mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-29 07:36:20 +02:00
Code Issues Packages Projects Releases Wiki Activity
68,933 Commits 38 Branches 627 Tags
207921bccaca157c48ef25546522fb3eaadd97af
Commit Graph

3173 Commits

Author SHA1 Message Date
Guocai He
91d538d055 babeltrace/libatomic-ops: correct the SRC_URI 
The old SRC_URIs are not available and need to update.

(From OE-Core rev: 94d24ff01573dc1d65078c92150dc252b3e9b145)

Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:30 -07:00
Vijay Anusuri
bb706cfe48 libsoup: Fix CVE-2025-46420 
Upstream-Status: Backport
[c9083869ec]

(From OE-Core rev: cb3a01ba6535b129608fb8d07261069f1fb4b84a)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
cecdcf3428 libsoup: Fix CVE-2025-32053 
Upstream-Status: Backport
[eaed42ca8d]

(From OE-Core rev: de40e2f32af4ec930c80858f8d77a5a1b0967069)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
dd4d1b28e3 libsoup-2.4: Fix CVE-2025-32053 
Upstream-Status: Backport
[eaed42ca8d]

(From OE-Core rev: a563a644fcdb556d904c3c391fbf9435fcd4bdf0)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
c2489908d7 libsoup: Fix CVE-2025-32052 
Upstream-Status: Backport
[f182429e5b]

(From OE-Core rev: f1e94b33fac8a1587aacfee13935587dfc6c147a)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
4976dc40af libsoup-2.4: Fix CVE-2025-32052 
Upstream-Status: Backport
[f182429e5b]

(From OE-Core rev: ab4d381f1cfd8613c23da514a0786a7505579203)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
8bce7467dc libsoup: Fix CVE-2025-32050 
Upstream-Status: Backport
[9bb0a55de5]

(From OE-Core rev: f4866635b88b24d5891f83e23c9cc3fc21876b52)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
ca51d99bf3 libsoup-2.4: Fix CVE-2025-32050 
Upstream-Status: Backport
[9bb0a55de5]

(From OE-Core rev: c5afbcf487cb7331f641c4dd2c7a972b4cd3c787)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
07f522869c libsoup: Fix CVE-2025-2784 
Upstream-Status: Backport
[242a10fbb1
&
c415ad0b67]

https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/435

(From OE-Core rev: b51135e1f7eaa20c97e54f5c52b98963819127e9)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Vijay Anusuri
f49fc9966d libsoup-2.4: Fix CVE-2025-2784 
Upstream-Status: Backport
[242a10fbb1
&
c415ad0b67]

https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/435

(From OE-Core rev: 5cea727e87489b144cba9b2aa491d0c90f34f93d)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-20 08:06:29 -07:00
Jiaying Song
179c5dc17f taglib: fix CVE-2023-47466 
TagLib before 2.0 allows a segmentation violation and application crash
during tag writing via a crafted WAV file in which an id3 chunk is the
only valid chunk.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-47466

Upstream patch:
dfa33bec08

(From OE-Core rev: bcf0102e0e9ecf55106eafcc4c2ad8b2e7ad762b)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-13 08:42:35 -07:00
Vijay Anusuri
9a368c7b92 libsoup-2.4: Backport auth tests for CVE-2025-32910 
libsoup-2.74.2/tests/auth-test.c:1554:39: error: unknown type name 'SoupServerMessage'; did you mean 'SoupServerClass'?

Fix auth-test.c compilation failure caused by CVE-2025-32910 patch

Link: 9af7d0fc75

(From OE-Core rev: 05d14768b5edf41c89b05725e06fd86b5376e6fd)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-13 08:42:34 -07:00
Hitendra Prajapati
e35c7960a7 icu: fix CVE-2025-5222 
Upstream-Status: Backport from 2c667e31cf

(From OE-Core rev: a7a82be3b409d496f7a0813055f77212a3b0ef12)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-06-13 08:42:34 -07:00
Vijay Anusuri
ef632f4693 libsoup-2.4: Fix CVE-2025-32914 
import patch from debian to fix
 CVE-2025-32914

Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/tree/debian/bullseye/debian/patches?ref_type=heads
Upstream commit 5bfcf81575]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/450
https://security-tracker.debian.org/tracker/CVE-2025-32914

(From OE-Core rev: 8996e178264cf6bf9b69365172f43a5ee8e9f727)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-28 08:46:32 -07:00
Vijay Anusuri
cbbea14280 libsoup-2.4: Fix CVE-2025-32912 
Upstream-Status: Backport from
cd077513f2
& 910ebdcd3d

(From OE-Core rev: e66218f6cda7de046bace6880ea5052900fd6605)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-28 08:46:32 -07:00
Vijay Anusuri
d8278fd9f9 libsoup-2.4: Fix CVE-2025-32911 & CVE-2025-32913 
Upstream-Status: Backport from
7b4ef0e004
& f4a761fb66

(From OE-Core rev: ff1896b14347c7b4a166716338d3822da97be2e4)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-28 08:46:32 -07:00
Vijay Anusuri
21bb9c063b libsoup-2.4: Fix CVE-2025-32910 
import patch from debian to fix
 CVE-2025-32910

Upstream-Status: Backport [import from debian https://salsa.debian.org/gnome-team/libsoup/-/tree/debian/bullseye/debian/patches?ref_type=heads
Upstream commit e40df6d48a
&
405a8a3459
&
ea16eeacb0]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/417
https://security-tracker.debian.org/tracker/CVE-2025-32910

(From OE-Core rev: b65e3d3a4dc2375d9bb81c7a91c84139cc667a47)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-28 08:46:32 -07:00
Ashish Sharma
0f58759f1b libsoup-2.4: Fix CVE-2025-46420 
Upstream-Status: Backport [c9083869ec]

(From OE-Core rev: f0d5d13b0b7b2cf3f60c85b0c135fd948c648256)

Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-28 08:46:32 -07:00
Vijay Anusuri
45c3cde26b libsoup: Fix CVE-2025-32914 
Upstream-Status: Backport
[5bfcf81575]

(From OE-Core rev: ce7cda16d823012f71d91c820083b0da93762d9d)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
3f1cc96cb9 libsoup: Fix CVE-2025-32912 
Upstream-Status: Backport from
cd077513f2
& 910ebdcd3d

(From OE-Core rev: 7c709d985c4e732f6fedd56748b3de3e52869282)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
d8c4c5ea04 libsoup: Fix CVE-2025-32911 & CVE-2025-32913 
Upstream-Status: Backport from
7b4ef0e004
& f4a761fb66

(From OE-Core rev: e79585ab2a492a5023bce637cbe519fcd1370e04)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
fe91f67d38 libsoup: Fix CVE-2025-32910 
Upstream-Status: Backport from
e40df6d48a
&
405a8a3459
& ea16eeacb0

(From OE-Core rev: aeaa106595f173f5646a17adb413a85e0d01887e)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
cc7f7f1c29 libsoup: Fix CVE-2025-32909 
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm
it/ba4c3a6f988beff59e45801ab36067293d24ce92

(From OE-Core rev: 491373828c1c66030fb41687f9a42b9e4deb010b)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
dc621121b1 libsoup: Fix CVE-2025-32906 
Upstream-Status: Backport from
1f509f31b6
& af5b9a4a39

(From OE-Core rev: 17fbb56b3cbea445767cba988f3db5b32fb00b71)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
14f293eecf libsoup: update fix CVE-2024-52532 
Upstream-Status: Backport from 4c9e75c667

(From OE-Core rev: caf0ac894d029aaac7d746fe87db1aa0e8c3c93f)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
e07ed2059c libsoup-2.4: Fix CVE-2025-32909 
Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm
it/ba4c3a6f988beff59e45801ab36067293d24ce92

(From OE-Core rev: ad1244ee75b4169eab21c2c8744b86342b32dd07)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
6b27d84c2c libsoup-2.4: Fix CVE-2025-32906 
Upstream-Status: Backport from
1f509f31b6
& af5b9a4a39

(From OE-Core rev: 2b938dd6beb1badca59804ffbe395deb679bc1b1)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Vijay Anusuri
02c2876c5e libsoup-2.4: Update fix CVE-2024-52532 
Upstream-Status: Backport from 4c9e75c667

(From OE-Core rev: 144d067ed5b98b8ca477a6a0e8c958c0b15e9643)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-16 08:58:06 -07:00
Peter Marko
ade4d1829a sqlite3: patch CVE-2025-29088 
Pick commit [1] mentioned in [2].

[1] 56d2fd008b
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-29088

(From OE-Core rev: 70d2d56f89d6f4589d65a0b4f0cbda20d2172167)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-05-02 08:12:41 -07:00
Yogita Urade
b5b884bc1a curl: ignore CVE-2025-0725 
CVE-2025-0725 can only trigger for curl when using a runtime
zlib version 1.2.0.3 or older and kirkstone supports
zlib 1.2.11 version, hence ignore cve for kirkstone.

Reference:
https://curl.se/docs/CVE-2025-0725.html
https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=8c3b4a604b40260e7ca9575715dd8017e17d35c0

(From OE-Core rev: 9077246122b1284e8b6430384cccaf6f0b6c80c3)

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-04-11 08:36:02 -07:00
Vijay Anusuri
e4721dd506 vim: Upgrade 9.1.1115 -> 9.1.1198 
This includes CVE-fix for CVE-2025-27423 and CVE-2025-29768

Changes between 9.1.1115 -> 9.1.1198
====================================
https://github.com/vim/vim/compare/v9.1.1115...v9.1.1198

(From OE-Core rev: 0ace90f2918496ceae32aebea05bb826d1e3dad6)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8e540bd287fd56e3a714f81395b59dd508a6d957)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-04-01 09:02:41 -07:00
Vijay Anusuri
4df4248036 libxslt: Fix for CVE-2025-24855 
Upstream-Commit: c7c7f1f78d

(From OE-Core rev: eced74ca3be7d6c47e7c50152a36e0b1e8eba74a)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-03-27 08:16:30 -07:00
Vijay Anusuri
0490768a25 libxslt: Fix for CVE-2024-55549 
Upstream-Commit: 46041b65f2

(From OE-Core rev: eae0c33539f302124544373b74bd6883467ff549)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-03-27 08:16:30 -07:00
Divya Chellam
b210ed67de vim: Upgrade 9.1.1043 -> 9.1.1115 
This includes CVE-fix for CVE-2025-26603 and CVE-2025-1215

Changes between 9.1.1043 -> 9.1.1115
====================================
https://github.com/vim/vim/compare/v9.1.1043...v9.1.1115

(From OE-Core rev: acb88b244e89bc1300a24f60d0a44c21e0ab1af6)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-03-19 07:13:17 -07:00
Vijay Anusuri
3cd40cac2b libtasn1: upgrade 4.19.0 -> 4.20.0 
* Noteworthy changes in release 4.20.0 (2025-02-01) [stable]
- The release tarball is now reproducible.
- We publish a minimal source-only tarball generated by 'git archive'.
- Update gnulib files and various build/maintenance fixes.
- Fix CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET
OF elements

License-Update: file COPYING.LESSER renamed to COPYING.LESSERv2 & Copyright year updated to 2025

(From OE-Core rev: 0ff5d08053d92eeae5b2a23f8e0d7a280488723c)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-03-13 08:50:03 -07:00
Jiaying Song
a84c9d6623 boost: fix do_fetch error 
Change the SRC_URI to the correct value due to the following error:
WARNING: boost-native-1.86.0-r0 do_fetch: Checksum failure encountered with download of https://boostorg.jfrog.io/artifactory/main/release/1.86.0/source/boost_1_86_0.tar.bz2 - will attempt other sources if available

(From OE-Core rev: 3b4c5ce6b89477307f3a2c30c7e275473b0c9f00)

Signed-off-by: Jiaying Song <jsong-cn@ala-lpggp7.wrs.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

backport to kirkstone.
Signed-off-by: Libo Chen <libo.chen.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-03-04 08:46:02 -08:00
Divya Chellam
3a36dce7e5 vim: Upgrade 9.1.0764 -> 9.1.1043 
This includes CVE-fix for CVE-2025-22134 and CVE-2025-24014

Changes between 9.1.0764 -> 9.1.1043
====================================
https://github.com/vim/vim/compare/v9.1.0764...v9.1.1043

(From OE-Core rev: 73b5570a16708d1e749b1ec525299d10557cbf56)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-02-28 06:51:35 -08:00
Hitendra Prajapati
be7617de69 libcap: fix CVE-2025-1390 
Upstream-Status: Backport from https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878

(From OE-Core rev: 142715b83fb2c5f4dfeeab2c6e7feccecd1ca46f)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-02-28 06:51:35 -08:00
Archana Polampalli
0730523542 gnutls: fix CVE-2024-12243 
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing.
Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate
data can take excessive time, leading to increased resource consumption.
This flaw allows a remote attacker to send a specially crafted certificate, causing
GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition.

(From OE-Core rev: 5fbe46de6d2e3862316cf486503f18e616c3c0a7)

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-02-24 07:00:53 -08:00
Peter Marko
0160cb7751 libpcre2: ignore CVE-2022-1586 
This CVE is fixed in 10.40
NVD wrongly changed <10.40 to =10.40 when adding debian_linux=10.0

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2022-1586#VulnChangeHistorySection

(From OE-Core rev: 63cbfcd0262d65c66762aa6a8b17b8e8b809737f)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-02-24 07:00:53 -08:00
Zhang Peng
4ebaec2ca3 vte: fix CVE-2024-37535 
CVE-2024-37535:
GNOME VTE before 0.76.3 allows an attacker to cause a denial of service
 (memory consumption) via a window resize escape sequence, a related
issue to CVE-2000-0476.

Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-37535]

Upstream patches:
[036bc3ddcb]
[c313849c2e]

(From OE-Core rev: 132a5168b125d6f4fb9391d982bc64d73429ab8f)

Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2025-01-24 07:49:28 -08:00
Jiaying Song
82902b3d64 diffoscope: fix CVE-2024-25711 
diffoscope before 256 allows directory traversal via an embedded
filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa,
may be disclosed to an attacker. This occurs because the value of the
gpg --use-embedded-filenames option is trusted.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-25711

Upstream patches:
458f7f04bc

(From OE-Core rev: da4977e9414361a30eb322d1456a664515b35693)

Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-12-09 07:54:03 -08:00
Peter Marko
4df7e37fca gnupg: ignore CVE-2022-3515 
This is vulnerability of libksba and we use fixed libksba version
(currently 1.6.4).

(From OE-Core rev: 12007a6d19db220e6540948de9818332192ecde1)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-12-09 07:54:03 -08:00
Vijay Anusuri
880002d47c libsoup-2.4: Backport fix for CVE-2024-52531 
import patch from ubuntu to fix
 CVE-2024-52531

Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsoup2.4/tree/debian/patches?h=ubuntu/jammy-security
Upstream commit
a35222dd0b
&
825fda3425]

Reference:
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/
https://ubuntu.com/security/CVE-2024-52531

(From OE-Core rev: 763af055ccb1cbcc4f8fa0944815ec02e3bff87c)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-12-09 07:54:03 -08:00
Changqing Li
e8c505f7a4 libsoup: fix CVE-2024-52531 
CVE-2024-52531:
GNOME libsoup before 3.6.1 allows a buffer overflow in applications that
perform conversion to UTF-8 in soup_header_parse_param_list_strict.
Input received over the network cannot trigger this.

Refer:
https://nvd.nist.gov/vuln/detail/CVE-2024-52531
https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/

(From OE-Core rev: 1159c7ef071fa2849f44e921c9b7c27fcbb6bfb3)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-12-09 07:54:03 -08:00
Vijay Anusuri
c1d55bc349 libsoup-2.4: Backport fix for CVE-2024-52530 and CVE-2024-52532 
Upstream-Status: Backport from
04df03bc09
&
6adc0e3eb7
& 29b96fab25

(From OE-Core rev: 87b0badcb1d10eddae31ac7b282a4e44778d63af)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-11-27 06:27:25 -08:00
Vijay Anusuri
bac0039c98 libsoup: Fix for CVE-2024-52530 and CVE-2024-52532 
Upstream-Status: Backport from
04df03bc09
&
6adc0e3eb7
& 29b96fab25

(From OE-Core rev: 5c96ff64b5c29e589d776d23dbbed64ad526a997)

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-11-27 06:27:25 -08:00
Peter Marko
e82352ffb4 curl: patch CVE-2024-9681 
Picked commit [1] per solution described in [2].

[1] https://github.com/curl/curl/commit/a94973805df96269bf
[2] https://curl.se/docs/CVE-2024-9681.html

(From OE-Core rev: fbb8928ea85980bb866febd66e5e18ad843dbef8)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-11-15 06:05:32 -08:00
Martin Jansa
57e51d5df3 at-spi2-core: backport a patch to fix build with gcc-14 on host 
* fixes:
| ../at-spi2-core-2.42.0/atspi/atspi-device-listener.c: In function ?atspi_device_listener_new_simple?:
| ../at-spi2-core-2.42.0/atspi/atspi-device-listener.c:252:37: error: passing argument 1 of ?atspi_device_listener_new? from incompatible pointer type [-Wincompatible-pointer-types]
|   252 |   return atspi_device_listener_new (device_remove_datum, callback, callback_destroyed);
|       |                                     ^~~~~~~~~~~~~~~~~~~
|       |                                     |
|       |                                     gboolean (*)(const AtspiDeviceEvent *, void *) {aka int (*)(const struct _AtspiDeviceEvent *, void *)}
| ../at-spi2-core-2.42.0/atspi/atspi-device-listener.c:222:50: note: expected ?AtspiDeviceListenerCB? {aka ?int (*)(struct _AtspiDeviceEvent *, void *)?} but argument is of type ?gboolean (*)(const AtspiDeviceEvent *, void *)? {aka ?int (*)(const struct _AtspiDeviceEvent *, void *)?}
|   222 | atspi_device_listener_new (AtspiDeviceListenerCB callback,
|       |                            ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~

(From OE-Core rev: e361d9e1021d7715d2b4e3af95832c910de67cad)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-11-02 06:32:36 -07:00
Martin Jansa
7274615f22 libffi: backport a fix to build libffi-native with gcc-14 
(From OE-Core rev: 1054417a217417ab192dc4aee8307133451fb0e4)

Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
 2024-11-02 06:32:36 -07:00