From: Dragos-Marian Panait <dragos.panait@...> In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interf

Currently /tmp is a link to /var/tmp which breaks glib-2.0 ptest Systemd documentation describes tmpdir usage as follows: /tmp/ and /var/tmp/ are two world-writable directories Linux systems provide f

From: Piotr Łobacz <p.lobacz@...> The generated /etc/group file had a wrong group name for nobody-group which was nobody with same id as nogroup groupd. This was leading to duplcate groups, with same

From: Tim Orling <ticotimo@...> Signed-off-by: Tim Orling <tim.orling@...> Signed-off-by: Richard Purdie <richard.purdie@...> (cherry picked from commit ab041ca5d036c2a1a1514893c6ffb5c7188ff00f) Signe

From: Richard Purdie <richard.purdie@...> Fix: scripts/pybootchartgui/pybootchartgui/parsing.py:134: SyntaxWarning: "is" with a literal. Did you mean "=="? if pid is 0: Signed-off-by: Richard Purdie <

From: Martin Jansa <Martin.Jansa@...> * passing -std=c2x to avoid build failure with gcc-13 on host works as well, but the resulting zic then segfaults when used in tzdata, use a fix from upstream ins

From: Martin Jansa <Martin.Jansa@...> * avoid copying whole exec_prefix over base_prefix as there were only zoneinfo files anyway Signed-off-by: Martin Jansa <Martin.Jansa@...> Signed-off-by: Richard

From: Martin Jansa <Martin.Jansa@...> Signed-off-by: Martin Jansa <Martin.Jansa@...> Signed-off-by: Richard Purdie <richard.purdie@...> (cherry picked from commit bc53ccaf82c57826acac5f9c2557e403ec367

From: Ross Burton <ross.burton@...> ptestresult_get_log() looked for a key called 'ptestresuls.sections', which should be 'ptestresult.sections' Signed-off-by: Ross Burton <ross.burton@...> Signed-off

From: Mikko Rapeli <mikko.rapeli@...> hwclock command fails on read-only-rootfs: AssertionError: 1 != 0 : Failed to reset RTC time, output: hwclock: cannot open /etc/adjtime: Read-only file system Sig

From: Romuald Jeanne <romuald.jeanne@...> Make sure to expand all MKUBIFS_ARGS_<label> and UBINIZE_ARGS_<label> vars in 'do_image_multiubi' task to use them to init the local 'mkubifs_args' and 'ubini

From: Khem Raj <raj.khem@...> Some packages like lirc places its unit files into $systemd_user_unitdir and also uses them in SYSTEMD_SERVICE list in recipe. This fails in do_package ERROR: Didn't find

From: Alexander Kanavin <alex.kanavin@...> If it exists, there is no need to delete it, and if it does not, devtool prints an ugly traceback. Signed-off-by: Alexander Kanavin <alex@...> Signed-off-by:

From: Chee Yang Lee <chee.yang.lee@...> Signed-off-by: Chee Yang Lee <chee.yang.lee@...> Signed-off-by: Steve Sakoman <steve@...> (cherry picked from commit 70adf86b515934168a6185dcff4a8edb39a40017) S

From: Peter Marko <peter.marko@...> Backport from v250-stable branch (v250.9) Signed-off-by: Peter Marko <peter.marko@...> Signed-off-by: Steve Sakoman <steve@...> --- .../systemd/systemd/CVE-2022-441

From: Pawan Badganchi <badganchipv@...> Add below patches to fix CVE-2023-23914 [1], CVE-2023-23915 [2] CVE-2023-23914_5-1.patch CVE-2023-23914_5-2.patch CVE-2023-23914_5-3.patch CVE-2023-23914_5-4.pa

Please review this set of patches for kirkstone and have comments back by end of day Monday. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5087 The fo

Backports the create-spdx classes from the latest versions on master. This backport is a simple copy with no modifications, as its too complex to cherry-pick all the corresponding changes. This will g

Upgrade libgit2 to v1.6.3. The new version now has git_fs_path_basename_r() which is based on BSD-2-Clause. Signed-off-by: Sudip Mukherjee <sudipm.mukherjee@...> --- .../libgit2/{libgit2_1.5.1.bb => l

The quilt package files are owned by the ptest user, which is provided by the ptest-runner package. The quilt recipe depends on ptest-runner but there have been instances where rebuilds of quilt end u