwOLW47yHu4 VvvggPPLZeiqQHhJtKABaJ7rnsdrLYpsqVZKyLLX1CWAbS9G6ZBCjAY9X/yO3hYHVS3Y j8fg== X-Gm-Message-State: AFq9FYJp+S9X2PtiWxrIjgodV9UoS5OYEU6p3WsOO81u9ji093SA5TWU m0NYuRDQat1Jdu4kg0PDqGueq0RtjrIs2dlQJrLx20eoUHmj32oi4fzClBf2RAEnNCg= X-Gm-Gg: AYBFou169TnMkkOI/0da4E6ulKH6Fymuji/WteKv6zJC8/GQz2Qmd8SBW9yPDkTzxpP lMoQ57IvGladiK0kskngLM+DR44j4kyZyZfnbRmq5TP8BsRCZw46s8kNpvEXPYbokle9WB3ky4s em3RkSef+8700Cc73RAXBrEu8q7OUtQ3GuxGc920hdc+Jw//ZTZBAXXKeD4A3rzeARVqgAHaW0y 9j4cqqUQsxTtru2n+1l/VJEIhNgsOVGNrH2eieet4xD1vSiyrgddfDHnpe4O3gumg4EQins2w3A B8e23iDUjfR8/bEogi0InvD6++3+bAeSWwzViTPawjbE5bGlIC1gYnu8CCzZ76tGXZ5JbiRQnDn vx31agDlWcSshX/9Pb2FFIMJHl1iNcnZc0XY6Qfmj9sRAFe1tL6iXwN/7R2hxSqPh//AQ6OOoRh XD1H+opLftCwi7QKHbUvTgGAar0e+kZ1mL2rDzyh2xRLPaY7DBJhHXFr3f25OWmHriEvdFS8CFu A6jZK97OMEwS/ZZmQMKcW9pJF6vc0+mPlnHUzY= X-Received: by 2002:a17:90a:4ce3:b0:3ab:a188:b8b7 with SMTP id 98e67ed59e1d1-3aba188beb4mr1942678a91.22.1791763824077; Sun, 11 Oct 2026 17:10:24 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:23 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 4/28] eject: ignore CVE-2026-28065 Date: Mon, 12 Oct 2026 13:09:42 +1300 Message-ID: <20261012001007.2541673-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130729 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-28065 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e6d111c16938dab4a377826147bfc86b72bca8a1) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/eject/eject_2.1.5.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/eject/eject_2.1.5.bb b/meta-oe/recipes-support/eject/eject_2.1.5.bb index aa0e86db12d..90630ff791b 100644 --- a/meta-oe/recipes-support/eject/eject_2.1.5.bb +++ b/meta-oe/recipes-support/eject/eject_2.1.5.bb @@ -34,3 +34,5 @@ ALTERNATIVE_PRIORITY[eject] = "100" ALTERNATIVE:${PN}-doc = "eject.1" ALTERNATIVE_LINK_NAME[eject.1] = "${mandir}/man1/eject.1" + +CVE_STATUS[CVE-2026-28065] = "cpe-incorrect: this CVE is for WordPress plugin or theme" From patchwork Mon Oct 12 00:09:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100379 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47FC5CA9EBD for ; Mon, 12 Oct 2026 00:10:33 +0000 (UTC) Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3505.1791763827730792302 for ; Sun, 11 Oct 2026 17:10:27 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=lUHocmrD; spf=pass (domain: gmail.com, ip: 209.85.215.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cc4e9e56e9aso305544a12.2 for ; Sun, 11 Oct 2026 17:10:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763827; x=1792368627; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=t4H22qeiDu7Wi0/N+SsuWRdiTVMK30xTEL53fVAubwM=; b=lUHocmrDIYoegSZMCr8FuqB1KkX95lV7BR09SCXJHG5yWgPpP+incbCjjOvpNL3l5h W7Cf1LObXSvQGrOgqJQ8iIAyTZtvuDf0ClC3XPnx0aIlxOrq9bJN1AH8vo1h48ggXW+W glqObyIw7apQf4glWW+2EYsqDtZSP4N9ObYN8SdGS1+2bROjdK2Zh06FehOiI2hYiiC+ Klg9oBYuTo9jNNWrepf1sf1O45oOh/Krn2dEX2c9Y6RVQp41QITtxXzPYdMa6SUazbLJ ClLj2jPrQVqjGt0TBXYyjy9gh8viJk+p4X6kARSmZpWSHFsoMPN0etQA6L4y0GACAWTs STSg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763827; x=1792368627; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=t4H22qeiDu7Wi0/N+SsuWRdiTVMK30xTEL53fVAubwM=; b=hzx0zwEhANLEMmuQNyUAUX9iOyC7B16Ap802SX0/e48HlACL9hqPxDQ618QdHwzrgC 6CVD+egmg3QjaYac5iQQ9Ql3PDMildqkGVNoNmO+5k2IcJYWYbAq7vyQik0s3XoruIB+ lA0qEgJDbeZUIY9rF+LH1PsrhkjJyKO1TbqxjnCGkZ6Mr/LhCYKyRZgTIiyPtkZTkY/D 4NxgraD1qQABrx9bTQjFfPZRAIReslrekkEbHs+e7IJLz8fIzjUdvCwWaSuoOpiCF/fO jpqBxWBKyF4fRSDCyJMO6a/WQ5w3/EyWBLd4jTcuQFcazysdgWlSHOpjouLLrQ8lHMtj SDWQ== X-Gm-Message-State: AFq9FYIoiPU5Iq12HVJVXdTzmwZHbFfp4neUNdbAy1bqqtkl/28mYo22 WE1l3qBxviV0VYncRGnzGH5R3p8485QzqKf5hyhO1hmv9CeYoReJoUjrlINewb4FUUI= X-Gm-Gg: AYBFou2eZyOVUWtFUeY6TPzhC1t8wxMX+h5aeRgeiy/cWF5+ITA5xoWEnn2jQ3kOc+A LRD3bHrUS6bmCa4pgP3vnwHukGa0J9Mi5645bo/yX29rQ5+l9XGw9zZEoeDShjDMmZdTnUhoKvC 17lgURvk6I+6V4pCVVLj6ZRCnWWPa/aZ2P0xVR2i9MXvG47Vl6s74DfNX28mop9ThYkm+b6uEQL fw7foFWXpJ/bRNKeI1WF/51fQJNQgvEHYsACE6QxnIYK/ZcH9WrEsqG2HdLwq+WvhPCqRD9uK7G /QmwFjBb93xhbwh1XW4bK8MT86oQQtlsMTnmxTJrx+Twr5Bm1keWLnkWN+MYxkp+98mOIvbrG+3 ryiblRkBXBDzt1f0UMEG0uJxunj1MgFi0cbuw8/va631RMQpThi39qG2VbO/RC4VEu0tQH0kQj7 UqV7STQVuMQA1E6ND8VFeJianzfRrJ/AYYE3Yh5xuer5CygIvIxI24CG6JHJYdySi1i9oLjKEzb +KuTNHARVdN8T8XsRAvHMBS/6j70lXYqRh0qFM= X-Received: by 2002:a17:90a:d44d:b0:3ab:3675:8ed with SMTP id 98e67ed59e1d1-3ab3a60cebcmr7120505a91.22.1791763826902; Sun, 11 Oct 2026 17:10:26 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:26 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 5/28] gpsd: patch CVE-2026-58459 Date: Mon, 12 Oct 2026 13:09:43 +1300 Message-ID: <20261012001007.2541673-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130730 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-58459 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 57e1f7d3d255e7b2eb55e9bca152f189ad8cdd09) Signed-off-by: Ankur Tyagi --- .../gpsd/gpsd/CVE-2026-58459-1.patch | 48 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-2.patch | 46 +++++++++++++++ .../gpsd/gpsd/CVE-2026-58459-3.patch | 58 +++++++++++++++++++ .../recipes-navigation/gpsd/gpsd_3.27.5.bb | 3 + 4 files changed, 155 insertions(+) create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch create mode 100644 meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch new file mode 100644 index 00000000000..aec3acdeb26 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-1.patch @@ -0,0 +1,48 @@ +From 485b793ee3a54865ff9d8efffd2fe9a309666be0 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Wed, 1 Jul 2026 17:55:57 -0700 +Subject: [PATCH 1/1] clients/gpsprof.py.in: Quote double quotes in title. + +Someone could use the double quote to break out of the +string and add gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 5581ba196d826a984fbfaf792b7d58535f9911ce) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/5581ba196d826a984fbfaf792b7d58535f9911ce] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 5c18f50ff..261e72665 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,6 +198,10 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + ++ # escape ", and \n, for gnuplot, to not break strings ++ desc = desc.replace('"', '\\042') ++ desc = desc.replace('\n', '') ++ + return desc + + def collect(self, verb, log_fp=None): +@@ -1262,10 +1266,10 @@ if __name__ == '__main__': + # Ship the plot to standard output + if not options.title: + options.title = plot.whatami() +- # escape " for gnuplot +- options.title = options.title.replace('"', '\\"') + if options.subtitle: + options.title += '\\n' + options.subtitle ++ # escape " for gnuplot, to not break strings ++ options.title = options.title.replace('"', '\\042') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch new file mode 100644 index 00000000000..dd50d276950 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-2.patch @@ -0,0 +1,46 @@ +From 6031dc96603d5537a650068a2f8d42ef90d9d32d Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 13:41:54 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 1a6bb7bcbdf58aa940132e630870af061dc88537) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/1a6bb7bcbdf58aa940132e630870af061dc88537] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 261e72665..202214769 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -198,8 +198,9 @@ class plotter(object): + if 'subtype' in self.device: + desc += "\\n%s" % self.device['subtype'] + +- # escape ", and \n, for gnuplot, to not break strings ++ # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') ++ desc = desc.replace('`', '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1268,8 +1269,9 @@ if __name__ == '__main__': + options.title = plot.whatami() + if options.subtitle: + options.title += '\\n' + options.subtitle +- # escape " for gnuplot, to not break strings ++ # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') ++ options.title = options.title.replace('"', '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: diff --git a/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch new file mode 100644 index 00000000000..a40edfe6d13 --- /dev/null +++ b/meta-oe/recipes-navigation/gpsd/gpsd/CVE-2026-58459-3.patch @@ -0,0 +1,58 @@ +From 54484dccf7265e51368eef03d99ea7a370c15e06 Mon Sep 17 00:00:00 2001 +From: "Gary E. Miller" +Date: Tue, 7 Jul 2026 14:23:56 -0700 +Subject: [PATCH] clients/gpsprof.py.in: Quote back ticks in title. + +Second try. Also quote "terminal". + +Someone could use the back tick to break out of the string and add +gnuplot commnds. + +For issue 404. +Reported by: CuB3y0nd, and Wade Sparks + +(cherry picked from commit 4c06658e988f4ced1a7a574ce082a22ef625df56) + +CVE: CVE-2026-58459 +Upstream-Status: Backport [https://gitlab.com/gpsd/gpsd/-/commit/4c06658e988f4ced1a7a574ce082a22ef625df56] +Signed-off-by: Ankur Tyagi +--- + clients/gpsprof.py.in | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/clients/gpsprof.py.in b/clients/gpsprof.py.in +index 202214769..e91367ee3 100644 +--- a/clients/gpsprof.py.in ++++ b/clients/gpsprof.py.in +@@ -200,7 +200,7 @@ class plotter(object): + + # escape ", `, and \n, for gnuplot, to not break strings + desc = desc.replace('"', '\\042') +- desc = desc.replace('`', '\\140') ++ desc = desc.replace("\x60", '\\140') + desc = desc.replace('\n', '') + + return desc +@@ -1271,13 +1271,19 @@ if __name__ == '__main__': + options.title += '\\n' + options.subtitle + # escape ", and`, for gnuplot, to not break strings + options.title = options.title.replace('"', '\\042') +- options.title = options.title.replace('"', '\\140') ++ options.title = options.title.replace("\x60", '\\140') + term_opts = "" + truecolor_terms = ['png', 'sixelgd', 'wxt'] + if options.terminal in truecolor_terms: + term_opts = 'truecolor' +- sys.stdout.write("set terminal %s size 800,950 %s\n" +- "set termoption enhanced\n" ++ ++ # escape ", `, and \n, for gnuplot, to not break strings ++ options.terminal = options.terminal.replace('"', '\\042') ++ options.terminal = options.terminal.replace("\x60", '\\140') ++ options.terminal = options.terminal.replace('\n', '') ++ ++ sys.stdout.write('set terminal "%s" size 800,950 %s\n' ++ 'set termoption enhanced\n' + % (options.terminal, term_opts)) + # double quotes on title so \n is parsed by gnuplot + sys.stdout.write('set title noenhanced "%s\\n\\n"\n' % options.title) diff --git a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb index fa3df89b272..52d86503a18 100644 --- a/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb +++ b/meta-oe/recipes-navigation/gpsd/gpsd_3.27.5.bb @@ -8,6 +8,9 @@ BUGTRACKER = "https://gitlab.com/gpsd/gpsd/-/issues" HOMEPAGE = "https://gpsd.io/" SRC_URI = "${SAVANNAH_GNU_MIRROR}/${BPN}/${BP}.tar.gz \ + file://CVE-2026-58459-1.patch \ + file://CVE-2026-58459-2.patch \ + file://CVE-2026-58459-3.patch \ file://gpsd.init \ " SRC_URI[sha256sum] = "409873f5048462ef1ac413a51ab35caa8b50b31be62b3347bee1cc2994e7c649" From patchwork Mon Oct 12 00:09:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100378 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3A2D3CA9ECF for ; Mon, 12 Oct 2026 00:10:33 +0000 (UTC) Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3506.1791763830056688366 for ; Sun, 11 Oct 2026 17:10:30 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=JNupWc5L; spf=pass (domain: gmail.com, ip: 209.85.215.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cc7e79c1eaaso405054a12.2 for ; Sun, 11 Oct 2026 17:10:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763829; x=1792368629; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CQ/To9wsn2t3Pxs/kp8y7LosA82+dyROBT2jtGHTIO8=; b=JNupWc5LX3gIzKQbO2LEcRrAwRqxm5Z2olpyyMN2rOtD66KEYjTK+c3Hc6MlYyga2U IR3Wrnbd2fxmU9nrP4CvbLbDEZf4Z9hjGYsu9juI5mBGKooYxLwq4Hxvr+WytPCM7eii Xovt08zAuUyLB85OEiyFAGEae0MmRcz2wCI/WO+fwXz1JEpK1kks2eT+5ROEwwBPlDV6 N5y5q5zO7v9dn15Gjxpu8LjVWOlV/bMcGv11dgSSy8Z/X2wv9diFqCVRADF2ogb6G9m9 /ENVwFqwuEUAqClatOuD6QLcGfZai8G/s0uHfV5stgelwwGo75VdJ6XfCLxSKT92d92Y mBJw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763829; x=1792368629; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CQ/To9wsn2t3Pxs/kp8y7LosA82+dyROBT2jtGHTIO8=; b=rU3o1Oip71j6Pbh6OCrvd8hVa5YsSOT2Y6ICAyeAXjz8adeN0hzVxDgyJM1mGAeIYh Ph51hdOMPw57tp3FMFG0DVQYB0KkNtcfnvbJLEb+jgnEuUcYCRE/iFIIi5iTiW1l07I9 dZwjNMQZ79MAQhc4sC8bohZL4Knlxl4/4wLAu+WU8SYhrrHg6uknAYW2cei8ZlZ1lBgF KaOeZJWAaGnoTObZqNwQMef0vqOw4CfQxxSCvO4RPvb2sfxLJbPxWzkZtwxUJ+2MgSKM ucVg7LepLM0plptDLSzU+gplKJsejAwou+qgMBZcxvPvzWzUzwuSwbAy7NaZuUMQKFgN 0f9A== X-Gm-Message-State: AFq9FYIoGSpiCDmSYmo94Z9pdIv8cVjDngCDlj+A6ce0HMamEDSWEG6P 1RA12G8C6rVYcRD23cUyGmXxBPpok21NtxTgelKArBO8Gi3EAYQbV4hkSa08mbYg1T8= X-Gm-Gg: AYBFou32MH5htPC8y0ule2hjErPUkNyc2kjtGoAEt2TtyjGFW1GU7zlfCf2SBV7aJLX fhepWSGjCREuXborJAhRgvQGVDZkjFH5D7AJZVJSS3snm+PWkXn3Z4fJe1RoYYjmzOdD4vBh396 w1W0R/cQl5kS68xXj+F9MImGt9t1+dE4cE/BS8RUOBlwFa/EUKuQBkUbDzPOVwRyjywHy89tOVk DtXE//qWedzswqkdzWCXYnrX/p2eODM/Ww+Elao1f0ZgJ7QBdnhq2ziljOv17Ua0WndlCMqR/gk PhpoCWTfeywzK9+TLxwkAKmfoHM9T5cUpHC6b7Bv8MszjjOo9xsK1yx7GGATRlW3fBCYYasi0C/ eyxIz9LhLd/8a8MwKuMHSMopPYWPGXiONQvDd/Q8iNBLsZQx7O7ES12TJTWHogGItgRuN7lyhs5 GV7BDTnM5QOpB2pbGpsBaunuWdeLeBDSqKRCZ8ZJJYIhqeLB2NkSTiYV5I90+rQT469iT1iqKvR bmNBjjQRth7goNLOfR9HCNdd+VfpqB4IHZE5CkD7CmKJXEIlg== X-Received: by 2002:a17:90b:164d:b0:3a4:a370:d888 with SMTP id 98e67ed59e1d1-3ab3a99b4c2mr5704195a91.20.1791763829429; Sun, 11 Oct 2026 17:10:29 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:28 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 6/28] bcc: correct CVE_PRODUCT mapping Date: Mon, 12 Oct 2026 13:09:44 +1300 Message-ID: <20261012001007.2541673-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:33 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130731 From: Ankur Tyagi Use "iovisor:bpf_compiler_collection", the exact NVD identity for the https://github.com/iovisor/bcc source. Signed-off-by: Ankur Tyagi --- .../meta-python/recipes-devtools/bcc/bcc_0.37.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb index 8caeef90bfb..eec8ef4a32d 100644 --- a/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb +++ b/meta-oe/dynamic-layers/meta-python/recipes-devtools/bcc/bcc_0.37.0.bb @@ -91,3 +91,5 @@ FILES:${PN}-doc += "${datadir}/${PN}/man" OEQA_BUILDPATHS_SKIP = "/home/ubuntu" COMPATIBLE_HOST = "(x86_64.*|aarch64.*|powerpc64.*|riscv64.*)-linux" + +CVE_PRODUCT = "iovisor:bpf_compiler_collection" From patchwork Mon Oct 12 00:09:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100381 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 57004CA9ED3 for ; Mon, 12 Oct 2026 00:10:43 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3507.1791763833564802267 for ; Sun, 11 Oct 2026 17:10:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=KBSBUjbp; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-381b831d535so1523711a91.0 for ; Sun, 11 Oct 2026 17:10:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763833; x=1792368633; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=KhP7I524Ik2T7MERZuAYHCRsypN597paxCkLUXVEfc8=; b=KBSBUjbpu2APSCAbwMYzgBC9uW3ZKrde+iXCJTlGX5pDiQL7YA1WlM7+PDnq2oTtYo oyk0mLUAPa13u3rycQBAXB8j9ac9QRFHsurMUJuEww5wNPzOgG7rgfhpWa47p9dR9H2B kmB6rxKPHi5271s9Pq9oCFK94xp3nte9yVpfZMM1N55SOIwfrejD6u9RienDkIzLgStz XXbj0Ps1+pLmfivETnTL8rFFnmCVSAekbt1Sya7jsGZLPSD2fvqwVWC7AlBwMyiDkN+z aTofpjVefgEhwCl8C/T9oJYHVON2QF0knEuWJWWHZ9jdY2DEBljGbSrtKHvlQQCZmQ63 w2tg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763833; x=1792368633; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KhP7I524Ik2T7MERZuAYHCRsypN597paxCkLUXVEfc8=; b=srfr5ACmCtFqEjWTtgN2u5dUxgYKsBQX9X0opcr59CU256Y0dh2WIDJgub8PBpSBxV lPHNgFc2Q2m1TjszxYeKRW0CD2OvCku6Iq8FE4iSZsounLvwRm2L9iVwiiZXkmDDRsPv ouFUQLmni0S3Fr+j5JFegBTMcEREljhrs/+cHwmXpBqHL97aaDvHwRDZ7vY67KA3Ziuk JgwI5MxDtCtSjo3wB3u3yam7hlAAGDOgaruuY3lb/Z0svB+5ZnEQFQWHxxZXbNkjakT+ 2S4G8KfIGt3Uxc1IPgN+8RN6MKOYcrN8NBDY6W2CEZzmSxpsLrw0BM2B//pr/cAAxZfL SYgg== X-Gm-Message-State: AFq9FYKEdTJunKvxoX7Cxk2OxGRSQ8tSTr0G0fiK5dwdJ02lKPW6LneN n6edk1Gw91gWvlMF4G1nIYTpp0whXoDRWgB5pDlZ5QL6TUudpJPmMIvdAlPovg== X-Gm-Gg: AYBFou2aLwGE6T2cb3V7Xn5m4WGynYn0uEqgKlPVpGYqgM4tNWhbkOPturMDkgH0Ypt tiAjXpYtkYHFP7tZud/c/ro+htgsv/w1++5Z8DG1IsRbZ1Ncy9HadGvcis/rmVmDmAj2LDeuA1s uESIkltA4zQofcTYULVtP6w7WJresjnaXKhLsOgFykEgMdMhz7YudABgpL2XjUfGkq83wyN6sHz Vt6o5eowo60GN37GJ3WXaQN7Y6N0PTrw1M2aHEzOZexfaeaJ0AgwxGa8pn+FwQa2y4OK1RAz1lb 8m0Sa2xprYvaE5LvRqxC/NqoDlYrB+XZKlaxlpzxViF1DGZN0HU77nL+ln5L4PE1w5IJ1KDaR1+ 5a5Dm6wdZ+ayP095S6UHUaVXIq9IlRmjbMiVclbcYuYEXBD0pzY9UHrGiBcazEMLitDJVA4u5Ku I+n9Etm0QVHRzJ89quWKGDNtmDMxhnHe6NTvCVGlYwQPnSHHFVNniBR/HiWtYLlCEOk1x2wDbG7 /EWINi/3gLdIvcBT2JHGAmWRUChKKwlnw6TPKo= X-Received: by 2002:a17:90b:3a48:b0:3a8:bd51:205b with SMTP id 98e67ed59e1d1-3ab3ac65f7dmr6893175a91.37.1791763832885; Sun, 11 Oct 2026 17:10:32 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:31 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 7/28] dool: patch CVE-2026-56651 Date: Mon, 12 Oct 2026 13:09:45 +1300 Message-ID: <20261012001007.2541673-7-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130732 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56651 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 2e1445decda0c68cc6889777c6f648cdaaef082c) Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56651.patch | 47 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 4 +- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch new file mode 100644 index 00000000000..e367884ca90 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56651.patch @@ -0,0 +1,47 @@ +From f5eb4fbf3977d919a2e9da8b73985a29d2878e56 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 10:52:27 +0200 +Subject: [PATCH] Neutralize formula-prefixed CSV output +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit d5aa93b3d1939a83b2b10a7cd8af3c819930aea1) + +CVE: CVE-2026-56651 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/d5aa93b3d1939a83b2b10a7cd8af3c819930aea1] +Signed-off-by: Ankur Tyagi +--- + dool | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index 634ed9d..fc1015d 100755 +--- a/dool ++++ b/dool +@@ -3030,7 +3030,10 @@ def perform(update): + + # Prep the line for the CSV file + if op.output and step == op.delay: +- oline = oline + o.showcsv() + o.showcsvend(totlist, vislist) ++ csv_cell = o.showcsv() ++ if o.type == 's' and len(o.vars) == 1: ++ csv_cell = csv_quote_string_cell(csv_cell) ++ oline = oline + csv_cell + o.showcsvend(totlist, vislist) + + ### Put the output in the csv file + if op.output and step == op.delay: +@@ -3170,6 +3173,12 @@ def file_slurp(filename, size = -1): + + return ret + ++def csv_quote_string_cell(text): ++ "Quote free-form CSV string cells and neutralize spreadsheet formulas" ++ if text and text[0] in ('=', '+', '-', '@'): ++ text = "'" + text ++ return '"' + text.replace('"', '""') + '"' ++ + # Make human readable device names that are shorter + # + # Example mappings: diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 8a057effdf3..5118eadad69 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -9,7 +9,9 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=1ebbd3e34237af26da5dc08a4e440464" DEPENDS += "asciidoc-native xmlto-native" RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell python3-unixadmin" -SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ + file://CVE-2026-56651.patch \ +" SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Mon Oct 12 00:09:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100382 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63509CA9ED6 for ; Mon, 12 Oct 2026 00:10:43 +0000 (UTC) Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3485.1791763836484240230 for ; Sun, 11 Oct 2026 17:10:36 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Th6HXyaa; spf=pass (domain: gmail.com, ip: 209.85.210.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-890d52c7c7bso1138703b3a.2 for ; Sun, 11 Oct 2026 17:10:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763836; x=1792368636; darn=lists.openembedded.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=IHZMYifF5YIf54LpMRTrtfIxEQZb5vTJwqmhYAklHYo=; b=Th6HXyaa69jPiq8vQVlgyHghWHrP7TxirjEK7wZ3kvLiwmUTZX1JBRbaRgHbK3ZImg JFeM/KhiUfuusvNpacWF1OLi+PiW8Zwlt3bLSCPk4pzNcAn8NABSEP7yuc/kaUzl2VUL dgpT3H25NC4s7DCB5a5fQ4wZ+XZgDwrsMuWycnGwdZdKVXfP3pQBJ2e9Uqr1D+mXibch WXySmvm3Ljoj/d0hLLIH++Q3RyNjtDM1dneYC35hvBGc9ugLOG0CItgxTVxJpZ3cZOWk Q7y72BQGirvaG5T92yiYETgTZYRov0NnODoFyf/DLw0GwR1Zt2st4FUno2TP26OervJ2 vb9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763836; x=1792368636; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:date:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=IHZMYifF5YIf54LpMRTrtfIxEQZb5vTJwqmhYAklHYo=; b=PyHo2BwALY2gbPbnuuB5r2tfPVRexa6O963xGPw+6v5Rx3OlGMuFnOoETVt997AKav 4sYPzKd68KXwJSEEzZimPWVNkcw5sWYoUL+yuXoQ/OdWL3gLSGK8rzlDlqc9wzvKI2IO M/iuyfBi3KoybBRca5CvMJ+MKbuqUIcZfIwwl9JmCJyZSkqOcqlzT+FfK6aSrnFj3uVa 2qjgoXhfNupubx/aykvDZ8DRVg1FZQM4avNdxJVuQivuxA6hPP3WOtPd7FQPqU77sx1J yJjGVKcIFTOITVUYIbIxXFhZThaZFwCcGqQ6TPRGVuw7fU4DTe4fYhH+BuyuBgYviVWU wORg== X-Gm-Message-State: AFq9FYK0lxVzjUqrTlt1P44wmWVswzNyAayjg4BSb50HF8ST6kTti61a WUMQO1uDcm8GV42+v1YFux0ITKK9jDSF1HsZCnB06c3zdh4ZrV4+/B4jSmcVAg== X-Gm-Gg: AYBFou1MCvPuSEa9gcse6alfsT/TsrXT4ciLLtyauGIOqovcwCcJslCJStzchSOqjVH ZaYcs5TxSVQgmsOLhmtBnhlRmXVDVIzgc03lYx0ILE1zbPVjjInl7lexTDW6VsF50v7qvU7L/nv EBLwECAz1erbCZkE6579RV63mD5MoUDBXxVo3x+6fpfSqSoSD60XkKXFfhJDoJnkkEvo8vED7c/ LaCKUY6TqIshESRLA/Z+8xwxZDzKvGEJIsXVFz1KMQTTJFaDkZLcGQq+spr7GLdDZk3XVhZv1zH Xx96uwIEidLaff6nVjJSeJzTvVaq5B4oigOCy3Xd0Um0AmLnhY312G4swLh++k/GlDzb39/DOU4 YejfbQlugk6Yv96xENS6P5GRZTRg9G8718X2s9FjfMHBQuZKWu1rs7o2AOojxsTrydWweyRmeTX MwVcMvrH+UcCRsKA9pq/W/Lo6MLAdgYLgG/RDQef7GliAzrRdn1CjzBtoBZ+GLA/KPENnKkOnKN wn7vsizwt7KT3jaf9Y8JjTcowW3m2kS8YclkO0= X-Received: by 2002:a17:90b:380a:b0:39e:6a7f:1dc6 with SMTP id 98e67ed59e1d1-3ab3a99ded9mr7573860a91.34.1791763835728; Sun, 11 Oct 2026 17:10:35 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:35 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 8/28] dool: patch CVE-2026-56652 Date: Mon, 12 Oct 2026 13:09:46 +1300 Message-ID: <20261012001007.2541673-8-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130733 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-56652 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 53bbf2771b13ae1d2c856975ea8f8712b329cb30) Signed-off-by: Ankur Tyagi --- .../dool/dool/CVE-2026-56652.patch | 35 +++++++++++++++++++ meta-oe/recipes-support/dool/dool_1.3.8.bb | 1 + 2 files changed, 36 insertions(+) create mode 100644 meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch diff --git a/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch new file mode 100644 index 00000000000..c6806ae0c56 --- /dev/null +++ b/meta-oe/recipes-support/dool/dool/CVE-2026-56652.patch @@ -0,0 +1,35 @@ +From d20ba041a0f4968fdbc2745827f9af676339924f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20Majchrowicz?= +Date: Thu, 18 Jun 2026 19:20:30 +0200 +Subject: [PATCH] Refuse symlinked devel log files +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Michał Majchrowicz +(cherry picked from commit 259fe40c7fa519020ef7a3f8ef8d61586b72ecc3) + +CVE: CVE-2026-56652 +Upstream-Status: Backport [https://github.com/scottchiefbaker/dool/commit/259fe40c7fa519020ef7a3f8ef8d61586b72ecc3] +Signed-off-by: Ankur Tyagi +--- + dool | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/dool b/dool +index fc1015d..2df407d 100755 +--- a/dool ++++ b/dool +@@ -2132,7 +2132,11 @@ def devel_log(msg): + if not DEBUG_FH: + log_file = "/tmp/dool-devel.log" + print("Writing devel log: '%s'" % log_file) +- DEBUG_FH = open(log_file, "w", 1) ++ flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC ++ if hasattr(os, 'O_NOFOLLOW'): ++ flags |= os.O_NOFOLLOW ++ fd = os.open(log_file, flags, 0o600) ++ DEBUG_FH = os.fdopen(fd, "w", 1) + + # Print out the header line for the devel log + DEBUG_FH.write("|Time |Since Prev |Description|\n"); diff --git a/meta-oe/recipes-support/dool/dool_1.3.8.bb b/meta-oe/recipes-support/dool/dool_1.3.8.bb index 5118eadad69..06484c54752 100644 --- a/meta-oe/recipes-support/dool/dool_1.3.8.bb +++ b/meta-oe/recipes-support/dool/dool_1.3.8.bb @@ -11,6 +11,7 @@ RDEPENDS:${PN} += "python3-core python3-misc python3-resource python3-shell pyth SRC_URI = "git://github.com/scottchiefbaker/dool.git;branch=next;protocol=https;tag=v${PV} \ file://CVE-2026-56651.patch \ + file://CVE-2026-56652.patch \ " SRCREV = "b74503e2dfbca8ef01c284d40aa77dc82be308b9" From patchwork Mon Oct 12 00:09:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100383 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 630D8CA9ED5 for ; Mon, 12 Oct 2026 00:10:43 +0000 (UTC) Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3488.1791763838925972453 for ; Sun, 11 Oct 2026 17:10:38 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=CMOrLQ3s; spf=pass (domain: gmail.com, ip: 209.85.215.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cc50ad2d650so899776a12.1 for ; Sun, 11 Oct 2026 17:10:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763838; x=1792368638; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8+1OKLLfY0HM+hYdXDzeeA60NjAWoNrRG1H/m8ZLgSM=; b=CMOrLQ3s2Y1PKACUD0gpOzH+of6jtBd6OHSqZdGVugxxaLnywjFA6qLAy3YEm6ZkgD KHTGSm1SN98ylbSRQxG0YXczgIar57F6EGKFmmj7uK7lgTZEPPTHFM5V/EJKbLd5J17W R6YfrdGtJviS3AG6COVpEC47zL38A4m0Q8ORXTvai6N2Aj4xUCgHw35CRz6mgf8RMpNo LjF+Rp6f0X5wSN8fp0rSOAgIek/B2h9981ljjO6cq6Mvnw6Bn+pZfA0enW1kOc9KOKKG zBapLd8E0K4b85jMSnDX8dft9ta8Pvy8vHLOctLpYxSyvkL3CWGiHnPiw+89Ob7s6HHF S/KQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763838; x=1792368638; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=8+1OKLLfY0HM+hYdXDzeeA60NjAWoNrRG1H/m8ZLgSM=; b=Fx6/i9EejfMlRjih7k77/w8mwQj4hsBITINy6EIUHtB4xQZv+sLz5SZu6gaJIljSq8 Ull6JO1T5Mqu6f7jkJ7r+LBTBd6YRkk6oWk0Tepxq1KXrMgdtpcMaCZmITsZemGU5I67 RO5Palnu4/RfSigZNyPpiuv6kNqY03uTkLqvwZqFDeOmOUnTnKBj2r8N9Z5TutZnLmcA W9taZXEV+LzDDXXN3y+4J5PQVp9W1+mpmVwclDXxkwh3YTN51F+oWNAYqGyLpM0I47M4 1bWl2KvQspj9wdI36fpy/PmaZoDJRK3IIxOaJgcPt1CMHiFAzuJBNAPJoV5SHDvl1G3O QGvw== X-Gm-Message-State: AFq9FYJW/50yJ210+DekZId/qrorogv7gTM2Z7ooa1cEzRfwgDEDjfvZ HQa1rmEuWLCbAkUn9o41/+QW659SekyJYCokEqj0g/hObZ3N625YMtzxHRlbjZjBYKI= X-Gm-Gg: AYBFou3tLvUsxm1zQQY/+dG8O07+6k0QC01SI6RoQugz+bL/ljT4sHs958Vt1+ayKW5 VzYmGc8/x+nMX+YJ5al1nsupKNyzoR/vfAdT0ovUjzJWdLvUh7nGWgDcB2i/+f2UsVhdfkXXamu SRvHBS7GAdirOu+N+a6RGpqjfp+G/HzyETZHga99pPP5GdA2qeRQM3EkLa2rnWIR13aP53Wzi7G b1kc9b7KpurIfz+37rXDoSXSr1Juuvbt/u0rhuM/YoX2pV9K/3UjOVPfWw9bEsITUmA5lW/VdHE 0ICkRW3zNxVuou2m2dJ/T1S5avpbEUVmF8LEtVRU4OeWyu8TUycTgCMwOm9Gai6MWs15YcKceB6 cjAv5KT1ohjD4wxAYHHlo8w0x3Q+JlWjZFR4tlwu5gGE2RxtbIZh8rnjSQlJ3DNkxWv2S81kHTZ p8fvg9eZkboiaaNyJy4gcZY/VpFxEK2yfWqE7GtR6t+0JHzla+/GLGaVA5q+euoiEyo2cbVnJJe emZfw6MMzXsOprXAc65MstUOZr8rdcOy931UB82+IqMNCMTfg== X-Received: by 2002:a17:90b:384a:b0:3a5:37e7:7118 with SMTP id 98e67ed59e1d1-3ab3a731577mr6717168a91.16.1791763838341; Sun, 11 Oct 2026 17:10:38 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:37 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 9/28] haveged: ignore CVE-2026-41054 Date: Mon, 12 Oct 2026 13:09:47 +1300 Message-ID: <20261012001007.2541673-9-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130734 From: Ankur Tyagi Debian[1] also confirms the fixed version. Details: https://nvd.nist.gov/vuln/detail/cve-2026-41054 [1] https://security-tracker.debian.org/tracker/CVE-2026-41054 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 086a780db02e001946bba0ecd337ee7834da1823) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/haveged/haveged_1.9.26.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb index fbebb158eee..727f8563799 100644 --- a/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb +++ b/meta-oe/recipes-extended/haveged/haveged_1.9.26.bb @@ -21,3 +21,5 @@ EXTRA_OECONF = "\ " MIPS_INSTRUCTION_SET = "mips" + +CVE_STATUS[CVE-2026-41054] = "fixed-version: fixed since v1.9.21" From patchwork Mon Oct 12 00:09:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100380 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56FC6CA9EBD for ; Mon, 12 Oct 2026 00:10:43 +0000 (UTC) Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3491.1791763841494160548 for ; Sun, 11 Oct 2026 17:10:41 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Iwfm1OVs; spf=pass (domain: gmail.com, ip: 209.85.215.171, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-ccce967aa8dso567176a12.1 for ; Sun, 11 Oct 2026 17:10:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763841; x=1792368641; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MR39kHT8Rwj5ttSiVFLB95sc/8LyJ4pAhvdYOC3+C/U=; b=Iwfm1OVsrm899m8ln8wBWnN6/mcQ1Mf5qicihI8E4KH+C93d0PjRQxVanxPfAcoMLp +c/b5ISk6Y1zmvKo35C3fbDJCzQCfGKuH279k+IGg9H0OmJp2p56A9fvPMEUzJinhqaD +s9q2vkdEeHjGSCvAvhAOgK5zT6iahSS1o+8Cm9fElKDvsPUlDYbRlZJFPTO6gNRKMqb FHhFZ/w2CNvI9+MRGDB1s2WdLfSwDg5PhsN493Gg7TGBh/a9+Yw19pRKdSuV1xBJ1k1S HhtV00u9A/ljOm9e8e0qreWFl8HydtpfQPyy6BlzIBmvAUi4yQZ0EifyNClbSinFyY6N 39tg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763841; x=1792368641; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=MR39kHT8Rwj5ttSiVFLB95sc/8LyJ4pAhvdYOC3+C/U=; b=ci9zoK87RF50gIbQJmtAknysRwAhIAy1q2KgYbvD+Y/fHLSUuP0DHHdpfbdOroOL6Q R1zIJtmrpfNQTVEAtQGjZR+rAGt6ymLfqA+G0i0B+/bcZqRU/HVpBU0ouKttbwao/czD yWiQ9saz5ohMizqyq7e0wrvzV1SLffhC7YMxxQQniqgxAD5RxtsD1Qe75cGxue2bC+bU gQYkKHGPFWTeDwZ9hpYpjSbUMxzYOfKCrQuAABNg7upE+l2L1amqpKQtOeDKuwJW/EVT 0GZ/iFsJiNA4c0fekLVX3030YkvBvTlflfydXtj+VyL8vOVMbh8iJJ4KfN4WsDGwnfa6 edKw== X-Gm-Message-State: AFq9FYKcU8oObl1s7OL4JnsCKeJZ+sKH+GOv09K9mJlUDYAvp5jZ4Vi7 MK33dvvEIm4q9iQqce9+3z2ZjF6ETkOIxe8lFgwlJrrf4ooZwa1avB9vgqo5eExcJ3A= X-Gm-Gg: AYBFou3YXaMRzqPeLE7NmOJUfbjD+cEtMB3UQmo2KZ7hjK8JfQhQheCwTjV7XMAvxxH cjTJQKPVnQFf+f1D1wPEfCPyLDxeHVxay8KsZr/ZlS0Y0q+lrAihPzAZNBSWXhaYmrrwkSWINbW pTdlsv0GdwGXQxszspcXeM7UKxBYRXqKuJagHxtYOfmyxlu7OhDAPbnsF3YaCYSaQ20C1OU4/xT il9C0AiQoshAFQKCjkfmwH4hH/Tf0/zJZBozfdYId0XIh0FoqGgAlytzSv8Jej3mFbgqvGxipkZ na4wiJuODI9qqMir21MhZZI5LCC5MF4GL6HMhKiyxpxueIUvKtGk1p4D3uTJazWZT6/Cbc0F/r9 IiZWb93xcsTsHeH9G/pC+B0Lce4UzqeisxvEkJyrFGPcuyIYD2qP3zLTnR7aFuZaNRJzRyZIJKm 3G0SxvRM8vlFd7GL9+4PUqCQcYzhlD+lnmDg8eAb0UDWTMs2FXNeXNrGjR6Pyu5tRYyadyAAFZH y/CyEbdHVfm9l66Z0q+1JtfcqG8xMlznJzr+tg= X-Received: by 2002:a17:90b:384b:b0:3a0:c276:1ec0 with SMTP id 98e67ed59e1d1-3ab3a9536cfmr6022377a91.28.1791763840790; Sun, 11 Oct 2026 17:10:40 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:40 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 10/28] gpm: ignore CVE-2025-4558 Date: Mon, 12 Oct 2026 13:09:48 +1300 Message-ID: <20261012001007.2541673-10-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:43 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130735 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-4558 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit e134adc8f3e5ff7359d7df04c4a841e4d5eeff15) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/gpm/gpm_git.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/gpm/gpm_git.bb b/meta-oe/recipes-support/gpm/gpm_git.bb index 155e56bdefe..9c07f334b0e 100644 --- a/meta-oe/recipes-support/gpm/gpm_git.bb +++ b/meta-oe/recipes-support/gpm/gpm_git.bb @@ -42,3 +42,5 @@ do_install:append () { } SYSTEMD_SERVICE:${PN} = "gpm.service" + +CVE_STATUS[CVE-2025-4558] = "cpe-incorrect: this CVE is for GPM from WormHole Tech" From patchwork Mon Oct 12 00:09:49 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100385 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82A05CA9EBD for ; Mon, 12 Oct 2026 00:10:53 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3510.1791763844076174991 for ; Sun, 11 Oct 2026 17:10:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=f3pKIMPW; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cd5e6f0a22bso227624a12.1 for ; Sun, 11 Oct 2026 17:10:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763843; x=1792368643; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ZjhCXHBxUjyK6lESQo2PAi2aWndh8PCz+Tl0U6po3z4=; b=f3pKIMPWV5Pj+0rTQ+YH0aWmTT20JIoVzE67apF0hMkRLrvcexOXqrZgCJ8C5NYnAI IwxN4d6u0iVzpoACIaieWLm00WMgHAYIgGbLnR67LeOnEzpirgOt1qtnl8aXMcpc3TW+ o5Zvii0a1HgMZe7yLUhvBWnPuluWutH443a6VMo2/1f/3XpdgKFtD7VR3nMMYLtd60Kx HvPlV4DkOXcJ2d4uO3rmiYfzazrmnL7J5s8DGCVNajUCqD7v40nb0DXLJE3ML1ciq0Vi QS7kzm2CfQLwSMFC14+c83ZIly1TOF7OBDpqxcB20IjGRNoYCBB/l99XO3sV6Ca/sJDt twmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763843; x=1792368643; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ZjhCXHBxUjyK6lESQo2PAi2aWndh8PCz+Tl0U6po3z4=; b=1mRFKf2q0y7ZtgUN8Xb0GNRZUL7hZOeX8ZDp85/GJ6e4ruTQdj6mS7iyt8Qhl5U7/p sCIe+n2ixDCTKpoVCu1fYU4nALZcV/aClNMxtOLDY8RyYbHq1NLgCablWLD5mqCcApRB vAdfPdg/tYA0OMS93BTkwcGuYZxplBsS3qIVLsBk8WM0CDu88mWB2jXyQZN8DQmaiZ3k 7eQiZp6IezV+MZtoHXlHZ4YdE/KHoe09ghzT0ab6WRyXFJMCsB0euc+clsd5q5pVH9Gq S65hhreY4t49OUOPlJ5PWEJT7yhk2LsWqDbv8RaAHjZsQRNfl2Co0Jgp5T9MYrF0y1Nt RAFA== X-Gm-Message-State: AFq9FYIRnfTiaWxz3ga2C7TZ83re6hGSDuncTV2dIcnaa3SygAyxpROX kOqa2RxXmRp+YBSvgeVVBph2wMZ/oMI8fmN3jGRgwEyGw/rQAPlWJQi3U0Z6jg== X-Gm-Gg: AYBFou3yqAHvu84OdPmgVzgjWX//RogErH63+gHJ0ZKqkSE9fIA4Te+ng/m70MDjWxl HnEhEoMEWG1NwG1G/aGzjIxSQaIwggxiAmRfU1lIo6KHZijFUQCClV+Xo61jRGkiNWIDC+G55D4 /cnQy12Te4jmrCej/ItuwPvuGPVXN3ohfZFfwkKkPY4s6xLUbnlOs9k8ZE1c1dqSsuy6xYdOrTl lbfBALixGLHzi/4yYQP+n37+1wlv3AMjeu4KVx3TcD/O4Z0Iz56Wuz2DJ4w/eFfj/ph3UT/qr2M aKsKi2dSq3C6Ei3bS22lzwr195KQ+pp7fysTziSDmERsvBhI1D3tWmqnq98gMd1StF2HtvqX0RA lPZ5VsdaVaBoDHSjVpMeaUF+6QStsHaE19HOhN6lknZT/dLqcr744sHA23AsSpqEQhXft/d82+V +IcGh0AFSwpL6pk8vQFIO9MpC043mhZrxqwHt5p0UwwutExnyllYVuqVfR0sNKMuIAI95MCdPM3 e9LX4jPpnIz2yr661M2Dx/AVm01yvippN4MqfM= X-Received: by 2002:a17:90a:d006:b0:3a8:6a04:80ef with SMTP id 98e67ed59e1d1-3ab3a2901c2mr5330967a91.6.1791763843373; Sun, 11 Oct 2026 17:10:43 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:43 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][PATCH 11/28] gerbera: ignore CVE-2025-23386 Date: Mon, 12 Oct 2026 13:09:49 +1300 Message-ID: <20261012001007.2541673-11-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130736 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2025-23386 This vulnerability is due to openSUSE specific packaging issue. Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 369d9629673fd4282cc88fc9b7435de5d1a0ceeb) Signed-off-by: Ankur Tyagi --- meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb index 3d28273f30a..ca54cf2315e 100644 --- a/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb +++ b/meta-multimedia/recipes-multimedia/gerbera/gerbera_3.3.0.bb @@ -29,3 +29,5 @@ PACKAGECONFIG[js] = "-DWITH_JS=TRUE,-DWITH_JS=FALSE,duktape" PACKAGECONFIG[zip] = "-DWITH_ZIP=TRUE,-DWITH_ZIP=FALSE,libzippp libzip" SECURITY_CFLAGS:riscv64 = "${SECURITY_NOPIE_CFLAGS}" + +CVE_STATUS[CVE-2025-23386] = "not-applicable-platform: The vulnerability is openSUSE specific" From patchwork Mon Oct 12 00:09:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100386 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F9B5CA9ED3 for ; Mon, 12 Oct 2026 00:10:53 +0000 (UTC) Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3511.1791763846762327861 for ; Sun, 11 Oct 2026 17:10:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=q/uwpAnU; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id 98e67ed59e1d1-3aacde0cc0fso460283a91.2 for ; Sun, 11 Oct 2026 17:10:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763846; x=1792368646; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=dvesF0Vep8chKF3Hj+95VrPPTpeej9DI7y0P/dY8fYQ=; b=q/uwpAnUyievWV3T7WZLiNxz6P4CnbFROGU0iqWIrc8sfsiu4z7djN3MPohtIp99JX w6IAWW606kOLKzQtTnxtrCvkb0PIt8lhzHSIBilQLb3ctSu+wYhuAk1YxVsZZokgnuEy ax3M/xwVWfz32G4FAbEzcUjwgGqkPLMIe6ztFbPXxWb8HWvILJV9HFnmiHQn35hvKM8u GTkeYvnQ+ZuXHFCa4E9mfFcRwUPUB0Mk3+rZiV22eoM6LeRL6Q94Dh3KG7KpjHQdbhc8 ABxFqOWEWtvszaPCRIZbm5A6G2aIb+yy6BAJa2J3nQKIaAsp2o9sHQ2pI4tq/tjAd1oN +nEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763846; x=1792368646; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=dvesF0Vep8chKF3Hj+95VrPPTpeej9DI7y0P/dY8fYQ=; b=M8L/Puwsv8BVVPbkiwxaVJZE90Op2YltaeY0RuQSZWNmO3Ydz6ZZCJlN7ITcVCGzHK VBMl7ic9HQAXYDomS1Otq424CAIl3LewuU3oc2DS5WSmWPHXoqZ+UKv8j/9NynefvHia O3vOVYHz9NRQgDu1WfZrxtrCWT/u0bSIZhxUKrtiN0y3txxrDLtBP38RvZKbdSwZmUP2 WeCD1vCQQasYklmf2i52XlN94gP1ytL9XtBCM+d+AifwfNBVNaC+NsMGfh9qH85vTwTf GiWgYKPrcyQWU5Es54TuSb4JzO8aXPK35kTYSU6j/OQY2dkTYfJ/a3Qu72cGVpic9PbY odNw== X-Gm-Message-State: AFq9FYIQJVUi7KKDXZOhFGR4V3iHq5KLm4S/tQXsSFNSrCSk/AfEoHYk pTymHlJ2oVSiqOKUxyE7/e73xi7bxQW5peMoTV62UNTD7YUpQnXIhm/QV4NvjXnQgfM= X-Gm-Gg: AYBFou2jQgFG5HE+XQmUHjKzk7QIhDMh/J9Jsb+hV9maqS0m/7nZfJ0G7PfqJZ4nkSW NxMVnT4iD2Xzluk7hN1wzKHdv0MLSSozeVzKfySuHLwTdKglfCRtLiqQUxmBAT//wLx8IkOCQHR xJwyC8IQLvFQKnTq1BwkA2DTlb6IZv1JueUjrPmyVyTGIpA8iP0HQxNYNPkaQiFOPqX6YbIE2Ly HZ6f+fj70x8ssgkFogTXa2usMqmMv3g7kwsrmm+8Jn+5ojpQA6YHarkE26jq/qKHBf0xt5msvKe WXM6o1fredS6rs/TBOWf6rWRVOXRKiC7S+xbOT6Nb7Oj7eSVk7wNy9m0S5qJbCzZYwpP+m/iRZE CvlijAbiv6HWNbTzfSRydfSKAZsZV54c7TCLytYhbSCIl9icyBjLCSRobF96129AI87VYHDJh7W 1rfrRYd3Oix4MU4uSj1YGTPsrE2gZaA4Tynm0KW+9DKhvQdEljccuWplsWeGCbAZ8/yfSupfcLC 1UqA9YlVZd6cOisMvnwXCVVRrpVPsaux1C4z30= X-Received: by 2002:a17:90b:3904:b0:3a4:7195:ecbb with SMTP id 98e67ed59e1d1-3ab3a98c83cmr6946325a91.30.1791763846121; Sun, 11 Oct 2026 17:10:46 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:45 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 12/28] iniparser: mark CVE-2025-0633 pached Date: Mon, 12 Oct 2026 13:09:50 +1300 Message-ID: <20261012001007.2541673-12-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130737 From: Ankur Tyagi Also mentioned in the release notes[1] Details: https://nvd.nist.gov/vuln/detail/cve-2025-0633 [1] https://gitlab.com/iniparser/iniparser/-/releases/v4.2.6 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 86fba2b5805f6c8ff0a5f936106a9be630bc54d9) Signed-off-by: Ankur Tyagi --- meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb index 9ab713ee92e..5958ecb9c6c 100644 --- a/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb +++ b/meta-oe/recipes-support/iniparser/iniparser_4.2.6.bb @@ -15,3 +15,5 @@ EXTRA_OECMAKE = " \ " FILES_${PN}-staticdev += "${libdir}/cmake/iniparser/iniparser-staticTargets*.cmake" + +CVE_STATUS[CVE-2025-0633] = "fixed-version: fixed in v4.2.6" From patchwork Mon Oct 12 00:09:51 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100387 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88C00CA9ED5 for ; Mon, 12 Oct 2026 00:10:53 +0000 (UTC) Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3493.1791763849657181188 for ; Sun, 11 Oct 2026 17:10:49 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=VL5Emejx; spf=pass (domain: gmail.com, ip: 209.85.216.48, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-3ab2bf5e75bso621830a91.3 for ; Sun, 11 Oct 2026 17:10:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763849; x=1792368649; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=AZOpdh2ofxltEUluA4G5vv652iJgziEy/5DNpaJ57go=; b=VL5EmejxXu4E2aO+/pYrl6uOv6XrCC34QOBDnxroi567Q1vbvCsdeL+902ldv3qmoS Sc2bBl+9NUmw8sRk2bxkbyaiUPdM5C76D/gmvyB6Y/MTQHQXrtRAUMZduGnJs47p/YF5 S2GJ6XzPu56uBe1K4ObcExW6zqVYw3lXAyDUKSLmhn8e/xhtqXL9Y8qi8Y22llvZJluF lCmiwRruREA08Ug0yzJa70XYb1qgrj/BVl7d7gB3wHUnm/LhEdhtKMeou+lOoR7l1BGS oyOUiWsfJNMFc3urf+qwcnVlRQbqMeLKWIaSPnInOAPSyvZg0O4F8dlvgrqan43Uylef O8Jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763849; x=1792368649; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=AZOpdh2ofxltEUluA4G5vv652iJgziEy/5DNpaJ57go=; b=2e0vPnnOxbER0p819jwnfGZ5OVg13AckibeTiMHOIgJLhFBnnUbGa1PLj/kCwKZu9X ijGl/X65NS/+Hh3jY9rzcUsmtaucTntjj9N5V6VoMv2lk4tRatYVlzX1gUZEEqI+7Dmw CHvsvaNl7l9eUtxdGz2C5bm/1Rm+x2St5LNg/dOqvPrzkFXZIX5W8HbnOQk/gYLgpUZr yTlSnIU7udWT0x31sYe3/TBmqgn5P4QJ2jkcY0byrG+L9Vp39cxekL57Z9qAovCEaMcZ S3bduYhIPdcKO0XhP0bD+B/oZbrhDM8czb2B4BLU5Hb4dgSI1SsB7+AKt5+PZFr70bEw S1tQ== X-Gm-Message-State: AFq9FYIKiWupBWIqKxqyBgtNqd97Q7LP9PPHE2Oma84dH3bBNaT6Hai7 DXDzgJxDmGz7g7LFunmS6BZimpmXo212oLU9H0ex3Nn8wH0rSAlHeftgZJlof+cBHbk= X-Gm-Gg: AYBFou2e22RMZIC2FAmbSdpuczJImQclzqok6At3l1VefWFPq7/5BungOSbOZ2LZDDw HuyYYuoRgqR5JAveT8xA1T2XeLb8WmJ+krTr5WUy8U1+ZJF58bfQJ4c4N0eqaqYylXMq9d2N9Np 9z/5lWYiHb+yYUW26HGEkJxCR6boU1WRPt0daOeToi3if8cS6FmZh7OWauWXpbuIFJ2fiBwCt9q PerJagGIErIFSkCjwLY5ozYPjuPhAev10VfUX/g3S8jJUhHlqoGNAhzZuoGkGyHHjyfGwFe6s7b F9E5QzqOCYBDYOYLWJ9+twGDo2kcQuKzXek5rzeHjVD1zM/1pgJVCDVlEo39brCztKluWCo1O2s UerKE896Cd6hWoe9cyn28lP/vamBzAlvW4n2VqVtAxsza/2YgjwX7epCB7u0NklV8hN2deVCnFW W5s84mzVss80EN5kFC0E8+mmqw/R4Cpt1fuZSpfJeRcxFZweG3qhR7oyhrvWd9OTshT+VzKIAWs 0JD9wuuZsvtKz8kCBDUUQvaX8UaWNqTgfuNQ9M= X-Received: by 2002:a17:90b:224c:b0:3aa:faf6:a951 with SMTP id 98e67ed59e1d1-3ab3a9a93b8mr6851755a91.37.1791763848924; Sun, 11 Oct 2026 17:10:48 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:48 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 13/28] wolfssl: mark CVEs patched Date: Mon, 12 Oct 2026 13:09:51 +1300 Message-ID: <20261012001007.2541673-13-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130738 From: Ankur Tyagi CVE-2023-6937[1] and CVE-2024-5814[2] are patched in current version. Details: https://nvd.nist.gov/vuln/detail/cve-2023-6937 https://nvd.nist.gov/vuln/detail/cve-2024-5814 [1]https://github.com/wolfSSL/wolfssl/blob/v5.6.6-stable/ChangeLog.md#vulnerabilities [2]https://github.com/wolfSSL/wolfssl/blob/v5.7.2-stable/ChangeLog.md#vulnerabilities Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c12fcc9b481d5fcd94db96cd062042301a4f24b1) Signed-off-by: Ankur Tyagi --- meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb index 8fc6068560b..a2b41b2d3c7 100644 --- a/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb +++ b/meta-networking/recipes-connectivity/wolfssl/wolfssl_5.9.4.bb @@ -72,3 +72,5 @@ CVE_STATUS[CVE-2026-5504] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5507] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5772] = "fixed-version: fixed in 5.9.1" CVE_STATUS[CVE-2026-5778] = "fixed-version: fixed in 5.9.1" +CVE_STATUS[CVE-2023-6937] = "fixed-version: fixed since v5.6.6" +CVE_STATUS[CVE-2024-5814] = "fixed-version: fixed since v5.7.2" From patchwork Mon Oct 12 00:09:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100384 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76752CA9ECF for ; Mon, 12 Oct 2026 00:10:53 +0000 (UTC) Received: from mail-pg1-f178.google.com (mail-pg1-f178.google.com [209.85.215.178]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3514.1791763851996338735 for ; Sun, 11 Oct 2026 17:10:52 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=TZLCV8NK; spf=pass (domain: gmail.com, ip: 209.85.215.178, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f178.google.com with SMTP id 41be03b00d2f7-cc50ad2d650so899881a12.1 for ; Sun, 11 Oct 2026 17:10:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763851; x=1792368651; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Tq4Jyy0Md+hDU71NW0upmsmT1bjck2A5lshkdE8RtuQ=; b=TZLCV8NKhKMQXR1nCX5XE3tyxEUQW53cxZZxWnUB1uLBoTE18G+wCdiiHvZajlX5Q0 9MgB+WZoH/3hzA4LYo2rUokxWmeJZUAi3wTNXSHRFCFB4+xoD0/DsX8/z6Pkz1Cj1TtG cJ5smzfmuHehit9Z5yAVIGtqOu5ArRbhX51mu/XaRvUdhEUs8FxMgo/e+yMiVPB+c1jD sFX3ZeQyjNlmdmrussvkolAv85sOfHuCBmlt5QtXCOCrJfr7AfeW6zyffO5HMNyHG0iP AIccF1c8pbnFzf6ISop5FFueHhyaoCa3CaFt9hW4lRYKSPH2B24eBQqqFCYFoD3p4NxD fdFg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763851; x=1792368651; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Tq4Jyy0Md+hDU71NW0upmsmT1bjck2A5lshkdE8RtuQ=; b=Q/cA6URF3JyBITcOVmwq3arRDtF+6VDowJ8lljd0LYLzPVKFfylZLOhlWq0d5L60PB ya9szWUd0Zm5mNpCFsWPuZQQfmX+uE2Z8Qdklg4m0j6mc6ujcf2dayqAR57Yh2vQAQiS A0iwvq/mqXGRGSwldPVrMW325FKX1FjE1iZVdarXR2ve0Q1HskiK87x+Vwvb0Cbn57IB E5+lFnYZzm2Rhp73akhuMCfuzXFrHFI7emVSBgpZT6lNKD9ka+zkSewqSGYuD0VDHC23 3/fL0JU2A5R7CEwOl5UhFPmU8iTyO/0P2SAm+U1JmnCoMgTxnpMP2OOeKg5j/KwixGck QH7Q== X-Gm-Message-State: AFq9FYJYeDuBZNBMaQFXwbzH5ffb5za1XYhvWhdTrmm2U2xk33oVGS/E ttMtaSXcxuQjtVnt3uwO82HrZdGU8ANHD3r+4If0SuWF7WSp7mqcf3ML19nIBw== X-Gm-Gg: AYBFou0QnFYE1EFtuJ5ztQg7vRJxqsc3+GWPxxMBVQQNl4fX+gJRn6UHGq2yyqLauaW mki9t15Xeohz4d9iFmG/bxI/aIvxdr7H/J5t3h5YC0Ow7UTLuWsTqnce78UqnhHMOSEfRWUeVHh mOEWkdZUcP9j/um7a5Pua6x/DSyDdpoUIm13qwVfLaUZ2HI/XFvXI2boPOpT/bgSaQgtZetra0b 0BbGZvF441DDwXGj98r/8MHAeAifA/C1kK9rxpxOsmVRKlB/LfW3HsPqcZmQu8tTdC9wQryulTw m1hE9IV27YrYskdhzZ6JSJa85atcPaUz5Ww1TeSItDMMRfGaACbWlw/E6cHlcaV5WU4P00gMDmX D+kNmaYPfFffvQLMigVlPVaynfRPkweMbQPJsI4xWAa5qU0Bd0vLL3Au0g9wHAJHCRDZ2vInS5X +dczTFOdXznimrK6fYom0lA/CMwyynDI3Lxi8xDAIsfo4MfXdINVyr8DHJU+x7nnW7CjEzOZA7l NJp3T/P73tc1967vwBNpJm3Ul6mkyaDJ1IyYFs= X-Received: by 2002:a17:90b:224c:b0:3a8:6045:5a19 with SMTP id 98e67ed59e1d1-3ab3a8ce938mr6606619a91.37.1791763851316; Sun, 11 Oct 2026 17:10:51 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:50 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-python][PATCH 14/28] python3-gunicorn: mark CVE-2024-1135 patched Date: Mon, 12 Oct 2026 13:09:52 +1300 Message-ID: <20261012001007.2541673-14-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:10:53 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130739 From: Ankur Tyagi Debian[1] also identified the commit. Details: https://nvd.nist.gov/vuln/detail/cve-2024-1135 [1]https://security-tracker.debian.org/tracker/CVE-2024-1135 Signed-off-by: Ankur Tyagi --- meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb index 545947446cf..e19be893602 100644 --- a/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb +++ b/meta-python/recipes-devtools/python/python3-gunicorn_26.2.0.bb @@ -41,3 +41,5 @@ EOF } RDEPENDS:${PN} += "python3-setuptools python3-fcntl" + +CVE_STATUS[CVE-2024-1135] = "fixed-version: fixed since v22.0.0" From patchwork Mon Oct 12 00:09:53 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100389 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id ACD1ACA9ECF for ; Mon, 12 Oct 2026 00:11:03 +0000 (UTC) Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3516.1791763854711617576 for ; Sun, 11 Oct 2026 17:10:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=MXEX7Izv; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2e623eda81cso7569395ad.0 for ; Sun, 11 Oct 2026 17:10:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763854; x=1792368654; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4x/C/dWGcatHe42E5jutBB/abcUKIjeNHiMFKqhs2V8=; b=MXEX7IzvrRje4tpYcf8pR9NH+OuLuEib0oLzV0rBxiBvPF5lqxPu80tkEpvh3gyPmm Q/Xs+MPkpa1/s2Sc2UD6h850UQao4UbiGt7pC+6iCR2fcCsIqPsNG4kzUSB1zwSjXhUc YH0s0dexnHncU/7WQCIODdl0+0KVo6RgOgfepbnNC0/uFJ0MD4YbCXr1UQU9oCgnvBmE zAuma6iXn0Jx72pNNfJcmnZzE9XazrDQYFBlju38LjDcub3lby9hvZErpv7BKVNTPxwL 1zwxbCgySpgUCyjkmMYEKL/CgmcOT5qFdkfj0kmxs8ojAfbbmaRpDILQsVdb6SHo2njg yrNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763854; x=1792368654; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=4x/C/dWGcatHe42E5jutBB/abcUKIjeNHiMFKqhs2V8=; b=vEK7Kglt9LfO+2gWfi8Kd9klR56iH1PPU+ZJWCt9NwMuxCOFwpZtVN2DNmC2SmHD3E D8HGIjjtden/H1HFnjh+4CGutagE0XA+SJ7Fja8Cm+Gm2pRNwZmv1nsUS/6SM3xpGPdg R6llcGMmVFkUUMMQz+AMAT+Xd4K19/g74jdOH8YyvpO/8PN3keviVLKQChCP4QsxyCZj dEsqxBQLxTq0oiGSEx9vYAUkRlmTR4zdc2Eh0m0vbv03zO3MlT/xZViSdOhT6fiJLtSv +tOnht+7hTqko384gnm3c5tfGRRjzgOWuAa7NxzOK4APnOuIE1qSI7p+s6MQcBsvmxGs ZZAQ== X-Gm-Message-State: AFq9FYJGO7GWgzlukHd7XAkaNX4K4pjtaFBqJKYSbV41087g+OnCszm0 GMEdvzZlHow8PbH4OtlBxpYrr3IY5bwRY64pkJJ3sFUGuLZ0A6gcmI+5hGb9Gg== X-Gm-Gg: AYBFou065qhtHrSLt6mc+6eGyABOAkapL8C/84SKkd/4n+yrL4Huq2OduZSwpAAisUA kElbmYw96WgACfG+fZuYTl0VV9pU8h0p1b2dUh2QqHFzHKO057qpAgQZ3KgHd4v0t+M2DqmW2N5 NSVihKM/c73RhN4bJSalMuSZjU8fKg1OxDC54XccrMwoxWnsVwV8mugUwAzP4H1XBzt90PKcNBA k7wY32jb/vl4lpvmlXTYK7T5QiyOqreUIsq/pQbzrWzLMcS/NvElx6R9bixxv9VetP79GCUWf9E 9n66GsrhTw7B2zMcMZNOSxa4n90M+jDmRcEBahPwk1Po0cisVb+PRXwz8gUk1OpfdZzlPQDyYA9 FEIMjCvivMErJN+HmpqsdVb+G5fNdu+5l9ylD1I39PpGf+Jb1GjRVVd2eOPQlXDl4JnzQ3jrTVX 7VFinGXOfJk6HZXd68fFLAl7bv+093eL46TAEchhq+cUBHp1PxtV7BtjgIURVS+1NBotbbkKBDq 8TjK9v5dqmYcYt1kQecUlbyjiwY53plsGOniF0= X-Received: by 2002:a17:90b:2790:b0:3ab:be66:ddbf with SMTP id 98e67ed59e1d1-3abbe66e03fmr2120609a91.54.1791763854047; Sun, 11 Oct 2026 17:10:54 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:53 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][PATCH 15/28] libde265: patch CVE-2026-49295 Date: Mon, 12 Oct 2026 13:09:53 +1300 Message-ID: <20261012001007.2541673-15-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130740 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49295 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit bd09bb41b41ee12aeb181bf04e5f5961b00123ef) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49295.patch | 41 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 4 +- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch new file mode 100644 index 00000000000..189d330b9a5 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49295.patch @@ -0,0 +1,41 @@ +From 7d5e48dbf9324691ba3ce4cd8ffa089d735b0b70 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:14:07 +0200 +Subject: [PATCH] bound aggregate short-term RPS size (GHSA-g2rg-wj66-w594) + +(cherry picked from commit 691f3a3c55b3d32478c4a49895dee061a282652b) + +CVE: CVE-2026-49295 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/691f3a3c55b3d32478c4a49895dee061a282652] +Signed-off-by: Ankur Tyagi +--- + libde265/refpic.cc | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/libde265/refpic.cc b/libde265/refpic.cc +index ea4db4b0..dcd2b214 100644 +--- a/libde265/refpic.cc ++++ b/libde265/refpic.cc +@@ -322,6 +322,22 @@ bool read_short_term_ref_pic_set(error_queue* errqueue, + + out_set->compute_derived_values(); + ++ // The unused short-term references are all collected into a single PocStFoll array ++ // of MAX_NUM_REF_PICS entries (see decoder_context::process_reference_picture_set). ++ // While each individual list is bounded above, the predicted-RPS construction can ++ // append the current-picture delta to an already-full source set, pushing the ++ // combined count past MAX_NUM_REF_PICS. Reject such sets to avoid an out-of-bounds ++ // write when filling PocStFoll. ++ if (out_set->NumDeltaPocs > MAX_NUM_REF_PICS) { ++ out_set->NumNegativePics = 0; ++ out_set->NumPositivePics = 0; ++ out_set->NumDeltaPocs = 0; ++ out_set->NumPocTotalCurr_shortterm_only = 0; ++ ++ errqueue->add_warning(DE265_WARNING_MAX_NUM_REF_PICS_EXCEEDED, false); ++ return false; ++ } ++ + return true; + } + diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index ca05e9099e5..6bed3250fa5 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -8,7 +8,9 @@ LICENSE = "LGPL-3.0-only AND MIT" LICENSE_FLAGS = "commercial" LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" -SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV}" +SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ + file://CVE-2026-49295.patch \ +" SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 00:09:54 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100390 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B91A1CA9ED3 for ; Mon, 12 Oct 2026 00:11:03 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3494.1791763857284450879 for ; Sun, 11 Oct 2026 17:10:57 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=nsB+vXtU; spf=pass (domain: gmail.com, ip: 209.85.216.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so612287a91.2 for ; Sun, 11 Oct 2026 17:10:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763857; x=1792368657; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=CPtpAxsWgHCGclwUU4Kex2f7e/VVpeiiVhkw7dMAbMg=; b=nsB+vXtUvN1wNqd/L8dPkx/TXJ0h5zfrJ0R2SGl69M8qFMgOeBNTeB6V+SXDrdCtn3 3YWf6Cju9lGDZsSLy+eOA5dCDOpLCmoQwWP+BWaHhq7KQYOtc7nU/3FfAGpnMuoJx3pz 2DhBNcEnZ+aCLemyPOJ68T4GfVfxg99jvCR2OoKchgFoIdiqkCsxQYJ7qOb8mLhPTcw0 LxuNtfHEn/UtJXXfhSsUQZrmEKdLw0/r4VWtyF0x0LonbEHQ3gQfoZIUak1pkN2vkLZo y2AEd6ikQkn4ZtAJHyPPyaxinJ+UJeOVUMsWAjn8l5NYwuu1nTE+DJPLlvjQCf4ppVw6 qXVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763857; x=1792368657; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=CPtpAxsWgHCGclwUU4Kex2f7e/VVpeiiVhkw7dMAbMg=; b=zqpN8VopcwOAt1WHvXM/mtfU8wUdq1xmeqzy56NlzCe2PKIn5+tdyei7JSGa84RxaG HUxuLYB6GLErHSS2SGINSRidDNk1Q2Bi8hB2gG1cI83HUx19O6x4zSDyqXkvgAtq05kw OvEKiaz0G2tXzWhRYvX92HFkKPtkWQ8BuD+ZL1awkWDPjSr+is4cuj4vG0L+dfaULcPY B4+VqPLLC1nZvHdtdrCtlxN/jGmW4IbFrhgCge5UwmCV+lCVvfncuPnmMhcomUcZVSDw vemHdO1Q8c84d2kGUtAeCqbqZK6EUEdw+gK1/0iPyPDIg/nnnEAOkkOpBqxHqgagYdRs BX6g== X-Gm-Message-State: AFq9FYJ5nPpWbtzu4VuT09nj+Ob3VkT4qjxrXGFzam1RXTUJ4cf3+WiB X8KL/OonSFBTYDlblQ/7TWmX46NFLpTa/QARGbr4EIFG7tI+G3gJ87xXVadTUlun7f0= X-Gm-Gg: AYBFou0FOTU51S2eLPjFJtsJGKAeJwmIUHhUFJhD7vrs/d71uSkAnjTG1hviSTxsPzC LTAS944ewOmddiEAMEp19f+7Pt4I/d9qtabaOnq0QYX8dXQh3+/gh3Xg6ChC5zlR1ihQ48PXYzr m4vIybka/r8OHTlOCrYcFE9DMSG7ZR78MqDyuOZN7f07SdjfT6wUQ+BtcEP0ZivLF8fQmJp4jnu t5HI5du8fnlUSXENnj+/tySojAjOrULVXhPpF7DN4qpZhAC+vu2c5EdkW3FxnyCxTbhptWyKvha NACF4whE5/5eWwXD3j/FxMkk+WcpmyyVGNFZf3zRXDttCzW+/NYJT3h9FSFslmCg/wlgft7u3PF vjbwbLdXVUcxHAVvB4RiqTYKPAUBc+9L4ObiHiM6NDFwB6hyZIv0PSngwcm645tuKHHCuEHntXj kGvOZ7v9Zrw/Z8r7J44BU+sWy2j1tHGDmcVZ/H4zUGEbu5TCz3vifzO3VswRMfELRHqAX5iRMHS 8T2tQwQi8oJsGrjHBbZ0FpBBuGH4UcVLDl5UTY= X-Received: by 2002:a17:90b:224c:b0:3a7:9adb:2a0d with SMTP id 98e67ed59e1d1-3ab3a0218bfmr7037060a91.0.1791763856572; Sun, 11 Oct 2026 17:10:56 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:56 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][PATCH 16/28] libde265: patch CVE-2026-49337 Date: Mon, 12 Oct 2026 13:09:54 +1300 Message-ID: <20261012001007.2541673-16-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130741 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49337 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c83399f83fbbbb855c5a272c9702e8aff4328ce4) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49337.patch | 53 +++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch new file mode 100644 index 00000000000..88e0e329491 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49337.patch @@ -0,0 +1,53 @@ +From 2f0c53241cb9bf2f5acded53c25f1b74db536de7 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Mon, 25 May 2026 20:29:40 +0200 +Subject: [PATCH] free orphaned slice header when no active image unit + (GHSA-g5hj-rf9f-7vxm) + +(cherry picked from commit 683cb9fa603e35840642f98765ab95cdb71cadf9) + +CVE: CVE-2026-49337 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/683cb9fa603e35840642f98765ab95cdb71cadf9] + +Signed-off-by: Ankur Tyagi +--- + libde265/decctx.cc | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/libde265/decctx.cc b/libde265/decctx.cc +index fbb3baa1..5deddc37 100644 +--- a/libde265/decctx.cc ++++ b/libde265/decctx.cc +@@ -478,10 +478,6 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + shdr->entry_point_offset[i] -= skipped; + } + +- this->img->add_slice_segment_header(shdr); +- +- +- + // --- start a new image if this is the first slice --- + + if (shdr->first_slice_segment_in_pic_flag) { +@@ -495,6 +491,13 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + + if ( ! image_units.empty() ) { + ++ // Hand the slice header to the picture (which takes ownership and frees it ++ // on release). Only do this when there is an active image unit to decode ++ // the slice; otherwise the header would be retained on img->slices forever, ++ // which a crafted stream of non-first slice NALs can exploit to grow memory ++ // without bound. ++ this->img->add_slice_segment_header(shdr); ++ + slice_unit* sliceunit = new slice_unit(this); + sliceunit->nal = nal; + sliceunit->shdr = shdr; +@@ -507,6 +510,7 @@ de265_error decoder_context::read_slice_NAL(bitreader& reader, NAL_unit* nal, na + } + else { + nal_parser.free_NAL_unit(nal); ++ delete shdr; + } + + bool did_work; diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 6bed3250fa5..5fcf6411131 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ + file://CVE-2026-49337.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 00:09:55 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100391 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2761CA9ED5 for ; Mon, 12 Oct 2026 00:11:03 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3495.1791763859892724347 for ; Sun, 11 Oct 2026 17:10:59 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=OyEzKqXv; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3ab62a8250aso718917a91.1 for ; Sun, 11 Oct 2026 17:10:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763859; x=1792368659; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=6QiV0nfZtc98gxzDTeDh7ZHrHNNpjxQXVoYPbjSwhmo=; b=OyEzKqXvqT5CRnO4c5A9qLvOg1cSOOC+kL3sTbwbRw7qqDqp/wIiXaTVWWEwDkX8s8 FN0MdiRDBTJhPlDVKfUV5swXfwyIydtTKUGpSHku7ckE98EcUsJwKa4dw3mHNNX2KSxa FwFDYyvhJ1FxeyyYF/t1TJkO5JOs2QyA+wlO+UeK+onIlO+1Uscu+RpttVTdLUQQpR8/ EeTwKR3oxKBMC1nQ+/l+scTUcfw7K8k3d1tWklEQSm63kOVSRdgSc2EWNb9YRgVZggDw l8jszur1RdpHmHdwPDc4Z+aSYy+xz43hLelA/lbvO/KYoojMJx0Rbtm2XOwVPiVnY6Dv Blvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763859; x=1792368659; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=6QiV0nfZtc98gxzDTeDh7ZHrHNNpjxQXVoYPbjSwhmo=; b=dwhzwMXsa6oyeX+52V2P/sE8copNQTJYo8F1EcY6iMvSbbWf2xJ987qWqZ8HBvpX9W j5oF8ZwYooDxVxbdj/S7O7RrWBcVsM6u2I5g8DCRx8lF5eLF3mMAK7dHbnAHwyiMcugD /jSu4JCofKVaOsBbVxmzfoGfeCBeI5Gt+Xrs9AkLysvDMEoH1cE82jEhHw5wHtWgM9v2 nkOs/f/NVCAJVhH6vyZRgRHNOJN8LOfW1O+gWI1FYNhtRmd77QCI7ODaTYutGQowa2k+ q/twXrzx3nG5LEqSfhWcfmrcZkvdjrRO/jRK5CagsgsnEwtfzNBA2UlHPARf1NgMn3M4 9D2w== X-Gm-Message-State: AFq9FYI7OgNEY+kK7dL/Xn6CrY67hpX+Wq6HS0oNeJRih3UzHpfmfBkN LZ7VBYi+fqNu75XIqJMaXMUU8/QK5K2DdL+JcvA1dXqLAD9Biw+79Mw9cg4aJuG5Z4U= X-Gm-Gg: AYBFou3MKrAn4pQfCzTiyiTQMrgE1IBGn39XrELz1wy2Co0d3LZtJ0iEStUHi2NCzVH eG8A9T5MkFwBt5Bui+9nqDbs4DhgvvaHJcGZwqjaMg0QdVjcJNa1VK+0Wy9phNxOuXX+miYuv8y 2Veg5Cx+dVwrdscCZjxgTRap9uCiosq8hCCyag+vE9nxbOX3Sq3Nq4tFdP/nqgxKEJ8rIgVOu66 MdJkqc+SSIzpCNWTz08NjpMuHgZChvfArpRAn5JvHD/gOFr3sIBvYoDok4AhCc7Nu3uQZYoIofs zTjFyt2MyZqkX7VE2A6fEDVniGpFl6xubq24gSNMb3ItGXlDX6DOaj+SNj5up7p24XNdNHBdCxh gwFFfsN+gayeaqotpM82ELrMqBwn56VkmajxFn6VtAsadh1l5CJ6shWbbx6okDO4SFkV8fn+AVX Fm/XFP9vypwb4WO+xlRqDIfs1M71k7Sl/4Do/85Q+GKFeDIZewp1P3AhCmcZzidiMgu8djh5q5Q 3tWaUNuwUQ639gV7E6YigkNGZHMkSvlnnj8RvIUDXohrWLaxQ== X-Received: by 2002:a17:90a:d450:b0:3ab:364a:951f with SMTP id 98e67ed59e1d1-3ab3a3593dbmr5356307a91.6.1791763859207; Sun, 11 Oct 2026 17:10:59 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:10:58 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-multimedia][PATCH 17/28] libde265: patch CVE-2026-49346 Date: Mon, 12 Oct 2026 13:09:55 +1300 Message-ID: <20261012001007.2541673-17-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130742 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-49346 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 4a63a2afa1c984b82a663ed8951b62f0ae5da093) Signed-off-by: Ankur Tyagi --- .../libde265/libde265/CVE-2026-49346.patch | 102 ++++++++++++++++++ .../libde265/libde265_1.0.19.bb | 1 + 2 files changed, 103 insertions(+) create mode 100644 meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch new file mode 100644 index 00000000000..288295b08a8 --- /dev/null +++ b/meta-multimedia/recipes-multimedia/libde265/libde265/CVE-2026-49346.patch @@ -0,0 +1,102 @@ +From 1667c33f2778a04f08ba4f7d6c1c16508350a779 Mon Sep 17 00:00:00 2001 +From: Dirk Farin +Date: Tue, 26 May 2026 00:59:08 +0200 +Subject: [PATCH] fix integer overflow in image plane allocation size + (GHSA-vv8h-932h-7r86) + +(cherry picked from commit 8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8) + +CVE: CVE-2026-49346 +Upstream-Status: Backport [https://github.com/strukturag/libde265/commit/8a1b5cf212f78e1c77cb46eb5d56e492a9336eb8] + +Signed-off-by: Ankur Tyagi +--- + libde265/image.cc | 46 +++++++++++++++++++++++++++------------------- + 1 file changed, 27 insertions(+), 19 deletions(-) + +diff --git a/libde265/image.cc b/libde265/image.cc +index 0b6071ba..94f3c974 100644 +--- a/libde265/image.cc ++++ b/libde265/image.cc +@@ -70,10 +70,11 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + void* inputdata, int inputstride, void *userdata) + { + int alignment = STANDARD_ALIGNMENT; +- int stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; +- int height = img->get_height(cIdx); ++ uint32_t stride = (img->get_width(cIdx) + alignment-1) / alignment * alignment; ++ uint32_t height = img->get_height(cIdx); + +- uint8_t* p = static_cast(ALLOC_ALIGNED_16(stride * height + MEMORY_PADDING)); ++ // size computed in size_t: stride*height can exceed UINT32_MAX for large planes ++ uint8_t* p = static_cast(ALLOC_ALIGNED_16(static_cast(stride) * height + MEMORY_PADDING)); + + if (p==nullptr) { return nullptr; } + +@@ -82,12 +83,14 @@ LIBDE265_API void* de265_alloc_image_plane(struct de265_image* img, int cIdx, + // copy input data if provided + + if (inputdata != nullptr) { +- if (inputstride == stride) { +- memcpy(p, inputdata, stride*height); ++ if (inputstride == static_cast(stride)) { ++ memcpy(p, inputdata, static_cast(stride) * height); + } + else { +- for (int y=0;y(inputdata) + inputstride*y, inputstride); ++ for (uint32_t y=0;y(y) * stride, ++ static_cast(inputdata) + static_cast(inputstride) * y, ++ inputstride); + } + } + } +@@ -107,30 +110,35 @@ LIBDE265_API void de265_free_image_plane(struct de265_image* img, int cIdx) + static int de265_image_get_buffer(de265_decoder_context* ctx, + de265_image_spec* spec, de265_image* img, void* userdata) + { +- const int rawChromaWidth = spec->width / img->SubWidthC; +- const int rawChromaHeight = spec->height / img->SubHeightC; ++ const uint32_t rawChromaWidth = spec->width / img->SubWidthC; ++ const uint32_t rawChromaHeight = spec->height / img->SubHeightC; + +- int luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; +- int chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t luma_stride = (spec->width + spec->alignment-1) / spec->alignment * spec->alignment; ++ uint32_t chroma_stride = (rawChromaWidth + spec->alignment-1) / spec->alignment * spec->alignment; + + assert(img->BitDepth_Y >= 8 && img->BitDepth_Y <= 16); + assert(img->BitDepth_C >= 8 && img->BitDepth_C <= 16); + +- int luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); +- int chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); ++ uint32_t luma_bpl = luma_stride * ((img->BitDepth_Y+7)/8); ++ uint32_t chroma_bpl = chroma_stride * ((img->BitDepth_C+7)/8); + +- int luma_height = spec->height; +- int chroma_height = rawChromaHeight; ++ uint32_t luma_height = spec->height; ++ uint32_t chroma_height = rawChromaHeight; + + bool alloc_failed = false; + +- uint8_t* p[3] = { 0,0,0 }; +- p[0] = static_cast(ALLOC_ALIGNED_16(luma_height * luma_bpl + MEMORY_PADDING)); ++ // Compute the plane sizes in size_t. Each operand fits in uint32_t, but the ++ // height * bytes-per-line product can exceed UINT32_MAX for large frames, so ++ // the multiplication must be done in 64 bits. Computing it in 32 bits wraps ++ // the allocation size to a small value while fill_image() later writes the ++ // real (size_t) size -> heap buffer overflow (GHSA-vv8h-932h-7r86). ++ uint8_t* p[3] = { nullptr,nullptr,nullptr }; ++ p[0] = static_cast(ALLOC_ALIGNED_16(static_cast(luma_height) * luma_bpl + MEMORY_PADDING)); + if (p[0]==nullptr) { alloc_failed=true; } + + if (img->get_chroma_format() != de265_chroma_mono) { +- p[1] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); +- p[2] = static_cast(ALLOC_ALIGNED_16(chroma_height * chroma_bpl + MEMORY_PADDING)); ++ p[1] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); ++ p[2] = static_cast(ALLOC_ALIGNED_16(static_cast(chroma_height) * chroma_bpl + MEMORY_PADDING)); + + if (p[1]==nullptr || p[2]==nullptr) { alloc_failed=true; } + } diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index 5fcf6411131..a02d6dd5d8c 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=695b556799abb2435c97a113cdca512f" SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https;tag=v${PV} \ file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ + file://CVE-2026-49346.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 00:09:56 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100388 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1CA2CA9EBD for ; Mon, 12 Oct 2026 00:11:03 +0000 (UTC) Received: from mail-pj1-f42.google.com (mail-pj1-f42.google.com [209.85.216.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3519.1791763862191802623 for ; Sun, 11 Oct 2026 17:11:02 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=A29gIq8X; spf=pass (domain: gmail.com, ip: 209.85.216.42, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f42.google.com with SMTP id 98e67ed59e1d1-38e42560ebcso506703a91.1 for ; Sun, 11 Oct 2026 17:11:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763861; x=1792368661; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HWE9KhoFhL239uXRN8REY/sU5aEGM5GPnqCa3pDUgE0=; b=A29gIq8XLWOc1VyFXG/SE146YEG/LzskEIioefPDQQTCBr3cUCw4Q0sinGCSWL4Pnh lid4sH8vY9H3xKOs2Al+54RSGkYB9RtRxDlt5rGphj0fdk+gZUmXGE5smQ8HzPenb6gS dUGh7A4ujH354HqR0yzrITvSao1IErqJ7ZkleERp4moEUh2qMlyPV7aijymVjLTv1K90 Tx7gT6wdmfIktS8wkjXJwoL7IkUnTx5/BhnnIoM48SuCrluR1hppRRjQwtizt8AheU8f 1KoMvmCGPZq+SGdsYqNsgRRFxhptjhvwvzmYk94vJurHHuvEBykxf+kZFhFAwHyYDIHC gh4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763861; x=1792368661; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=HWE9KhoFhL239uXRN8REY/sU5aEGM5GPnqCa3pDUgE0=; b=dCq3/m8a3CTc/rBg24uXgapfc0OxpRuF+syqLLRlYxzOKv95b4956jujcFY6kXTdDq tLNKaRFZPI6z8/F7C9GJJscvuYRE5kmjTP8iKQJao8o3EhE9TiJUguzYbCxrP86K7LfM 0HNrLOWmCSLisROZH8f96M3JAt4cQBAOwkCBHeFFL3Irdd9laeVQrSbaIqHBXlrG7Tqx 2W/tNysFpECthGSj125R4lXdL75gaRM6YfKYmPtCntB4ifrsdzH7uXG9qvRSGw4FjLoG K7brHmelhIdkrfJSPyjLf5WOJv/F4tQBgY5BAFRtLzGbv5ebbpxagNclNJQn8OeT/P/p lJgQ== X-Gm-Message-State: AFq9FYLOAigqnVBnz01nty8LHmtb1oMI7MOTYUm6nd1fLSVvrR8MuTwJ E+e6aOnbExtcEV5eiApivt864Ve+traOm/AIdkrGc+FuBxNA04ZpKWnv4g4KY2S1K2g= X-Gm-Gg: AYBFou0qcQfrvPofp9J16zWxuOLgXS8qtUKJRN7SLzCasxo11tHvp5bM+Qcln6Lfp3V Zdp5k5OGnzc7/npJuMNCeHnmY9VHZl7mdwdasi67jXY03pCtk4PU2kWAdIkRgsl2wJ9jQAG0VkH /yXsXR6PAjSFzLyPiQ7X9gW1jiuOAJxdhruhSQQzt2xUmhi5rAWF0Kd3xS0JW0dqJ6M5Dutfy9S +db3OP11ofI3j+eVXVylpSS85GmpQHmxt6yK7tzsmcWDXh1yP47rq1N8LJ+ZnqOHMZRzm5WGxvt CqQB+5RLNz53wUoTiBkyU+jw3AsUysoxfxtn47tc7c2ztKZwgD1EdiLsOBcff6vGgdmKgkni1IH FANM5nvHyCpJtRGSM35EjlO6WMr70bUkqXyIEH0PkpPJxQUvVh691u2XBgzAU86cHRXqkhFounw yaXY+mfWhPxdag/PB17MPRZsImpjRmwZuBrcTrGP6bVmJD+BZnx6u7XpKovjVbpxR/D5Bea3urv 4iXMMhUPSNymL3WjTL2WAX1qpyK0T81LsbvCgg= X-Received: by 2002:a17:90b:384a:b0:3a8:bb56:f1ef with SMTP id 98e67ed59e1d1-3ab3a2902a2mr6819402a91.2.1791763861472; Sun, 11 Oct 2026 17:11:01 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.10.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:01 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-multimedia][PATCH 18/28] libde265: patch CVE-2026-54240 and CVE-2026-54241 Date: Mon, 12 Oct 2026 13:09:56 +1300 Message-ID: <20261012001007.2541673-18-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:03 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130743 From: Ankur Tyagi Debian identified same commit as fix for both CVEs[1][2]. Details: https://nvd.nist.gov/vuln/detail/cve-2026-54240 https://nvd.nist.gov/vuln/detail/cve-2026-54241 [1]https://security-tracker.debian.org/tracker/CVE-2026-54240 [2]https://security-tracker.debian.org/tracker/CVE-2026-54241 Signed-off-by: Ankur Tyagi --- meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb index a02d6dd5d8..8e145cf8dd 100644 --- a/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb +++ b/meta-multimedia/recipes-multimedia/libde265/libde265_1.0.19.bb @@ -12,6 +12,7 @@ SRC_URI = "git://github.com/strukturag/libde265.git;branch=master;protocol=https file://CVE-2026-49295.patch \ file://CVE-2026-49337.patch \ file://CVE-2026-49346.patch \ + file://CVE-2026-54240-CVE-2026-54241.patch \ " SRCREV = "824b4138ecd51611d7073f1b50d5d6f982609b06" From patchwork Mon Oct 12 00:09:57 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100393 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C90F1CA9ECF for ; Mon, 12 Oct 2026 00:11:13 +0000 (UTC) Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com [209.85.216.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3521.1791763865460770629 for ; Sun, 11 Oct 2026 17:11:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=GkKj46xu; spf=pass (domain: gmail.com, ip: 209.85.216.51, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f51.google.com with SMTP id 98e67ed59e1d1-398a5aad413so613416a91.3 for ; Sun, 11 Oct 2026 17:11:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763865; x=1792368665; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=UQGQuHIaxDSL9TFDWXqM5bu3wBbrle3z2o81dZ1QKb4=; b=GkKj46xujP2nNZ1wuoe2qDhpwuJsEqDbhXnmLmipnCknMKpAmlW9vb6EV1wwuDpOMl SUVVzr0C49ENBBOuksxGCJO06lc68R3qt8nJjkThc802ja1Mg2bGbMPAbcYfgxxyuaBs z/VipxMrrj179zvCmcILhBiE5rsW9eEcCLq2i+ujikCaPH+l+t24oof7lW2McL6b7tvh yiywh+52rnbr2++Hhopa17gA9L3YBBVCCXhOm62CD5mb4ic0rm7dLKp4O+COAybdqwSQ MZVgD9hk90e86QUUkKDm1ZwgNySZn9u273FAurp/OQiRLOKSbzQ1JskSghL0UxsOptBB yt9g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763865; x=1792368665; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=UQGQuHIaxDSL9TFDWXqM5bu3wBbrle3z2o81dZ1QKb4=; b=acizw2Tub1w+k5GERxdMfBhYJ2fINOJt7iEV0EFAeN1jYSeyAOVYpG83CAnRv9zmAN SY9/lAZyHHImIVH1f55lyaGWgxx7S8LYgOHiUlp8627MQmqQ0qTtzmTDso0hrNBVYdvG jSlBbLojayZg3xb0nsKqIzeWsnwm7r6/ky6sHZ0izpouZCHncN/40EccI5SBoQ+2sJd8 //CaXZm7eczZ8PkkMBmtz6/u85iCz6ijFO8c6gBi00Tf0oluEB+hXb35LSlDpvLFTFtP KMlMb9qo4/puCnF3L7Pj8c1/DLi9NMDHAhAAW8xWANBo2h0+LQy+nEexa67BiVwJJIpZ 61jA== X-Gm-Message-State: AFq9FYK+fDFl2Iz+Eq0hsqyPo8SIRrgcCCJLA8usyJiBIVhZZ9GLud/I DxEEEOnxvcldcqkkJd3Bg3sgtVSTVJn4r4MMzoJ6WTIZoVtQgXXiDH+R370iefn7RW4= X-Gm-Gg: AYBFou2pYwoQK34LNw8PtQBhmRB2DUhgluiI94MGRU6lTdhy3nXku5eNy9gEJNEY3NR vnG4e6Gd/NqFTe2b3VujBpInRjk19MfP+h/lJKzMMfW6tqxbQgCQD3BX9gjEzR7LpvUWcjXGhAp 0o2wFXE7LIAf9Zmp+et8ORTcMAKtBsY6Png2TCzvqQX67Jm0hLIoqhPoXCjGHRfjESSpZT+fu8n A1bKPHtZKDt0dQ7UvQA4mW7IF/NuJojilI9U3B1IgrZhUXJ5ngDWbf4rPwPn+CK9fpDJeyl3xHZ RuhC6SeCtds9rn4MlNMn4WtGv8+mNVORA4RGP8DkuoIpJsLvQDJ3iSw3ChnsxqnhMhlpPyAtAC2 yaWgIPwnV5d9Aq4gEuz95wYgzHqca2w0AN50JfOstA/TEYh31qq5XIGKHDIfofzN+dzlqVF1Byy fJIK2BBi1Gw5pLVjRWSCpFlIsXQAqWgUhYj+01nFmXoC175w9B3MDzQrhby+sZWKcp9WFVQQTYb xaF6cTmRV7mByQZN50teeHiKa+0aXXwdfkIS6k= X-Received: by 2002:a17:90b:2886:b0:3ab:3606:f281 with SMTP id 98e67ed59e1d1-3ab3a92f6c3mr6248656a91.47.1791763864603; Sun, 11 Oct 2026 17:11:04 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:03 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 19/28] hdf5: patch CVE-2026-17572 Date: Mon, 12 Oct 2026 13:09:57 +1300 Message-ID: <20261012001007.2541673-19-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130744 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6499 [2] https://github.com/HDFGroup/hdf5/issues/6501 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17572 [4] https://security-tracker.debian.org/tracker/CVE-2026-17572 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit c279e9e68822db77648667093bcbf3013269c791) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17572.patch | 253 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 254 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch new file mode 100644 index 00000000000..373a6c374ef --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17572.patch @@ -0,0 +1,253 @@ +From 606bb0a0282d0b056a3bdda1d489a608deee78d2 Mon Sep 17 00:00:00 2001 +From: Nayyar +Date: Tue, 14 Jul 2026 23:39:56 +0530 +Subject: [PATCH] reject SOHM list message count exceeding list_max (#6499) + +* bound SOHM list decode to list_max messages + +* Add tsohm test for out-of-range SOHM list message count + +Create a file with a shared-message list index, corrupt the on-disk +message count so it exceeds list_max (repairing the table checksum), +and confirm reopening rejects the file instead of overrunning the +list image buffer and message array. + +--------- + +Co-authored-by: H. Joe Lee +Co-authored-by: Larry Knox + +CVE: CVE-2026-17572 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/20f0b9564bc46154e60f8d35578720a599d41552] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5SMcache.c | 14 ++++ + test/tsohm.c | 173 ++++++++++++++++++++++++++++++++++++++++++++++++ + 2 files changed, 187 insertions(+) + +diff --git a/src/H5SMcache.c b/src/H5SMcache.c +index eb6d612a78..96687ffed9 100644 +--- a/src/H5SMcache.c ++++ b/src/H5SMcache.c +@@ -489,6 +489,12 @@ H5SM__cache_list_verify_chksum(const void *_image, size_t H5_ATTR_UNUSED len, vo + assert(image); + assert(udata); + ++ /* The buffer only holds list_max messages; a corrupted header whose message ++ * count exceeds that would size the checksum region past the end of it. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_BADVALUE, FAIL, "number of SOHM messages exceeds list size"); ++ + /* Exact size with checksum at the end */ + chk_size = H5SM_LIST_SIZE(udata->f, udata->header->num_messages); + +@@ -552,6 +558,14 @@ H5SM__cache_list_deserialize(const void *_image, size_t H5_ATTR_NDEBUG_UNUSED le + HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "bad SOHM list signature"); + image += H5_SIZEOF_MAGIC; + ++ /* The message array is sized for list_max entries; a list index always ++ * holds at most that many before it is promoted to a B-tree. Reject a ++ * corrupted header whose message count would drive the decode loop past ++ * the allocation and the input buffer. ++ */ ++ if (udata->header->num_messages > udata->header->list_max) ++ HGOTO_ERROR(H5E_SOHM, H5E_CANTLOAD, NULL, "number of SOHM messages exceeds list size"); ++ + /* Read messages into the list array */ + ctx.sizeof_addr = H5F_SIZEOF_ADDR(udata->f); + for (u = 0; u < udata->header->num_messages; u++) { +diff --git a/test/tsohm.c b/test/tsohm.c +index 1652c9b044..61036e7dc3 100644 +--- a/test/tsohm.c ++++ b/test/tsohm.c +@@ -3702,6 +3702,175 @@ test_sohm_external_dtype(void) + free(orig); + } /* test_sohm_external_dtype */ + ++/*------------------------------------------------------------------------- ++ * Function: test_sohm_reject_bad_count ++ * ++ * Purpose: A shared-message list index holds at most list_max messages ++ * on disk before it is promoted to a B-tree, and both the list ++ * image buffer and the in-memory message array are sized for ++ * list_max entries. Corrupt the on-disk message count so it ++ * exceeds list_max and verify the list load rejects the file ++ * instead of sizing a read or indexing the array past its end. ++ * ++ *------------------------------------------------------------------------- ++ */ ++static void ++test_sohm_reject_bad_count(void) ++{ ++ hid_t fcpl_id = H5I_INVALID_HID; ++ hid_t fid = H5I_INVALID_HID; ++ hid_t sid = H5I_INVALID_HID; ++ hid_t did = H5I_INVALID_HID; ++ hsize_t dims[1] = {4}; ++ FILE *fp = NULL; ++ uint8_t *buf = NULL; ++ long fsize = 0; ++ long table_off = -1; ++ unsigned list_max = 100; ++ uint32_t chksum; ++ size_t pos; ++ int i; ++ herr_t ret; ++ ++ /* On-disk shared-message table layout for a file with a single index and ++ * 8-byte addresses: a 4-byte "SMTB" signature, one index record, then a ++ * 4-byte checksum. Within the record the 16-bit message count follows the ++ * (version, index type, message types, minimum size) prefix and the 16-bit ++ * list and B-tree cutoffs. ++ */ ++ const size_t rec_size = 1 + 1 + 2 + 4 + 3 * 2 + 8 + 8; /* 30 */ ++ const size_t table_body = (size_t)H5_SIZEOF_MAGIC + rec_size; /* 34 */ ++ const size_t num_msgs_off = (size_t)H5_SIZEOF_MAGIC + (1 + 1 + 2 + 4 + 2 + 2); /* 16 */ ++ ++ MESSAGE(5, ("Testing rejection of an out-of-range SOHM list message count\n")); ++ ++ /* Create a file whose single shared-message index is a list that can hold ++ * up to list_max messages before converting to a B-tree. ++ */ ++ fcpl_id = H5Pcreate(H5P_FILE_CREATE); ++ CHECK_I(fcpl_id, "H5Pcreate"); ++ ret = H5Pset_shared_mesg_nindexes(fcpl_id, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_nindexes"); ++ ret = H5Pset_shared_mesg_index(fcpl_id, 0, H5O_SHMESG_SDSPACE_FLAG | H5O_SHMESG_DTYPE_FLAG, 1); ++ CHECK_I(ret, "H5Pset_shared_mesg_index"); ++ ret = H5Pset_shared_mesg_phase_change(fcpl_id, list_max, 0); ++ CHECK_I(ret, "H5Pset_shared_mesg_phase_change"); ++ ++ fid = H5Fcreate(FILENAME, H5F_ACC_TRUNC, fcpl_id, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fcreate"); ++ ++ /* Several datasets sharing one dataspace and datatype leave the index a ++ * list holding a couple of messages, well under list_max. ++ */ ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ for (i = 0; i < 5; i++) { ++ char name[16]; ++ ++ snprintf(name, sizeof(name), "dset%d", i); ++ did = H5Dcreate2(fid, name, H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ CHECK_I(did, "H5Dcreate2"); ++ ret = H5Dclose(did); ++ CHECK_I(ret, "H5Dclose"); ++ } ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ ++ /* Read the whole file so the shared-message table can be located and edited. */ ++ fp = fopen(FILENAME, "rb"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fseek(fp, 0, SEEK_END) != 0) ++ TestErrPrintf("fseek failed at line %d\n", __LINE__); ++ fsize = ftell(fp); ++ if (fsize <= (long)(table_body + 4)) ++ TestErrPrintf("unexpected file size %ld at line %d\n", fsize, __LINE__); ++ rewind(fp); ++ ++ buf = (uint8_t *)malloc((size_t)fsize); ++ CHECK_PTR(buf, "malloc"); ++ if (buf && fread(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fread failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Find the shared-message table by signature, confirming the match with the ++ * stored checksum so the correct bytes are edited. ++ */ ++ for (pos = 0; buf && (pos + table_body + 4) <= (size_t)fsize; pos++) { ++ if (memcmp(buf + pos, H5SM_TABLE_MAGIC, (size_t)H5_SIZEOF_MAGIC) != 0) ++ continue; ++ ++ chksum = (uint32_t)buf[pos + table_body] | ((uint32_t)buf[pos + table_body + 1] << 8) | ++ ((uint32_t)buf[pos + table_body + 2] << 16) | ((uint32_t)buf[pos + table_body + 3] << 24); ++ if (chksum == H5_checksum_metadata(buf + pos, table_body, 0)) { ++ table_off = (long)pos; ++ break; ++ } ++ } ++ if (table_off < 0) ++ TestErrPrintf("could not locate the shared-message table in %s\n", FILENAME); ++ ++ if (buf && table_off >= 0) { ++ unsigned bad_count = list_max + 200; /* well past the list_max cutoff */ ++ size_t base = (size_t)table_off; ++ ++ /* Overwrite the 16-bit message count and repair the table checksum so ++ * the table loads and the corruption is only caught at the list. ++ */ ++ buf[base + num_msgs_off] = (uint8_t)(bad_count & 0xff); ++ buf[base + num_msgs_off + 1] = (uint8_t)((bad_count >> 8) & 0xff); ++ ++ chksum = H5_checksum_metadata(buf + base, table_body, 0); ++ buf[base + table_body] = (uint8_t)(chksum & 0xff); ++ buf[base + table_body + 1] = (uint8_t)((chksum >> 8) & 0xff); ++ buf[base + table_body + 2] = (uint8_t)((chksum >> 16) & 0xff); ++ buf[base + table_body + 3] = (uint8_t)((chksum >> 24) & 0xff); ++ ++ fp = fopen(FILENAME, "r+b"); ++ CHECK_PTR(fp, "fopen"); ++ if (fp) { ++ if (fwrite(buf, 1, (size_t)fsize, fp) != (size_t)fsize) ++ TestErrPrintf("fwrite failed at line %d\n", __LINE__); ++ if (fclose(fp) != 0) ++ TestErrPrintf("fclose failed at line %d\n", __LINE__); ++ fp = NULL; ++ } ++ ++ /* Reopen and share a new message, which protects the list and drives ++ * the vulnerable decode. The load should reject the file cleanly. ++ */ ++ fid = H5Fopen(FILENAME, H5F_ACC_RDWR, H5P_DEFAULT); ++ CHECK_I(fid, "H5Fopen"); ++ sid = H5Screate_simple(1, dims, NULL); ++ CHECK_I(sid, "H5Screate_simple"); ++ ++ H5E_BEGIN_TRY ++ { ++ did = H5Dcreate2(fid, "trigger", H5T_NATIVE_INT, sid, H5P_DEFAULT, H5P_DEFAULT, H5P_DEFAULT); ++ } ++ H5E_END_TRY ++ ++ if (did >= 0) { ++ TestErrPrintf("dataset creation succeeded on a corrupted SOHM list at line %d\n", __LINE__); ++ H5Dclose(did); ++ } ++ ++ ret = H5Sclose(sid); ++ CHECK_I(ret, "H5Sclose"); ++ ret = H5Fclose(fid); ++ CHECK_I(ret, "H5Fclose"); ++ } ++ ++ free(buf); ++ ret = H5Pclose(fcpl_id); ++ CHECK_I(ret, "H5Pclose"); ++} /* test_sohm_reject_bad_count */ ++ + /**************************************************************** + ** + ** test_sohm(): Main Shared Object Header Message testing routine. +@@ -3755,6 +3924,10 @@ test_sohm(void H5_ATTR_UNUSED *params) + + test_sohm_extend_dset(); /* Test extending shared datasets */ + test_sohm_external_dtype(); /* Test using datatype in another file */ ++ ++ /* Editing the on-disk table in place needs the single-file sec2 layout */ ++ if (default_driver) ++ test_sohm_reject_bad_count(); /* Test rejecting a bad SOHM list message count */ + } /* test_sohm */ + + /*------------------------------------------------------------------------- diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 7860931e7e1..c83bb832deb 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -18,6 +18,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://0001-cmake-remove-build-flags.patch \ file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ + file://CVE-2026-17572.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 00:09:58 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100394 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D4D41CA9EBD for ; Mon, 12 Oct 2026 00:11:13 +0000 (UTC) Received: from mail-pg1-f173.google.com (mail-pg1-f173.google.com [209.85.215.173]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3524.1791763868132008651 for ; Sun, 11 Oct 2026 17:11:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=SUjQNiYt; spf=pass (domain: gmail.com, ip: 209.85.215.173, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f173.google.com with SMTP id 41be03b00d2f7-ca766c1c9ccso347122a12.0 for ; Sun, 11 Oct 2026 17:11:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763867; x=1792368667; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DdiunAitm9p3IpUO3AfUpuarKIA8DrhqU3e+HYdK9bg=; b=SUjQNiYts/Z9X1JMq3ISy9MHJs15rMVgg4sUEb1JZB370x7M6karC+mewQ70lqiLuV wHjwgoNe8gN065i0iVFTvBhzMGRE98n2W/rjLSozsCChPYixEmsi0LdoZUnNcpRLWYmU j3JRMTMku64VyPboNahBZlU36VvN3V7qL51Lc6Vp2ML9ESSDEGcbgL9EnbEj3uvNIob6 r2B4THHK0Ar/19rPxo5kpuNqVMgE060FJNjn7Uiiecur6asJSD8Ois0UIfMKAZuuKENX c0yBi3oY7rY9tbsskX+B9qvKYcrEwmGVNtCDLRaR+t0Eh4Db2Tthj94hhP12r5Y/9Di/ PYNQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763867; x=1792368667; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DdiunAitm9p3IpUO3AfUpuarKIA8DrhqU3e+HYdK9bg=; b=aCW6FcfW+OXFOkrUx+esHUhEMeFb5QztX6O7BEQbl22dp8YYilIfUOR5VeoVjZH3rw jJU68+Ga6ULTkCruxydVHyabYAzCvfVbH4X8Kdb8j37TFJTLLbubfxLuw5QAWCL0lhCe mvH+pr2pJ0cfQtH/v+78ps+2zNPtBUgiQ/7Gc3Pen5SCSV0Z+K9Hlw4mlySrAJMVz0oR HA+QyBlhg8rt+JC8ZFOMxY0LDsFiZ1vEMhUOg87u/oozjxXj/SzrdmTqBmCVPfxKF2ze lNe4S8RXYpTM2jaXL/ZxALEy8r7M39N/36Cb1ZKq3HavfGWJo6K6gxSCEFBpEYq0HnU+ H2FQ== X-Gm-Message-State: AFq9FYILHAjqTEfDKiNNW72ulsxFOcv6TZTvnXeXXrkD85mLtfStMtN+ u5N4G+RcbssLAkwCah9Py6dyKISdDNjnIk3vP7rb8D3uzmdsp+cB+J5dk93PHGbuh8I= X-Gm-Gg: AYBFou2xvlOPXwt/GghITPwM5SmHMRqHqSCq01adAq+Kh3GFlsZU/PN6OoOfUoDfj13 w/4/m5vp6+q1ByEfpwrIq4olsXzebBsMjvthZj/cLr0J63ZfDR9cnNaaw7Hs8RbxIbgcZEbhoks dX/+bSadcF6rUQluC79g6VBVV7TyBQKBHCRLDV8rCmh7cAu3rgPFmKpTuEjMznOespUqVpd5gFZ QPtEMB+YgPvG/y2/RH9v5E6NRV+m5RE9r4CNogiJb7UEvLwuUZkFDFvEoxEVzhkDTJTGgXN8bOf piFBYWeFjI7dGX3jI5X62IdN8ZNslW5szldBfwYmtso6NzymF0dlLI8to58rBrSAQqiq/DkT06M romNG1KMx2v0oQUd4piu2JaNV7CdoYqWkDzrDnqtMyl0whWkpYtB6S4Fg42yoZUVKRqoVDkK6KD syi2cKO1WS9zzdZdH7KwKn/w4Sa+8Xi/AkpGbhCEjIqTIPJccXyysM5vKV/RsD0DJ3lIj6yHhtw zk1MKoksU49ths1MbeBXbeiSRjzRjnTZMku6UI= X-Received: by 2002:a17:90b:3c07:b0:3ab:1a24:56e4 with SMTP id 98e67ed59e1d1-3ab3aca1257mr5723829a91.30.1791763867482; Sun, 11 Oct 2026 17:11:07 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:07 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 20/28] hdf5: patch CVE-2026-17573 Date: Mon, 12 Oct 2026 13:09:58 +1300 Message-ID: <20261012001007.2541673-20-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130745 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. Debian[4] has also identified the commit. [1] https://github.com/HDFGroup/hdf5/pull/6160 [2] https://github.com/HDFGroup/hdf5/issues/6124 [3] https://nvd.nist.gov/vuln/detail/cve-2026-17573 [4] https://security-tracker.debian.org/tracker/CVE-2026-17573 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit f46990293cf684add8cc2ee7e71738e97889bcc3) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17573.patch | 53 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 54 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch new file mode 100644 index 00000000000..3cfb52de42d --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17573.patch @@ -0,0 +1,53 @@ +From 856e7f1dd23e466ebeab5e454a5891b12e188f6a Mon Sep 17 00:00:00 2001 +From: jhendersonHDF +Date: Tue, 27 Jan 2026 05:55:38 -0600 +Subject: [PATCH] Fix double-free issue in H5D__chunk_copy (#6160) + +Fix double-free caused by loss of buffer pointer after re-allocation + +Co-authored-by: Larry Knox + +CVE: CVE-2026-17573 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/dd3080a58cc6bb86f3b34284399915da9e513262] + +Dropped changes to the CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Dchunk.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/src/H5Dchunk.c b/src/H5Dchunk.c +index f2a0e85c03..5ff537ebde 100644 +--- a/src/H5Dchunk.c ++++ b/src/H5Dchunk.c +@@ -7034,7 +7034,7 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + const H5S_extent_t *ds_extent_src, H5T_t *dt_src, const H5O_pline_t *pline_src, + H5O_copy_t *cpy_info) + { +- H5D_chunk_it_ud3_t udata; /* User data for iteration callback */ ++ H5D_chunk_it_ud3_t udata = {0}; /* User data for iteration callback */ + H5D_chk_idx_info_t idx_info_dst; /* Dest. chunked index info */ + H5D_chk_idx_info_t idx_info_src; /* Source chunked index info */ + int sndims; /* Rank of dataspace */ +@@ -7202,7 +7202,6 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + HGOTO_ERROR(H5E_RESOURCE, H5E_NOSPACE, FAIL, "memory allocation failed for raw data chunk"); + + /* Initialize the callback structure for the source */ +- memset(&udata, 0, sizeof udata); + udata.common.layout = &layout_src->u.chunk; + udata.common.storage = &layout_src->storage.u.chunk; + udata.file_src = f_src; +@@ -7253,11 +7252,11 @@ H5D__chunk_copy(H5F_t *f_src, H5O_layout_t *layout_src, H5F_t *f_dst, H5O_layout + } /* end for */ + } + ++done: + /* I/O buffers may have been re-allocated */ + buf = udata.buf; + bkg = udata.bkg; + +-done: + if (dt_dst && (H5T_close(dt_dst) < 0)) + HDONE_ERROR(H5E_DATASET, H5E_CANTCLOSEOBJ, FAIL, "can't close temporary datatype"); + if (dt_mem && (H5T_close(dt_mem) < 0)) diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index c83bb832deb..df0192a0911 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -19,6 +19,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26199.patch \ file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ + file://CVE-2026-17573.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 00:09:59 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100392 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9130CA9ED3 for ; Mon, 12 Oct 2026 00:11:13 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3526.1791763870877980195 for ; Sun, 11 Oct 2026 17:11:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=FcHv0cHP; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cc4dbda1e5dso311109a12.2 for ; Sun, 11 Oct 2026 17:11:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763870; x=1792368670; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=hcA8hh3M98vJCTJzI9euS/gus0y3Gzf5/hG2K1IrN2g=; b=FcHv0cHPYcBcFrITtRl2weELBxiPC9gzOFmVJe4ySAMee3Ry3ck8mSI9i3lmkHq3pO DZzvzQg8Rb9kbZbidcjeWWedXGaMEZkJWCqVQdhAZqKzD8BzP+07VhG6620ODWZrMUcY +oiW8kULn4mOutZbXBdquJlHIMO8u1gvHenwKHYhqXKMCZMbogc+we37vOqHZ231Ad3o PwW7mAmK5XFJv3l9cK3ND+3hNJhbqAkkn+WGR3+MnTOrDEbbl90JlQuDXtXB4TMSsUa/ 7vp8tjRQ7ZTQmXdNir5GMU3YwqXq2+oHRjJmojl5VtnR1yF7mmMjVKRzjyTUyLgbUw5p pi0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763870; x=1792368670; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=hcA8hh3M98vJCTJzI9euS/gus0y3Gzf5/hG2K1IrN2g=; b=G7PXk8DRixCoQW9UD6wYZaXamhnh1xFf7UYj0UMYZONg6BR1dgO820nBVpBkGpI1GZ 1HS0hAPG3aSTpgaHpgAugPzUmSUwS8WR7ojkjcUuj9S4g05K/mdKAWzcQjY5qklffKX3 un/sGeIJrAQT6zY8cNaAeiR+NHg5dYLscm76tUYssjdHKzCiHlGzGR0IV9UxT4Z+0kab AscS4TjH9R1RpCL7UevQXG8xERwDfQUBUsEp+d6s4PMyh6ZgWBieuaOw5/bCkR1Vxp2Y cqEr576nXoGAzSBwPcntIF+qkI929j9MQc3rf+bJFaWo8XzM8i76Z3IqJtFkcfgDjgLv BteA== X-Gm-Message-State: AFq9FYKvDT1MD/9XLsscXgOGvqkRG9/RzfeqTPx2IAO11KnV2AwMJKxY famdWyaqSDqPztD4PKSuztxs9owb9Am39ZUoXiC181dioSBSTRQzpOwVnT63Gdyt8ac= X-Gm-Gg: AYBFou1gSHCOoSFKe/oFJTszb2vzlqDROh/Hzu1pGGUKZbewELBKhU7hfeHGR0jfLGm N+Ya8a+ijhakLtGcM3yqu0MQCGIr6jr5ZLj9FCcqhmXZE2aZtMAP+W9Gc14edQgNjyWMRY83esd /Hc1E1svvVSJoNbWOJa5Vty0u5/4i3IMXaaKYom4y2/RA6VboUhegNvG96dJkTz0lfIQkmd3krm Auw5rqP4IQmIbltBv7AGWo/0YUOz7Z3fERdUzxbvTuw1vgZnLd9e05905lEAgcxz2xN45TMzEi1 d/kTh8qrIGhMzjq+OuYUayWhXW57nuK+jkbMPhZzYTV/6BXfj0vFYHkqaZCUDsOwy2j1hZ7jB7j WxQuC1+u8o5WHC3bb+VlavBeDEO3cm6ead/qAvASMIDbpcMtHqWOKwpjs1aPuI1X7NMAY306iOS WcUMEjz8jyD0UrB4bW9OXgVDJQZ7IRJaGVrG5RG9eqobnl+y44PZq0oVBkQqiqtIc8wb74NMak6 SGB7c8YaXPVHtPJHUEzUIiCJ4NMcfp4F3e53oo= X-Received: by 2002:a17:90b:2d0b:b0:3a4:945e:bc33 with SMTP id 98e67ed59e1d1-3ab3af7177amr6174008a91.47.1791763870220; Sun, 11 Oct 2026 17:11:10 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:09 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 21/28] hdf5: patch CVE-2026-17574 Date: Mon, 12 Oct 2026 13:09:59 +1300 Message-ID: <20261012001007.2541673-21-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:13 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130746 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-17574 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 637f437de908d10e8a3118888740a286c2cd1f06) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-17574.patch | 65 +++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 66 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch new file mode 100644 index 00000000000..0ae79a2811a --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-17574.patch @@ -0,0 +1,65 @@ +From e374b227c277e100d9bfa3b1fe5c0b60cdff6c43 Mon Sep 17 00:00:00 2001 +From: tbeu +Date: Thu, 28 May 2026 17:26:57 +0200 +Subject: [PATCH] Validate VL datatype type during decode and check file + pointer in H5T_set_loc (#6395) + +H5O__dtype_decode_helper() reads vlen.type from the file without +validation. With corrupted HDF5 files (e.g. from fuzzing), this field +can have an invalid value that is neither H5T_VLEN_SEQUENCE nor +H5T_VLEN_STRING, which later triggers assert(0) in H5T__vlen_set_loc() +(debug builds) or a NULL pointer dereference / SEGV in release builds. + +Fix by: +1. Adding a validation check in H5O__dtype_decode_helper() immediately + after reading the vlen.type field, returning an error if the value + is invalid. +2. Adding a NULL file pointer check in H5T_set_loc() before calling + H5T__vlen_set_loc() when loc == H5T_LOC_DISK, so the low-level + assert(file) invariant is never violated. + +This fixes the root cause at the decode level where the bad value +enters the system, as requested in review of #6378 and #6385. + +Found by OSS-Fuzz via the matio fuzzer (ClusterFuzz testcase +5366895365914624). + +(cherry picked from commit 3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc) + +CVE: CVE-2026-17574 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/3fa6ed6e9dfeebbc784e21d8c48e31e35a8042bc] +Signed-off-by: Ankur Tyagi +--- + src/H5Odtype.c | 2 ++ + src/H5T.c | 5 +++++ + 2 files changed, 7 insertions(+) + +diff --git a/src/H5Odtype.c b/src/H5Odtype.c +index d6405cdb86..6e622f3ebc 100644 +--- a/src/H5Odtype.c ++++ b/src/H5Odtype.c +@@ -751,6 +751,8 @@ H5O__dtype_decode_helper(unsigned *ioflags /*in,out*/, const uint8_t **pp, H5T_t + */ + /* Set the type of VL information, either sequence or string */ + dt->shared->u.vlen.type = (H5T_vlen_type_t)(flags & 0x0f); ++ if (dt->shared->u.vlen.type != H5T_VLEN_SEQUENCE && dt->shared->u.vlen.type != H5T_VLEN_STRING) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, "invalid VL datatype type"); + if (dt->shared->u.vlen.type == H5T_VLEN_STRING) { + dt->shared->u.vlen.pad = (H5T_str_t)((flags >> 4) & 0x0f); + dt->shared->u.vlen.cset = (H5T_cset_t)((flags >> 8) & 0x0f); +diff --git a/src/H5T.c b/src/H5T.c +index 3b2e391a53..e2c9ba9791 100644 +--- a/src/H5T.c ++++ b/src/H5T.c +@@ -6953,6 +6953,11 @@ H5T_set_loc(H5T_t *dt, H5VL_object_t *file, H5T_loc_t loc) + ret_value = changed; + } /* end if */ + ++ /* Validate file pointer for disk-based VL types */ ++ if (loc == H5T_LOC_DISK && NULL == file) ++ HGOTO_ERROR(H5E_DATATYPE, H5E_BADVALUE, FAIL, ++ "NULL file pointer for disk-based VL datatype"); ++ + /* Mark this VL sequence */ + if ((changed = H5T__vlen_set_loc(dt, file, loc)) < 0) + HGOTO_ERROR(H5E_DATATYPE, H5E_CANTINIT, FAIL, "Unable to set VL location"); diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index df0192a0911..12c9852fd02 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -20,6 +20,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-26197.patch \ file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ + file://CVE-2026-17574.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 00:10:00 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100396 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E9880CA9ED3 for ; Mon, 12 Oct 2026 00:11:23 +0000 (UTC) Received: from mail-pj1-f49.google.com (mail-pj1-f49.google.com [209.85.216.49]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3527.1791763873716297339 for ; Sun, 11 Oct 2026 17:11:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=o/XhuB1n; spf=pass (domain: gmail.com, ip: 209.85.216.49, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f49.google.com with SMTP id 98e67ed59e1d1-3ab2bf5e75bso621951a91.3 for ; Sun, 11 Oct 2026 17:11:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763873; x=1792368673; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=R6rtrxU2F0igLKmi1YwTtTAtE+8sinCmQ20pGSFM21o=; b=o/XhuB1nAtyJJ5sCeHVh9LGTLm417VvKcM1sVE1r8752EzUN0zsdoeJ0kqqSUptcDi eG/7oKuBshPka2bcMLMAPDyGThPi1UzQhWL3dcb7HuItdg50jGQmRU6919xb1HaE30ts UZi6z825C+wGiQIUXUDMmSeniQaUPOo0EXfdrHEo1Bi+3+bPcTivPTPO5Zp01+myNVny KPGn+WS0XOlNBdGAwX9CVjZjhW0UNIUR9+NYB5motzB5Nz0q2jB0if9TZTGEb7+J7kXp pUsP1m0KrA6FHVbEWrfgEtG1gYqm/l8ZAzLfXsmmzjYfzOfZi1Jng01RsiyWz13FvZln TPFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763873; x=1792368673; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=R6rtrxU2F0igLKmi1YwTtTAtE+8sinCmQ20pGSFM21o=; b=ogBPvQqUrns+Qp580Nakwvk1/3qXTSicDL9P2nV3vMaibT9qtZvlsDp6sUROa2nKFH h/xNymKxE+MunZSTQHzoX2tLNUBVzQ4fcbqwEaOwo/sfh/3TN89OlLn/qOY5kuv7R8Vm 5IDVwKd25gYx52EHzUjlB1yN9c+TcZIHamf9n9Jc+ZcomajO0NAGZHQ3szm7NQShT3U5 Ok97saSrm9t/G+xXwRC7QOxOAn5WeKF2w4+I+XO0aGyWDkVOl6f+x6516Yc/WWwEBNTx Uj/Te8sY1KFnCaOpo77HflAsQwyI80XgGdIscskVQmEBNiQfgMKolvMXq9M8kSZb3pQC yuVw== X-Gm-Message-State: AFq9FYIvR1q4ap3XptRGUoHKSbDyUu/jTlA8hz+MV9jybyv0axNgW/fN Rjb7mL5Vn0OiRTghZCTU7jNo5FDD2xsBuVq1Odi5XxeDxjlQECCfgQ8DOAZCuVsOy+0= X-Gm-Gg: AYBFou3yUUK7lh7cowbIffteNSA2ngT8jfU6P2GZ6TwzePN3Q0SPF/ETbPAYViM+498 qlflm7nf4llgR6joRqTgcSRiE5nJ8/drhwFEeG2Hb/kEC+diT5ahTy5I+aljGJwmWXY1vdGaCW0 t8ALZ4dZmmVvlayx6tVkC+6iVS0Smeu9XT1bcPONHkW0+ydp3/2ndTxHkQR1QaChWMmIefLTeb6 0zTTINpH/9L4Jn1hFv8bVzdGM5nIqxmjIRc42eSRqK52x3e6iCq6jPHLQULQQ3SmqY6BcbX/v6O PECoX2fwUngzm9OtcVhkisAZNHfQExkF5sL7yIxy+nM3VNSkMdv8sUstJmkHjCP/KUlFSMHmCn4 xAjzSW1OhznJh1aMs7NzhQKApfmyqwKd1Pss3wOOtmC5cV3pAnLcSxw0HRwK6aIjqbjwKWeLTsT LdzAU+l1q24JOhgA2hAeXEBKqpDZqyfwSkZqfgtaTYfdcKnxBf8WGWoJ++B2/736nydPFpqUHgq ZELou6AQ8c7qJ2XZp4BKGkP50++eezY1NMAOYY= X-Received: by 2002:a17:90b:4fcb:b0:3ab:31b9:fe51 with SMTP id 98e67ed59e1d1-3ab3acf311bmr6924449a91.67.1791763873019; Sun, 11 Oct 2026 17:11:13 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:12 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 22/28] hdf5: patch CVE-2026-19025 Date: Mon, 12 Oct 2026 13:10:00 +1300 Message-ID: <20261012001007.2541673-22-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130747 From: Ankur Tyagi Backport patch from the PR[1] fixing the issue[2] mentioned in the NVD[3]. [1] https://github.com/HDFGroup/hdf5/pull/6508 [2] https://github.com/HDFGroup/hdf5/issues/6491 [3] https://nvd.nist.gov/vuln/detail/cve-2026-19025 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit df3f814ab84f9cbdcdaeb7cc745e0c61c90c55e8) Signed-off-by: Ankur Tyagi --- .../hdf5/files/CVE-2026-19025.patch | 112 ++++++++++++++++++ meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb | 1 + 2 files changed, 113 insertions(+) create mode 100644 meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch diff --git a/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch new file mode 100644 index 00000000000..075bcf7653e --- /dev/null +++ b/meta-oe/recipes-support/hdf5/files/CVE-2026-19025.patch @@ -0,0 +1,112 @@ +From 0cb26cd769d1da3f2ad2c3836dc1732309f935a7 Mon Sep 17 00:00:00 2001 +From: Matt L <124107509+mattjala@users.noreply.github.com> +Date: Fri, 28 Aug 2026 13:49:02 -0500 +Subject: [PATCH] Fix CVE-2026-19025 (Reject chunked datasets with mismatched + chunk/dspace rank at open time) (#6508) + +* Reject chunked datasets with mismatched chunk/dspace rank + +H5D__chunk_construct() validates that the chunk layout dimensionality +matches the dataspace rank, but that runs only at dataset creation time. +When an existing dataset is opened, H5D__chunk_init() didn't repeat the +check, so a file whose stored chunk rank disagreed with its dataspace rank +was accepted. During chunk I/O the memory-selection rank (from the +dataspace) and the file-selection rank (chunk ndims - 1) then differ, which +produces a zero stride that causes a divide-by-zero in +H5S__hyper_iter_get_seq_list(). + +H5D__chunk_init() now performs the same dimensionality check on open (the +stored chunk rank includes the extra element-size dimension, so it must be +exactly one greater than the dataspace rank) and rejects a mismatch with an +error. + +Added test_chunk_dims_mismatch() as a regression test in test/dsets.c + +Fixes #6491 + +* Fix typo + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> + +* Clarify element-vs-byte wording + +* Validate chunk/dataspace rank at layout decode time + +Move the stored-chunk-rank vs dataspace-rank consistency check out of +H5D__chunk_init() and into H5O__layout_decode(), so a malformed chunked +layout is rejected as the message is decoded (mirroring the fill/datatype +size check in the fill message decode). + +* Update release_docs/CHANGELOG.md + +Co-authored-by: Larry Knox + +* Update CHANGELOG + +* Pin format version bounds in bad chunk layout generator + +--------- + +Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> +Co-authored-by: Larry Knox + +CVE: CVE-2026-19025 +Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/b7b85e7abf9aa9b1dd9693523defa35217684eb2] + +Dropped changes to the test and CHANGELOG file. + +Signed-off-by: Ankur Tyagi +--- + src/H5Olayout.c | 32 ++++++ + 1 file changed, 32 insertions(+) + +diff --git a/src/H5Olayout.c b/src/H5Olayout.c +index d230feb992..5dce35e916 100644 +--- a/src/H5Olayout.c ++++ b/src/H5Olayout.c +@@ -23,6 +23,7 @@ + #include "H5FLprivate.h" /* Free Lists */ + #include "H5MMprivate.h" /* Memory management */ + #include "H5Opkg.h" /* Object headers */ ++#include "H5Sprivate.h" /* Dataspaces */ + + /* Local macros */ + +@@ -561,6 +562,37 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU + } + } + ++ /* For a chunked layout, the stored dimensionality includes an extra ++ * element-size dimension, so it must be exactly one greater than the ++ * dataspace rank. Validate that here ++ * to reject malformed files before the inconsistent ++ * ranks can cause problems during chunk I/O. ++ */ ++ if (mesg->type == H5D_CHUNKED && open_oh != NULL) { ++ htri_t space_exists; /* Whether the dataspace message exists */ ++ ++ if ((space_exists = H5O_msg_exists_oh(open_oh, H5O_SDSPACE_ID)) < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't check for dataspace message"); ++ if (space_exists) { ++ H5S_extent_t *extent; /* Dataspace extent from the sibling message */ ++ int rank; /* Dataspace rank */ ++ ++ if (NULL == (extent = (H5S_extent_t *)H5O_msg_read_oh(f, open_oh, H5O_SDSPACE_ID, NULL))) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't read dataspace message"); ++ ++ rank = H5S_extent_get_dims(extent, NULL, NULL); ++ ++ /* Done with the sibling dataspace message */ ++ H5O_msg_free(H5O_SDSPACE_ID, extent); ++ ++ if (rank < 0) ++ HGOTO_ERROR(H5E_OHDR, H5E_CANTGET, NULL, "can't get dataspace rank"); ++ if (mesg->u.chunk.ndims != (unsigned)rank + 1) ++ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, ++ "dimensionality of chunks doesn't match the dataspace"); ++ } ++ } ++ + /* Set return value */ + ret_value = mesg; + \ No newline at end of file diff --git a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb index 12c9852fd02..a0eb5eb155e 100644 --- a/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb +++ b/meta-oe/recipes-support/hdf5/hdf5_2.0.0.bb @@ -21,6 +21,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v2_0/v2_0_0/downloads/${BP file://CVE-2026-17572.patch \ file://CVE-2026-17573.patch \ file://CVE-2026-17574.patch \ + file://CVE-2026-19025.patch \ " SRC_URI[sha256sum] = "f4c2edc5668fb846627182708dbe1e16c60c467e63177a75b0b9f12c19d7efed" From patchwork Mon Oct 12 00:10:01 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100397 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02A09CA9ED5 for ; Mon, 12 Oct 2026 00:11:24 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3528.1791763876659358359 for ; Sun, 11 Oct 2026 17:11:16 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Z3jkMto7; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cc4ca696de6so644554a12.2 for ; Sun, 11 Oct 2026 17:11:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763876; x=1792368676; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=aX58d3wxyfWAj/pKjRcwECLPPmGI4L6iIb86qlI2+8o=; b=Z3jkMto7JJ36QraTWU+wUBqxyDjvgyj+8XrkdP58jEk2DzJRwC8rfYJU2/QltateMa xxcevAtcBzdwZIfyoIqQN55eqAT3Anq7BTYHJ+J6+2AkI4jDM9DS3vzTpDIcpTRmT5L5 rHRGL6kOCsvHqTyWCvO/Ngjfto+OBTGXczILU3pjHFV0KZ5khjk4DvQnOgAuU1QGIQMM PvkGp6adfTFRY+VBFz6RCe9Wj/WclHEqyEcCzi/2CaWBhrMtXxTTz6elgVLix5GqTSyG HjIDm481hJAAeugGAhNpXxgKu10porm5eYPI5Rq8JOqse1ImzlJPpv20sGROFqQ0xKoW hEqw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763876; x=1792368676; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=aX58d3wxyfWAj/pKjRcwECLPPmGI4L6iIb86qlI2+8o=; b=A8ucrk7UXgedesaBkTBBAPOBAszvPo6wd38wLcy4mHrTxQW7GEiy0LU3GFaxdqYAKx XdyFeW0I4ayI46NTFhwcR4nergLvhazVsGLmVsm9UYFPS0SFtmteG/Qh/cT8PH/GqEfE IapXUxokUGk/knTQY4iAm1E9PgbxC19LvRoR9r52iztsUgU2iWwrAnFcAQhWTHZy3kW0 vG+84pSuRzAAi3ku7RsMQakxDBQqzU3ZdQeXpVfzmCNO7MeiHAMkywkC2zB0YqZRDC1m ddPHc6s5gmmPlzrocrsNmlPZ0uGmV6UtSryOSiYAhRwFqqBfVbAuo6bLUnxg3Cy9vJA4 30HQ== X-Gm-Message-State: AFq9FYJiiyJ0gnVFaTC9TmQZYqq9o+lCFpJbpvqyf4UsZR2ko6x2tdUv anwTV51Zgq8p5wvf8ekjE5i1zgl+76hw8Zxth6PgWd/ArXMKHKz/69E4KEYU+TpG/js= X-Gm-Gg: AYBFou1AXF/oVB2oM0NBXe+3k1+1adXsRoK78L/RG6/Slw+oMSwOioV4OJ7x1zZkd9k EKP7w8IHkJdrQry/5bs7nIj15AfkQw8OjZRz4zGBV+qrbOvU6ArixCzsChTfbDAbfca7d51drK0 yFW5DMvk0Aadocsz7osK5nP3/dyQ0JGsPx8msFZv62Lv4lX4zTiLKhZd4SGpZm/h46wFZdc/OW+ WAdXAewt1WLfkDVC/GBwvJLOW1wnnVAw8hCjpDUq0LJ6sKnk1Z9JSdnqVR69bFlTe/SmH8HYIKd 7ztVDvLyfDRdCii8/PPgEV10NC3nU838KMJAcqjBWP7O73byJayW3wf4nYiWy21rviMJh3kHIhO nL2HDZ415xO015Nv7oBelb9cc3v5t605/Fk7JjeQC26m0Qmnb+l8QDEld0J2IxEWdxLQ4pUEzJs Cy3lv7ytKWfRuXION2MVzBQ/Fo1uOOADsDOo9vIHJ3KnruWZ0a6JSzev/f5b6g2EkNLT6IFTr1F mkT39czsozydWEJbo2mz3B7KBY+qmGbeIjylY8= X-Received: by 2002:a17:90b:384a:b0:3a7:250:3853 with SMTP id 98e67ed59e1d1-3ab3a90d555mr6806015a91.23.1791763875989; Sun, 11 Oct 2026 17:11:15 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:15 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 23/28] libiec61850: mark CVE-2024-45969 patched Date: Mon, 12 Oct 2026 13:10:01 +1300 Message-ID: <20261012001007.2541673-23-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130748 From: Ankur Tyagi NVD[1] mentions commit[2] for v1.5 but is also present in v1.6[3] [1] https://nvd.nist.gov/vuln/detail/cve-2024-45969 [2] https://github.com/mz-automation/libiec61850/commit/7afa40390b26ad1f4cf93deaa0052fe7e357ef33 [3] https://github.com/mz-automation/libiec61850/commit/d1ab50298fcba3f87b1e58dabff92f8615b14ee7 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit a7088b0fda5d269721e5d3f16ae410062b9b2c8e) Signed-off-by: Ankur Tyagi --- .../recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb index d2fbbc53fb6..51ceb5cf02f 100644 --- a/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb +++ b/meta-networking/recipes-connectivity/libiec61850/libiec61850_1.6.2.1.bb @@ -35,3 +35,5 @@ FILES:${PN} += " \ ${PYTHON_SITEPACKAGES_DIR}/pyiec61850.py \ ${PYTHON_SITEPACKAGES_DIR}/_pyiec61850.so \ " + +CVE_STATUS[CVE-2024-45969] = "fixed-version: fixed since v1.6.0" From patchwork Mon Oct 12 00:10:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100398 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEED9CA9EBD for ; Mon, 12 Oct 2026 00:11:23 +0000 (UTC) Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3533.1791763879795984761 for ; Sun, 11 Oct 2026 17:11:19 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=Xi5Y65gH; spf=pass (domain: gmail.com, ip: 209.85.216.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-3ab2bf5e75bso621976a91.3 for ; Sun, 11 Oct 2026 17:11:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763879; x=1792368679; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KXbyCa13wnvjKK6vtk0O76lvNis4Bh3iBUF4NLnhi2Q=; b=Xi5Y65gH++EjNCdxZ5OXj1L0u3jxwNSYuB7gxv8vuNTvNqLStMW3+5g+7FpJktxl82 VTqNKz0NWXsoExV7DKhH7gwnx9H18kBv2UhoscHJErxKEuTsLf+yy2fvVU69lbPFxeig /0fBssZEfb3wWgXXV3kJL8kSKYJvu/Ty+HzkQ0BSu1Hhz17K9TVrZ3/6GPaRxc5elabP m54J6BibduhyfyFJTEgMDe1jeBEGaw3IOR/eIt0qYg4bP6Sf7ZUAHEzoQM3i7hsRmrcY abtBwyG0IoutxO13ptdZyA53vexIs0O80WkN+XtYpQ7mnMDycPu1o7FS1Vb3KL98NBfO z1Qg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763879; x=1792368679; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=KXbyCa13wnvjKK6vtk0O76lvNis4Bh3iBUF4NLnhi2Q=; b=S66VkmlmlGocx/j94uAiGHqk5xRhJFSp1g/BV5u6V7omjWchCmxPrIh6LbbRDR+aWb m/eW4radWYB9oaThBhUYHSRheHvboMVrcXUCmZK6IAqEN6E9S33m7Rxg6u7LSNjGh6Vo A5gCQka7Ml4Rs37+KC4KMurusltK3uN6Pta4CwRUrmgZmgMuGRvHRZxlXTaGtrk1jDac xiJnCh2WzFP/y7T9nVMR9TgnTfTGBafpYkU0pG+ZnfpFcFuT3C9Sl6FMIWMSPcbU69XF XXb6qhpq7O/qbKdm4az2hKRbdRVLzS3JfrUGhtQNl9kXW43hmjjOW7sjN+7ObmuN0hc8 Apnw== X-Gm-Message-State: AFq9FYLhiEv64XEmuVnY9NOv3gBazvR5F9kuYBPysculHPCP7RBUcPgD /N6wlrz0mouZFJS28StRvKWpQ4b8RXWKysakwGNR5uXSvUKR2Qx20Mc9StfIOhav8e0= X-Gm-Gg: AYBFou11jW0SHonN3gBYU1e7Vqgt+Fuc407fhX5WTPDlFv+gxcUsGQvawYY0OdIjqEJ n2tB7Q3Vd9VE+bHhfT2oDNEZVyPY9mTSDpKDB59H85lHVI3+nge9xJcpRO4gQtA8aex4N1/sGf+ XWXlUsdUQwpDyN/XoynDSv5C5NhGyvXoIqf+VZ+seqGu60vGeLoFdla4MoRXFXVJctEMBBh499a fh4JYvD3Bhh2a437zTQuREe4JN/K8LVt8iDoR6rn4o28/6/IVcKHt3ML5w1VT5mss/FC34ckCEc rPK5sPhcvnT5iKS1SLs9H5NrlAqbo8HIfr8B1F+TQescm/zNBmH0SP7iw45Q48/tXLiw0v7EgoJ blQ8v2Q1OEN4FzrBoDpm+lxelO31RZb1/6jpAw8m0uTF5DUo+ulNit1Gpj9LSewz/WxXBoE9XYY LPxyjZRXU33X7EElWtpTDeGwOaUrTjfDlcApUaLe2JJOlosFX5PC/AYPxQfKk31JsGqLYW7boIr +oLRaAy7aKSJjDgkQIhMXtjVWZxYVrgB65XspQ= X-Received: by 2002:a17:90b:3143:b0:3aa:548f:eb77 with SMTP id 98e67ed59e1d1-3ab3ac95141mr7474786a91.56.1791763879003; Sun, 11 Oct 2026 17:11:19 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:18 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][PATCH 24/28] miniupnpd: patch CVE-2026-107159 Date: Mon, 12 Oct 2026 13:10:02 +1300 Message-ID: <20261012001007.2541673-24-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130749 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-107159 Signed-off-by: Ankur Tyagi --- .../miniupnpd/files/CVE-2026-107159.patch | 78 +++++++++++++++++++ .../miniupnpd/miniupnpd_2.3.11.bb | 1 + 2 files changed, 79 insertions(+) create mode 100644 meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch diff --git a/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch new file mode 100644 index 00000000000..fa2401e0391 --- /dev/null +++ b/meta-networking/recipes-connectivity/miniupnpd/files/CVE-2026-107159.patch @@ -0,0 +1,78 @@ +From 8a3e282b22b16fc90740d62fe213c51696e8dc01 Mon Sep 17 00:00:00 2001 +From: Thomas Bernard +Date: Sat, 3 Oct 2026 23:42:55 +0200 +Subject: [PATCH] minissdp.c: MX: 0 is invalid as well. 1 is the minimum + accepted + +(cherry picked from commit 8f13b7a5843f5270db684099c0a083f98869636a) + +CVE: CVE-2026-107159 +Upstream-Status: Backport [https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a] +Signed-off-by: Ankur Tyagi +--- + minissdp.c | 22 +++++++++++++++++----- + 1 file changed, 17 insertions(+), 5 deletions(-) + +diff --git a/minissdp.c b/minissdp.c +index afb11ec..d825bf6 100644 +--- a/minissdp.c ++++ b/minissdp.c +@@ -2,7 +2,7 @@ + /* vim: tabstop=4 shiftwidth=4 noexpandtab + * MiniUPnP project + * http://miniupnp.free.fr/ or https://miniupnp.tuxfamily.org/ +- * (c) 2006-2025 Thomas Bernard ++ * (c) 2006-2026 Thomas Bernard + * This software is subject to the conditions detailed + * in the LICENCE file provided within the distribution */ + +@@ -1015,7 +1015,7 @@ ProcessSSDPData(int s, const char *bufr, int n, + #endif + #endif + #if defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) +- int mx_value = -1; ++ int mx_value = -1; /* -1 => not set, -2 => invalid value (0 or negative) */ + #endif + unsigned int delay = 50; /* Non-zero default delay to prevent flooding */ + /* UPnP Device Architecture v1.1. 1.3.3 Search response : +@@ -1113,7 +1113,16 @@ ProcessSSDPData(int s, const char *bufr, int n, + memset(atoi_buffer, 0, sizeof(atoi_buffer)); + memcpy(atoi_buffer, mx, MIN((int)(sizeof(atoi_buffer) - 1), mx_len)); + mx_value = atoi(atoi_buffer); +- syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value); ++ /* UPnP Device Architechture v2.0 : ++ * MX ++ * Required. Field value contains maximum wait time in seconds. ++ * shall be greater than or equal to 1 and should be less than ++ * 5 inclusive. */ ++ if (mx_value <= 0) { ++ syslog(LOG_WARNING, "MX: %.*s (value=%d) INVALID (must be between 1 and 5 incl.)", mx_len, mx, mx_value); ++ } else { ++ syslog(LOG_DEBUG, "MX: %.*s (value=%d)", mx_len, mx, mx_value); ++ } + } + #endif /* defined(UPNP_STRICT) || defined(DELAY_MSEARCH_RESPONSE) */ + #if defined(UPNP_STRICT) +@@ -1140,9 +1149,12 @@ ProcessSSDPData(int s, const char *bufr, int n, + /* For multicast M-SEARCH requests, if the search request does + * not contain an MX header field, the device MUST silently + * discard and ignore the search request. */ +- if(mx_value < 0) { ++ if(mx_value == -1) { + syslog(LOG_INFO, "ignoring SSDP packet missing MX: header"); + return; ++ } else if(mx_value <= 0) { ++ syslog(LOG_WARNING, "ignoring SSDP packet with invalid value for MX: header"); ++ return; + } else if(mx_value > 5) { + /* If the MX header field specifies a field value greater + * than 5, the device SHOULD assume that it contained the +@@ -1150,7 +1162,7 @@ ProcessSSDPData(int s, const char *bufr, int n, + mx_value = 5; + } + #elif defined(DELAY_MSEARCH_RESPONSE) +- if(mx_value < 0) { ++ if(mx_value <= 0) { + mx_value = 1; + } else if(mx_value > 5) { + /* If the MX header field specifies a field value greater diff --git a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb index 42a654e3278..920d33da94c 100644 --- a/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb +++ b/meta-networking/recipes-connectivity/miniupnpd/miniupnpd_2.3.11.bb @@ -13,6 +13,7 @@ DEPENDS += "iptables net-tools util-linux libmnl libnetfilter-conntrack openssl" SRC_URI = "http://miniupnp.tuxfamily.org/files/download.php?file=${BP}.tar.gz;downloadfilename=${BP}.tar.gz \ file://miniupnpd.service \ + file://CVE-2026-107159.patch \ " SRC_URI[sha256sum] = "91994b127da735b2c97f19992e34420648c0e8c4ace8a4bcb0596e7685c48678" From patchwork Mon Oct 12 00:10:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100395 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC83CCA9ECF for ; Mon, 12 Oct 2026 00:11:23 +0000 (UTC) Received: from mail-pg1-f172.google.com (mail-pg1-f172.google.com [209.85.215.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3535.1791763882367552326 for ; Sun, 11 Oct 2026 17:11:22 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=hFvza4H+; spf=pass (domain: gmail.com, ip: 209.85.215.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f172.google.com with SMTP id 41be03b00d2f7-cc4c02ddd62so536957a12.0 for ; Sun, 11 Oct 2026 17:11:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763882; x=1792368682; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Nd5iME4DHBJ20zDw+3DocSsaOXDxJpLV+Hucf4RLi2o=; b=hFvza4H+OkKqHrbDhROy1SNW1NnrI1G77IkxtvsKHXY32k6Xud+Gh/JfLYCq7zbUbi T3RDiZse2TMpsdbXxw5u9lfvMxqpwdL9ulCS3gIqT0BKrhkPJuAFihcImXNHqCBWCsLd iQhyVxGZS6xjJ8H8bw+lbq9DF6u3SM4/lk5Y54jbB/Pqnjx3EVd+LelhZEo2Pa6VEsJP Kju81xc42ziRndyDVQudKK4fyJBhhANf1ND/JnJ2of+ejcme9OEEkKu4Qm38EaYOShRM LdLV9MUxOg/6Ea8UHugPJk424kC1rKAi58NRj75NEkTFVMS2ea00gAD7FK8vj31GO91U wrDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763882; x=1792368682; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Nd5iME4DHBJ20zDw+3DocSsaOXDxJpLV+Hucf4RLi2o=; b=mD/qQpqkNsNEcL6LQaNfJdhBxOMwppJSkvpPiA+MYuvXHbN4TAmF4EDdY7JAMrR1c1 qmtN7WSWcxjFCkEotQHFpGuWYhdWRrsWk5WQcglkABNG/s47vd1F5D49TvOat7DfNcoL Fzms3TRy+Unk42fUZFSKV1ZcaI06O9gZpYauiMAT8QT5keD4S1fsFPMa7sWd3FGzVoYD IsqVGlMQA1/McXs4HGAgzkmpsA7QYEBTCauhBROYLX1gn9Usy3rAgcV8hJUuI5SaO+BF LWs175m2GyDkaZgJx0XjHE0XK25X6w4oIVA2l5OTrpU/UG4jCyWzqZeC1O4FIEKl+tIf rpEA== X-Gm-Message-State: AFq9FYJqBFhGCmaG5j9sFNV4svNYtEF5V7HB/IqP1tz1ZOJvH50eCZvr 5pw8B3ne7YwCiQfld1lJFMC57EVc/zBb1AONCMRXfPCCVIFeI2KwzOyFkM935s/gEwU= X-Gm-Gg: AYBFou2B8343at57gRDM+lGRfsIpanRXEBqIhqtlYTVFS77YE5yChBYVnFhp7ed9jfl 2PoOq/6Py2JMECilqTW9kVAYTyI5KjFeCZVUqLBtfMAuTfIFQ5V4tP6YUmbK0+FHxKLCaw0VxqB vTnb+AZ8euMn3QN5DWPxVvGSsXWBLaXdOo8fZ47drr15I+A95VWL7CiDsUzLnvlLsSR3a3wOBt2 oJmyV8k2eeLybEXD5OewcGRGHs6jJjBU9mXJhU2nz+T2hbh7+g7Z6NwyN+uva6nmeBr3sgWQECR Ax6GONFEWUFxgYRd8+IO82BG0QGQdBXG6WlYnmcjH/Z7KPTo84Vc3fLzEhD7slpA32MS0iX6Iuu TqBVVhTyRNzi5SZ4idxHnoewp/vPcETEsmh5ob6lmGEjtrEqXca2v7QWbfEaRzcL+pNdGiO94pY bsdWUPHAdrcvNkZdkKza+GtQeglcgUN4sy8K6leTtzSRWHiWjBxG4tet0DISMxOXA49n8PmyMpd OksV8tLtm2R2McnvkS2qbB0vMjBR/wGz2cKpx0ZQVw0ibnVOA== X-Received: by 2002:a17:90a:d446:b0:3a4:7938:844d with SMTP id 98e67ed59e1d1-3ab3ace27e4mr5399361a91.64.1791763881721; Sun, 11 Oct 2026 17:11:21 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:21 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-oe][PATCH 25/28] libyang: patch CVE-2026-41401 Date: Mon, 12 Oct 2026 13:10:03 +1300 Message-ID: <20261012001007.2541673-25-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:23 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130750 From: Ankur Tyagi Backport patch identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-41401 [1]https://security-tracker.debian.org/tracker/CVE-2026-41401 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 6b06704ac1bae4ef4831384f0c28d14e98c804b8) Signed-off-by: Ankur Tyagi --- .../libyang/libyang/CVE-2026-41401.patch | 43 +++++++++++++++++++ .../libyang/libyang_3.13.6.bb | 1 + 2 files changed, 44 insertions(+) create mode 100644 meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch diff --git a/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch new file mode 100644 index 00000000000..06537acbb82 --- /dev/null +++ b/meta-oe/recipes-extended/libyang/libyang/CVE-2026-41401.patch @@ -0,0 +1,43 @@ +From 34b2a26ee86716e2b593c44e51e38ee15d4e8434 Mon Sep 17 00:00:00 2001 +From: Michal Vasko +Date: Thu, 26 Mar 2026 08:33:44 +0100 +Subject: [PATCH] parser common BUGFIX invalid metadata removal + +(cherry picked from commit 54c3276d871023da266d4ed3ceaee7e8d71d0b04) + +CVE: CVE-2026-41401 +Upstream-Status: Backport [https://github.com/CESNET/libyang/commit/54c3276d871023da266d4ed3ceaee7e8d71d0b04] + +Signed-off-by: Ankur Tyagi +--- + src/parser_common.c | 4 ++-- + tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 | 5 +++++ + 2 files changed, 7 insertions(+), 2 deletions(-) + create mode 100644 tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 + +diff --git a/src/parser_common.c b/src/parser_common.c +index 0b221af72..fefe723eb 100644 +--- a/src/parser_common.c ++++ b/src/parser_common.c +@@ -413,8 +413,8 @@ lyd_parser_set_data_flags(struct lyd_node *node, struct lyd_meta **meta, struct + next_meta = meta2->next; + + /* delete the metadata */ +- if (meta != &node->meta) { +- *meta = (*meta)->next; ++ if ((meta != &node->meta) && (meta2 == *meta)) { ++ *meta = next_meta; + } + lyd_free_meta_single(meta2); + if (prev_meta) { +diff --git a/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 +new file mode 100644 +index 000000000..7e3b6c39e +--- /dev/null ++++ b/tests/fuzz/corpus/lyd_parse_mem_xml/advisory2026_03_26 +@@ -0,0 +1,5 @@ ++5 diff --git a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb index 822c30ba24b..7724b4c2189 100644 --- a/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb +++ b/meta-oe/recipes-extended/libyang/libyang_3.13.6.bb @@ -11,6 +11,7 @@ SRCREV = "c2ddd01b9b810a30d6a7d6749a3bc9adeb7b01fb" SRC_URI = "git://github.com/CESNET/libyang.git;branch=master;protocol=https;tag=v${PV} \ file://0001-test_context-skip-test-case-test_searchdirs.patch \ file://run-ptest \ + file://CVE-2026-41401.patch \ " From patchwork Mon Oct 12 00:10:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100399 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FD74CA9ECF for ; Mon, 12 Oct 2026 00:11:34 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3505.1791763885332024619 for ; Sun, 11 Oct 2026 17:11:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=GvCvBdHV; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-3a8af3a704fso591462a91.2 for ; Sun, 11 Oct 2026 17:11:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763885; x=1792368685; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DIyg5qq8b+2UqKvFnrtqZGTXonYDjkNyPtCICmTLpUI=; b=GvCvBdHVJsJoi0q4znOHUZiayu7KXjuIDgSSIGLpXyavj7ij2QRUJ09WOFSxEMH7sb LhhUXiO9sJPBqfiZT2UFgoc3rAvVbq1+froMlNA1HP2LcyL1SMVGPNNqFQcLxiqgIJso hRwloxNPKb7S3lKcWE8vFtjQtXWW9yvJpeA6i3xi36qQ+nZZuGg/z6TqNyhS0441ROjE CDU6T4huNssBqkMKpYcelXGFwqZNm0HlzgcD6FiejC5NKVNWSdhFu9ZHtWbN2LllpNsY KagsgwNghr96DSeD+GkP+0jfJtXlcHpEJTB+wBTj6plZuHqLXKA3d47l6yr28CB+DW40 NlEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763885; x=1792368685; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DIyg5qq8b+2UqKvFnrtqZGTXonYDjkNyPtCICmTLpUI=; b=MSKHERyKvSjswuhnY6nmWCWnpjYpNS7apeapRi1zQNJ8E9rKwWYu+8WepMa+tESVUo tEhBsvBUQinjYLGdrKtMvvcUvG3WENrPlxdNHv/slzu+JloSBxn/8KRuDnTGAi4CvNBD O8bfWhNiPTlqCynila7b+VpREuzE7B6T53eh459Z+J1RT7nsrnL7GkseKoMJlY/U5AaO dpyBU4N33J2+kPKNWn5Sqvsf4UtvSPFNfKpmvyt8FhqtB/pHSXUjOH9dR+NlTnmG7Nrg z2e6vbKq0PaUNFXJpADSjnwv2ZyZLb/N8EWIHoYfv2JNStYkYcOgFiGfPAGQrl61N53E IS6g== X-Gm-Message-State: AFq9FYJN3hDxaRpUnmdzEflXMXBw9jlPUJvwkrMo8n2fc5Xu/f2JbVDY t38GcTss2aYlSSwt9sz7WcuiadVZ3lgItJYDZLcagRB7LW2l0WOrIIOHjfwg4A== X-Gm-Gg: AYBFou1wit1A5AP0Efxo1Z0C/z4tGDLvmsyGJ71Zt+zEr1tpyTA0sAHsILwwh2cLhg/ PpQ5B02Fx0d0rgSQ2Trm6o4mBY2Fbc7CTIzlXNjM8BXeRXVgLHTYuAEjtW7NQ45xtP/gSjg8WPX ZXaYuY5dP3Zkpn3GX6jVqYMFyjBwTl8vYkyiHUOnRSytZjpnZ2CpAPEgyj1nNsnp1WMBJygx2/z moNk7QKLHxNaFV2rSVGOTqq0S5AGMoLzVPPQO43T8Xs6ZQKRdLvPG9wm0+WgYK2gmdVDrNUCDPr LUmMIS67xQWxARl93yfY/ypTbImb4zO3CsI1gTz/gIRx+F//Nz0SNdGxGaK/cjoBqMat7hMbQTX KMgSrqKMlqSZId/IXybC3K+cj1AJBFy7HUTfBvlTNXRqLSQ0HqTP3tEPqvob3BjdyfL7ckeeSI5 LVyiFIxzyfa1T2XAHw7eArT+mKKau/dnwnIj9x+r89TfJQq4l97eMe09o8j/9oG4CNLT5mz5e9y UTl/9znpI7QFoIzDBX7LpddjuCwArY7CP+UTK0= X-Received: by 2002:a17:90b:1d52:b0:3a6:e8fb:76b5 with SMTP id 98e67ed59e1d1-3ab3a79001bmr7085329a91.37.1791763884633; Sun, 11 Oct 2026 17:11:24 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:24 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 26/28] tinyproxy: patch CVE-2026-31842 Date: Mon, 12 Oct 2026 13:10:04 +1300 Message-ID: <20261012001007.2541673-26-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130751 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-31842 [1]https://security-tracker.debian.org/tracker/CVE-2026-31842 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 985acd9e7c375e17a674be4c21e9e80d0259eb38) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-31842.patch | 33 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 34 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch new file mode 100644 index 00000000000..6b8c02d6292 --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-31842.patch @@ -0,0 +1,33 @@ +From ed5252d213a68546feaff68e2b40e401d2c2afd4 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Fri, 3 Apr 2026 11:21:23 +0200 +Subject: [PATCH] reqs: fix case-sensitive matching of "chunked" (#605) + +the chunked transfer encoding needs to be matched in a case- +insensitive manner. + +closes #604 + +(cherry picked from commit 879bf844abffa0bf5fae6aff0c73179024dd9f98) + +CVE: CVE-2026-31842 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/879bf844abffa0bf5fae6aff0c73179024dd9f98] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/reqs.c b/src/reqs.c +index 7aacfd3..8b68538 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -850,7 +850,7 @@ static int is_chunked_transfer (pseudomap *hashofheaders) + { + char *data; + data = pseudomap_find (hashofheaders, "transfer-encoding"); +- return data ? !strcmp (data, "chunked") : 0; ++ return data ? !strcasecmp (data, "chunked") : 0; + } + + /* diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index 2555d2132d9..a0ef5fd62f9 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -9,6 +9,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://run-ptest \ file://CVE-2026-3945-1.patch \ file://CVE-2026-3945-2.patch \ + file://CVE-2026-31842.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Mon Oct 12 00:10:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100400 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C54CCA9EBD for ; Mon, 12 Oct 2026 00:11:34 +0000 (UTC) Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.3537.1791763888016717955 for ; Sun, 11 Oct 2026 17:11:28 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=KttQJs/H; spf=pass (domain: gmail.com, ip: 209.85.216.43, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3856d6fbcb3so612410a91.2 for ; Sun, 11 Oct 2026 17:11:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763887; x=1792368687; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=NXyyvuUcu5QLDCsKxmVu1m7pp0gj/ECe/+J84LPSuKM=; b=KttQJs/H6qg6wQDxur0ph/Zjbgrzx1j0E4s40eFrw4aiii/KEnQsk9CPD1yRDnJRWb AkEdtKTyInoKDs3qAOIF8h5R0RS6l9n8OlAJ9art2gda5Wrm+O5IBemhESy9ElwwChtV Z+vLZALJp2XAP5xelaRIDUxK9nCDyo5kgGTImloMxqH5+6A2RX9lFKod+Se/NBGIjaOF VAje+PIYVHkLPyyg5eDbF7O2BhzmoIunijAm8EmAzDhWQWcY08QltwIKZllDuhVdcLHh qb7q1SzHNK/GgG5PqUgmn4Abowq0E9viEctUd0YXb2IzIzSJD5ocpOzuJl3QulpeCcwO UolA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763887; x=1792368687; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=NXyyvuUcu5QLDCsKxmVu1m7pp0gj/ECe/+J84LPSuKM=; b=Nv6wyCF4G1rBqvF0fNRNwP4Jr9iDGS3OXed1wWqLy5uVASK1iiNRoOE+w3STrqcB39 pfTg5vk9Xwpz6X30ywxrDEhRBnyXv8LVprHPeZ/mB5Dx2zBu0hXrsv0fbPNPTdlCIVL2 dcW+Kb8PslNM65fKfTUhMOftAo8SiTTlxoF2VWdinDl3gzwgMxY73458sUk0enlpgEF0 EPN20tKxGQ3NL5JsYtUuK4Yi91Y7kb20GSmQaNzRCmCCzSehT13o00gbYbxA+gkZ727V 5TIhnYGL2DjBQkFPxAATn9+d0/KcPGB5EXen2YoeNvMScIjzhRHJQhuNHlIE+kNu6NE1 QMtA== X-Gm-Message-State: AFq9FYJOY8/27W67jm3RZcavAQYYzKr9Mqc/RFdU2otCE7PudBELt9Fh WAOszQBiPE1UpTA+AW2FVzyIxWrp8H79lVDA/m7rD9Wi9al4GJZ3jIw0uHJTEaiaeJ4= X-Gm-Gg: AYBFou1oKCc4d5VVDNo0mzVvQv3ZoT0RX6KPd4TXwB+KlnhPttyNWIxFOEqBNhaRTkQ Sb2byiPN/Uj5rZRq5u+NvPW0NVboKQ+n8mqtLvgDmmSbZ90nQlTU1Wl9gfcI738fB16p52nrGCE aSA8S3PKOqbD2jPrml++FS6ml36YBsKLgv3MzeJ+ZNfH45dIrBSoQyb2Gjet8zo9EIgT6C7NpJe Kn24Agye3eAhDIsh6/FDAHIGKc4wS/JYLo3kI8xKghqgjRKhm7z3B0hqmbt/AFlGGNEFDR7raRZ 9DPPDVLCKi9LkSgPWHA6GM7cOpQUn0RLFanmEh8a6llB9fhZ/2Bjw+9VlyEa+ddVg3cMD0+C71Y tvJ7WyG/u42eimdZoJ8UND1vu8mHUvtHW9PZqW3ZAtQRx0i+uYBcJ/9V1jyqKzh/aeePAA80+0H edYQxlwX1U5TrZToEYZ8NIfSFPAm4ddWvPo/dxvYQkvYAPwE6LL0hegijXVAoylRnValtr5qRoE vELREUZ87ULCiPOoWpohyUgSpNHEf+Ep6OpRCc= X-Received: by 2002:a17:90a:d006:b0:3a8:6a04:80ef with SMTP id 98e67ed59e1d1-3ab3a2901c2mr5331955a91.6.1791763887332; Sun, 11 Oct 2026 17:11:27 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:26 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 27/28] tinyproxy: patch CVE-2026-54387 Date: Mon, 12 Oct 2026 13:10:05 +1300 Message-ID: <20261012001007.2541673-27-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130752 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-54387 [1]https://security-tracker.debian.org/tracker/CVE-2026-54387 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 33649b065762429d18d1d9e9ec94deedb6edb63a) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-54387.patch | 37 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch new file mode 100644 index 00000000000..c0199c1713c --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-54387.patch @@ -0,0 +1,37 @@ +From a9602e492cedd5d5d18dd3675d9be90e9b0d9e66 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Thu, 7 May 2026 16:33:11 +0000 +Subject: [PATCH] reqs: prevent request smuggling via both content-length and + chunked + +addressing point 1 of #609 + +(cherry picked from commit 623bfc093df009296f0b85d40bc677ef9d5c09bb) + +CVE: CVE-2026-54387 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/src/reqs.c b/src/reqs.c +index 8b68538..e3cfe76 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -942,8 +942,13 @@ process_client_headers (struct conn_s *connptr, pseudomap *hashofheaders) + connptr->content_length.client = get_content_length (hashofheaders); + + /* Check whether client sends chunked data. */ +- if (connptr->content_length.client == -1 && is_chunked_transfer (hashofheaders)) ++ if (is_chunked_transfer (hashofheaders)) { ++ if (connptr->content_length.client != -1) ++ /* request smuggling, see GH issue #609 */ ++ pseudomap_remove (hashofheaders, "content-length"); ++ + connptr->content_length.client = -2; ++ } + + /* + * See if there is a "Connection" header. If so, we need to do a bit diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index a0ef5fd62f9..e84aeae53cc 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -10,6 +10,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-3945-1.patch \ file://CVE-2026-3945-2.patch \ file://CVE-2026-31842.patch \ + file://CVE-2026-54387.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Mon Oct 12 00:10:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 100401 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 29720CA9ED5 for ; Mon, 12 Oct 2026 00:11:34 +0000 (UTC) Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.3508.1791763890616700873 for ; Sun, 11 Oct 2026 17:11:30 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20251104 header.b=AjN1UyfZ; spf=pass (domain: gmail.com, ip: 209.85.216.41, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-398a5aad413so613502a91.3 for ; Sun, 11 Oct 2026 17:11:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1791763890; x=1792368690; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=z8GN4om8v5rdFSVZdGpD+ZsZwPq5HhaGQ2mhYesOgWg=; b=AjN1UyfZAP1lU7teptCxBuTaoZbj94+Nkv8ODPoNbfZJBG4ECGLITvChPgE2eY2vnp Z1qFZNYxdSU1Sx5O/k2Ttx88Pjwqd/tQyxZBRmLv+emLTIXvtnKxoV7btTd4m8Djd2kP ORK9y95vYTWZS0cMyMQgMQqQKswBGu7rSazEq7X5PLrXdd2lA9TBF/dnhnWsM+eYsj67 Yz8DCUoGITVmK6WIsMTIpRvYEd/DYsBxu9Fwd9SKgEkIi/VRJ0QBzu8O5EKMsG45+L/P UlCuEwsXlOR1apA7/+K+PdmPjFUV4ViG6uED3D8QL9NFTR9FWqM9izSHLFY74Sl3fdvw htag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1791763890; x=1792368690; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=z8GN4om8v5rdFSVZdGpD+ZsZwPq5HhaGQ2mhYesOgWg=; b=GQJEpqv2TPw41pX16W6TfGXKaWAC/z6PnshNthRrTPO8SZU1fdMsL1HD3E9Yh37t0k 6Fx4k3kJMpBWnzN+Kj9IbqHQVwnFYzhV9Di6NelfhmqYWpCDGTupPXPe2wixP7oFiybP iOek9I6E/8DG+eHxIXrwGaEmozg+ai+AqHMcE/XJo3+bk9SbiOdgHdqw7wZwYzBVUH5q pNwbIOzdHPuRRANBQrFuqZgItC9aXzn6zeO72J2mXDPyBhdhOggnHONdxpH2lYt8m3QV Gyd4Uxts3lgfDVSYDCEXvrbXvFqBrHOovcBKNzp22fZcUdD19G7nd0lr60904ETfT36u YMtw== X-Gm-Message-State: AFq9FYIByaQ1An4RGpO88ObDuQvONBy6jUWHaJrHwwISJDxrzF3k0E6e akLNWT8cZGckgUgQ0HTss2wLWC4g9Hdk89ASpFtGMIRWoS7G7CGwsW1Q03LzG+k11pk= X-Gm-Gg: AYBFou24rzS5L5Z1/hPv00qg0Lkerq9kCukBB8zhf/p3Av3XMmFMZSR4ZdyH4In6lMn ALBkJ/kn2syKFlxa/veX/ikxDRJvXO7tC0BSOLrkvhi5UOyXd58lo9chp1iSmgOV8dDqrkxyTLH GtVTDtAXeooNXHXiku9lJZQzpONDkhB1e+PU1ZFZ1VI23l3cUrRTiVyzPUs/krrdafaP97S3x/g qTon53ovFuvvjM4a/hg3xikTt6v67s9fTUqXGh4qhGjsc8EZOr82WAM19lhUdPznlwWIxBIbGW7 k/p7/q8ZHCgqvFZlO5+xIgkAPkwvpanwyagDlTwrrUU2fXGjOUVz14xtjt9Li9tM094Qwo/iloo F5SsJUJUaO00quFFikcc0X64GLDBvboIXJyXUpGuQslOICJQneN2rDNyjW+tig6ZXHP6VE6Oh9e lZ5PlG04Ai0jVVLXTQNP85voQoaya4RnglXbr409lWb+XTlr+ekx2Zp8HdbcZ2H28VKxbYJ6/Lh UR/9GXJaVTgCfh1gdTCi/OwfOkO/zqQo20evSw= X-Received: by 2002:a17:90a:d2c7:b0:3ab:1b19:78f0 with SMTP id 98e67ed59e1d1-3ab3a8e1d1bmr6449619a91.41.1791763889949; Sun, 11 Oct 2026 17:11:29 -0700 (PDT) Received: from NVAPF55DW0D-IPD.brunswick.com ([203.211.105.219]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3ab3966dc7dsm7850379a91.2.2026.10.11.17.11.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 11 Oct 2026 17:11:29 -0700 (PDT) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi , Anuj Mittal Subject: [oe][meta-networking][PATCH 28/28] tinyproxy: patch CVE-2026-55202 Date: Mon, 12 Oct 2026 13:10:06 +1300 Message-ID: <20261012001007.2541673-28-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> References: <20261012001007.2541673-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 12 Oct 2026 00:11:34 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/130753 From: Ankur Tyagi Backport commit identified by Debian[1] Details: https://nvd.nist.gov/vuln/detail/cve-2026-55202 [1]https://security-tracker.debian.org/tracker/CVE-2026-55202 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal (cherry picked from commit 233e6a56e5311eff91c8a46c36a790db1fb38933) Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-55202.patch | 107 ++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 108 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch new file mode 100644 index 00000000000..4e446542e27 --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-55202.patch @@ -0,0 +1,107 @@ +From 04b34f814076d790db26925d7df7c30798910c99 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Sat, 18 Apr 2026 00:03:15 +0200 +Subject: [PATCH] reqs: improve stathost detection (#606) + +until now, only the basicauth code checked the host header, regular connections didn't. + +- add a new helper function to compare a hostname with optional + trailingcolon/port against the stathost. +- add stathost check via host header before transparent proxy check, + else stathost might be misdetected as a trans host request. +- refactor existing stathost checks to use the new helper + +this should make it easier to access the stathost, for example by +injecting a host header into a curl command line with -H: + + $ curl -H "Host: tinyproxy.stats" 127.0.0.1:8080 + +the stathost can also be specified as an ip address, e.g. +Stathost "127.0.0.10" + a separate Listen statement for that ip. +in such a case e.g. + + $ curl http://127.0.0.10:8080 + +would work too, even if curl didn't add a Host header (but it does anyway). + +(cherry picked from commit 09312a185ae25cc486b4ff5987638a7917a48bce) + +CVE: CVE-2026-55202 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce] + +Signed-off-by: Ankur Tyagi +--- + src/reqs.c | 37 +++++++++++++++++++++++++------------ + 1 file changed, 25 insertions(+), 12 deletions(-) + +diff --git a/src/reqs.c b/src/reqs.c +index e3cfe76..d5037cf 100644 +--- a/src/reqs.c ++++ b/src/reqs.c +@@ -316,6 +316,17 @@ static int send_connect_method_response (struct conn_s *connptr) + connptr->protocol.minor); + } + ++/* determine whether a hostname with optional trailing colon/port is the ++ stathost */ ++static int is_stathost (const char* host) ++{ ++ const char *p = config->stathost; ++ const char *q = host; ++ if (!p || !q) return 0; ++ while (*p && *(p++) == *(q++)); ++ return *p == 0 && (*q == 0 || *q == ':'); ++} ++ + /* + * Break the request line apart and figure out where to connect and + * build a new request line. Finally connect to the remote server. +@@ -384,6 +395,16 @@ BAD_REQUEST_ERROR: + goto fail; + } + ++ /* ++ * Check to see if they're requesting the stat host ++ */ ++ if (is_stathost (pseudomap_find (hashofheaders, "host"))) { ++got_stathost: ++ log_message (LOG_NOTICE, "Request for the stathost."); ++ connptr->show_stats = TRUE; ++ goto fail; ++ } ++ + #ifdef REVERSE_SUPPORT + if (config->reversepath_list != NULL) { + /* +@@ -497,19 +518,11 @@ BAD_REQUEST_ERROR: + } + } + #endif +- +- +- /* +- * Check to see if they're requesting the stat host +- */ +- if (config->stathost && strcmp (config->stathost, request->host) == 0) { +- log_message (LOG_NOTICE, "Request for the stathost."); +- connptr->show_stats = TRUE; +- goto fail; +- } ++ /* check whether hostname from url is the stathost */ ++ if (is_stathost (request->host)) ++ goto got_stathost; + + safefree (url); +- + return request; + + fail: +@@ -1688,7 +1701,7 @@ void handle_connection (struct conn_s *connptr, union sockaddr_union* addr) + + if (!authstring && config->stathost) { + authstring = pseudomap_find (hashofheaders, "host"); +- if (authstring && !strncmp(authstring, config->stathost, strlen(config->stathost))) { ++ if (authstring && is_stathost(authstring)) { + authstring = pseudomap_find (hashofheaders, "authorization"); + stathost_connect = 1; + } else authstring = 0; diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index e84aeae53cc..25df44301b6 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -11,6 +11,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-3945-2.patch \ file://CVE-2026-31842.patch \ file://CVE-2026-54387.patch \ + file://CVE-2026-55202.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592"