Gyorgy Sarvari
d9fbd8560e
zlog: patch CVE-2024-22857
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-22857
Pick the patch from the PR mentioned by the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-14 16:18:47 +01:00
Gyorgy Sarvari
4437919060
znc: patch CVE-2024-39844
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-39844
Pick the patch that is mentioned in the oss-security[1] advisory
[1]: https://www.openwall.com/lists/oss-security/2024/07/03/9
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-14 16:18:46 +01:00
Divyanshu Rathore
2114ae5f26
ImageMagick: Fix CVE-2023-34151
...
Backport the fix for CVE-2023-34151
Upstream-Status: Backport [3d6d98d8a2
2025-12-12 22:06:56 +01:00
Divyanshu Rathore
3a86962b26
ImageMagick: Fix CVE-2025-55298
...
Backport the fix for CVE-2025-55298
Upstream-Status: Backport [439b362b931f93323df9
2025-12-12 22:06:55 +01:00
Divyanshu Rathore
a137e10750
ImageMagick: Fix CVE-2025-55154
...
Backport the fix for CVE-2025-55154
Upstream-Status: Backport [db986e4782
2025-12-12 22:06:54 +01:00
Divyanshu Rathore
4f4cf3248e
ImageMagick: Fix CVE-2025-57807
...
Backport the fix for CVE-2025-57807
Upstream-Status: Backport [077a417a19
2025-12-12 22:06:53 +01:00
Divyanshu Rathore
f978eae8fc
ImageMagick: Fix CVE-2025-57803
...
Backport the fix for CVE-2025-57803
Upstream-Status: Backport [61f444e545
2025-12-12 22:06:52 +01:00
Divyanshu Rathore
222e1b635e
ImageMagick: Fix CVE-2025-55004
...
Backport the fix for CVE-2025-55004
Upstream-Status: Backport [55d97055e0
2025-12-12 22:06:51 +01:00
Divyanshu Rathore
a1c2509aea
ImageMagick: Fix CVE-2025-53019
...
Backport the fix for CVE-2025-53019
Upstream-Status: Backport [fc3ab0812e
2025-12-12 22:06:50 +01:00
Divyanshu Rathore
f0ce346514
ImageMagick: Fix CVE-2025-55005
...
Backport the fix for CVE-2025-55005
Upstream-Status: Backport [b68bb6d3cf
2025-12-12 22:06:49 +01:00
Divyanshu Rathore
7b1c9fa6fb
ImageMagick: Fix CVE-2025-55160
...
Backport the fix for CVE-2025-55160
Upstream-Status: Backport [63d8769dd6
2025-12-12 22:06:48 +01:00
Divyanshu Rathore
bbcd2ab724
ImageMagick: Fix CVE-2025-53101
...
Backport the fix for CVE-2025-53101
Upstream-Status: Backport [66dc8f51c1
2025-12-12 22:06:47 +01:00
Divyanshu Rathore
520f64ef3c
ImageMagick: Fix CVE-2025-53014
...
Backport the fix for CVE-2025-53014
Upstream-Status: Backport [29d82726c7
2025-12-12 22:06:46 +01:00
Viswanath Kraleti
cac725f7d2
gflags: switch Git branch from master to main
...
Update SRC_URI to use the 'main' branch instead of 'master' since
the upstream GitHub repository has renamed its default branch.
Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-12 19:22:39 +01:00
Valeria Petrov
46a6fbcdcb
apache2: upgrade 2.4.65 -> 2.4.66
...
Security fixes:
- CVE-2025-66200
- CVE-2025-65082
- CVE-2025-59775
- CVE-2025-58098
- CVE-2025-55753
See: http://www.apache.org/dist/httpd/CHANGES_2.4.66
Signed-off-by: Valeria Petrov <valeria.petrov@spinetix.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-12 19:21:36 +01:00
Gyorgy Sarvari
97d4be2839
gupnp-igd: add ptest support
...
Execution takes around 10 seconds.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 19:34:22 +01:00
Gyorgy Sarvari
590afd1a98
gupnp-av: add ptest support
...
It takes around a second to execute the suite.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 65c2f6de55fa662bce0281046ed3f291c414ff82)
Adapted to Kirkstone.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 19:34:21 +01:00
Gyorgy Sarvari
535fc775a6
gupnp: add ptest support
...
It takes almost 50 seconds on my machine to execute.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e7878d69abd4d1cfaad3f5e5ba9cf7ad00f136bd)
Adapted to Kirkstone
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 19:34:20 +01:00
Gyorgy Sarvari
ff2b74df62
gssdp: add ptest support
...
It is quick, it finished under 20 seconds on my machine.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 27865a96d576160a0e3a0fda6b7e604f19edbc6c)
Adapted to Kirkstone
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 19:34:19 +01:00
Gyorgy Sarvari
d95d7c8e7b
xrdp: add ptest support
...
It takes under 10 seconds to run the suite.
Executed succesfully on x86-64, with musl and glibc.
The recipe requires pam DISTRO_FEATURE to be present.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 54ca51b6c6c90ad464a488e1ee271d3fff708955)
Adapted to Kirkstone
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 19:34:17 +01:00
Gyorgy Sarvari
dcc7681d01
xrdp: patch CVE-2022-23493
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23493
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:13 +01:00
Gyorgy Sarvari
fc2c0460ab
xrdp: patch CVE-2022-23484
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23484
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:11 +01:00
Gyorgy Sarvari
e89a73a759
xrdp: patch CVE-2022-23483
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23483
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:10 +01:00
Gyorgy Sarvari
e0e34a0615
xrdp: patch CVE-2022-23481
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23481
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:09 +01:00
Gyorgy Sarvari
07291c5d65
xrdp: patch CVE-2022-23480
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23480
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:09 +01:00
Gyorgy Sarvari
d2a493539f
xrdp: patch CVE-2022-23479
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23479
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:08 +01:00
Gyorgy Sarvari
444c8f69d2
xrdp: patch CVE-2022-23478
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23478
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:07 +01:00
Gyorgy Sarvari
74b0b81579
xrdp: patch CVE-2022-23477
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23477
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:06 +01:00
Gyorgy Sarvari
5709e8f6ec
xrdp: patch CVE-2022-23468
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23468
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:05 +01:00
Gyorgy Sarvari
f218f0373f
xrdp: upgrade 0.9.18 -> 0.9.18.1
...
Contains fix for CVE-2022-23613
Changelog: https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.18.1
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:04 +01:00
Saravanan
e2da1298ac
python3-django: fix CVE-2025-32873
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-32873
Upstream-patch:
9cd8028f3e
2025-12-05 15:29:59 +01:00
Saravanan
ee59faebac
python3-django: fix CVE-2024-53907
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-53907
Upstream-patch:
790eb058b0
2025-12-05 15:29:58 +01:00
Saravanan
64e4cf9933
python3-django: fix CVE-2024-41991
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-41991
Upstream-patch:
efea1ef7e2
2025-12-05 15:29:55 +01:00
Khem Raj
edb07bc11e
scsirastools: Fix build with usrmerge
...
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 4448cd9ee7e62de0a2787110256c8c0cabb941ee)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-02 13:54:27 +01:00
Gyorgy Sarvari
4a70d6f944
gradm: fix installation with usrmerge enabled
...
In case usrmerge DISTRO_FEATURE is enabled, the recipe installs its
binaries into /sbin folder, which however supposed to be a symlink
to /usr/sbin folder, thus ultimately failing the installation.
To avoid this problem, backport a patch from master branch that allows
specifying the installation location.
This is a partial backport of 682657248c654c54ac87edc9bf0a95fb59ff0b1e
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-02 13:54:16 +01:00
Gyorgy Sarvari
bc55ba3d8c
babeld: fix installation with usrmerge
...
In case usrmerge DISTRO_FEATURE is enabled, the recipe installed
the application to /bin folder, which is however a symlink to /usr/bin,
so the installation ultimately failed.
To fix this, set the correct prefix for the installation.
This is a partial backport of f91983f1f3e897d25ab477fdfb5baed89ccc0daf
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-02 13:54:02 +01:00
Gyorgy Sarvari
6416254c0b
fontforge: patch CVE-2024-25081 and CVE-2024-25082
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2024-25081
https://nvd.nist.gov/vuln/detail/CVE-2024-25082
The same patch fixes both vulnerabilities.
Take the patch from the pull request that is referenced by the
nv report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 20:48:08 +01:00
Gyorgy Sarvari
2491ea2ffb
fontforge: patch CVE-2020-5395, CVE-2020-25690 and CVE-2020-5496
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-5395
https://nvd.nist.gov/vuln/detail/CVE-2020-25690
https://nvd.nist.gov/vuln/detail/CVE-2020-5496
The same patch fixes all three.
The patch for CVE-2020-25690 is mentioned in the RedHat bug, which is
referenced in the nvd report.
The patch for CVE-2020-5395 is mentioned in the Github issue that
is referenced in the nvd report.
The patch for CVE-2020-5496 is mentioned in the comments of the issue
that is linked in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 20:48:07 +01:00
Gyorgy Sarvari
48d2305f48
fontforge: ignore CVE-2019-15785
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2019-15785
The vulnerability is not present in the currently used version, so
ignore it.
Current version: 20190801
First vulnerable version: 20190813
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 20:48:06 +01:00
Gyorgy Sarvari
67bb8e4b16
yasm: patch CVE-2021-33456
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33465
The patch was taken from Debian:
https://sources.debian.org/patches/yasm/1.3.0-8/1020-hash-null-CVE-2021-33456.patch/
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 1e2731fce05d15020fddf3dca5d8ee42ec3c04e1)
2025-11-30 20:48:05 +01:00
Gyorgy Sarvari
68a44fe280
yasm: patch CVE-2021-33464
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-33464
The patch was taken from Debian:
https://sources.debian.org/patches/yasm/1.3.0-8/1010-nasm-pp-no-env-CVE-2021-33464.patch/
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 66a0b01b52e5d1cd2af4c41ae0b67541464874e6)
2025-11-30 20:48:04 +01:00
Gyorgy Sarvari
5fb0376aed
yasm: patch CVE-2023-29579
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-29579
The patch was taken from Debian:
https://sources.debian.org/patches/yasm/1.3.0-8/1000-x86-dir-cpu-CVE-2023-29579.patch/
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cc30757a7fd0af5f60b9a6408b3eb94c0810acda)
2025-11-30 20:48:03 +01:00
Gyorgy Sarvari
b6eb044866
yasm: add alternative CVE_PRODUCT
...
There are multiple vendors for yasm:
$ sqlite3 ./nvdcve_2-2.db "select distinct vendor, product from products where product = 'yasm';"
tortall|yasm
yasm_project|yasm
Both products refer to the same application
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 93f85e4fd2fb124cb047f6b378cf0052a1f102aa)
2025-11-30 20:48:01 +01:00
Saravanan
8b438a9d7b
python3-django: fix CVE-2024-39330
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-39330
Upstream-patch:
2b00edc015
2025-11-30 15:16:36 +01:00
Saravanan
740980aaba
python3-django: fix CVE-2024-39329
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-39329
Upstream-patch:
156d3186c9
2025-11-30 15:16:34 +01:00
Saravanan
21d389c8f9
python3-django: fix CVE-2025-57833
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-57833
Upstream-patch:
31334e6965
2025-11-30 15:16:32 +01:00
Saravanan
0b554678b6
python3-django: fix CVE-2024-56374
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-56374
Upstream-patch:
ad866a1ca3
2025-11-30 15:16:31 +01:00
Saravanan
540b79e3ee
python3-django: fix CVE-2025-26699
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-26699
Upstream-patch:
e88f7376fe
2025-11-30 15:16:30 +01:00
Saravanan
666ec505b4
python3-django: fix CVE-2024-27351
...
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-27351
Upstream-patch:
072963e4c4
2025-11-30 15:16:29 +01:00
Saravanan
d4a5c4cf6c
python3-django: upgrade 4.2.17 -> 4.2.26
...
Fixes CVE-2025-64459, CVE-2025-64458, CVE-2025-59682, CVE-2025-59681,
CVE-2025-57833, CVE-2025-48432, CVE-2025-32873, CVE-2025-26699, CVE-2024-56374
and other bug fixes.
Release notes:
https://docs.djangoproject.com/en/dev/releases/4.2.18/
https://docs.djangoproject.com/en/dev/releases/4.2.19/
https://docs.djangoproject.com/en/dev/releases/4.2.20/
https://docs.djangoproject.com/en/dev/releases/4.2.21/
https://docs.djangoproject.com/en/dev/releases/4.2.22/
https://docs.djangoproject.com/en/dev/releases/4.2.23/
https://docs.djangoproject.com/en/dev/releases/4.2.24/
https://docs.djangoproject.com/en/dev/releases/4.2.25/
https://docs.djangoproject.com/en/dev/releases/4.2.26/
Signed-off-by: Saravanan <saravanan.kadambathursubramaniyam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:16:28 +01:00
