The project started to outsource the source hosting to Google storage
and Github.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
GNU indent 2.2.13 has a heap-based buffer overflow in search_brace
in indent.c via a crafted file.
Reference:
https://savannah.gnu.org/bugs/index.php?64503
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 7da6cb848bc42b3e6bd5d2b37b52ba75510a6ca0)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
The project switched to storing their releases on Github, and
the original links stopped working.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
A flaw was found in polkit. When processing an XML policy with 32 or
more nested elements in depth, an out-of-bounds write can be triggered.
This issue can lead to a crash or other unexpected behavior, and
arbitrary code execution is not discarded. To exploit this flaw, a
high-privilege account is needed as it's required to place the
malicious policy file properly.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-7519
Upstream-patch:
107d380136
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
bpftrace need line up with kernel architecture type,
so add it to NON_MULTILIB_RECIPES.
bpftrace must be built with the same architecture (32-bit/64-bit) as the kernel
to ensure compatibility when tracing kernel functions and using eBPF features.
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f8498f26991fbd8ea996dcf7c63d1c79e9c034a7)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Without the option -Wno-implicit-int , the following error will occur and the command procmail will not be installed to target.
lmtp.c:54:8: error: type defaults to 'int' in declaration of 'ctopfd' [-Wimplicit-int]
54 | static ctopfd;
| ^~~~~~
make[1]: [Makefile:239: lmtp.o] Error 1 (ignored)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d23de74dc8f80b8a4abb21801dcfbef611664e9a)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
aids building on newer build hosts which now have moved to gcc-14
as well, so using cmdline option just for target compile is not
enough as it runs tests using host compiler as well
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6d13c58e386d478b8788f440b7815cb866b9d6f0)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Also fix native pieces to build with gcc-14 while here
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f8ece969ea279f37938a54e6d8c01e9937753f03)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Newer compilers e.g. clang19+ will treat implicit function prototypes
as errors, therefore define main() with a valid return type
Fixes
ckwart.c:531:1: error: return type defaults to ‘int’ [-Wimplicit-int]
531 | main(argc,argv) int argc; char **argv; {
| ^~~~
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9813fb56d22acad36d70158335b8ee9f4a05ad89)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Some portions are built using host CC, which
is important when doing cross compile to pass correct flags
otherwise it fails when using newer host compiler e.g. gcc-14
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 32eb26264323888e77154c2aeadc9994a4a54d5d)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Original URI is not accessible anymore
Drop md5sum
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ceb91603415c6e059d866666574dd1be5b93867a)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Default branch is renamed from `master` to `main`. Commitshas are the
same.
Signed-off-by: Jeroen Knoops <jeroen.knoops@philips.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 58679b6a515b51d28c480836ad598fca6f0cc655)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Change the SRC_URI to the correct value due to the following error:
ERROR: geoip-1.6.12-r0 do_fetch: Bitbake Fetcher Error: FetchError('Unable to fetch URL from any source.', 'http://sources.openembedded.org/GeoIP.dat.20181205.gz;apply=no;name=GeoIP-dat;')
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit aadc2ac9dc49dfb5a2066401f22e7b553b324313)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
It was missing as the recipe is using --with-tirpc
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Adapted for Walnascar
Signed-off-by: Gyorgy Sarvari <gyorgy.sarvari@gmail.com>
(cherry picked from commit 8832aa3ca83d6a2f705d4aa48496f8bd12c9cc15)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
The currently generated LibVNCServerTargets.cmake will include the
following 'set_target_properties':
set_target_properties(LibVNCServer::vncclient PROPERTIES
INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
INTERFACE_LINK_LIBRARIES "systemd;/usr/lib/libz.so;/usr/lib/liblzo2.so;/usr/lib/libjpeg.so;/usr/lib/libgcrypt.so;/usr/lib/libgnutls.so"
)
INTERFACE_LINK_LIBRARIES here points to absolute paths which hardcodes
the library paths. From CMake doc [1]:
Note that it is not advisable to populate the INTERFACE_LINK_LIBRARIES
of a target with absolute paths to dependencies. That would hard-code
into installed packages the library file paths for dependencies as
found on the machine the package was made on.
This breaks krfb build (kde desktop sharing server) since CMake cannot
find these libraries. Removing the absolute paths solves the issue.
Note: I also added a 'inherit pkgconfig' since libvncserver uses it to
detect libsystemd presence.
1: https://cmake.org/cmake/help/latest/prop_tgt/INTERFACE_LINK_LIBRARIES.html
Signed-off-by: Marc Ferland <marc.ferland@sonatest.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 215694286716cf83bf9e52c5e61b4cbc861098fc)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
When building an SDK with lcov included, gcov isn't included in the SDK
by default. Running lcov to generate coverage fails, because it tries to
use the gcov binary from the host system instead and that cause problems
if the gcc versions do not match.
Signed-off-by: Jef Driesen <jefdriesen@telenet.be>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
(cherry picked from commit 0cd6283a4174453ac8d927d917268ba0c3161a02)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
When creating sparse images, the RAW image is no longer needed in
some workflows such as Android and CI pipelines. These RAW images
can be multi-GB artifacts and consume significant disk space.
This change introduces a configuration option
`DELETE_RAWIMAGE_AFTER_SPARSE_CMD` which, when set to "1",
removes the RAW image after sparse image generation.
This reduces disk usage in builds where sparse images are the
final deliverables and RAW images are not required.
Default behavior is unchanged: RAW images are kept unless the
variable is explicitly enabled:
DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "1" # Delete RAW image
DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "0" # Default behavior
(cherry-picked from f5246b7df447ac76ec04c6e5add398862d1c9ccd in master )
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Gutenprint install hooks run in parallel but depend on each other. This
is a race condition and might trigger a build failure (e.g on AB [0]):
| chmod 700 $WORKDIR/image/usr/libexec/cups/backend/backend_gutenprint
| chmod: cannot access '$WORKDIR/image/usr/libexec/cups/backend/backend_gutenprint': Not a directory
| make[5]: *** [Makefile:2166: install-exec-hook] Error 1
Fixes this by adding an explicit dependency between the dependent
targets.
[0]: https://autobuilder.yoctoproject.org/valkyrie/#/builders/87/builds/46/steps/33/logs/stdio
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
CVE-2024-58249:
In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-58249]
Upstream patches:
[f2918a9ac8]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
(walnascar rev: d3d3df49d5f6e8747c0b04100c4f708b4cafbbd4)
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Fix follow runtime error: ./build_support/src/sniff_mq_prio_max:
/lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by
./build_support/src/sniff_mq_prio_max)
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
CVE-2025-54350:
In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion
failure and application exit upon a malformed authentication attempt.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2025-54350]
Upstream patches:
[4eab661da0]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
A flaw was found in libssh when using the ChaCha20 cipher with the
OpenSSL library. If an attacker manages to exhaust the heap space,
this error is not detected and may lead to libssh using a partially
initialized cipher context. This occurs because the OpenSSL error
code returned aliases with the SSH_OK code, resulting in libssh not
properly detecting the error returned by the OpenSSL library.
This issue can lead to undefined behavior, including compromised
data confidentiality and integrity or crashes.
Reference:
https://security-tracker.debian.org/tracker/CVE-2025-5987
Upstream-patch:
https://git.libssh.org/projects/libssh.git/commit/?h=stable-0.11&id=90b4845e0c98574bbf7bea9e97796695f064bf57
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Add the instance specifier to the ptp4l dependency for the phc2sys
service, so the corresponding service is automatically started
correctly. This fixes the following error messages, when starting the
phc2sys@... service:
Failed to restart phc2sys@eth0.service: Unit ptp4l.service not found.
Signed-off-by: Martin Schwan <m.schwan@phytec.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 31f0b9d3d51a65b1c3d63eb6520e7ab174a8550c)
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
This recipe is a Scarthgap backport of kernel-hardening-checker_0.6.10.2.bb
in the master branch as of August 19, 2025.
Tested on qemux86-64 and on beaglebone-yocto
Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
There were a some accidenal typos in the CVE-2025-52886-0001.patch file
that introduced a number of syntactical errors in the qt5/src/poppler-annotation.cc
file, which failed the compilation, in case qt5 PACKAGECONFIG is enabled.
This change fixes these typos. Since qt6 is not enabled in the recipe,
only the qt5 related parts were verified.
While reworking the backport, unfortunately some line number differences
were introduced, which inflate the size of this patch - just scroll
past those.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
CVE-2025-31181:
A flaw was found in gnuplot. The X11_graphics() function may lead to a
segmentation fault and cause a system crash.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2025-31181]
Upstream patches:
[af96c2c1b2/]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
CVE-2025-31180:
A flaw was found in gnuplot. The CANVAS_text() function may lead to a
segmentation fault and cause a system crash.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2025-31180]
Upstream patches:
[b2343fd02c/]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
CVE-2025-31179:
A flaw was found in gnuplot. The xstrftime() function may lead to a
segmentation fault, causing a system crash.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2025-31179]
Upstream patches:
[ed647df512/]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
CVE-2025-31178:
A flaw was found in gnuplot. The GetAnnotateString() function may lead to a
segmentation fault and cause a system crash.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2025-31178]
Upstream patches:
[b78cc829a1/]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
