summaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-extended
Commit message (Collapse)AuthorAgeFilesLines
* libblockdev: fix CVE-2025-6019Changqing Li2025-07-132-0/+32
| | | | | | | | | | | | | | | | | | | | | | CVE-2025-6019: A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks daemon, an "allow_active" user on a system may be able escalate to full root privileges on the target host. Normally, udisks mounts user-provided filesystem images with security flags like nosuid and nodev to prevent privilege escalation. However, a local attacker can create a specially crafted XFS image containing a SUID-root shell, then trick udisks into resizing it. This mounts their malicious filesystem with root privileges, allowing them to execute their SUID-root shell and gain complete control of the system. Refer: https://cdn2.qualys.com/2025/06/17/suse15-pam-udisks-lpe.txt Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* canutils: use https instead of git protocolBastian Krause2025-07-021-1/+1
| | | | | | | | The git server at git.pengutronix.de no longer supports the git protocol, so switch to https. Signed-off-by: Bastian Krause <bst@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libsocketcan: use https instead of git protocolBastian Krause2025-07-021-1/+1
| | | | | | | | The git server at git.pengutronix.de no longer supports the git protocol, so switch to https. Signed-off-by: Bastian Krause <bst@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: Fix CVE-2025-21605Vijay Anusuri2025-07-022-0/+63
| | | | | | | Upstream-Status: Backport from https://github.com/redis/redis/commit/42fb340ce426364d64f5dccc9c2549e58f48ac6f Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libmodbus: patch CVE-2024-10918Peter Marko2025-03-204-1/+518
| | | | | | | | | | | Pick commit mentioning the bug and two follow-up commits mentioning the first commit. Tested by running the test-suite (test starter scripts were copied from scarthgap version which has them working). Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dlt-daemon: fix CVE-2023-36321Yogita Urade2025-03-062-0/+33
| | | | | | | | | | | | | | | Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 wwas discovered to contain a buffer overflow via the component /shared/dlt_common.c. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-36321 Upstream patch: https://github.com/michael-methner/dlt-daemon/commit/8ac9a080bee25e67e49bd138d81c992ce7b6d899 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dlt-daemon: fix CVE-2022-39836 and CVE-2022-39837Yogita Urade2025-03-062-0/+252
| | | | | | | | | | | | | | | | | | | | | | | | CVE-2022-39836: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a heap-based buffer over-read of one byte. CVE-2022-39837: An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that crashes the process can be created. This is due to missing validation checks. There is a NULL pointer dereference. Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-39836 https://nvd.nist.gov/vuln/detail/CVE-2022-39837 Upstream patch: https://github.com/COVESA/dlt-daemon/commit/855e0017a980d2990c16f7dbf3b4983b48fac272 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix CVE-2024-51741Divya Chellam2025-02-092-0/+90
| | | | | | | | | | | | | | | | | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-51741 Upstream-patch: https://github.com/redis/redis/commit/15e212bf69de28d2b4585aa79cc2a40f49e4a94d Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix CVE-2024-46981Divya Chellam2025-02-094-0/+73
| | | | | | | | | | | | | | | | | | | | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote code execution. The problem is fixed in 7.4.2, 7.2.7, and 6.2.17. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-46981 Upstream-patch: https://github.com/redis/redis/commit/e344b2b5879aa52870e6838212dfb78b7968fcbf Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix CVE-2024-31449Divya Chellam2025-02-094-0/+100
| | | | | | | | | | | | | | | | | | | | Redis is an open source, in-memory database that persists on disk. An authenticated user may use a specially crafted Lua script to trigger a stack buffer overflow in the bit library, which may potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-31449 Upstream-patches: https://github.com/redis/redis/commit/1f7c148be2cbacf7d50aa461c58b871e87cc5ed9 https://github.com/redis/redis/commit/fe8de4313f85e0f8af2eff1f78b52cfe56fb4c71 Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix CVE-2024-31228Divya Chellam2025-02-094-0/+138
| | | | | | | | | | | | | | | | | | | | | Redis is an open source, in-memory database that persists on disk. Authenticated users can trigger a denial-of-service by using specially crafted, long string match patterns on supported commands such as `KEYS`, `SCAN`, `PSUBSCRIBE`, `FUNCTION LIST`, `COMMAND LIST` and ACL definitions. Matching of extremely long patterns may result in unbounded recursion, leading to stack overflow and process crash. This problem has been fixed in Redis versions 6.2.16, 7.2.6, and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. References: https://security-tracker.debian.org/tracker/CVE-2024-31228 Upstream-patch: https://github.com/redis/redis/commit/9317bf64659b33166a943ec03d5d9b954e86afb0 Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix CVE-2024-31227Divya Chellam2025-02-092-0/+34
| | | | | | | | | | | | | | | | | | Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem exists in Redis 7 prior to versions 7.2.6 and 7.4.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Reference: https://security-tracker.debian.org/tracker/CVE-2024-31227 Upstream-patch: https://github.com/redis/redis/commit/b351d5a3210e61cc3b22ba38a723d6da8f3c298a Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix CVE-2023-45145Divya Chellam2025-02-094-0/+146
| | | | | | | | | | | | | | | | | | | | | | | Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory. Reference: https://security-tracker.debian.org/tracker/CVE-2023-45145 Upstream-patch: https://github.com/redis/redis/commit/7f486ea6eebf0afce74f2e59763b9b82b78629dc Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix CVE-2023-41056Divya Chellam2025-02-092-0/+64
| | | | | | | | | | | | | | | | | Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-41056 Upstream-patch: https://github.com/redis/redis/commit/e351099e1119fb89496be578f5232c61ce300224 Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* p7zip: Fix CVE-2023-52169 and CVE-2023-52168hongxu2024-12-082-0/+456
| | | | | | | | | | | | | According to [1][2], Igor Pavlov, the author of 7-Zip, refused to provide an advisory or any related change log entries. Have to backport a part of ./CPP/7zip/Archive/NtfsHandler.cpp from upstream big commit https://github.com/ip7z/7zip/commit/fc662341e6f85da78ada0e443f6116b978f79f22 [1] https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/ [2] https://dfir.ru/wp-content/uploads/2024/07/screenshot-2024-07-03-at-02-13-40-7-zip-_-bugs-_-2402-two-vulnerabilities-in-the-ntfs-handler.png Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* indent: fix CVE-2024-0911hongxu2024-12-082-0/+124
| | | | | | | | | Backport a fix from upstream to resolve CVE-2024-0911 https://git.savannah.gnu.org/git/indent.git feb2b646e6c3a05018e132515c5eda98ca13d50d Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* p7zip: fix CVE-2018-5996 & CVE-2016-9296Zahir Hussain2024-02-073-0/+260
| | | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2018-5996 https://nvd.nist.gov/vuln/detail/CVE-2016-9296 Upstream patches: https://sources.debian.org/data/non-free/p/p7zip-rar/16.02-3/debian/patches/06-CVE-2018-5996.patch https://snapshot.debian.org/archive/debian-debug/20180205T215659Z/pool/main/p/p7zip/p7zip_16.02%2Bdfsg-6.debian.tar.xz Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* indent: fix CVE-2023-40305stable/kirkstone-nutYogita Urade2023-11-033-0/+8452
| | | | | | | | | | | GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. Reference: https://savannah.gnu.org/bugs/index.php?64503 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.0.12 -> 7.0.13Polampalli, Archana2023-09-2310-1/+1
| | | | | | | | | | | | | | | | | | | | | This release has only security and bug fixes. ChangeLog: https://github.com/redis/redis/releases/tag/7.0.13 Security Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-41053 $ git log --oneline 7.0.12..7.0.13 49dbedb1d (tag: 7.0.13, origin/7.0) Redis 7.0.13 0f14d3279 Fix sort_ro get-keys function return wrong key number (#12522) 4d67bb6af do not call handleClientsBlockedOnKeys inside yielding command (#12459) 37599fe75 Ensure that the function load timeout is disabled during loading from RDB/AOF and on replicas. (#12451) ea1bc6f62 Process loss of slot ownership in cluster bus (#12344) 646069a90 Skip test for sdsRemoveFreeSpace when mem_allocator is not jemalloc (#11878) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster@mvista.com>
* hwloc: fix CVE-2022-47022Soumya Sambu2023-09-062-1/+80
| | | | | | | | | | | | An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. References: https://nvd.nist.gov/vuln/detail/CVE-2022-47022 https://github.com/open-mpi/hwloc/issues/544 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libqb: upgrade 2.0.6 -> 2.0.8Narpat Mali2023-08-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 2.0.6 and 2.0.8 contains the CVE-2023-39976 fix and other bugfixes. git log --oneline shows: 002171b (HEAD, tag: v2.0.8, origin/main, origin/HEAD, main) Update library version for 2.0.8 1bbaa92 log: fix potential overflow with long log messages (#490) 92ddd7c test - fix test dependancies (#489) 06c8641 (tag: v2.0.7) Update -version info for 2.0.7 0665086 spec: Migrate to SPDX license (#487) 5862acb blackbox: fix potential overlow/memory corruption (#486) a3aedbc tests: allow -j to work (#485) 335dbb6 test: Remove gnu/lib-names.h from libstat_wrapper.c (#482) 4dcdfe9 strlcpy: avoid compiler warning from strncpy (#473) 1a32a60 Add --disable-tests option (#475) 10b0623 m4/ax_pthread.m4: update to latest upstream version (serial 31) (#472) e038f59 tests: Close race condition in check_loop (#480) fde729e timer: Move state check to before time check (#479) 5594d37 ipc: Retry receiving credentials if the the message is short (#476) e8129a3 add simplified chinese readme (#474) eaa95ec lib: Fix some small bugs spotted by newest covscan (#471) 14507d5 configure: Modernize configure.ac a bit (#470) 8325d84 tests: Fix tests on FreeBSD-devel (#469) e407874 doxygen2man: Fix function parameter alignment (#468) 0eb0991 tests: cleanup the last of the empty directories (#467) 44a4cb2 tests: Make ipc test more portable (#466) 758044b (tag: v2.0.6) test: Include ipc_sock.test in the libqb-tests rpm (#463) Release Notes: https://github.com/ClusterLabs/libqb/releases Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.0.11 -> 7.0.12Polampalli, Archana2023-08-0310-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | This release has only security and bug fixes. ChangeLog: https://github.com/redis/redis/releases/tag/7.0.12 Security Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-36824 https://nvd.nist.gov/vuln/detail/CVE-2022-24834 $ git log --oneline 7.0.11..7.0.12 8e73f9d34 (tag: 7.0.12, origin/7.0) Redis 7.0.12 f90ecfb1f Fix compile errors when building with gcc-12 or clang (partial #12035) bd1dac0c6 Fix possible crash in command getkeys (#12380) 25f610fc2 Use Reservoir Sampling for random sampling of dict, and fix hang during fork (#12276) eb64a97d3 Add missing return on -UNKILLABLE sent by master case (#12277) 2ba8de9d5 Fix WAIT for clients being blocked in a module command (#12220) 1d2839a83 Fix memory leak when RM_Call's RUN_AS_USER fails (#12158) c340fd5a3 Prevent repetitive backlog trimming (#12155) 88682ca30 Free backlog only if rsi is invalid when master reboot (#12088) f6a7c9f9e Lua cjson and cmsgpack integer overflow issues (CVE-2022-24834) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libyang: fix CVE-2023-26917Urade, Yogita2023-07-252-0/+41
| | | | | | | | | | | | libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse_mem.c. References: https://github.com/CESNET/libyang/issues/1987 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: use the files path correctlyChen Qi2023-06-1510-2/+0
| | | | | | | | | | | | | | | | | | | | | Recipes are not expected to set FILESPATH directly, they are expected to use FILESEXTRAPATH. I can see the seting of FILESPATH in this recipe only wants to find redis-7 specific patches and files. This could be easily achieved by using redis-7.0.11/ directory to hold all those files. Using FILESPATH in this way removes the possibility of overriding some files (e.g., the redis service file) from other layers via FILESEXTRAPATH:prepend, which is kind of a common practice and is actually working for basically all other recipes. This is because we have: meta/classes-global/base.bbclass:FILESPATH = "${@base_set_filespath(["${FILE_DIRNAME}/${BP}", "${FILE_DIRNAME}/${BPN}", "${FILE_DIRNAME}/files"], d)}" And FILESEXTRAPATH is handled in base_set_filespath. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libyang: backport a fix for CVE-2023-26916Natasha Bailey2023-06-032-0/+58
| | | | | | | | | | | | | This patch fixes a bug in libyang which could cause a null pointer dereference from a call to strcmp. Since this recipe includes ptests, the tests were run twice (once before the patch and once after) with the same results: all tests passing except utest_types, which is skipped. Signed-off-by: Natasha Bailey <nat.bailey@windriver.com> Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: fix do_patch fuzz warningChangqing Li2023-05-062-2/+2
| | | | | | | | | | | | | | Fix: WARNING: lib32-redis-7.0.4-r0 do_patch: Fuzz detected: Applying patch GNU_SOURCE.patch patching file src/zmalloc.c Hunk #1 succeeded at 32 with fuzz 2 (offset 4 lines). There are two version of redis, and need different GNU_SOURCE.patch Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.0.10 -> 7.0.11Changqing Li2023-04-281-1/+1
| | | | | Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.0.9 -> 7.0.10Changqing Li2023-04-281-1/+1
| | | | | | | | | | | | | | | | | | | Upgrade urgency: SECURITY, contains fixes to security issues. Security Fixes: * (CVE-2023-28425) Specially crafted MSETNX command can lead to assertion and denial-of-service Bug Fixes ========= * Large blocks of replica client output buffer may lead to psync loops and unnecessary memory usage (#11666) * Fix CLIENT REPLY OFF|SKIP to not silence push notifications (#11875) * Trim excessive memory usage in stream nodes when exceeding `stream-node-max-bytes` (#11885) * Fix module RM_Call commands failing with OOM when maxmemory is changed to zero (#11319) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 6.2.11 -> 6.2.12Changqing Li2023-04-281-1/+1
| | | | | Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dlt-daemon: fix CVE-2023-26257Urade, Yogita2023-04-132-0/+35
| | | | | | | | | | | | | An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8. Dynamic memory is not released after it is allocated in dlt-control-common.c. References: https://nvd.nist.gov/vuln/detail/CVE-2023-26257 https://github.com/COVESA/dlt-daemon/issues/440 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openwsman: Change download branch from master to main.Wang Mingyu2023-04-131-1/+1
| | | | | | Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* duktape: Add ptestNikhil R2023-04-042-1/+53
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The Ptest for duktape executes below tests: 1. hello - a helloworld example is basic compilation test that test the APIs - duk_get_top(), duk_push_c_function(), duk_eval_string() 2. eval - a very simple for evaluating expressions from command line which test the APIs - duk_push_string(), duk_insert(), duk_join(), duk_pop() 3. evloop - a basic eventloop implementation test that test the APIs - duk_is_object(), duk_compile() duk_push_c_function(), duk_safe_call() Test Summary: Execution time = 46 sec Signed-off-by: Nikhil R <nikhil.r@kpit.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3277a81937bee01437a7ca8634e0f056e318f21b) Signed-off-by: Nikhil R <nikhil.r@kpit.com> (cherry picked from commit 5f935c35de9ea620bcbf0d55b096b1a328563a8a) Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com> Signed-off-by: Nikhil R <nikhilar2410@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* jansson: whitelist CVE-2020-36325Marta Rybczynska2023-03-221-0/+3
| | | | | | | | | | | | | According to the upstream [1], the bug happens only if the programmer does not follow the API definition. [1] https://github.com/akheron/jansson/issues/548 Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit e0e79bbde23f17185cc59908fee97c0cea098428) [Fixup for Kirkstone context] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 6.2.8 -> 6.2.11Changqing Li2023-03-131-1/+1
| | | | | Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.0.7 -> 7.0.9Changqing Li2023-03-071-1/+1
| | | | | Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* liblockfile: fix do_install failure when ldconfig is not installedChangqing Li2023-03-052-0/+64
| | | | | | | | liblockfile do_install task will fail since syntax error when ldconfig is not installed on the host. Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: 7.0.5 -> 7.0.7Changqing Li2023-01-252-10/+12
| | | | | | | | | This upgrade include fix for CVE-2022-3647 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d869383b0f9848a07ab3d7fbb5b7f687dce7744a) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.0.4 to 7.0.5Changqing Li2023-01-251-1/+1
| | | | | | | Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c8d9407eec21e1eb3e34b66cac8d11fe13c6e63e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: 6.2.7 -> 6.2.8Changqing Li2023-01-252-7/+10
| | | | | | | This upgrade include fix for CVE-2022-3647 Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: build with USE_SYSTEMD=yes when systemd is enabledZheng Qiu2022-11-192-2/+7
| | | | | | | | | | | | | Compile redis with full systemd support when the chosen init system is systemd. Enabling systemd supervision allows redis to communicate the actual server status (i.e. "Loading dataset", "Waiting for master<->replica sync") to systemd, instead of declaring readiness right after initializing the server process. Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* polkit: refresh patchChen Qi2022-10-041-10/+10
| | | | | | Refresh patch to avoid QA issue about patch fuzz. Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
* libcec: fix runtime dependencies for ${PN}-examplesMartin Jansa2022-09-251-0/+3
| | | | | | | | | | | | | | | | | | | | | | * cec-client doesn't link with libcec, but uses LibCecInitialise to dlopen libcec, so do_package cannot add the runtime dependency automatically * fixes: root@rpi4:# cec-client -l libcec.so.6: cannot open shared object file: No such file or directory root@rpi4:# cecc-client -l libcec.so.6: cannot open shared object file: No such file or directory libcec.so.6: cannot open shared object file: No such file or directory libcec/6.0.2-r0 $ objdump -p ./build/src/cec-client/cec-client-6.0.2 | grep NEEDED NEEDED libncurses.so.5 NEEDED libtinfo.so.5 NEEDED libstdc++.so.6 NEEDED libgcc_s.so.1 NEEDED libc.so.6 Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* polkit: update patches for musl compilationMarta Rybczynska2022-08-074-63/+96
| | | | | | | | | | | | | | | | | | | | | | | Update the patch to make netgroup support optional to fit the commit merged upstream [1], update the other patch depending on one of the changes. Without this update, a compilation using duktape with musl fails with: | ../../../polkit-0.119/src/polkitbackend/polkitbackendduktapeauthority.c: In function 'js_polkit_user_is_in_netgroup': | ../../../polkit-0.119/src/polkitbackend/polkitbackendduktapeauthority.c:1039:7: warning: implicit declaration of function 'innetgr' [-Wimplicit-function-declaration] | 1039 | if (innetgr (netgroup, | | ^~~~~~~ The main patch has been split in two, to apply the duktape part only when duktape is applied. [1] https://gitlab.freedesktop.org/polkit/polkit/-/commit/b57deee8178190a7ecc75290fa13cf7daabc2c66 Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 271282b1a5579179241748d5f0bdb8d2ea013dd6) {Fixup for kirkstone content; exlude Ducktape chages] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* polkit: Add --shell /bin/nologin to polkitd userAkash Hadke2022-08-071-1/+1
| | | | | | | | | | polkitd user has default access to /bin/sh, add --shell /bin/nologin to remove default access to /bin/sh and avoid login through it. Signed-off-by: Akash Hadke <akash.hadke@kpit.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 7ca63e5454bd7cbdb5ac58f6b5913e3387b64201) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* polkit-group-rule-udisks2: fix override syntax in RDEPENDSYi Zhao2022-08-071-1/+1
| | | | | | | | | RDEPENDS_${PN} -> RDEPENDS:${PN} Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 10b508deacd8ff588b1511d077fcdd708deb653a) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* polkit: add udisks2 ruleVyacheslav Yurkov2022-08-072-0/+41
| | | | | | | | | | The rule allows non-priviledged users from plugdev group to mount/unmount block devices Signed-off-by: Vyacheslav Yurkov <v.yurkov@precitec.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d7ff4a77241fc79fc704a0d9d6b414b52f025531) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* redis: upgrade 7.0.2 -> 7.0.4wangmy2022-07-261-1/+1
| | | | | | | | | | | | | | | | | Changelog: ========== Upgrade urgency: SECURITY, contains fixes to security issues. Security Fixes: ---------------- (CVE-2022-31144) A specially crafted XAUTOCLAIM command on a stream key in a specific state may result with heap overflow, and potentially remote code execution. The problem affects Redis versions 7.0.0 or newer. Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d9f8d015a45188c3cf2d6841ea05319032930dbc) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* rsyslog: update 8.2202->8.2206Aryaman Gupta2022-07-211-1/+1
| | | | | | | | | | | | | | | | | | Package changes mainly include performance improvements to tcpsrv/imtcp, bug fixes and additional/updated tests: https://github.com/rsyslog/rsyslog/blob/master/ChangeLog ptest results for qemux86-64 with kvm and increasing filesystem space to 4GB using IMAGE_ROOTFS_EXTRA_SPACE : Version | Passed | Failed | Skipped 8.2202 | 456 | 0 | 5 8.2206 | 465 | 0 | 5 Signed-off-by: Aryaman Gupta <aryaman.gupta@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0f048c4c46fd4b377b7aacc236a23249ae05fdaa) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-oe: ignore patched CVEsDavide Gardenal2022-07-212-0/+8
| | | | | | | | | | | Some old CVEs don't have a vulnerable version range in the NVD database, this causes come mismatch with cve-check. Ignore many CVEs that are picked up by the class but are patched in our products. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit efa12676dd0676fd0aa63457d7ba360fe8a6fae2) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libplist: ignore patched CVEsDavide Gardenal2022-07-211-0/+6
| | | | | | | | | | | CVE-2017-5834, CVE-2017-5835 and CVE-2017-5836 are patched in our version of libplist but they don't have a vulnerable version range in the NVD database, that's why they need to be ignored. Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 261465eb6e2bd8f83e6841f8e42e1fb1be6d1499) Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 10:16:19 +0000