Jaipaul Cheernam
1a7b2e6b68
perl: fix CVE-2025-40909
...
This patch applies the upstream fix as referenced in [1], using the
commit shown in [2].
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-40909
[2] 918bfff86cjaipaul.cheernam@est.tech >
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
[YC: CVE-2025-40909.patch is not merged on a main branch but was
provided by upstream to facilitate backport (Thanks!)
https://github.com/Perl/perl5/issues/23010#issuecomment-2919448987
]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2026-09-04 10:39:10 +01:00
Jaipaul Cheernam
68cfa8f4db
perl: fix CVE-2026-57432
...
This patch applies the upstream fix as referenced in [1], using the
commits shown in [2] and [3].
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-57432
[2] 5f7eb6bbbe40754edc72jaipaul.cheernam@est.tech >
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2026-09-04 10:39:10 +01:00
Jaipaul Cheernam
f4fecd5a7b
perl: fix CVE-2026-13221
...
This patch applies the upstream fix as referenced in [1], using the
commit shown in [2].
[1] https://nvd.nist.gov/vuln/detail/CVE-2026-13221
[2] 03f74bbbd3jaipaul.cheernam@est.tech >
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
2026-09-04 10:39:10 +01:00
Theo Gaige (Schneider Electric)
94181a64fd
perl: patch CVE-2026-8376
...
Backport patches from [1]
[1] https://github.com/Perl/perl5/pull/24433
(From OE-Core rev: 918bf1dd78104c833497f7766cabe9cba4fa35b0)
Signed-off-by: Theo Gaige (Schneider Electric) <tgaige.opensource@witekio.com >
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-07-20 09:04:32 +01:00
Ross Burton
4e2dac74d5
perl: link to the system zlib instead of a vendored copy
...
The perl module Compress-Raw-Zlib defaults to using a vendored copy of
the zlib sources which has a number of CVEs. A newer version of perl
updates this to zlib 1.3.2 to resolve them, but we should be linking to
our zlib recipe instead of the vendored code.
This mitigates CVE-2026-4176 so mark it as not appropriate.
(From OE-Core rev: 6e83e5520f415fc6ca9029a8aaa0af31cd832a90)
Signed-off-by: Ross Burton <ross.burton@arm.com >
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org >
(cherry picked from commit bf515229043685d4f00c965eb3e0236c37b6b403)
Signed-off-by: Sudhir Dumbhare <sudumbha@cisco.com >
Signed-off-by: Yoann Congal <yoann.congal@smile.fr >
Signed-off-by: Paul Barker <paul@pbarker.dev >
2026-06-10 14:35:20 +01:00
Archana Polampalli
c8b84eb224
perl: upgrade 5.38.2 -> 5.38.4
...
update include fix for CVE-2024-56406
https://perldoc.perl.org/5.38.4/perl5384delta
(From OE-Core rev: a9edffbd3c129966d4028505940ae6286273f399)
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com >
Signed-off-by: Steve Sakoman <steve@sakoman.com >
2025-05-02 08:20:12 -07:00
