Gyorgy Sarvari
68bc6d3bbe
imagemagick: patch CVE-2025-62171
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-62171
Pick the patch that's mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-25 10:17:02 +01:00
Gyorgy Sarvari
339ac6d59c
imagemagick: patch CVE-2025-65955
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-65955
Pick the patch referenced by the NVD report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-25 10:17:02 +01:00
Gyorgy Sarvari
4eae56f5d0
imagemagick: patch CVE-2022-1115
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-1115
Pick the patch referenced in the NVD report.
Tested successfully against the PoC described in the related Github issue[1].
[1]: https://github.com/ImageMagick/ImageMagick/issues/4974
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-25 10:17:02 +01:00
Gyorgy Sarvari
cdd9a07823
gosu: set SRCREV_FORMAT variable
...
The recipe fetches from multiple repositories, however the SRCREV_FORMAT
variable wasn't set. Due to this the recipe couldn't reuse sstate artifacts from
a mirror, only threw warnings:
WARNING: gosu-1.14-r0 do_package_qa_setscene: ExpansionError('SRCPV',
'${@bb.fetch2.get_srcrev(d)}', FetchError('The SRCREV_FORMAT variable
must be set when multiple SCMs are used.\nThe SCMs are:
git://github.com/tianon/gosu.git;branch=master;protocol=https
git://github.com/opencontainers/runc;name=runc;branch=main;protocol=https', None))
WARNING: Setscene task (/cocto/kirkstone-next/meta-openembedded/meta-oe/recipes-support/
gosu/gosu_1.14.bb:do_package_qa_setscene) failed with exit code '1' - real task
will be run instead
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-14 16:18:49 +01:00
Divyanshu Rathore
2114ae5f26
ImageMagick: Fix CVE-2023-34151
...
Backport the fix for CVE-2023-34151
Upstream-Status: Backport [3d6d98d8a2
2025-12-12 22:06:56 +01:00
Divyanshu Rathore
3a86962b26
ImageMagick: Fix CVE-2025-55298
...
Backport the fix for CVE-2025-55298
Upstream-Status: Backport [439b362b931f93323df9
2025-12-12 22:06:55 +01:00
Divyanshu Rathore
a137e10750
ImageMagick: Fix CVE-2025-55154
...
Backport the fix for CVE-2025-55154
Upstream-Status: Backport [db986e4782
2025-12-12 22:06:54 +01:00
Divyanshu Rathore
4f4cf3248e
ImageMagick: Fix CVE-2025-57807
...
Backport the fix for CVE-2025-57807
Upstream-Status: Backport [077a417a19
2025-12-12 22:06:53 +01:00
Divyanshu Rathore
f978eae8fc
ImageMagick: Fix CVE-2025-57803
...
Backport the fix for CVE-2025-57803
Upstream-Status: Backport [61f444e545
2025-12-12 22:06:52 +01:00
Divyanshu Rathore
222e1b635e
ImageMagick: Fix CVE-2025-55004
...
Backport the fix for CVE-2025-55004
Upstream-Status: Backport [55d97055e0
2025-12-12 22:06:51 +01:00
Divyanshu Rathore
a1c2509aea
ImageMagick: Fix CVE-2025-53019
...
Backport the fix for CVE-2025-53019
Upstream-Status: Backport [fc3ab0812e
2025-12-12 22:06:50 +01:00
Divyanshu Rathore
f0ce346514
ImageMagick: Fix CVE-2025-55005
...
Backport the fix for CVE-2025-55005
Upstream-Status: Backport [b68bb6d3cf
2025-12-12 22:06:49 +01:00
Divyanshu Rathore
7b1c9fa6fb
ImageMagick: Fix CVE-2025-55160
...
Backport the fix for CVE-2025-55160
Upstream-Status: Backport [63d8769dd6
2025-12-12 22:06:48 +01:00
Divyanshu Rathore
bbcd2ab724
ImageMagick: Fix CVE-2025-53101
...
Backport the fix for CVE-2025-53101
Upstream-Status: Backport [66dc8f51c1
2025-12-12 22:06:47 +01:00
Divyanshu Rathore
520f64ef3c
ImageMagick: Fix CVE-2025-53014
...
Backport the fix for CVE-2025-53014
Upstream-Status: Backport [29d82726c7
2025-12-12 22:06:46 +01:00
Viswanath Kraleti
cac725f7d2
gflags: switch Git branch from master to main
...
Update SRC_URI to use the 'main' branch instead of 'master' since
the upstream GitHub repository has renamed its default branch.
Signed-off-by: Viswanath Kraleti <viswanath.kraleti@oss.qualcomm.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-12 19:22:39 +01:00
Gyorgy Sarvari
d95d7c8e7b
xrdp: add ptest support
...
It takes under 10 seconds to run the suite.
Executed succesfully on x86-64, with musl and glibc.
The recipe requires pam DISTRO_FEATURE to be present.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 54ca51b6c6c90ad464a488e1ee271d3fff708955)
Adapted to Kirkstone
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 19:34:17 +01:00
Gyorgy Sarvari
dcc7681d01
xrdp: patch CVE-2022-23493
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23493
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:13 +01:00
Gyorgy Sarvari
fc2c0460ab
xrdp: patch CVE-2022-23484
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23484
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:11 +01:00
Gyorgy Sarvari
e89a73a759
xrdp: patch CVE-2022-23483
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23483
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:10 +01:00
Gyorgy Sarvari
e0e34a0615
xrdp: patch CVE-2022-23481
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23481
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:09 +01:00
Gyorgy Sarvari
07291c5d65
xrdp: patch CVE-2022-23480
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23480
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:09 +01:00
Gyorgy Sarvari
d2a493539f
xrdp: patch CVE-2022-23479
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23479
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:08 +01:00
Gyorgy Sarvari
444c8f69d2
xrdp: patch CVE-2022-23478
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23478
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:07 +01:00
Gyorgy Sarvari
74b0b81579
xrdp: patch CVE-2022-23477
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23477
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:06 +01:00
Gyorgy Sarvari
5709e8f6ec
xrdp: patch CVE-2022-23468
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2022-23468
Pick the patch that mentions this vulnerability explicitly.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:05 +01:00
Gyorgy Sarvari
f218f0373f
xrdp: upgrade 0.9.18 -> 0.9.18.1
...
Contains fix for CVE-2022-23613
Changelog: https://github.com/neutrinolabs/xrdp/releases/tag/v0.9.18.1
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-06 17:33:04 +01:00
Gyorgy Sarvari
4a70d6f944
gradm: fix installation with usrmerge enabled
...
In case usrmerge DISTRO_FEATURE is enabled, the recipe installs its
binaries into /sbin folder, which however supposed to be a symlink
to /usr/sbin folder, thus ultimately failing the installation.
To avoid this problem, backport a patch from master branch that allows
specifying the installation location.
This is a partial backport of 682657248c654c54ac87edc9bf0a95fb59ff0b1e
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-12-02 13:54:16 +01:00
Gyorgy Sarvari
a12478e722
libraw: patch CVE-2025-43964
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-43964
Pick the patch that is referenced by the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
0e30e2ab37
libraw: patch CVE-2025-43963
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-43963
Pick the patch that is referenced in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
cb0fcd1ae4
libraw: patch CVE-2025-43961 and CVE-2025-43962
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-43961
https://nvd.nist.gov/vuln/detail/CVE-2025-43962
Pick the patch that is mentioned by the nvd reports - the
same patch fixes both vulnerabilities.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
309e9688d5
libraw: patch CVE-2023-1729
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-1729
Pick the patch that is mentioned to solve the issue in the issue
linked from the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
730f4c000c
libraw: ignore CVE-2020-35535
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35535
The fix is already included in the used revision.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
298f329594
libraw: ignore CVE-2020-35534
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35534
The fix is already included in the currently used revision.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
ce9b6df403
libraw: ignore CVE-2020-35533
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35533
The fix is already included in the currently used revision.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
73891ac756
libraw: ignore CVE-2020-35532
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35532
The fix is already included in the currently used revision.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
34f34b93d9
libraw: ignore CVE-2020-35531
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35531
The fix is already included in the currently used revision.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
27f77ae006
libraw: ignore CVE-2020-35530
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2020-35530
The fix is already included in the currently used revision.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:58 +01:00
Gyorgy Sarvari
7965aa0704
links: set CVE_PRODUCT
...
There are some unrelated software called "links", which cases
false-positive CVEs to be reported by the CVE checker.
Set the vendor/product pairs that were historically used with
CVEs for this software.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 62a53097324ace9161d8fdcfbc533baac9ee6309)
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
8602562caa
exiv2: patch CVE-2021-34335
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-34335
Pick the patches from the PR mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
41e6c428c8
exiv2: patch CVE-2021-34334
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-34334
Pick the patches from the PR mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
0f89f58111
exiv2: patch CVE-2021-32815
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-32815
Pick the patch from the PR mentioned in he nvd report.
This patch is a combination of 3 commits, which are so
small, that it is still very readable in this form also.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
19fb28a912
exiv2: patch CVE-2021-32617
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-32617
Pick the patch from the PR that's mentioned by the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
3a8bb65960
exiv2: add missing CVE tag to patch
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29458
https://nvd.nist.gov/vuln/detail/CVE-2021-31292
The patch is already present, but it was missing the CVE tag, which
is added in this change.
The same patch fixes both CVEs.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
aa979d9766
exiv2: patch CVE-2021-29623
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2021-29623
Pick the patch from the PR mentioned in teh nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
de561a26c0
poco: patch CVE-2023-52389
...
Details: https://nvd.nist.gov/vuln/detail/CVE-2023-52389
Pick the patch from the PR mentioned in the nvd report.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
AshishKumar Mishra
fb79c60c57
imagemagick: adds ptest for imagemagick recipe
...
Backport of the commit 96b97c0c6490b713b559a4e82bd699a2ebe357d3 from master
This patch enables ptest for imagemagick, improving test coverage for
continuous integration and runtime validation.
No functional changes are introduced to the core package.
The logic used is :
- We check if the required tools are present or not
- We used convert to create an raw RGB file
- The created RGB is then converted to PNG using convert
- We re-gerenate RGB from PNG and compare the original and re-generated RGB
- Enabled the ptest in ptest-packagelists-meta-oe.inc as
suggested by Gyorgy Sarvari and incorporated logging suggestion
- This was done as standard imagemagick test like drawtest requires manual
internetion to verify the file.
Signed-off-by: AshishKumar Mishra <ashishkumar.mishra@bmwtechworks.in>
Adapted to Kirkstone.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Divya Chellam
4ae2ec4620
libssh : fix CVE-2025-8114
...
A flaw was found in libssh, a library that implements the SSH protocol.
When calculating the session ID during the key exchange (KEX) process,
an allocation failure in cryptographic functions may lead to a NULL
pointer dereference. This issue can cause the client or server to crash.
Reference:
https://security-tracker.debian.org/tracker/CVE-2025-8114
Upstream-patch:
https://git.libssh.org/projects/libssh.git/commit/?id=53ac23ded4cb2c5463f6c4cd1525331bd578812d
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Mingli Yu
d77da5b656
nspr: fix buildpaths issue
...
Fixes:
WARNING: nspr-4.29-r0 do_package_qa: QA Issue: File /usr/bin/nspr-config in package nspr-dev contains reference to TMPDIR [buildpaths]
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-30 15:13:57 +01:00
Gyorgy Sarvari
5f1ffc2139
iksemel: fix SRC_URI branch
...
Master branch was renamed to main.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
2025-11-17 09:08:33 +01:00
