summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* gstreamer1.0: ignore CVEs fixed in plugins recipesPeter Marko2025-01-091-0/+13
| | | | | | | | | These were fixed in previous commits. (From OE-Core rev: 5c582778954a05f102e292a0516b73b010d289a0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: patch CVE-2024-47835Peter Marko2025-01-092-0/+40
| | | | | | | | | | Pick commit from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8039 (From OE-Core rev: e9113fafef9cb2f060c9728d1e1bebdd76baad47) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: patch several CVEsPeter Marko2025-01-098-0/+452
| | | | | | | | | | Pick commits from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8042 (From OE-Core rev: 4763e9911e82c886a02727bf654872280138d83e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: patch CVE-2024-47774Peter Marko2025-01-092-0/+47
| | | | | | | | | | Pick commit from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8043 (From OE-Core rev: cc560b159f6629bc018ce6d832551a81d4c3f8c8) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: patch CVE-2024-47606Peter Marko2025-01-092-0/+57
| | | | | | | | | | Pick commit related to gstreamer from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032 (From OE-Core rev: d68a84dd3419811ec7f487907d7412c6105979d0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: patch CVE-2024-47606Peter Marko2025-01-092-0/+45
| | | | | | | | | | Pick commit related to plugins-good from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8032 (From OE-Core rev: 30f2b1c6b10e064ce0f0f1910d2740e6ccc86251) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: patch CVE-2024-47600Peter Marko2025-01-092-0/+39
| | | | | | | | | | Pick commit from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8034 (From OE-Core rev: 13e66d4e616e66d278cd96bb04da4cc7e599626b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: patch CVE-2024-47599Peter Marko2025-01-092-0/+100
| | | | | | | | | | Pick commits from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8040 (From OE-Core rev: ba5545302daee0fb5ac2f3ca45cf8524cee278dc) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: patch CVE-2024-47542Peter Marko2025-01-092-0/+65
| | | | | | | | | | Pick commits from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8033 (From OE-Core rev: 8a0c3c92ec3bf150c0697d25c70ad149b2d82f0e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: patch CVE-2024-47541Peter Marko2025-01-093-0/+139
| | | | | | | | | | Pick commits from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8036 (From OE-Core rev: c81dae9e755d28eb514bfa32426ef2d8fff78e56) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: patch several CVEsPeter Marko2025-01-098-0/+335
| | | | | | | | | | | | | Pick commits from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8057 (From OE-Core rev: 4edd9caa9703e067167c4a185c7338c4e89f795b) Signed-off-by: Peter Marko <peter.marko@siemens.com> fixup! gstreamer1.0-plugins-good: patch CVE-2024-47540 and CVE-2024-47601 Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: patch CVE-2024-47613Peter Marko2025-01-092-0/+54
| | | | | | | | | | Pick commit from: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8041 (From OE-Core rev: 6236088fc43f7d2e8a01bb6e3937969ced8a7f6d) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: patch CVE-2024-47615Peter Marko2025-01-093-0/+250
| | | | | | | | | | Pick commits from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8038 (From OE-Core rev: fbf7092a67703ff3101cce55bf33bcfc24339503) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: patch CVE-2024-47607Peter Marko2025-01-092-0/+42
| | | | | | | | | | Pick commit from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8037 (From OE-Core rev: 0cdac58a6a7ec25404b8a67508604844d282345a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-base: patch CVE-2024-47538Peter Marko2025-01-092-0/+36
| | | | | | | | | | Pick commit from: * https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8035 (From OE-Core rev: e7dbf6d73a11e6e9ec16035711179f451044eb09) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-good: fix several CVEsPeter Marko2025-01-0914-1/+1261
| | | | | | | | | | | | | Cherry-pick commits from branch 1.22 per [1]. Also cherry-pick [2] so these apply cleanly. [1] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8059 [2] https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/62de06c7a443a5ac40ab2a4f2589625932bf9632 (From OE-Core rev: 33c2611c3998f25bf606b5a940c09b70ce04674c) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: add new tested distrosAntonin Godard2024-12-261-0/+4
| | | | | | | | | These are currently tested on the autobuilder for Scarthgap. (From meta-yocto rev: bd166d1fb8dc1bed7e71bd06b970a3da9149203e) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/bmaptool.rst: simplify and fix instructionsMichael Opdenacker2024-12-231-5/+4
| | | | | | | | | | | | | | | | | | | | | - Remove duplicate instructions - Detail how to run bmaptool directly if you installed it on your host instead of building it through the ``bmaptool-native`` recipe, as running "oe-run-native bmaptool-native bmaptool ..." won't work in this case. - Use "chmod a+w" instead of "chmod 666", better advice, and only run "chmod" in the option that runs "oe-run-native" (From yocto-docs rev: a1e4f18af6b0b10cece83c53ebb14052a0b94314) Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 4afa71ef6e5bf1db126c80e6d987f588d0b5a086) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual/bmaptool.rst: correct command for bmaptool-nativeMichael Opdenacker2024-12-231-1/+1
| | | | | | | | | | | | | | | | | | | Using only "bitbake bmaptool-native", running "oe-run-native bmaptool-native bmaptool ..." fails as follows: Error: Have you run 'bitbake bmaptool-native -caddto_recipe_sysroot'? Running the "bitbake bmaptool-native -caddto_recipe_sysroot" target is actually sufficient. (From yocto-docs rev: c43eea3875e265c8a62b9f7323365b8d740a39f8) Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 72fe904a3bbb5e2c7279ab1f119c2beca200dcf2) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dev-manual: fix styling of references to bmaptoolMichael Opdenacker2024-12-232-11/+11
| | | | | | | | | | | | | | | | | To follow the styling conventions when we are refering to the name of a tool instead of the command itself (documentation/standards.md). This also improves the HTML rendering of the bmaptools subsection. (From yocto-docs rev: 55146fae45e8c2de1d0f7242f1c89f3e165d77c9) Signed-off-by: Michael Opdenacker <michael.opdenacker@rootcommit.com> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit c569d840c4b6f43e10629b6f1ff45189211e27a9) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Update the documentation for SRCPVAntonin Godard2024-12-236-63/+47
| | | | | | | | | | | | | | | | | | | | | | | | The variable SRCPV is deprecated since 4.3. Instead of including SRCPV in PV, including the sign "+" is enough for bitbake to add the source control information to PKGV during the packaging phase. Update the documentation for SRCPV and the places where it was used. When instructions previously referred to SRCPV, replace by mentioning to include "+" in the assignment. In most examples, "+git" is added to PV as it is the most popular SCM. Simply adding "+" is also possible, although it is better practice to include the SCM name, so give that example. Update the gcompat example with l3afpad as it didn't include "+git" in its PV definition anymore. (From yocto-docs rev: ef4d259842d9b1dd2d08ee38e00f932852f70543) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit ee16c96202e5027d1a8d7e89e11c25f127c78326) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* rust: add reproducibility patch to eliminate host leakageAlexander Kanavin2024-12-232-0/+52
| | | | | | | | | | | | [YOCTO #15185] (From OE-Core rev: 01423828248b75e1f5afe2e5959ccd971df875cd) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 924df18b47e9a69fa295bafe37bdb39d8eaea2bb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: add dependency on -compression to -coreRoss Burton2024-12-231-1/+1
| | | | | | | | | | | | | | | | importlib.metadata is part of -core, but that will import zipfile which is part of -compression. Obviously this shows that our packaging of the Python modules is not optimal. I plan to follow up with a redesign of the splitting which focuses on simply pulling out the larger or esoteric modules and having a more featureful core. (From OE-Core rev: 05166eafb99cf8c7adb6879277069ab384a2f8df) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3: Drop empty patchKhem Raj2024-12-232-27/+0
| | | | | | | | | | | The fix brought by this patch is already part of python 3.12.3 therefore drop it. (From OE-Core rev: 555623d2378138fdcfae95c04e06ba384cebab5b) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Fix c++: tweak for Wrange-loop-constructSunil Dora2024-12-232-0/+114
| | | | | | | | | | | | | | | | | | | | This commit updates the warning to use a check for "trivially constructible" instead of "trivially copyable." The original check was incorrect, as "trivially copyable" only applies to types that can be copied trivially, whereas "trivially constructible" is the correct check for types that can be trivially default-constructed. This change ensures the warning is more accurate and aligns with the proper type traits. LLVM accepted a similar fix: https://github.com/llvm/llvm-project/issues/47355 PR c++/116731 [https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116731] (From OE-Core rev: 614a8e3a06003dfcbf1f32dc2d6f4d18f74b71a4) Signed-off-by: Marek Polacek <polacek@redhat.com> Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35368Archana Polampalli2024-12-232-0/+42
| | | | | | | | | | FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. (From OE-Core rev: 53528caafa576a2f6417436cc0dba8be06e75048) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35367Archana Polampalli2024-12-232-0/+48
| | | | | | | | | | FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer (From OE-Core rev: 64d77d422d3c99d8a246ab03edfb54d9d185326e) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-35366Archana Polampalli2024-12-232-0/+36
| | | | | | | | | | | | FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking. (From OE-Core rev: a07bc254011736c0f0445607c56609be677ea8a7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* subversion: fix CVE-2024-46901Jiaying Song2024-12-232-1/+163
| | | | | | | | | | | | | | | | | | | | | | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected. References: https://nvd.nist.gov/vuln/detail/CVE-2024-46901 Upstream patches: https://subversion.apache.org/security/CVE-2024-46901-advisory.txt (From OE-Core rev: 16c212bd9a9e9c35256ff308da72a518c76ce11d) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2024-53589Yash Shinde2024-12-232-0/+93
| | | | | | | | | | | | | | | | A buffer overflow vulnerability exists in GNU Binutils’ objdump utility when processing tekhex format files. The vulnerability occurs in the Binary File Descriptor (BFD) library’s tekhex parser during format identification. Specifically, the issue manifests when attempting to read 8 bytes at an address that precedes the global variable ‘_bfd_std_section’, resulting in an out-of-bounds read. Backport a patch from upstream to fix CVE-2024-53589. Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=e0323071916878e0634a6e24d8250e4faff67e88] (From OE-Core rev: 15635eb807ea1cbf0fd04e0cbe9cf169df107a05) Signed-off-by: Yash Shinde <Yash.Shinde@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* system-requirements.rst: add dependencies for pdf buildsAntonin Godard2024-12-182-3/+76
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the recent changes from commit bd6265ca323fac547a197bb516dc4a9ef3897508 ("doc: Makefile: add support for xelatex"), the list of dependencies needs to be updated. The initial list of dependencies was made for Ubuntu/Debian, and the packages were translated for the other distros using pkgs.org. Add them separately from the rest of the dependencies as they pull a _lot_ of additional dependencies (for LaTeX). Move the texlive-fncychap documentation dependency to the PDF specific dependency. Notes: - Fedora/OpenSUSE do not have the "lang-all" texlive collection, so install all available languages. - AlmaLinux does not seem to provide texlive-collection-fontsextra, texlive-collection-lang*, and texlive-collection-latexextra, so add a warning about that. (From yocto-docs rev: 804240fa86fee63d0d2dd029d941cf14b23bd730) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 02c090718ac602f7d4760dd28dadbf0631668d49) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* system-requirements: update list of supported distrosAntonin Godard2024-12-181-0/+2
| | | | | | | | | | | To match the list in meta-poky/conf/distro/poky.conf. (From yocto-docs rev: 74639cae135e254814c350f01f6e333d6d764fe9) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit c9c3f6896e4bc967a9b394574532735babb70397) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* system-requirements: add fedora 39 to supported distrosAntonin Godard2024-12-181-0/+2
| | | | | | | | | (From yocto-docs rev: 7b829845aa5a06bdcad0005fc44b24e2757a3d84) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit dc7fd0e56fbfed77975f6b4ed2106331476ef7f3) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.yaml.in: replace inkscape dependency by librsvg2-binAntonin Godard2024-12-181-4/+4
| | | | | | | | | | | | | inkscape used to be a requirement to convert SVG images to PNGs/PDFs, but we replaced it recently by rsvg-convert. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> (From yocto-docs rev: 19e18d3019209e9789461502bc5147856faef9c3) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 8c0bb4e41c203a0a7a31c2bdc26834d87a83413a) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.yaml.in: add missing locales dependencyAntonin Godard2024-12-181-0/+4
| | | | | | | | | | | | | | | | | This is a requirement for building the documentation, otherwise we get (on Ubuntu 24.04): File "/usr/lib/python3.12/locale.py", line 615, in setlocale return _setlocale(category, locale) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ locale.Error: unsupported locale setting (From yocto-docs rev: 1b0353a230dce361fe29d4d184aebd9af28a9937) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 0943a7b67ef0012b5d9badc15e0c579dbb9014ae) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Gather dependencies in poky.yaml.inAntonin Godard2024-12-183-35/+202
| | | | | | | | | | | | | | | | | | | We used to have packages here and there in system-requirements.rst for each distro. Instead, gather all the dependencies in poky.yaml.in so we have an overview of what we provide for each distro. Use yaml ">" to list the dependencies in alphabetical order, one entry per line, which makes them easier to read and compare among distros. Rename UBUNTU_… variables to UBUNTU_DEBIAN_…, since these are used for both distros. (From yocto-docs rev: 33c0656706f5110381681b212877d39ec2148cc6) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 1ed6118b7cf1b5dcbfca753c83fa30fb97bf44ad) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ref-manual: use standardized method accross both ubuntu and debian for ↵Guénaël Muller2024-12-182-2/+18
| | | | | | | | | | | | | | | | | | locale install Modify locale installation method to be standard accross all debian-based distributions. Pre-existing method is available only on Ubuntu, locale-gen tool has no parameter in Debian. (From yocto-docs rev: 70212d4780df6b7b74bd5c428d71b49d9a91c403) Signed-off-by: Guénaël Muller <guenael.muller@smile.fr> Reviewed-by: Yoann Congal <yoann.congal@smile.fr> Reviewed-by: Antonin Godard <antonin.godard@bootlin.com> Tested-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> (cherry picked from commit 30002019198a168e48537407bb928facb26af82a) Signed-off-by: Antonin Godard <antonin.godard@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-update-nvd2-native: Tweak to work better with NFS DL_DIRRichard Purdie2024-12-181-0/+2
| | | | | | | | | | | | | | | | | After much debugging, the corruption issues on the autobuilder appear to be due to the way sqlite accesses database files. It doesn't change the file timestamp after making changes, which for reasons unknown, confuses NFS. As soon as the file is touched, NFS becomes fine again accross the whole cluster, as if by magic. We could try and debug further but putting a "touch" call into the code is easy and harmless. Lets hope this removes this annoying source of errors. (From OE-Core rev: b19b1e905d966443c4e4d17dfaeb299ae2526575) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to scarthgap head revisionyocto-5.0.6scarthgap-5.0.6Steve Sakoman2024-12-131-1/+1
| | | | | | (From OE-Core rev: 336eec6808710f260a5336ca8ca98139a80ccb14) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 5.0.6Steve Sakoman2024-12-131-1/+1
| | | | | | (From meta-yocto rev: e9b828fdf46d3b3ad6ccd51710845bdfd29357bb) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sanity: check for working user namespacesRoss Burton2024-12-131-0/+24
| | | | | | | | | | | | | | | | | | If user namespaces are not available (typically because AppArmor is blocking them), alert the user. We consider network isolation sufficiently important that this is a fatal error, and the user will need to configure AppArmor to allow bitbake to create a user namespace. [ YOCTO #15592 ] (From OE-Core rev: 3577ceca39c7c3be81563de9ccf06a805f61d3ca) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b6af956fe6e876957a49d4abf425e8c789bf0459) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dnf: drop python3-iniparse from DEPENDS and RDEPENDSGuðni Már Gilbert2024-12-131-2/+1
| | | | | | | | | | | | | | | python3-iniparse dependency was dropped 2019, see the following commit as reference: https://github.com/rpm-software-management/dnf/pull/1329/commits/d7d0e0e2f9d8c7d021c794821ad0b56a39ebc01f When looking at the Git history, this happened around tag 4.2.1 (From OE-Core rev: 3273ace1e5e4b0573ceaa44f2710f651db9ae525) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-poetry-core: drop python3-six from RDEPENDSGuðni Már Gilbert2024-12-131-1/+0
| | | | | | | | | | | | | | | | Looking at the history, python3-six was removed as a dependency in the poetry.lock file in v1.5.2 Even before v1.5.2 and until now (v1.9.1) there is no code in the package which imports the six module. So it can be safely dropped from the recipe. (From OE-Core rev: 09378088bba46b6e505f69381496da0ecd0ecf2c) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd-boot: drop intltool-native from DEPENDSGuðni Már Gilbert2024-12-131-1/+1
| | | | | | | | | | | | intltool was dropped as a dependency in v236 See commit for reference: https://github.com/systemd/systemd/pull/7313/commits/c81217920effddc93fb780cf8f9eb699d6fe1319 (From OE-Core rev: fffffc22e9cdfee5afe05baadaae941785f5a18b) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: drop intltool-native from DEPENDSGuðni Már Gilbert2024-12-131-1/+1
| | | | | | | | | | | | intltool was dropped as a dependency in v236 See commit for reference: https://github.com/systemd/systemd/pull/7313/commits/c81217920effddc93fb780cf8f9eb699d6fe1319 (From OE-Core rev: 60e6fd2b7e3adfbe4260cd266dbe245c745344a9) Signed-off-by: Guðni Már Gilbert <gudni.m.g@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: fix CVE-2024-10041Divya Chellam2024-12-132-0/+99
| | | | | | | | | | | | | | | | | | | | | A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. References: https://security-tracker.debian.org/tracker/CVE-2024-10041 Upstream patches: https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be (From OE-Core rev: 0e76d9bf150ac3bf96081cc1bda07e03e16fe994) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: set CVE-2024-6505 to fixedPeter Marko2024-12-131-0/+3
| | | | | | | | | | | | | | | | | CVE patch was removed on last upgrade as fixing commit was backported to stable 8.2.x branch. NVD DB has this CVE as version-less (with "-"). So explicit status set is needed to mark it as fixed. (From OE-Core rev: 64359ec3b60ae68d39c2e6444f903fd20e397cff) (From OE-Core rev: 33050bf82add43409675122a8f29acbcda4e8439) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2024-7055Archana Polampalli2024-12-132-0/+39
| | | | | | | | | | | | | | A vulnerability was found in FFmpeg up to 7.0.1. It has been classified as critical. This affects the function pnm_decode_frame in the library /libavcodec/pnmdec.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.0.2 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-273651. (From OE-Core rev: 71a9c2d01ad8ed83f9da6e6b9541fcf1d9baed48) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-49528Archana Polampalli2024-12-132-0/+59
| | | | | | | | | | | Buffer Overflow vulnerability in FFmpeg version n6.1-3-g466799d4f5, allows a local attacker to execute arbitrary code and cause a denial of service (DoS) via the af_dialoguenhance.c:261:5 in the de_stereo component. (From OE-Core rev: a5e0e1f8be3c6611c09158c80e26848ae3d4f4e7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix CVE-2023-50007Archana Polampalli2024-12-132-0/+79
| | | | | | | | | | | Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via theav_samples_set_silence function in the libavutil/samplefmt.c:260:9 component. (From OE-Core rev: b63ba0bff9e5b5e73d50b2b3ff805418fa98d7e5) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-05 05:23:55 +0000