From patchwork Thu Nov 12 07:13:43 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103863 Received: from mail-pl1-f172.google.com (mail-pl1-f172.google.com [209.85.214.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8430.1794467639033439428 for ; Wed, 11 Nov 2026 23:13:59 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=RPk2QBIZ; spf=pass (domain: gmail.com, ip: 209.85.214.172, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f172.google.com with SMTP id d9443c01a7336-2ea138a3497so23942275ad.2 for ; Wed, 11 Nov 2026 23:13:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794467638; x=1795072438; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=h0FUFLEZTGzlWamemxAXdZY+ZtgQNv3UyFvsYDXcDYQ=; b=RPk2QBIZy/bqGFqORrnJbTcOW1gmDjH6MYbD5mwwAV42OBwDRkHFRsymkHOShL6Y8t A5NJMy5NXWHRTl6Io2g+IJFPedLehivEDHOohtyU3L9nRzrTr7bTwYvfot66zq4n55B/ cQ7BQozHwRdpRe479aJX3X3NuuFV0V1WCxUIQ03WZiZS31BxgUteRJc2NodtCIIQk65b BBabztHJ15hTMnLMpVxdLZcouM11zcfk+QNbeElI2Kq6L2+N+2CE7tsN+ylFk+jUz0g9 oQ8I06da4pE/PiPckt0nwKkI8EWB0Uj3qRfgPyExBX+lxh9nsCl1xQRZZqbMaOKuYKqZ gF9w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794467638; x=1795072438; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=h0FUFLEZTGzlWamemxAXdZY+ZtgQNv3UyFvsYDXcDYQ=; b=rYxDPWqZ5RzT8he3ziDUqbYUv5WSjMSkCgZE36vr9Km0GW1nMit+SdVYFey4iGLEQz 9dDKlibLAW1fOhyTK90ocVGAqLz8LLj8TFnl59ZuAuHIbrs5Em9dyJDa+UwgTCZDDFY9 HOjbfs6HornIw7QrvRkLCS/lj1o8fFzJfM0BddXPynlHGDNrHBU4ec71zeViGOfrdYNG +S5Q6NumrRe+7tOsun6n8ET10hsBRGhJJSbxE2wMdms4Cwd/WjAxKJ1mF/6FkRSbCxJf Zo0G8TcGf8jGXKjrVu6DfSssqr7W4UwSCq96lJeb/IXLGZP89jOcn0Rja8y3UlUjF+6f TtHg== X-Gm-Message-State: APuU4Z++AYjZK2HVVHG3dlFczlt+hMsPB+1bgdy/ceK4HjuAmjJP8JIY St9/vSPrLlSPfJuOgAFAA4tFoQwuP8RDMgjJVb29WIoqb/jQI397MxeTdmQu+g== X-Gm-Gg: AYBFou2J7WtenHGZlUholySRKTGUXzsx4XuWIdAYcHLBWrC4src/Wq7qzJwCFCXrvoJ B74d0QP5FJpkRk+qIGynGGJhCCqbJOBGwDQe2blgNSuXfmJmSmmJvh/XtnK7v4MwczZy4ulgBBf WRYo0yvuJHERjpVU799UAY3v0zHRHm114NGyCpk38HzCpvwTyqbr4EVbqWmVOWVbZXu3cdCl3Kb w/RGegDAQZfvVoZDvInW/TVlz8r/PbajRDYM8WKtXa2p22g7nl56oOcu7wRJple8kp1whPlmCSa NaDdirUzm0tfFKzQkFmtqQaxdhhC6ArwtUdzJ8hpQNTFCoNAYD38xG6m73+9+4PyolVW4OcwgTr 5WhMd7hxyX4UplmaNyB9YnokXN0XM95cSGRCW14jSE3BNMvvctWcqZyN/QvMBD3KTJy3zPMi8xY JV3IgNQhDOpC/Y1dWurAVJsVOBgfS4quijnOhKWM5mBw4ih58vOas3FRq6e/Oy3UjCsdhJCdt82 nREsB/MbSPWd1Rt+5zMOgNctjrFDAmpkZ9HVZiuAxsx1b+1WioUKhCpbO0GyVRaouqme9fw2vxL djDN11b55jFcAdgmCWK+uCN7rdK5o76XkR5Ar57UitUNsZb58bvCmQ0bJwjY7SRQpCs2JHrGaK7 RqPpRrhc= X-Received: by 2002:a17:903:37cd:b0:2e6:136e:f264 with SMTP id d9443c01a7336-2edd7a691cbmr47388945ad.50.1794467638303; Wed, 11 Nov 2026 23:13:58 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2edb6d7e062sm29018355ad.35.2026.11.11.23.13.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 23:13:57 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 1/6] 7zip: upgrade 26.05 -> 26.06 Date: Thu, 12 Nov 2026 20:13:43 +1300 Message-ID: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 07:14:01 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132200 From: Ankur Tyagi Changelog: https://github.com/ip7z/7zip/releases/tag/26.06 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/7zip/{7zip_26.05.bb => 7zip_26.06.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-extended/7zip/{7zip_26.05.bb => 7zip_26.06.bb} (98%) diff --git a/meta-oe/recipes-extended/7zip/7zip_26.05.bb b/meta-oe/recipes-extended/7zip/7zip_26.06.bb similarity index 98% rename from meta-oe/recipes-extended/7zip/7zip_26.05.bb rename to meta-oe/recipes-extended/7zip/7zip_26.06.bb index 050673f678..375f55f0ef 100644 --- a/meta-oe/recipes-extended/7zip/7zip_26.05.bb +++ b/meta-oe/recipes-extended/7zip/7zip_26.06.bb @@ -12,7 +12,7 @@ SRC_URI = "git://github.com/ip7z/7zip.git;protocol=https;branch=main;tag=${PV} \ file://0001-Remove-treating-warning-as-errors.patch \ file://7z_wrapper.sh \ " -SRCREV = "b88c6bc09339de32f7d18bbab900686b244f42ba" +SRCREV = "d3296e39e1f1f92c7b41c0c3848e65640428d42d" UPSTREAM_CHECK_URI = "https://github.com/ip7z/7zip/releases/latest" From patchwork Thu Nov 12 07:13:44 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103864 Received: from mail-pg1-f176.google.com (mail-pg1-f176.google.com [209.85.215.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8432.1794467641499279943 for ; Wed, 11 Nov 2026 23:14:01 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Up6so4dD; spf=pass (domain: gmail.com, ip: 209.85.215.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f176.google.com with SMTP id 41be03b00d2f7-ccca948203aso1900552a12.3 for ; Wed, 11 Nov 2026 23:14:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794467641; x=1795072441; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wOP29ozpki2ZcLEcdAReRlCMfqJh2G7tO+pqYnkedD4=; b=Up6so4dDxe3QkK/9b4v8Z8Eo0e8NnZA1s5CcuPwBaRFdypvRD0eQO4W3agQz/pEX8a BvSu51JI+DrAs0Tmwn8JFZQdJPQQV82B3fjYfleFhivjazRxOA9HR+rZDETmBMPwxWZX w/Tihovn0cYBUwURa9L1clT2TZjpum8TUS8fHcpjMu4varW9d3INVWOckXz81Ro6fA3r 0ha5gv21Ounbf4LfzUNpqWewreJl03tWvFwBAQr0qrTeAVAlH0WIgHh6ekM8VP49fq4b BouY9uK64rdrsgG420y0iJH0aKmHe2W8O5kFxnrLDwlFfYpu6VdlWibRGhe9T4SiCp5S +naQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794467641; x=1795072441; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=wOP29ozpki2ZcLEcdAReRlCMfqJh2G7tO+pqYnkedD4=; b=nyVjc5WP/weT1MDpuBvz/kPzWev77PjszvhNU8xjv2AUVIPDi30fpsAgqfERrMV8vs A4vuMqL1ot/TAcaEbnuRUZ1S/o4T+gVrhE9/StGf7HEyIeCqji+6Ds9h2x8NJQrD5qN3 0RCN1MFoubT6/vtFl/SnBwLT4C/wJWbby88yxGiC8b7MrqgL20W4AypSqxmkm/VNemOW xJjq2wCyZW4UNL0/kUZpqMQPvbs+hnWwtDKGYkUW8eH/n1AxP5VRlP5uJK3LDtrXanHc 3Pp1O7ivM5+KBA8I53T0U+RFhsZiK+bLQltXC77aDqgh/ktVowvvPbm1tTHMiMLBSbOz mMNQ== X-Gm-Message-State: APuU4Z+nqPu163XFhgADZi3VHhWOmSAykBL1twBZFY9WYRDIPnCZYswC /dxAl+jGR8PLSKSxZo/WUQ3++vUxMVdUZyEUk7GCu+fGajZ2ROE1H9vpK8yfug== X-Gm-Gg: AYBFou0wORQ1WZ48yoUfQ4Jdg+k+jjFWIV2EwIDqfhBX8n/bEmjrZFpC9xLFsHEhdMq 9k4Eq7BwNHeWpuolQOBlFXapRIAe2/InY4J6DMYlVNICVsDbABYlVgeEqxh3aabPD7YG8Gyr4a3 pL5Rm9kUM4PcQATU8I5L5Q0uw6WOWs6VSFAt5L65R4FUUh3+q1zLW2EM8NZGA8I6ki250agwfpd ZdTESyCwwUfMJ4d951Z9UB2/orGe6gHmIur9gYplryvqD8Xe1BKcSmcXJ4Id4hecQRhLSxxExgh BuqrsvQvTp/xuWE130vod39WjzWBLidbBCXAFgDezKpQb6aDyoSfLYTo4Od9Xza+ESMHJFIeTzc JBHjL03yqtz1WubpDIhB/UCz0gW+dh8Ao+yd7exiN31tVSo+6M/i/lA8hITPdMv9J2C/xaSgP2L qHqPXjKtjF8mCrmMDwVbJXC9mfVIbY4+D7RScO5elpgrBfD3Ms9Gw4M1rEyUHv40bWBvvKeTsg1 E2Q5QHSkvxnOp1EAW5ZH6QK//ereRmnfsqksTPA/EjzMe23+0B6682DzfMt7xL7XZz5nGhR/rxX 7qrE2GcXtzFmLtFPGU2CEcLaDYFbx+30C0PKFKjHk6D5e5dZveQr+HKuAT9dRw== X-Received: by 2002:a17:90b:2688:b0:3b0:9183:23ef with SMTP id 98e67ed59e1d1-3b182dea8bcmr4794379a91.3.1794467640681; Wed, 11 Nov 2026 23:14:00 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2edb6d7e062sm29018355ad.35.2026.11.11.23.13.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 23:14:00 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 2/6] apitrace: patch CVE-2026-126050 Date: Thu, 12 Nov 2026 20:13:44 +1300 Message-ID: <20261112071348.4144113-2-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> References: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 07:14:02 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132201 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-126050 Signed-off-by: Ankur Tyagi --- .../apitrace/apitrace/CVE-2026-126050.patch | 39 +++++++++++++++++++ .../apitrace/apitrace_14.0.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch diff --git a/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch b/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch new file mode 100644 index 0000000000..4b0d3b2768 --- /dev/null +++ b/meta-oe/recipes-devtools/apitrace/apitrace/CVE-2026-126050.patch @@ -0,0 +1,39 @@ +From a7c7db06b56f22235eeea2da608ef84dd401f3b6 Mon Sep 17 00:00:00 2001 +From: Deus Rex research team +Date: Tue, 10 Nov 2026 13:05:32 +0000 +Subject: [PATCH] trace: Fix heap out-of-bounds write in + SnappyFile::flushReadCache(). + +The Snappy trace reader takes each chunk's compressed length from a +4-byte field in the file and reads that many bytes into +m_compressedCache, a heap buffer allocated once with a fixed size of +snappy::MaxCompressedLength(1 MiB) = 1223370 bytes. The length is never +compared with that size, so a .trace file that declares and supplies a +longer chunk makes the read write past the end of the buffer. + +(cherry picked from commit 3890c5a448addfd75ccbe1bd09e3075de6fb3395) +CVE: CVE-2026-126050.patch +Upstream-Status: Backport [https://github.com/apitrace/apitrace/commit/3890c5a448addfd75ccbe1bd09e3075de6fb3395] +Signed-off-by: Ankur Tyagi +--- + lib/trace/trace_file_snappy.cpp | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/lib/trace/trace_file_snappy.cpp b/lib/trace/trace_file_snappy.cpp +index 5b60ec9d..9b0a681d 100644 +--- a/lib/trace/trace_file_snappy.cpp ++++ b/lib/trace/trace_file_snappy.cpp +@@ -224,6 +224,13 @@ void SnappyFile::flushReadCache(size_t skipLength) + return; + } + ++ if (compressedLength > snappy::MaxCompressedLength(SNAPPY_CHUNK_SIZE)) { ++ std::cerr << "error: invalid compressed chunk length in trace\n"; ++ m_stream.setstate(std::ios_base::failbit); ++ createCache(0); ++ return; ++ } ++ + m_stream.read((char*)m_compressedCache, compressedLength); + if (m_stream.fail()) { + std::cerr << "warning: unexpected end of file while reading trace\n"; diff --git a/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb b/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb index cb5ee92e04..7c51f45842 100644 --- a/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb +++ b/meta-oe/recipes-devtools/apitrace/apitrace_14.0.bb @@ -8,6 +8,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=aeb969185a143c3c25130bc2c3ef9a50 \ SRCREV = "18cfd388ac47a9e00978b34d6c20341f3e2cdb56" SRC_URI = "gitsm://github.com/${BPN}/${BPN}.git;branch=master;protocol=https;tag=${PV} \ file://0001-zstd-disable-the-x86-64-BMI2-assembly-fast-loops.patch \ + file://CVE-2026-126050.patch \ " DEPENDS += "zlib libpng python3-native" From patchwork Thu Nov 12 07:13:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103865 Received: from mail-pj1-f54.google.com (mail-pj1-f54.google.com [209.85.216.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8300.1794467643448703086 for ; Wed, 11 Nov 2026 23:14:03 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=mTPluF12; spf=pass (domain: gmail.com, ip: 209.85.216.54, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f54.google.com with SMTP id 98e67ed59e1d1-3ae2b7e1e17so2506697a91.3 for ; Wed, 11 Nov 2026 23:14:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794467643; x=1795072443; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=HDlEgziNqunqggW/luFDNrufEbsRgIUzQyEFSwkgPBc=; b=mTPluF1247dlNqczEmuKz0i/Qg50hpcpEGvYP4JHsLTmBZ3neWVOCbcphjuoo5W4ib WBFR0RiVAtEAs0f3yb5koi+4suyBYr2b21o7EVOK54KEBkCPncwqfLUFR7aXxhfK04Am GgPFpJaaT2IIup6Y/4mC7a2GbbweMldzng/DXQVhZ/t1q1unLWbSe3qniLTFbiZl9OJp rnwUvEUEpfg2lbaSXgk0dVjCoIm/soekiwZgL3SUpQjsPr7YUnsFe5uepWpRN2jxWBaz sCK1lEtMN0U87/ObYcdz4Kk7qM5RTgk8L/90lM+6RBGQ08xsRBn6IcKGeWpL1KGFsLBk rf3w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794467643; x=1795072443; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=HDlEgziNqunqggW/luFDNrufEbsRgIUzQyEFSwkgPBc=; b=I9A1d6AR/7xojzkUqGVUvyuyzp7C8pySrC6U2RXZzYyD9Bk5GqkIDUxPCsjT//qxKU Dl+qEwYwmoufEPZKI9jV+lolJniRnnMxtvazRNgv7hq3223PUOwBRT9fODFofdb9Cntb 6gOqcWtCtvSHuFJdtf6UkDBMyH7KDzFiRvnbpUcfiV6VirEYHO0ZSFzH+25ZJ6wwoVto NWxvnzWwame5IoZ9LkhPIyqLnPgUNhIsPI59U+6LGBdlUlCaiyCNi4vo6W3uwDej8F7B 53Nh19P4NCAJ3qDBntpweFgtLgEwO+0oeWWe9Hmtw6+zV4INzxZkGEtozhlEtrK4lbDs X7bA== X-Gm-Message-State: APuU4Z85tpdu+EYc61/xb7xsvbXCzvgVg4nDPNsJAMJ7snMPWPagMcQ2 Cr6I74BaT3Hx6zI/cPSD4WolBifo08W/aW8PRK8kP7nP446PTFJkuLVTfOwU1A== X-Gm-Gg: AYBFou1mLNNBG6b9fgSKsEfl4leokF62ynYAa68kH1eVowNbIKM0H+E5A4C1ONjfHeY 7A617GCIjX6CD1tuN022+S6C5DYnGnj4BHoyoyBGfMYokONcfYj9FocfK6g6Ov1qdOXMgi6bLBN rJ1oHnl9b0OhPPN7T+gdFkd42JE7z8GHOkkcT7oSXvvcTdbRJliayyD+Jn3c+JfOtWqSpb8Ljaw rhhiZfyaV0l0ajeCFSB/hVMvUbENloGsVZo/UGQlJhNX72HXoCHCZo0yj0htih11YPSdxjP+BU1 os2X3dcZQEiiT4upRWuMRjXWNFM6FmhR1eMyNyDV3DYZzUTMt6G3aUDKh9phwCCIDTFOi64pxJp QJoFeHa6pql/IobPIJ+2b+JPEijru5NIpd7Jbx4cG1by2UVtdVP58OtAT1JKe2Bkre51B+LcwmP cSXYcM4moCHcGvcuvF6p2rxCek5NAfSKjtCe8qoe8RtSusf2MLoAIVtCYvFO3yeHgLC+iTdvECZ aOxwxdlH3TOohm++2z9f8b169UvepJ2QPzLo8krBfWhBQq8Vc8cQqlPdFDwOpYaw78OhSD/XJhD GFCqtSMYAacBECeBwDBtOrhbvEDbQjJqmDkCZDFG0jA5itTIcaCGu0o2NLX5qA== X-Received: by 2002:a17:90b:2d08:b0:3ab:f2a9:cacd with SMTP id 98e67ed59e1d1-3b182f26e76mr4863208a91.49.1794467642726; Wed, 11 Nov 2026 23:14:02 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2edb6d7e062sm29018355ad.35.2026.11.11.23.14.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 23:14:02 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-webserver][PATCH 3/6] cockpit: mark CVE-2024-2947 fixed Date: Thu, 12 Nov 2026 20:13:45 +1300 Message-ID: <20261112071348.4144113-3-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> References: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 07:14:11 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132202 From: Ankur Tyagi Commit[1] also identified by Debian[2] Details: https://nvd.nist.gov/vuln/detail/cve-2024-2947 [1]https://github.com/cockpit-project/cockpit/commit/9c4cc9b6df632082538b53bdc8ee9ec1c5cad4da [2]https://security-tracker.debian.org/tracker/CVE-2024-2947 Signed-off-by: Ankur Tyagi --- meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb b/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb index e12cabcd98..3aa1f155e7 100644 --- a/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb +++ b/meta-webserver/recipes-webadmin/cockpit/cockpit_366.1.bb @@ -202,3 +202,4 @@ do_install:append() { } CVE_PRODUCT = "cockpit-project:cockpit" +CVE_STATUS[CVE-2024-2947] = "fixed-version: fixed since v314" From patchwork Thu Nov 12 07:13:46 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103866 Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.8436.1794467645444705927 for ; Wed, 11 Nov 2026 23:14:05 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Ci8Shhqs; spf=pass (domain: gmail.com, ip: 209.85.214.176, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-2ed39646f04so15103135ad.0 for ; Wed, 11 Nov 2026 23:14:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794467645; x=1795072445; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=2h/7Xw7QWiKqNawLALhqEGQOuq9Yggf5eN9lcwkDIwU=; b=Ci8ShhqsnbrQ5uYwAkqsa0i09JtUaFrb1cz4Z2cPnTCbRcqckLPX2fn34DLHIJwSTp P1MBvsynuDGsxcJrAzdsnQ8z7ltq3a1jKiCIMUZUdwDRRGwlNfT6Xfr6ZijnToBcJaQv BWpZMjexVIbnjw4DIw+cv5u8qp4mu33/SxtifM1xnFvhZAT3Hh3gftGHwmh7EVGeSvMi SJ+8PLemJ8R3D1GYrffxO2gvTkUK5YN8VOx4cSw7SrIVriac7SvZ3kRCjxH4IKscbM1+ 3yCXfVaxVe+YgBvoz2YCS6SwijfgOc68N/aSZMsRx4GnBcF6EO2bAvJQGZ+Hv5B2czzl twmg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794467645; x=1795072445; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=2h/7Xw7QWiKqNawLALhqEGQOuq9Yggf5eN9lcwkDIwU=; b=x62ZWxIpLDQaAE+N05LD3hcHiP4YoG5ZC01Gyj8AfBw4oGsBpP/Hj2k5NwCk3VVV0h x5huh4DA++poX8693kTNG+oqvq3dMAxJ0hkeb8NsYpiNH3jiyjhVLk3PxZoDlzTQGDjr TSUsOgZwwbAWlL2fKVXwGx9BQ6cTA2RmwhxulsqrJIHNXyRkPnY7fu2TGeWm//cxXilU gvQplh1TWRJWANWrUKi2MxMBckx/IFUlXRvtgKM5jZYmgBQW4/sEmEh7bs+qPb2ANIj/ YhmRw1PLu1/3sYZpQH97CoFJHf8uyidWyuvqc32BXPbM4OtUyRghDJBbwOpLDvNg1dLd cHzA== X-Gm-Message-State: APuU4Z+X7KMMtzAnKkksXf/nPGe02J55LVZsfpxAnafsTkthF3rqQJDW FX44zEzzW3hUm+WB9BjUXzQntlu6JFLEqlKTZ8SbXWRJGqxmPflRoX/qYuMQEQ== X-Gm-Gg: AYBFou1+YvzIOvytp0z9beOf77zdEoLQaR7TCaMTBHwd/BIGiRSJqwfQ4ZxJRw0Fp8s 9hjnhfofbKq4cGZo1L8UiyRv42vgtR+KmJ9DU/nmMS0vTzBrmJejpcMjl8gM28XcTsqwBh59guf +YJfqz12R6HpRRkv59ClgaH3z5M5YF9HmvzkqQIUEOx25akJGR3NMnghyC2mUrg4K0eCTymY963 Qw4LuZpx1Bb6AloDRn89WA47X5F88iEEu2pLFInfI9HsO3K80HTXR0J1KciDeRjsuND5p5cUo20 O4Rzy9oeGGkfVVMsHgz0lPkOkWEsbetd7FSlZcejbLjeam+BaBHPpa3pAlIwGNvxLbbjt8ET2ZZ igmlfwXsiW8mna1J8miWeVMeXw3Ijme33n4Th5dS31KQCSVAerCCVZpozNoRtG6fF7qxfg6tiHn 0VStrnVwSvI7WH0elbhT2wrPTApzT1Z6koawBAQpp36+rxeOmel0Uc/hg6yMifa7WNszVzF3Q4y UCvJGk3F0F4LdSNR2ilp5qq8NS+oY0KC6Qu5n8emqNB2/MOwREV5I9Cu3fOAEtHJ6xoUvQvzjhx NjAVW9WXZLFKzh1/4QZgLSEvuHkgjS4APss/hkKanxXtJB2J8qF0cbazqRG5Tg== X-Received: by 2002:a17:903:1109:b0:2e9:5714:6072 with SMTP id d9443c01a7336-2edd7a8ebb5mr48657835ad.44.1794467644714; Wed, 11 Nov 2026 23:14:04 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2edb6d7e062sm29018355ad.35.2026.11.11.23.14.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 23:14:04 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 4/6] brotli: set CVE_PRODUCT to "google:brotli" Date: Thu, 12 Nov 2026 20:13:46 +1300 Message-ID: <20261112071348.4144113-4-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> References: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 07:14:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132203 From: Ankur Tyagi cve-check class is setting default CVE_PRODUCT to 'brotli' which ignores the CVEs from NVD Database. Reference: CVE-2026-111497 https://nvd.nist.gov/vuln/detail/cve-2026-111497 Signed-off-by: Ankur Tyagi --- meta-oe/recipes-extended/brotli/brotli_1.2.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb b/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb index dca16cb79b..14d7fe96e5 100644 --- a/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb +++ b/meta-oe/recipes-extended/brotli/brotli_1.2.1.bb @@ -20,3 +20,5 @@ do_install:append () { } BBCLASSEXTEND = "native nativesdk" + +CVE_PRODUCT = "google:brotli" From patchwork Thu Nov 12 07:13:47 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103867 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8302.1794467647586559469 for ; Wed, 11 Nov 2026 23:14:07 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=GDoyP1FX; spf=pass (domain: gmail.com, ip: 209.85.216.44, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-3b09a65c76dso2946854a91.1 for ; Wed, 11 Nov 2026 23:14:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794467647; x=1795072447; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=DJ8Sqp2Qy8v/2Tm+GlgAu/UL6bsjajOG1m6Q/zvsfgI=; b=GDoyP1FXX0sL/UKcjoFaf7exvygUrisVyM76sH3ih815kQLnknblF9eW84ZjUGLhPz g+W2jlUwDApSmr8tQhZ2T3ZvNawd5wuIrjyLJxbx35mLJk4RuJ5E5bZgLTLaP6V4SdCH y7eltoI63hflmO3cJ1CQp73LJD8ma3IcceDedB28sD4xj9tM569jGK7SBKVmGHAomvzX bsHiSL8oKx04nGqAajR5xzVsTwvsM1QvgP4psy4T8DkS9ixHWlCjA0Q+DuoKZgjkg3A9 KqAQG4Um3qPltrnCSPE4SGmIEwKBuRE+NteKqkB4IdUp7uvvc+po09p+fXo3es8lIhug FaUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794467647; x=1795072447; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=DJ8Sqp2Qy8v/2Tm+GlgAu/UL6bsjajOG1m6Q/zvsfgI=; b=DW2Pey4k7bLa+GQzjm37s3z22Nn3TQIkeZv9QXflPf7oPPuHWegYs5/faw0ItGIyNS 1bpsKQrUWGVOuqrHfkbJlJDGXcVZWaohI0AgCjMppz0ekIsxQOQZi0Sd1W61epCArCyq gpug82AbWbKK1G+B2ok3WwKp3EI8FfKKQplp37uJtnX54QYgxZdKZCjvmn2Iz/iAui3S QP1mZi7EmRZVBNl2VRtVZavDI4Lpsj1BGnr2UcTSQAGqytiwA7a7HB/ts9c0ndv2nRV8 542AJRnrpVH7LGIXlMj6ZVDK4UiJ0LfMiD0U427boIL+VpelZJ0WB0G7K9upiyssDDGq RefQ== X-Gm-Message-State: APuU4Z9ZEvykyM0q8WWkmr2SJLdTzfPSng+LK6VILfeaxFiceuioD2+8 Vtuc6FUm38kKt8mY8Mc+smWli4RJ6RgWHaisgbgBSppc1Fqfb0/rBk2AekUmAg== X-Gm-Gg: AYBFou3g1E6xt6k02lhqOq1CYpd0DaGf48r9SZi1kUuEt0/awRoFOH1ES7lELXGY9Tr 5W/FjzszRaQvUbwrGJnpGOW7X2AqfOuQIHF5HNFo41U8+DRKFMMtV+M5pwjuSxnW0A9v2ypD3Wo TV5pyFmcCarmPizcgX/2eN7r4R6RvpMbq2eJQZqayjxWi9Lrk7/xrAiCk/FKvMhrmpXTUJfk3TF LZpHqrvR5sQA1K05in6XnSXWaftTWka4EnpiE/eueoJ/rPNzvBey5mJZAqrBuWtN+Vrm2kC8myv UQ/qUOhHyoanYc+E3F5sY9NYTo/9ju7gewwNByxvhI8ULFTM3mNoRpF20AyWCBUs1GrDXKdwa+C nOcTZ1BDuLLSmQWAuBVFXVi9CDaT/PfxTfkAR1mrN07PKaDSBqh72pspMBWNr5fwPcynk24MsF9 kL7WskZT61kbhJdByFMfSDderddgoPAkHBfX5sRiJn3PZiXzmjnyvRbofU29nScmxL1RjNOs8oQ zl6WSEbWQxdM6U4hlaBOcjqYTUeSYUhXY/BzpqY64ACyq620zvkdibUhlLi1WkirDbXw8ctqDRx ZI9VjfmOU2cmEHrTmFDbJm2Q7fDuma79IR4NkM7ALcc4XW2EyUxd08neXalSJ6VpVfFsuU2/EFo F/HOzVbw= X-Received: by 2002:a17:90b:164b:b0:3ab:a3ee:33ad with SMTP id 98e67ed59e1d1-3b182e940fdmr4488570a91.22.1794467646868; Wed, 11 Nov 2026 23:14:06 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2edb6d7e062sm29018355ad.35.2026.11.11.23.14.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 23:14:06 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-networking][PATCH 5/6] tinyproxy: patch CVE-2026-125371 Date: Thu, 12 Nov 2026 20:13:47 +1300 Message-ID: <20261112071348.4144113-5-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> References: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 07:14:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132204 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-125371 Signed-off-by: Ankur Tyagi --- .../tinyproxy/tinyproxy/CVE-2026-125371.patch | 70 +++++++++++++++++++ .../tinyproxy/tinyproxy_1.11.3.bb | 1 + 2 files changed, 71 insertions(+) create mode 100644 meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch new file mode 100644 index 0000000000..7a86af207c --- /dev/null +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy/CVE-2026-125371.patch @@ -0,0 +1,70 @@ +From 8c8463fb1a0bf7db82d3dfc6f363d5b339e96cd3 Mon Sep 17 00:00:00 2001 +From: rofl0r +Date: Tue, 15 Sep 2026 06:42:05 +0000 +Subject: [PATCH] acl: use hostspec parser to disallow suffix hostname matches + +the existing ad-hoc parsing in acl.c allowed an attacker to +use e.g. an "untrusted.net" domain name to access a reachable +tinyproxy instance if it had an allow list entry for "trusted.net". + +exploiting it would require that the attacker has prior knowledge +of the instance's configuration or is damn good at guessing and +well-budgeted to register lots of potentially matching domains. + +fix by re-using the existing hardened hostspec parser. + +closes #627 + +(cherry picked from commit 3991ac8f98c6a9f05b3265018b812dbf2ca92c28) +CVE: CVE-2026-125371 +Upstream-Status: Backport [https://github.com/tinyproxy/tinyproxy/commit/3991ac8f98c6a9f05b3265018b812dbf2ca92c28] +Signed-off-by: Ankur Tyagi +--- + src/acl.c | 25 +++++++++---------------- + 1 file changed, 9 insertions(+), 16 deletions(-) + +diff --git a/src/acl.c b/src/acl.c +index 2d141ba..db526db 100644 +--- a/src/acl.c ++++ b/src/acl.c +@@ -105,7 +105,6 @@ acl_string_processing (struct acl_s *acl, const char *ip_address, + { + int match; + struct addrinfo hints, *res, *ressave; +- size_t test_length, match_length; + char ipbuf[512]; + + assert (acl && acl->h.type == HST_STRING); +@@ -153,23 +152,17 @@ STRING_TEST: + return -1; + } + +- test_length = strlen (string_addr); +- match_length = strlen (acl->h.address.string); +- + /* +- * If the string length is shorter than AC string, return a -1 so +- * that the "driver" will skip onto the next control in the list. ++ * compare the reverse-resolved client hostname against the ACL ++ * entry, using the shared hostspec matcher so that hostname ++ * entries are matched at label boundaries: plain entries match ++ * the whole hostname exactly, and leading-dot entries match the ++ * apex host plus every subdomain below it. This prevents ++ * suffix-collision bypasses, e.g. "Allow trusted.net" must not ++ * admit "untrusted.net" (GH issue #627). + */ +- if (test_length < match_length) +- return -1; +- +- if (strcasecmp +- (string_addr + (test_length - match_length), +- acl->h.address.string) == 0) { +- if (acl->access == ACL_DENY) +- return 0; +- else +- return 1; ++ if (hostspec_match (string_addr, &acl->h) != 0) { ++ return acl->access != ACL_DENY; + } + + /* Indicate that no tests succeeded, so skip to next control. */ diff --git a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb index 46d3a4d7c6..86e7e906b1 100644 --- a/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb +++ b/meta-networking/recipes-support/tinyproxy/tinyproxy_1.11.3.bb @@ -13,6 +13,7 @@ SRC_URI = "https://github.com/${BPN}/${BPN}/releases/download/${PV}/${BP}.tar.gz file://CVE-2026-54387.patch \ file://CVE-2026-55202.patch \ file://CVE-2026-54388.patch \ + file://CVE-2026-125371.patch \ " SRC_URI[sha256sum] = "9bcf46db1a2375ff3e3d27a41982f1efec4706cce8899ff9f33323a8218f7592" From patchwork Thu Nov 12 07:13:48 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ankur Tyagi X-Patchwork-Id: 103868 Received: from mail-pg1-f177.google.com (mail-pg1-f177.google.com [209.85.215.177]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.8303.1794467649897658676 for ; Wed, 11 Nov 2026 23:14:09 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20260707 header.b=Ojox4N/g; spf=pass (domain: gmail.com, ip: 209.85.215.177, mailfrom: ankur.tyagi85@gmail.com) Received: by mail-pg1-f177.google.com with SMTP id 41be03b00d2f7-cd69954c755so2806839a12.3 for ; Wed, 11 Nov 2026 23:14:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794467649; x=1795072449; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Vd5SD3p0efXkTUYyLJO4uC1u5tQVNvKva8m39m31jKo=; b=Ojox4N/gjMNemM0nwV+9F/x8gGMm7sdNqoUBv3gxljZkHsDWMkKy9qmuMgWGS5f9Mi 2hd8PsoEp+BlsnWK+AoYIFsW0Z9dpHLUnpmVBkeURyLvZmxhXJNDu+EYXMLfsaXu9RtL PBcfmntHDpjqlG1Ju8xeIVVOLvyjd5VjU3rr/Bf5oIgjOT6MRHCl3jEelk2hWYznL0Yd z2cVWk3avUIKe5F24fcZc0xj8+xhMHX2vUvu4kemp1QJZ8CsZO74NIm/97LmCzYo+E3l G5lBLXhlCehbnQKc3m1J/S8w9NIp2ud6KnKc0ZHHdnnsbeUwWcpnKvbLuNesdNkJVVNn JATg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794467649; x=1795072449; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=Vd5SD3p0efXkTUYyLJO4uC1u5tQVNvKva8m39m31jKo=; b=rCpg2F21dNygSwRt5B/hs23lOw6EOC1K3LxXlQzzbc+AE7RwEAf8j6BVrCrHFMd25c 6Bv7jVKKlToqfPacZYoMtshgmG74VOBDnNHS7tNpeIBXJOAcb/Fimf8SlkZDYnEwnOWD WbvRW264j3HD09ubOGJOo4mOe8eiIWf+FchujAn5PI9bV+9ETXBZvQ54exZ04jMw3/WA 3LpGOL+Fxh7J+N7QS0jwHEZrVvx7d5dKMBHQsriKMVBgUWOjojAd7oZqHfO3MKqqb4zb UiClkr6LsrwqQPi2flkpk/Wi/+fha1iGJ8fSw6WErebKT8N8IyzOtps5Pr2ncujtRrUZ fJxA== X-Gm-Message-State: APuU4Z9NQsKdRnJEVceBySEIe9vOiG4P3fw0rIC7Qf1pGI1KpWNJRTqT zOshU1ife2Y95ZdwwW8DaAwJprVycoBQltItNIw8hWwJdIWlOxwoNDyVnUVxQQ== X-Gm-Gg: AYBFou0BgiS70ITA+1kTNNIneelEZRJdNO7Qf33jOAs5i0khCPTq6/kexPtuy/FqiBl Nbeaw2yS9qn+pcV07imftgGe9zMmzRFpxD+oSGBDQ/hO04PZdZXA4uWOaqcDTgE23A2CeabHP9O StZy3SWvEbeg4HTAIbC5sAitmvXZoqtOG4avI/VKHTzQZBntQHIWvC7pLO3u4Oodqg/shin0E7Z 9t+jTyLSawsbAs16Una6CVDWo6tqzU9nxnj0V4fRHZTB26TlJI7cjQ8czf66+TsIvhTmPVgBh/d 8UU8G0D7ZZT/p+SN5RwRW2wH6hXCa7LADxpP/MFF1C1XzZlQ9n3wSfE3GqaSkBmP1cDxE9tlQGf kZFT0J+LkgxXOLrdJfUHLM8bzUH8Ta/IPsVL84wE/1AzUXQbo7IOBM8eGe9KKUxmG1At7+iColy bEgEGb8/Es0f2o64JHEk0f8/vy0r+MXpWwrLvrIQs8W9pxrtQqoomsHsPpvcCcse8AstmJpaPuE kQxxTMhK+IlAshG3ApSJ5U29pIF+mGSmtDJyhmmAJ5XceFh1tlNrtuKp1NajnhMDDEoMOHFH5lL a/IGkiPSkVx/5iCnBJOuCQkj42dvRPwvCf4kN9e49Tc4lFpY17MmisrsrtjJZtSpqmEDrrCciyz UdEcmyoo= X-Received: by 2002:a17:90b:590c:b0:3ac:adce:60af with SMTP id 98e67ed59e1d1-3b182e6f3ddmr4562522a91.16.1794467649159; Wed, 11 Nov 2026 23:14:09 -0800 (PST) Return-Path: Received: from NVAPF55DW0D-IPD.. ([147.161.217.9]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2edb6d7e062sm29018355ad.35.2026.11.11.23.14.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 11 Nov 2026 23:14:08 -0800 (PST) From: ankur.tyagi85@gmail.com To: openembedded-devel@lists.openembedded.org Cc: Ankur Tyagi Subject: [oe][meta-oe][PATCH 6/6] mpv: patch CVE-2026-123095 Date: Thu, 12 Nov 2026 20:13:48 +1300 Message-ID: <20261112071348.4144113-6-ankur.tyagi85@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> References: <20261112071348.4144113-1-ankur.tyagi85@gmail.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Thu, 12 Nov 2026 07:14:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/132205 From: Ankur Tyagi Details: https://nvd.nist.gov/vuln/detail/cve-2026-123095 Signed-off-by: Ankur Tyagi --- .../mplayer/mpv/CVE-2026-123095.patch | 37 +++++++++++++++++++ .../recipes-multimedia/mplayer/mpv_0.41.0.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch diff --git a/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch new file mode 100644 index 0000000000..1efa0fdee6 --- /dev/null +++ b/meta-oe/recipes-multimedia/mplayer/mpv/CVE-2026-123095.patch @@ -0,0 +1,37 @@ +From 2c6599aa7d16efd29ae49865757eb449d9306742 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Kacper=20Michaj=C5=82ow?= +Date: Wed, 4 Nov 2026 20:28:57 +0100 +Subject: [PATCH] ytdl_hook: reject playlist entry URLs with control characters + +The entries are joined into a memory:// M3U playlist, one URL per line. +A URL with a line break became several entries, and only the first line +went through url_is_safe(). The other lines were loaded with the origin +of the opened URL, so any protocol was allowed. Skip any URLs with +control characters. + +Fixes: e6e6b0dcc7 +Fixes: GHSA-p99g-m25w-x8xv +(cherry picked from commit c3096515dcd26c14004f985538b5aa41db613856) + +CVE: CVE-2026-123095 +Upstream-Status: Backport [https://github.com/mpv-player/mpv/commit/c3096515dcd26c14004f985538b5aa41db613856] + +Signed-off-by: Ankur Tyagi +--- + player/lua/ytdl_hook.lua | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/player/lua/ytdl_hook.lua b/player/lua/ytdl_hook.lua +index 65ef859595..2b0edb193a 100644 +--- a/player/lua/ytdl_hook.lua ++++ b/player/lua/ytdl_hook.lua +@@ -1111,6 +1111,9 @@ local function run_ytdl_hook(url) + -- links without protocol as returned by --flat-playlist + if not site then + msg.error("Playlist entry does not have unique URL, can't add it.") ++ elseif site:find("%c") then ++ -- a line break would add entries to the playlist ++ msg.error("Playlist entry URL contains control characters, can't add it.") + elseif not site:find("://") then + -- youtube extractor provides only IDs, + -- others come prefixed with the extractor name and ":" diff --git a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb index f37ae4ac50..0c99e354e7 100644 --- a/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb +++ b/meta-oe/recipes-multimedia/mplayer/mpv_0.41.0.bb @@ -27,6 +27,7 @@ SRC_URI = " \ git://github.com/mpv-player/mpv;name=mpv;branch=release/${@oe.utils.trim_version('${PV}', 2)};protocol=https;tag=v${PV} \ file://0001-opengl-context-require-swap_buffers-param-for-FenceS.patch \ file://0002-hwdec_drmprime_overlay-make-the-framebuffer-the-whole-frame.patch \ + file://CVE-2026-123095.patch \ " inherit meson pkgconfig mime-xdg