Details: https://nvd.nist.gov/vuln/detail/CVE-2025-55212
Pick the patch that mentions the related github advisory in its commit message.
Also backport the missing function that the fix uses.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-55160
Pick the commit that mentions the related github advisory in its commit message.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-55154
Pick the commit that mentions the related github advisory in its commit message.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-55005
Pick the patch that mentions the relevant github advisory in its commit message.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-55004
Pick the patch that mentions the relevant github advisory in its commit message.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-26623
Apply the first to PRs from the relevant issue.
(The second PR adds a test, and the 3rd PR tries to reimplement
correctly the feature that introduced the vulnerability:
it is switching some raw pointers to smart pointers. It was not picked
because the
1. In the original issue it is stated that the first PR itself
fixes the vulnerability
2. The patch doesn't apply clean due to the time gap between our
and their version
3. The behavior of the application does not change
)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This is a bugfix release addressing issues in tools and core library. No
API changes.
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6914e20d63ab1c4378fc23ebd71b000be5fa131a)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Canberra does not specify a buffer size, which leads to ALSA rejecting the settings.
By specfiying a buffer time of 500ms and a period time with a fourth of that,
an appropriate buffer size can be calculated.
This behaviour is mimicked from aplay for compatibility.
Signed-off-by: Patrick Zacharias <1475802+Fighter19@users.noreply.github.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9d2dc82fcb598e17069855985c56952b1fec3184)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
When PACKAGECONFIG options like 'cxx' 'webp' and 'xml' are disabled,
certain files such as Magick++-config.im7, configure.xml, or
delegates.xml are not installed. Unconditionally running sed
on these files results in errors during do_install
Error:
sed: can't read .../image/usr/bin/Magick++-config.im7: No such file or directory
Signed-off-by: Nikhil R <nikhilr5@kpit.com>
Signed-off-by: Sana Kazi <sanakazi720@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 27469599fa6302a90af252c5148daef26c4b2e81)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Drop a patch that has been incorporated into this version.
(That is also the changelog - the only change is the accepted patch)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a5cfc39eceb8d5bd0e563458e2d55e7c51cd6beb)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
From variables docu:
> Setting it to "0" does not disable inhibition.
> Only the empty string will disable inhibition.
That means in case of examples enabled we need ""
and if not "1" to disable update-rc.d.
Signed-off-by: Denis OSTERLAND-HEIM <denis.osterland@diehl.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0ae908de1a5ea3de90e6051f038b3836c7027b0c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This is needed to build opencv-native.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* According to latest comment [1] and the mentioned pull request [2],
build an ENABLE(WEBASSEMBLY) && !ENABLE(JIT) configuration is
supported, so original issue already fixed in current version, the
EXTRA_OECMAKE setting is not needed anymore.
* This EXTRA_OECMAKE setting causes following configure error on
beaglebone-yocto, remove the setting to let the configure process
decide the configuration:
CMake Error at Source/cmake/WebKitFeatures.cmake:312 (message):
ENABLE_JIT conflicts with ENABLE_C_LOOP.You must disable one or the
other.
[YOCTO #15254]
[1] https://github.com/WebKit/WebKit/pull/17447
[2] https://github.com/WebKit/WebKit/pull/17688
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
It fails to compile webkitgtk when debug build enabled:
| /path_to//tmp/work/core2-64-poky-linux/webkitgtk3/2.48.1/webkitgtk-2.48.1/Source/bmalloc/libpas/src/libpas/bmalloc_heap_config.h:82:36:
error: inlining failed in call to 'always_inline' 'pas_page_base* bmalloc_heap_config_page_header(uintptr_t)':
function not considered for inlining
| 82 | PAS_BASIC_HEAP_CONFIG_DECLARATIONS(bmalloc, BMALLOC);
| |
Add a cmake variable WEBKIT_NO_INLINE_HINTS to disable gcc function attribute `always_inline` when debug build is enabled.
And adjust indent as well.
Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
OpenCV is an Open Source Computer Vision Library. Versions prior to
4.12.0 have an uninitialized pointer variable on stack that may lead
to arbitrary heap buffer write when reading crafted JPEG images.
Version 4.12.0 fixes the vulnerability.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-53644
Upstream-patch:
a39db41390
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
A fix was sent in:
https://lists.openembedded.org/g/openembedded-devel/message/116537
but it causes issues with clang as well as older gcc as reported on
ML and also in upstream PR:
https://github.com/openlink/iODBC/pull/111
Use gnu17 until this is properly resolved to avoid:
http://errors.yoctoproject.org/Errors/Details/852861/
In file included from ../../libiodbc-3.52.16/iodbc/execute.c:94:
../../libiodbc-3.52.16/iodbc/execute.c: In function '_ReBindParam':
../../libiodbc-3.52.16/iodbc/execute.c:643:49: error: too many arguments to function 'hproc3'; expected 0, have 8
643 | CALL_DRIVER (pstmt->hdbc, pstmt, retcode, hproc3,
| ^~~~~~
http://errors.yoctoproject.org/Errors/Details/853276/
../../libiodbc-3.52.16/iodbcinst/unicode.c: In function 'dm_AtoUW':
../../libiodbc-3.52.16/iodbcinst/unicode.c:1565:16: error: initialization of 'ucs4_t *' {aka 'unsigned int *'} from incompatible pointer type 'wchar_t *' {aka 'long int *'} [-Wincompatible-pointer-types]
1565 | ucs4_t *us = dest;
| ^~~~
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This is required in order to build krdp (KDE's remote desktop
integration).
The do_configure task for krdp expects both 'winpr-makecert3' and
'winpr-hash3' to be present, failure to do so results in:
| CMake Error at /path/to/krdp/6.4.4/recipe-sysroot/usr/lib/cmake/WinPR3/WinPRTargets.cmake:98 (message):
| The imported target "winpr-makecert" references the file
|
| "/path/to/krdp/6.4.4/recipe-sysroot/usr/bin/winpr-makecert3"
|
| but this file does not exist. Possible reasons include:
|
| * The file was deleted, renamed, or moved to another location.
|
| * An install or uninstall procedure did not complete successfully.
|
| * The installation package was faulty and contained
|
| "/path/to/6.4.4/recipe-sysroot/usr/lib/cmake/WinPR3/WinPRTargets.cmake"
|
| but not all the files it references.
|
| Call Stack (most recent call first):
| /path/to/krdp/6.4.4/recipe-sysroot/usr/lib/cmake/WinPR3/WinPRConfig.cmake:44 (include)
| /path/to/krdp/6.4.4/recipe-sysroot-native/usr/share/cmake-3.31/Modules/CMakeFindDependencyMacro.cmake:76 (find_package)
| /path/to/krdp/6.4.4/recipe-sysroot/usr/lib/cmake/FreeRDP3/FreeRDPConfig.cmake:2 (find_dependency)
| CMakeLists.txt:45 (find_package)
|
|
| -- Configuring incomplete, errors occurred!
Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6c30f47645c3c16b81801d4427d04c2385daa4cd)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
When building an SDK with lcov included, gcov isn't included in the SDK
by default. Running lcov to generate coverage fails, because it tries to
use the gcov binary from the host system instead and that cause problems
if the gcc versions do not match.
Signed-off-by: Jef Driesen <jefdriesen@telenet.be>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
* Security:
* CVE-2025-4877 - Write beyond bounds in binary to base64 conversion
* CVE-2025-4878 - Use of uninitialized variable in privatekey_from_file()
* CVE-2025-5318 - Likely read beyond bounds in sftp server handle management
* CVE-2025-5351 - Double free in functions exporting keys
* CVE-2025-5372 - ssh_kdf() returns a success code on certain failures
* CVE-2025-5449 - Likely read beyond bounds in sftp server message decoding
* CVE-2025-5987 - Invalid return code for chacha20 poly1305 with OpenSSL
* Compatibility
* Fixed compatibility with CPM.cmake
* Compatibility with OpenSSH 10.0
* Tests compatibility with new Dropbear releases
* Removed p11-kit remoting from the pkcs11 testsuite
* Bugfixes
* Implement missing packet filter for DH GEX
* Properly process the SSH2_MSG_DEBUG message
* Allow escaping quotes in quoted arguments to ssh configuration
* Do not fail with unknown match keywords in ssh configuration
* Process packets before selecting signature algorithm during authentication
* Do not fail hard when the SFTP status message is not sent by noncompliant
servers
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This upgrade includes fix for CVE-2025-50420.
poppler 25.08.0 changelog:
==========================
core:
* FormWidgetSignature::signDocumentWithAppearance: add imagePath parameter
* Fix parsing Distinguished Names that end with a hex string
* Fix crashes in malformed documents
glib:
* Add poppler_page_render_transparent_selection()
* Add missing since to the documentation
poppler 25.07.0 changelog:
==========================
core:
* Changed rendering of malformed documents to mimic what Adobe Reader does. Issue #1602
* Improvemenst in signature validation in the NSS backend
* Add more detailed output when signing fails
* Internal code improvements
* Fix crashes in malformed documents
utils:
* pdfsig: command line option for allowing PGP signatures in GnuPG backend
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Pick commit mentioned in [1].
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-6375
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
