Skip to content

Commit 4987cd3

Browse files
krnowakkrnowak
authored
Merge pull request #3271 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-09-15
Weekly portage-stable package updates 2025-09-15
2 parents 1797381 + f94ec83 commit 4987cd3

File tree

159 files changed

+4349
-2613
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

159 files changed

+4349
-2613
lines changed

‎changelog/security/2025-09-16-weekly-updates.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
- libpcre2 ([CVE-2025-58050](https://www.cve.org/CVERecord?id=CVE-2025-58050))
2+
- libxslt ([CVE-2025-7424](https://www.cve.org/CVERecord?id=CVE-2025-7424), [CVE-2025-7425](https://www.cve.org/CVERecord?id=CVE-2025-7425))
3+
- net-tools ([CVE-2025-46836](https://www.cve.org/CVERecord?id=CVE-2025-46836))

‎changelog/updates/2025-09-16-weekly-updates.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
- SDK: azure-core ([1.16.1](https://github.com/Azure/azure-sdk-for-cpp/releases/tag/azure-core_1.16.1))
2+
- SDK: azure-identity ([1.13.1](https://github.com/Azure/azure-sdk-for-cpp/releases/tag/azure-identity_1.13.1))
3+
- base, dev: coreutils ([9.7](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00006.html) (includes [9.6](https://savannah.gnu.org/news/?id=10715)))
4+
- base, dev: libffi ([3.5.2](https://github.com/libffi/libffi/releases/tag/v3.5.2))
5+
- base, dev: libnftnl ([1.3.0](https://lwn.net/Articles/1032725/))
6+
- base, dev: libxml2 ([2.13.9](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.9))
7+
- base, dev: ncurses ([6.5_p20250802](https://invisible-island.net/ncurses/NEWS.html#t20250802))
8+
- base, dev: nftables ([1.1.4](https://www.netfilter.org/projects/nftables/files/changes-nftables-1.1.4.txt))
9+
- dev, sysext-incus: squashfs-tools ([4.7.2](https://github.com/plougher/squashfs-tools/releases/tag/4.7.2) (includes [4.7.1](https://github.com/plougher/squashfs-tools/releases/tag/4.7.1)))
10+
- sysext-podman: gpgme ([2.0.0](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=blob_plain;f=NEWS;h=cd0e093bf83fe47b6773fb478fced07d8409fbe0;hb=e17ba578861905857da0a514b4fc9b88a57f7346))
11+
- sysext-python: charset-normalizer ([3.4.3](https://github.com/jawah/charset_normalizer/releases/tag/3.4.3))
12+
- sysext-python: pip ([25.2](https://raw.githubusercontent.com/pypa/pip/refs/tags/25.2/NEWS.rst))

‎sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-libs/libxslt/CVE-2025-7424.patch‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
2+
From: David Kilzer <[email protected]>
3+
Date: Sat, 24 May 2025 15:06:42 -0700
4+
Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
5+
and source nodes
6+
7+
* libxslt/functions.c:
8+
(xsltDocumentFunctionLoadDocument):
9+
- Implement fix suggested by Ivan Fratric. This copies the xmlDoc,
10+
calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
11+
xmlDoc to tctxt->docList.
12+
- Add error handling for functions that may return NULL.
13+
* libxslt/transform.c:
14+
- Remove static keyword so this can be called from
15+
xsltDocumentFunctionLoadDocument().
16+
* libxslt/transformInternals.h: Add.
17+
(xsltCleanupSourceDoc): Add declaration.
18+
19+
Fixes #139.
20+
---
21+
libxslt/functions.c | 16 +++++++++++++++-
22+
libxslt/transform.c | 3 ++-
23+
libxslt/transformInternals.h | 9 +++++++++
24+
3 files changed, 26 insertions(+), 2 deletions(-)
25+
create mode 100644 libxslt/transformInternals.h
26+
27+
diff --git a/libxslt/functions.c b/libxslt/functions.c
28+
index 72a58dc4..11ec039f 100644
29+
--- a/libxslt/functions.c
30+
+++ b/libxslt/functions.c
31+
@@ -34,6 +34,7 @@
32+
#include "numbersInternals.h"
33+
#include "keys.h"
34+
#include "documents.h"
35+
+#include "transformInternals.h"
36+
37+
#ifdef WITH_XSLT_DEBUG
38+
#define WITH_XSLT_DEBUG_FUNCTION
39+
@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr ctxt,
40+
/*
41+
* This selects the stylesheet's doc itself.
42+
*/
43+
- doc = tctxt->style->doc;
44+
+ doc = xmlCopyDoc(tctxt->style->doc, 1);
45+
+ if (doc == NULL) {
46+
+ xsltTransformError(tctxt, NULL, NULL,
47+
+ "document() : failed to copy style doc\n");
48+
+ goto out_fragment;
49+
+ }
50+
+ xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
51+
+ idoc = xsltNewDocument(tctxt, doc);
52+
+ if (idoc == NULL) {
53+
+ xsltTransformError(tctxt, NULL, NULL,
54+
+ "document() : failed to create xsltDocument\n");
55+
+ xmlFreeDoc(doc);
56+
+ goto out_fragment;
57+
+ }
58+
} else {
59+
goto out_fragment;
60+
}
61+
diff --git a/libxslt/transform.c b/libxslt/transform.c
62+
index 54ef821b..38c2dce6 100644
63+
--- a/libxslt/transform.c
64+
+++ b/libxslt/transform.c
65+
@@ -43,6 +43,7 @@
66+
#include "xsltlocale.h"
67+
#include "pattern.h"
68+
#include "transform.h"
69+
+#include "transformInternals.h"
70+
#include "variables.h"
71+
#include "numbersInternals.h"
72+
#include "namespaces.h"
73+
@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
74+
*
75+
* Resets source node flags and ids stored in 'psvi' member.
76+
*/
77+
-static void
78+
+void
79+
xsltCleanupSourceDoc(xmlDocPtr doc) {
80+
xmlNodePtr cur = (xmlNodePtr) doc;
81+
void **psviPtr;
82+
diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
83+
new file mode 100644
84+
index 00000000..d0f42823
85+
--- /dev/null
86+
+++ b/libxslt/transformInternals.h
87+
@@ -0,0 +1,9 @@
88+
+/*
89+
+ * Summary: set of internal interfaces for the XSLT engine transformation part.
90+
+ *
91+
+ * Copy: See Copyright for the status of this software.
92+
+ *
93+
+ * Author: David Kilzer <[email protected]>
94+
+ */
95+
+
96+
+void xsltCleanupSourceDoc(xmlDocPtr doc);
97+
--
98+
2.39.5 (Apple Git-154)
99+

‎sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-libs/libxslt/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
The libxslt project in unmaintained, so we will need to carry the
2+
patch indefinitely.

‎sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/net-tools/0001-CVE-2025-46836.patch‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
From 7a8f42fb20013a1493d8cae1c43436f85e656f2d Mon Sep 17 00:00:00 2001
2+
From: Zephkeks <[email protected]>
3+
Date: Tue, 13 May 2025 11:04:17 +0200
4+
Subject: [PATCH] CVE-2025-46836: interface.c: Stack-based Buffer Overflow in
5+
get_name()
6+
7+
Coordinated as GHSA-pfwf-h6m3-63wf
8+
---
9+
lib/interface.c | 63 ++++++++++++++++++++++++++++++-------------------
10+
1 file changed, 39 insertions(+), 24 deletions(-)
11+
12+
diff --git a/lib/interface.c b/lib/interface.c
13+
index 71d4163..a054f12 100644
14+
--- a/lib/interface.c
15+
+++ b/lib/interface.c
16+
@@ -211,32 +211,47 @@ static int if_readconf(void)
17+
}
18+
19+
static const char *get_name(char *name, const char *p)
20+
+/* Safe version — guarantees at most IFNAMSIZ‑1 bytes are copied
21+
+ and the destination buffer is always NUL‑terminated. */
22+
{
23+
- while (isspace(*p))
24+
- p++;
25+
- while (*p) {
26+
- if (isspace(*p))
27+
- break;
28+
- if (*p == ':') { /* could be an alias */
29+
- const char *dot = p++;
30+
- while (*p && isdigit(*p)) p++;
31+
- if (*p == ':') {
32+
- /* Yes it is, backup and copy it. */
33+
- p = dot;
34+
- *name++ = *p++;
35+
- while (*p && isdigit(*p)) {
36+
- *name++ = *p++;
37+
- }
38+
- } else {
39+
- /* No, it isn't */
40+
- p = dot;
41+
- }
42+
- p++;
43+
- break;
44+
- }
45+
- *name++ = *p++;
46+
+ char *dst = name; /* current write ptr */
47+
+ const char *end = name + IFNAMSIZ - 1; /* last byte we may write */
48+
+
49+
+ /* Skip leading white‑space. */
50+
+ while (isspace((unsigned char)*p))
51+
+ ++p;
52+
+
53+
+ /* Copy until white‑space, end of string, or buffer full. */
54+
+ while (*p && !isspace((unsigned char)*p) && dst < end) {
55+
+ if (*p == ':') { /* possible alias veth0:123: */
56+
+ const char *dot = p; /* remember the colon */
57+
+ ++p;
58+
+ while (*p && isdigit((unsigned char)*p))
59+
+ ++p;
60+
+
61+
+ if (*p == ':') { /* confirmed alias */
62+
+ p = dot; /* rewind and copy it all */
63+
+
64+
+ /* copy the colon */
65+
+ if (dst < end)
66+
+ *dst++ = *p++;
67+
+
68+
+ /* copy the digits */
69+
+ while (*p && isdigit((unsigned char)*p) && dst < end)
70+
+ *dst++ = *p++;
71+
+
72+
+ if (*p == ':') /* consume trailing colon */
73+
+ ++p;
74+
+ } else { /* if so treat as normal */
75+
+ p = dot;
76+
+ }
77+
+ break; /* interface name ends here */
78+
+ }
79+
+
80+
+ *dst++ = *p++; /* ordinary character copy */
81+
}
82+
- *name++ = '\0';
83+
+
84+
+ *dst = '\0'; /* always NUL‑terminate */
85+
return p;
86+
}
87+

‎sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/net-tools/0002-fix-for-CVE-2025-46836.patch‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
From ddb0e375fb9ca95bb69335540b85bbdaa2714348 Mon Sep 17 00:00:00 2001
2+
From: Bernd Eckenfels <[email protected]>
3+
Date: Sat, 17 May 2025 21:53:23 +0200
4+
Subject: [PATCH] Interface statistic regression after 7a8f42fb2
5+
6+
---
7+
lib/interface.c | 5 ++---
8+
1 file changed, 2 insertions(+), 3 deletions(-)
9+
10+
diff --git a/lib/interface.c b/lib/interface.c
11+
index a054f12..ca4adf1 100644
12+
--- a/lib/interface.c
13+
+++ b/lib/interface.c
14+
@@ -239,12 +239,11 @@ static const char *get_name(char *name, const char *p)
15+
/* copy the digits */
16+
while (*p && isdigit((unsigned char)*p) && dst < end)
17+
*dst++ = *p++;
18+
-
19+
- if (*p == ':') /* consume trailing colon */
20+
- ++p;
21+
} else { /* if so treat as normal */
22+
p = dot;
23+
}
24+
+ if (*p == ':') /* consume trailing colon */
25+
+ ++p;
26+
break; /* interface name ends here */
27+
}
28+

‎sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-apps/net-tools/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Drop the CVE-2025-46836.patch when updating to a release >2.10, if
2+
that ever happens.

‎sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords‎

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,11 @@ dev-cpp/azure-security-keyvault-keys
6060

6161
# The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
6262
=dev-libs/jose-12 **
63+
64+
# CVE-2025-58050
65+
=dev-libs/libpcre2-10.46 ~amd64 ~arm64
66+
67+
# The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
6368
=dev-libs/luksmeta-9-r1 **
6469

6570
# Keep versions on both arches in sync.
@@ -85,21 +90,12 @@ dev-cpp/azure-security-keyvault-keys
8590
=net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
8691
=net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
8792

88-
# CVE-2025-54349, CVE-2025-54350, CVE-2025-54351
89-
=net-misc/iperf-3.19.1 ~amd64 ~arm64
90-
91-
# Keep versions on both arches in sync.
92-
=net-misc/ntp-4.2.8_p18-r1 ~arm64
93-
=net-nds/rpcbind-1.2.8 ~arm64
94-
9593
# Packages are in Gentoo but not expected to be used outside Flatcar, so they
9694
# are generally never stabilised. Thus an unusual form is used to pick up the
9795
# latest version of the package with the unstable keywords.
9896
sys-apps/azure-vm-utils
9997

10098
# Keep versions on both arches in sync.
101-
=sys-apps/iproute2-6.16.0 ~arm64
102-
=sys-apps/portage-3.0.68 ~arm64
10399
=sys-apps/zram-generator-1.2.1 ~arm64
104100
=sys-auth/sssd-2.9.7 ~arm64
105101
=sys-boot/mokutil-0.7.2 **

‎sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -167,10 +167,6 @@ sys-firmware/intel-microcode -split-ucode
167167
net-dns/bind gssapi
168168
net-dns/bind-tools gssapi
169169

170-
# Flatcar can't benefit from this performance boost for several reasons, the
171-
# main one being the use of binary packages.
172-
sys-kernel/dracut -dracut-cpio
173-
174170
# Avoid initrd bloat by using OpenSSL instead of gcrypt in systemd.
175171
# systemd-journal's FSS feature requires gcrypt, but Flatcar doesn't need it.
176172
sys-apps/systemd -gcrypt

‎sdk_container/src/third_party/portage-stable/app-arch/pixz/pixz-1.0.7-r1.ebuild‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Copyright 1999-2025 Gentoo Authors
22
# Distributed under the terms of the GNU General Public License v2
33

4-
EAPI=7
4+
EAPI=8
55

66
inherit flag-o-matic
77

0 commit comments

Comments
 (0)