From patchwork Fri Nov 6 01:13:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prasanth Ramesh X-Patchwork-Id: 103199 Received: from mail-dy1-f170.google.com (mail-dy1-f170.google.com [74.125.82.170]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10938.1793927635016071430 for ; Thu, 05 Nov 2026 17:13:55 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=HN+g/IZ+; spf=pass (domain: gmail.com, ip: 74.125.82.170, mailfrom: ragaprasanth@gmail.com) Received: by mail-dy1-f170.google.com with SMTP id 5a478bee46e88-3645f0f3fcdso206051eec.0 for ; Thu, 05 Nov 2026 17:13:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793927634; x=1794532434; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=eSiyDqZ6puBrhOudc6cZu2MCSAOX3L6d7YDAP5wdeZQ=; b=HN+g/IZ+ohhZyyoOzBKzH28PoRjZwabsgkXhkUtXQFa22Q2xWwrnFAFkBkUOvw1HBc ndsKNBG2j88Lm6Nf0P/BU31O1wkN/mFnEjIQKBja/txHsv1CKv2OsD3UYrJa+SJ9987v WrBhnsH9JOZNDtvknt3hebwYYpuG9LZRgZ4drx4KKJwRFYyQ9ATIBZs0spP5lDQhD3bz 6xEe+75YMNdauOzk42pKG6mKBGeGPO0Hfr+MD1BF4QlDFrRaNJGCrMq19KSW58ymE/2a dqCvFBBScMvM+dPnGSElIDzahnlKErtP53TnYcGF02wdnvqgd8Fr0Qi0nTX56PrrlnBt fdeg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793927634; x=1794532434; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eSiyDqZ6puBrhOudc6cZu2MCSAOX3L6d7YDAP5wdeZQ=; b=NttqrdEUoCBFmC/nXwDhU0xwNhqR9DX2H490Dagk7qjSvtaSvcL5N+RjMFEJh9aBwK lK9NYtXc/8e+i4qUJ4LBLvugLy/9FejJRKx7W7SkksInPec6JSxM0acBjPW16xFsYo8h ij6UlpZVMVs+dRiigrX84hK2FkobFYB4QbcW4C9XLtugp3GLeuEMs3BnWP3jQB56FOwB DLJF7ztwH8maqGPSew7XhKPq5T99UuwOw8P2zlSMzoBdnhlLI/IC/g1ZcU7ZU2uGiPuu iB2JfSce0N0gdwupAHe/B0/PgWQ/Cp9oDLvMxd7J7qVMn7v7kaeu0cQfYVV1s5lgVpMb DMJA== X-Gm-Message-State: APuU4Z+yfBGB5m6c6wvEkEo+HLiAKOMyjhoWztCig95jDDOCad59YGU3 zk2VvLjBVrhY0RRd5OR1tn4XgO5fAiAgMYkzB3TUS33fvgVWhc9yKVHwPT25ow== X-Gm-Gg: AYBFou1AVTAeoZ+kmiMUK3HSWav8FFRR3ErIS13aIj7Ej4sc4mK9CQ8ezxbj+4dBH92 63wrVAiZwAh3s8t5/qDo+SUb1t4rRe9lal/mAWZhhbiK9/x0ZA4ZqgiC+XH+9QKK2Q/AzJDHmha KrfqoFFQVqScdIifgyHwjo0P4svHTKxnJBpLhhW0ZUiSkLlYczbjiWXzeJ+fd/UfuUcYzObxSQq fr0I2Qhz4snFFyMy5zqv5tfxnTq556M5LvjwT4BJXPvJEzkyM7CfFHSnBq8VKYoA6dsJXpHe3W1 qrcn04jEcAs61zkoV6kFv+jNUKlBreTzbs5JmkL9/XMQ/zz205s0wnFwpYdfhLt+KPQMtXWdyW7 v5AstKllqLCzxm427v6r84dpRfpQa+TnSRpHwLEth+yygLPRNHeKjlpGnaP+25rqqSQV7UQPulT f11FY2C0oQVBdf6B9BUy7pZhi58pggJZ9A8cbUqtEgIT6qmcp0YbnPeZge9ItPdZpdeQ/SEqApJ Vv7OQZ6sniPmUblTlQGq4OUynOA2TBqNqh5wNdrK8nuWaApt0DHZC6HPPEfY6kVLo9q9AscAX66 NA2krAQgCMZFMPtVv4BU9ayojwPuOwqJNFikX+41XDwhAtQLwJvYJBYSWqUrtWwh X-Received: by 2002:a05:693c:2585:b0:36e:fa91:b6e3 with SMTP id 5a478bee46e88-36f75838d8amr1099531eec.17.1793927634095; Thu, 05 Nov 2026 17:13:54 -0800 (PST) Return-Path: Received: from prasanth.alps.lineo.co.jp (vpn1.lineo.co.jp. [203.141.200.204]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36fa922c6c7sm1166949eec.10.2026.11.05.17.13.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 17:13:53 -0800 (PST) From: Prasanth R To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, peter.marko@siemens.com, Prasanth R Subject: [PATCH v2 1/2] zlib: upgrade 1.3.2 -> 1.4 Date: Fri, 6 Nov 2026 10:13:23 +0900 Message-Id: <20261106011324.626292-1-ragaprasanth@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 01:13:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249581 Bug fix and security release. It fixes CVE-2026-85091, a heap buffer overflow in gzwrite(), and several inflate, deflate and gzread issues. Drop the -fuse-ld=bfd workaround. 1.4 fixes the configure test that failed with lld 17+ (upstream commit 6ddc2d0, "Fix configure when using zlib.map with some linkers"). PR #936, named in the old comment, is about --zprefix builds, which we don't use. License checksum is unchanged. Changelog: https://github.com/madler/zlib/blob/v1.4/ChangeLog AI-Generated: Uses Claude Signed-off-by: Prasanth R --- Notes: v2: zlib 1.4 is out, so upgrade instead of the backport (Peter), and mark CVE-2026-76844 cpe-incorrect in a separate patch (Paul). Also drop the lld workaround: tested a 1.4 build with gcc + ld.lld, same exported symbols as with bfd. ptest passes on Test. meta/recipes-core/zlib/{zlib_1.3.2.bb => zlib_1.4.bb} | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) rename meta/recipes-core/zlib/{zlib_1.3.2.bb => zlib_1.4.bb} (85%) diff --git a/meta/recipes-core/zlib/zlib_1.3.2.bb b/meta/recipes-core/zlib/zlib_1.4.bb similarity index 85% rename from meta/recipes-core/zlib/zlib_1.3.2.bb rename to meta/recipes-core/zlib/zlib_1.4.bb index 8a23d98cd3..18b27df878 100644 --- a/meta/recipes-core/zlib/zlib_1.3.2.bb +++ b/meta/recipes-core/zlib/zlib_1.4.bb @@ -12,16 +12,13 @@ SRC_URI = "https://zlib.net/${BP}.tar.gz \ " UPSTREAM_CHECK_URI = "http://zlib.net/" -SRC_URI[sha256sum] = "bb329a0a2cd0274d05519d61c667c062e06990d72e125ee2dfa8de64f0119d16" +SRC_URI[sha256sum] = "02dd159783677a749c04adbdd02b55b8a2bcc7e054f51b76b549199a916ad584" # When a new release is made the previous release is moved to fossils/, so add this # to PREMIRRORS so it is also searched automatically. PREMIRRORS:append = " https://zlib.net/ https://zlib.net/fossils/" CFLAGS += "-D_REENTRANT -fPIE" -# zlib does not build with lld, keep it until https://github.com/madler/zlib/pull/936 -# is addressed -LDFLAGS:append = " -fuse-ld=bfd" RDEPENDS:${PN}-ptest += "make" From patchwork Fri Nov 6 01:13:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Prasanth Ramesh X-Patchwork-Id: 103200 Received: from mail-dy1-f179.google.com (mail-dy1-f179.google.com [74.125.82.179]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.10939.1793927637309559096 for ; Thu, 05 Nov 2026 17:13:57 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=QKXwbKOv; spf=pass (domain: gmail.com, ip: 74.125.82.179, mailfrom: ragaprasanth@gmail.com) Received: by mail-dy1-f179.google.com with SMTP id 5a478bee46e88-36f6295304dso137542eec.1 for ; Thu, 05 Nov 2026 17:13:57 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1793927636; x=1794532436; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=exG029InAKqsUnF3KC1GwoOh3B1V02ux0Y+C8uywZA0=; b=QKXwbKOva5omS/2Uq1ZCi0NXULttim9zfRmMqEIvMUrm6RvTSuuZdSQrYYiVq2eHei +rtudsuUrQEHD3/cC9gfe5A1z2Pn9z0K/uwuI2hNYHFaw+djrkgiZQjAPNrbnlT3j83Y +hZqvXp3XsWNOVfVOkWJRAZLCig5ekLTBX6GDS8mE5Nzszes6WbM1RNqMIK1QKfKAzbN CXANmTD9rzJ9Jomj2/ew8EgtA1PztPXj536kKC3z76lph41o/IztzX0XOEfkyvN6eUwy CPEqFuzsrX4P7nb1EU6CoMrXcHfGvuq7KFLW68MDPoYN9AIdsx9tkYWaYhGdp+5AFOgq /RNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793927636; x=1794532436; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=exG029InAKqsUnF3KC1GwoOh3B1V02ux0Y+C8uywZA0=; b=mlEunTXANWJurDCJH4+7tGvIA9kGZIhkQcdUSaXK63OL2Y/d1j1Pf0WzPRX9rFA2jJ If57eR6eRgoeVCR+B4sIwwGQnU4UD8dUuYC0VhnQpYAJwegbaZwE0nbhoVL8Sov9JsP5 1rail0y/r+GZvt8PFlTHVUCc1fE3TigC45P+oprQtQShdo9NZn7qoHqjBJ9b2Rs3Rl1H uNlAnTCpXM3FYvm92HrWs9Gy2wLA4HpNjBv2m28vsEbpmKV3F2X3+A6MyWtX1rnhYLXX 9lntzXfre9zWs/x64IFJaEjTa5gpVXPdUcujWcavhNWWN3jQqgHdz05NYYEB5PONQPGZ UbVw== X-Gm-Message-State: APuU4Z/wln+b4EBLYXLc9jYgvsAcCzfSDchL62PyG7XkBazl4Ds2QvN/ zXD3X1DL72F0g52CrNwB8iX9cNtTArm03wDYjFn2A7iw9rF7YcV31YYMLOCJ3w== X-Gm-Gg: AYBFou0cu0/eFvgAyglcPBDsY2UXxPhaqHYN+koAElFlF7kZz0v54TQPiHUXoWkG/cP ZdY2RpKtoBu0BuH7w/YK5uXNWNn4zbwzx11LUsrRPh77Ma84hNL7o2vaJJtRhSdLyhL/AXcAGaa 9ab2NyUU7s0OGCOu9wqgAQHShw+x3gY16ECzp+bf9/4uQsrywJe2MApDxIra+cFZ/xTDfhqKO3E 6lbtUNGz6tp9+s6PF76ejxkxLlTPVVQhh2Pi518L3e4pikBBfIeat6S2YYtsYTnE4aH15+6PE8O iMVIrYXTANj/sNWbYYgeHwHvbv5R9d+MdG5U9LQ9ejqyb0k0Hsn9RhqpBtld4chUsM6ZJEIT26+ ugI6Of2rkPew0QvnpNTZPB85iGcfV8WK3/KyTj43e7aMGkhogt+NfT490VihcD9Wq/r6aQhkofs wSrnbEniAujISGA8/JP+8u/yuDl+KyVX6LJ0od1g/s6hX0HwlWVQ1q6284bToMPNgxqddJbdPYL 1jLgCTBq0RTD9t6T3oiDiYANIF3DuMcgaIy/m1tJ5TbW6Agv4Hrrfb6hHbybmc3SGRoeGE0/A5+ UUHIKwym31WUhCjzpkE0r7HCEFk57I9J/uTuj9A6W1g1x1wOGBC2Zc5z0+G2tlfMYDqKcVvMeoI CejAyQItk3Q== X-Received: by 2002:a05:7301:d805:b0:36b:f09f:924a with SMTP id 5a478bee46e88-36f7592e4d4mr721686eec.14.1793927636246; Thu, 05 Nov 2026 17:13:56 -0800 (PST) Return-Path: Received: from prasanth.alps.lineo.co.jp (vpn1.lineo.co.jp. [203.141.200.204]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-36fa922c6c7sm1166949eec.10.2026.11.05.17.13.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Nov 2026 17:13:55 -0800 (PST) From: Prasanth R To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev, peter.marko@siemens.com, Prasanth R Subject: [PATCH v2 2/2] zlib: ignore CVE-2026-76844 Date: Fri, 6 Nov 2026 10:13:24 +0900 Message-Id: <20261106011324.626292-2-ragaprasanth@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20261106011324.626292-1-ragaprasanth@gmail.com> References: <20261106011324.626292-1-ragaprasanth@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Fri, 06 Nov 2026 01:13:58 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249582 CVE-2026-76844 is a webpack-dev-middleware CVE. Its record got the zlib gz_vacate details by mistake; the zlib CVE for that bug is CVE-2026-85091 [1]. [1] https://github.com/madler/zlib/issues/1330 AI-Generated: Uses Claude Signed-off-by: Prasanth R --- meta/recipes-core/zlib/zlib_1.4.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-core/zlib/zlib_1.4.bb b/meta/recipes-core/zlib/zlib_1.4.bb index 18b27df878..2bc1967c0e 100644 --- a/meta/recipes-core/zlib/zlib_1.4.bb +++ b/meta/recipes-core/zlib/zlib_1.4.bb @@ -47,3 +47,5 @@ BBCLASSEXTEND = "native nativesdk" # Adding 'CVE_PRODUCT' to avoid false detection of CVEs CVE_PRODUCT = "zlib:zlib gnu:zlib" + +CVE_STATUS[CVE-2026-76844] = "cpe-incorrect: this CVE is for webpack-dev-middleware, the zlib details were added in error"