summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* pypi.bbclass: Set CVE_PRODUCT to PYPI_PACKAGEAlex Kiernan2023-05-251-0/+2
| | | | | | | | | | | | | | The CVE product name for PyPI packages is (usually) the same as the PyPI package name (and not our recipe name), so use that as the default. (From OE-Core rev: 1c37b96cd4fdfad21bf24b8b883e371c3bca56de) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 61f6b0ad09bf87cdc2d3f08770b7c44cad1d0e58) Signed-off-by: Sanjay Chitroda <schitrod@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: ammend fix for CVE-2023-27534 to fix error when ssh is enabledSiddharth2023-05-253-106/+68
| | | | | | | | | | | | | | | | | | The upstream patch for CVE-2023-27534 does three things: 1) creates new path with dynbuf(dynamic buffer) 2) solves the tilde error which causes CVE-2023-27534 3) modifies the below added functionality to not add a trailing "/" to the user home dir if it already ends with one with dynbuf. dynbuf functionalities are added in curl in later versions and are not essential to fix the vulnerability but does add extra feature in later versions. This patch completes the 3rd task of the patch which was implemented without using dynbuf Upstream-Status: Backport from [https://github.com/curl/curl/commit/6c51adeb71da076c5c40a45e339e06bb4394a86b] (From OE-Core rev: df489f644e41108cf0e2ff55af7ce5e9bca40471) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2023-25652Hitendra Prajapati2023-05-252-0/+95
| | | | | | | | | | | | | | | | | | | | | | | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. References: https://nvd.nist.gov/vuln/detail/CVE-2023-25652 Upstream-Status: Backport from https://github.com/git/git/commit/9db05711c98efc14f414d4c87135a34c13586e0b (From OE-Core rev: 6747482316b8f7839a09bf041d8c11b559f84b44) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2023-29007Hitendra Prajapati2023-05-252-0/+160
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29007 Upstream patches: https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4 https://github.com/git/git/commit/29198213c9163c1d552ee2bdbf78d2b09ccc98b8 https://github.com/git/git/commit/a5bb10fd5e74101e7c07da93e7c32bbe60f6173a https://github.com/git/git/commit/e91cfe6085c4a61372d1f800b473b73b8d225d0d https://github.com/git/git/commit/3bb3d6bac5f2b496dfa2862dc1a84cbfa9b4449a (From OE-Core rev: db4c152441aebe4c04a7bb7aceb88d8941a6576b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* run-postinsts: Set dependency for ldconfig to avoid boot issuesArturo Buzarra2023-05-161-1/+1
| | | | | | | | | | | | | | | | | | | | | If a package with a postsints script requires ldconfig, the package class adds a ldconfig postinst fragment to initialize it before. Systemd has its own ldconfig.service to initialize it and sometimes if both services are running at the same time in the first boot, the first one will work, but the second one will fail with the following error: ldconfig[141]: /sbin/ldconfig: Renaming of /etc/ld.so.cache~ to /etc/ld.so.cache failed: No such file or directory This commit adds a ordering dependency between them to make sure that only one service is running at the same time. (From OE-Core rev: 1bc254e7969f3d5470bacf9ad9f065d38b7b7fde) Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e9d812e127dc6743f52f4881e509e8e2e833afe) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libbsd: Add correct license for all packagesRanjitsinh Rathod2023-05-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | BSD-4-Clause is only applicable to the {PN}-doc package as when I check for the source code I find below files which only uses the license BSD-4-Clause ~/sources/libbsd$ grep -rl "All advertising materials mentioning features or use of this software" *|grep -v \.1|grep -v \.5|grep -v \.8 | sort COPYING man/arc4random.3bsd man/getprogname.3bsd man/tree.3bsd ~/sources/libbsd$ grep -rnB6 "BSD-4" COPYING-9-Files: COPYING-10- man/arc4random.3bsd COPYING-11- man/tree.3bsd COPYING-12-Copyright: COPYING-13- Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de> COPYING-14- All rights reserved. COPYING:15:License: BSD-4-clause-Niels-Provos (From OE-Core rev: 187f1588240a0eb5cc753c2114fd6c0cef66e14f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-yocto: Exclude 294 CVEs already fixed upstreamYoann Congal2023-05-162-0/+1843
| | | | | | | | | | | | | Exclude CVEs that are fixed in current linux-yocto version v5.4.237. To get the commit fixing a CVE, I used the Debian kernel-sec repo [1]. [1]: https://salsa.debian.org/kernel-team/kernel-sec/-/commit/86d5040aee9275f9555458fcaf9cb43710dff398 (From OE-Core rev: ec0f3e5869c596a308a164f93cb031e04034a8ed) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* connman: Fix CVE-2023-28488 DoS in client.cAshish Sharma2023-05-162-0/+55
| | | | | | | | | | | | | | | Avoid overwriting the read packet length after the initial test. Thus move all the length checks which depends on the total length first and do not use the total lenght from the IP packet afterwards. Fixes CVE-2023-28488 Reported by Polina Smirnova <moe.hwr@gmail.com> (From OE-Core rev: 47a9ae5592392bd10740e4571b06c8c739705058) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2023-28484 and CVE-2023-29469Peter Marko2023-05-163-0/+123
| | | | | | | | | | | Backports from: * https://gitlab.gnome.org/GNOME/libxml2/-/commit/e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68 * https://gitlab.gnome.org/GNOME/libxml2/-/commit/547edbf1cbdccd46b2e8ff322a456eaa5931c5df (From OE-Core rev: c0cfcd3945257efd40745e0ebb84495441acb590) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* freetype: fix CVE-2023-2004 integer overflowin in tt_hvadvance_adjust() in ↵Vivek Kumbhar2023-05-162-0/+41
| | | | | | | | | | | src/truetype/ttgxvar.c Fix An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c (From OE-Core rev: 24c87e674db9c1d4a8922c3af78a0004c061e70f) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Security fix for CVE-2023-24538Shubham Kulkarni2023-05-164-0/+532
| | | | | | | | | | | html/template: disallow actions in JS template literals Backport from https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b (From OE-Core rev: c8a597b76505dab7649f4c9b18e1e14b0e3d57af) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.25dunfell-23.0.25Steve Sakoman2023-05-031-1/+1
| | | | | | (From OE-Core rev: fd4cc8d7b5156c43d162a1a5a809fae507457ef4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* poky.conf: bump version for 3.1.25Steve Sakoman2023-05-031-1/+1
| | | | | | (From meta-yocto rev: 0faaa6c13564565a5fe7f7ff00000c146c511cc4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* documentation: update for 3.1.25Steve Sakoman2023-05-031-5/+5
| | | | | | | | (From yocto-docs rev: 19b7932e6af89943b899687c1f5cb91181cd3580) Signed-off-by: Steve Sakoman <steve@sakoman.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* populate_sdk_base: add zip optionsChristoph Lauer2023-05-031-1/+3
| | | | | | | | | | | | | Add SDK_ZIP_OPTIONS to remove symbolic link creation in zip archive or add options, e.g. for encryption of the zip archive. (From OE-Core rev: 04b62f9459b401c276255f166d0738b6f902a576) (From OE-Core rev: b9e0c3ced645cab74b2488a26b8f656a94b2a6f5) Signed-off-by: Christoph Lauer <christoph.lauer@xtronic.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24534 denial of service from excessive memory allocationVivek Kumbhar2023-05-032-0/+201
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A parsed MIME header is a map[string][]string. In the common case, a header contains many one-element []string slices. To avoid allocating a separate slice for each key, ReadMIMEHeader looks ahead in the input to predict the number of keys that will be parsed, and allocates a single []string of that length. The individual slices are then allocated out of the larger one. The prediction of the number of header keys was done by counting newlines in the input buffer, which does not take into account header continuation lines (where a header key/value spans multiple lines) or the end of the header block and the start of the body. This could lead to a substantial amount of overallocation, for example when the body consists of nothing but a large block of newlines. Fix header key count prediction to take into account the end of the headers (indicated by a blank line) and continuation lines (starting with whitespace). Thanks to Jakob Ackermann (@das7pad) for reporting this issue. Fixes CVE-2023-24534 For #58975 Fixes #59267 (From OE-Core rev: daa6aa9c7198a07322f1828a9db457fec86191cf) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Security fix CVE-2023-27533, CVE-2023-27535 and CVE-2023-27536Vijay Anusuri2023-05-035-0/+524
| | | | | | | | | Upstream-Status: Backport [https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches?h=ubuntu/focal-security & https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684 & https://github.com/curl/curl/commit/ed5095ed94281989e103c72e032200b83be37878 & https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c & https://github.com/curl/curl/commit/8f4608468b890dce2dad9f91d5607ee7e9c1aba1 & https://github.com/curl/curl/commit/cb49e67303dbafbab1cebf4086e3ec15b7d56ee5] (From OE-Core rev: 08ffa2437967a642a4c8e35e2158bb369454764a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Whitelist CVE-2023-0664Virendra Thakur2023-05-031-0/+5
| | | | | | | | | | | This CVE is related to Windows. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0664 (From OE-Core rev: 8efb0fc7e7db4bad3dbc40d8f890a6c2e7be38fa) Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Fix CVE-2023-0466Omkar Patil2023-05-032-0/+83
| | | | | | | | | | | | Add patch to fix CVE-2023-0466 Link: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a (From OE-Core rev: a80d772593b3a38c062e546557d5f8d76eb71fe4) Signed-off-by: Omkar Patil <omkar.patil@kpit.com> Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Fix CVE-2023-0465Omkar Patil2023-05-032-0/+61
| | | | | | | | | | | | Add patch to fix CVE-2023-0465 Link: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95 (From OE-Core rev: cbca55301bb065a6506e65cf64cc90b598e39789) Signed-off-by: Omkar Patil <omkar.patil@kpit.com> Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Fix CVE-2023-0464Nikhil R2023-05-032-0/+227
| | | | | | | | | | | | | | | | | | | Fix CVE-2023-0464 for openssl A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service(DoS) attack on affected systems. Link: https://git.openssl.org/gitweb/?p=openssl.git;a=patch;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b (From OE-Core rev: 0c50550e2c8fca3263776c2bb985a8c58b920b99) Signed-off-by: Nikhil R <nikhil.r@kpit.com> Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Ignore CVE-2022-1705Shubham Kulkarni2023-05-031-0/+3
| | | | | | | | | | | | The vulnerability was introduced in go1.15beta1 with commit d5734d4. Dunfell uses go1.14 version which does not contain the affected code. Ref: https://security-tracker.debian.org/tracker/CVE-2022-1705 (From OE-Core rev: 6e4a952efc94a3bb94216db1cbd738f4fb70217f) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: Security fix for CVE-2023-28486 and CVE-2023-28487Vijay Anusuri2023-05-033-0/+674
| | | | | | | | | | | | | | import patches from ubuntu to fix CVE-2023-28486 CVE-2023-28487 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/sudo/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca & https://github.com/sudo-project/sudo/commit/12648b4e0a8cf486480442efd52f0e0b6cab6e8b] (From OE-Core rev: 4870543273bef9831c075ee0bce108c54355a92f) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bitbake: tests/fetch.py: fix link to project documentationSteve Sakoman2023-05-021-1/+1
| | | | | | | (Bitbake rev: e16a9ca7e9286790ac37a067fdc8fde3a35a1c44) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2023-24537 Infinite loop in parsingVivek Kumbhar2023-04-262-0/+77
| | | | | | | | | | | | | Setting a large line or column number using a //line directive can cause integer overflow even in small source files. Limit line and column numbers in //line directives to 2^30-1, which is small enough to avoid int32 overflow on all reasonbly-sized files. (From OE-Core rev: d1943e6a0ec00653c81cd4c0bb0d6b7e0909094c) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Security fix for CVE-2020-29510Shubham Kulkarni2023-04-262-0/+66
| | | | | | | | | | | encoding/xml: replace comments inside directives with a space Backport from https://github.com/golang/go/commit/a9cfd55e2b09735a25976d1b008a0a3c767494f8 (From OE-Core rev: 76d855f3d2c250ac85ca6f24bf0e178fb32607f9) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* screen: CVE-2023-24626 allows sending SIGHUP to arbitrary PIDsHitendra Prajapati2023-04-262-0/+41
| | | | | | | | | Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/screen.git/commit/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7 (From OE-Core rev: d1f99b928b0a57bec879dde1b1b94c3c09286ea0) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2022-41716Peter Marko2023-04-261-0/+3
| | | | | | | | | | | | | | This CVE is specific to Microsoft Windows, ignore it. Patch fixing it (https://go-review.googlesource.com/c/go/+/446916) also adds a redundant check to generic os/exec which could be backported but it should not be necessary as backport always takes a small risk to break old code. (From OE-Core rev: 4263f3fda59aacb4f159d2dffb52e5f66249b5e4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: Fix CVE-2023-26604rajmohan r2023-04-265-0/+597
| | | | | | | | | | | | | | | | | | | | | | | | Below patch files to fix CVE-2023-26604 CVE-2023-26604-1.patch, CVE-2023-26604-2.patch and CVE-2023-26604-3.patch and CVE-2023-26604-4.patch make pager secure when under euid is changed or explicitly requested Reference: CVE-2023-26604-1.patch: https://github.com/systemd/systemd/pull/17270/commits/612ebf6c913dd0e4197c44909cb3157f5c51a2f0 CVE-2023-26604-2.patch: https://github.com/systemd/systemd/pull/17270/commits/1b5b507cd2d1d7a2b053151abb548475ad9c5c3b CVE-2023-26604-3.patch: https://github.com/systemd/systemd/pull/17270/commits/0a42426d797406b4b01a0d9c13bb759c2629d108 CVE-2023-26604-4.patch: https://github.com/systemd/systemd/pull/17359/commits/b8f736b30e20a2b44e7c34bb4e43b0d97ae77e3c (From OE-Core rev: 7880eb801dcee44a9e8920d249057492d1de6b12) Signed-off-by: rajmohan r <rajmohan.r@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41722Shubham Kulkarni2023-04-263-0/+159
| | | | | | | | | | | path/filepath: do not Clean("a/../c:/b") into c:\b on Windows Backport from https://github.com/golang/go/commit/bdf07c2e168baf736e4c057279ca12a4d674f18c (From OE-Core rev: 70135bf04eb7173434a7240ddf11639d13aab003) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27538 fix SSH connection too eager reuseHitendra Prajapati2023-04-262-0/+32
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb (From OE-Core rev: b2740d1ff74b2c55011b5d4230c7b06b5109376d) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27534 SFTP path ~ resolving discrepancyHitendra Prajapati2023-04-192-0/+124
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/4e2b52b5f7a3bf50a0f1494155717b02cc1df6d6 (From OE-Core rev: 9aefb4e46cf4fbf14b46f9adaf3771854553e7f3) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: CVE-2023-28756 ReDoS vulnerability in TimeHitendra Prajapati2023-04-192-0/+62
| | | | | | | | | Upstream-Status: Backport from https://github.com/ruby/ruby/commit/957bb7cb81995f26c671afce0ee50a5c660e540e (From OE-Core rev: 52d26edffdd0444588ecad56b40a65e225889a01) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix build error introduced by CVE-2021-3929 fixGaurav Gupta2023-04-194-15/+221
| | | | | | | | | | | | | | | | | | | | | | The patch for CVE-2021-3929 applied on dunfell returns a value for a void function. This results in the following compiler warning/error: hw/block/nvme.c:77:6: error: void function 'nvme_addr_read' should not return a value [-Wreturn-type] return NVME_DATA_TRAS_ERROR; ^ ~~~~~~~~~~~~~~~~~~~~ In newer versions of qemu, the functions is changed to have a return value, but that is not present in the version of qemu used in “dunfell”. Backport some of the patches to correct this. (From OE-Core rev: 4ad98f0b27615ad59ae61110657cf69004c61ef4) Signed-off-by: Gaurav Gupta <gauragup@cisco.com> Signed-off-by: Gaurav Gupta <gauragup@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix for CVE-2022-3341Bhabu Bindu2023-04-192-0/+68
| | | | | | | | | | | | | | | | | | | avformat/nutdec: Add check for avformat_new_stream Check for failure of avformat_new_stream() and propagate the error code. Upstream-Status: Backport [https://git.yoctoproject.org/poky/commit/?h=kirkstone&id=bba70ce34115151362bfdc49a545ee708eb297ca] (From OE-Core rev: e17ddd0fafb562ed7ebe7708dac9bcef2d6cecc1) (From OE-Core rev: 0c68435a7c0ff1c417119dbd408e75443c09afcb) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bba70ce34115151362bfdc49a545ee708eb297ca) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bmap-tools: switch to main branchMartin Jansa2023-04-141-1/+1
| | | | | | | | | | | | | | | | | | | | * master branch was removed upstream: downloads/git2/github.com.intel.bmap-tools $ git remote prune origin Pruning origin URL: https://github.com/intel/bmap-tools * [pruned] refs/heads/master * [pruned] refs/pull/73/merge * downloads/git2/github.com.intel.bmap-tools $ git branch -a --contains c0673962a8ec1624b5189dc1d24f33fe4f06785a main release-3.0 (From OE-Core rev: 4045bf02bbc6e87a05ba689a63c675e49c940772) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 369fee186d6916322b9be9d936b654d0c5910cb3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.1403 -> 9.0.1429Randy MacLeod2023-04-141-2/+2
| | | | | | | | | | | | Fixes: CVE-2023-1127, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264, CVE-2023-1355 (From OE-Core rev: 821229f48f5b31aeb646f08c7e4656dc4ce8b0f4) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2415072c3800feb164dd4d1fa0b56bd141a5cbd8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: Fix false negative version issueGeoffrey GIRY2023-04-143-1/+60
| | | | | | | | | | | | | | | | NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. [YOCTO #14127] Reviewed-by: Yoann CONGAL <yoann.congal@smile.fr> (From OE-Core rev: eb439b1283b60e6665694ff28c89fbd633eda6b0) Signed-off-by: Geoffrey GIRY <geoffrey.giry@smile.fr> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7d00f6ec578084a0a0e5caf36241d53036d996c4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix compile error which imported by CVE-2022-4144Hitendra Prajapati2023-04-142-0/+237
| | | | | | | | | Upstream-Status: Backport from https://github.com/qemu/qemu/commit/61c34fc && https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f (From OE-Core rev: d17f4c741c66268ce54ff89be2be9b0402c98df2) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: Security fix for CVE-2023-22490 and CVE-2023-23946Vijay Anusuri2023-04-145-0/+643
| | | | | | | | | | | | | Upstream-Status: Backport from https://github.com/git/git/commit/58325b93c5b6212697b088371809e9948fee8052 & https://github.com/git/git/commit/cf8f6ce02a13f4d1979a53241afbee15a293fce9 & https://github.com/git/git/commit/bffc762f87ae8d18c6001bf0044a76004245754c (From OE-Core rev: 071fb3b177bcbdd02ae2c28aad97af681c091e42) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41723Shubham Kulkarni2023-04-142-0/+157
| | | | | | | | | | | | Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. Backport from https://github.com/golang/go/commit/5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3 (From OE-Core rev: 53a303fb5908edaf29e35abb08fff93e7c0ff92c) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-23916 HTTP multi-header compression denial of serviceHitendra Prajapati2023-04-142-0/+232
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9 (From OE-Core rev: b121b59cf6f642f46c97c96f3c4cf4cd84ff2af5) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes/package: Use gzip for extended package dataJoshua Watt2023-04-012-8/+6
| | | | | | | | | | | | | The master version of extended package data uses zstd for efficient compression, but it relies on the zstd tool to be present on the host system. Since dunfell supports older distros, we don't want to add this tool as an additional requirement so switch to using gzip instead. (From OE-Core rev: 1c7d555379c4b0962bccd018870989050d87675f) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* create-spdx: Use gzip for compressionJoshua Watt2023-04-011-11/+9
| | | | | | | | | | | | | The master version of the SPDX classes uses zstd for efficient compression, but it relies on the zstd tool to be present on the host system. Since dunfell supports older distros, we don't want to add this tool as an additional requirement so switch to using gzip instead. (From OE-Core rev: 55b08fd641767a3d2e080727828ca37d9e610109) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* licenses: Add GPL+ licenses to mapJoshua Watt2023-04-011-0/+7
| | | | | | | | | | | Adds some missing licenses mappings related to the "+" versions of the GPL licenses (From OE-Core rev: 5f9a8809acf1ab4e73c3085b8fd100f4568ebd86) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/package: Add extended packaged dataJoshua Watt2023-04-012-3/+49
| | | | | | | | | | | | | | | | | | | | | | Adds extended package data which is encoded as JSON which allows it to encode more structure than the "flat" package data files. The extended data might be much larger than the standard package data, so it is not read by default and instead requires oe.packagedata.read_subpkgdata_extended() to be called Currently, the file sizes and ELF debug sources are saved off into the extended package data (cherry picked from commit db9cf430e54ae68da80fbc3fba80ce88d8df164d) (From OE-Core rev: 2318cb79ef1652fb19d696a8d43826e39c22834e) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Reviewed-by: Saul Wold <saul.wold@windriver.com> Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* classes/create-spdx: BackportJoshua Watt2023-04-015-0/+7455
| | | | | | | | | | | | | | Backports the create-spdx classes from the latest versions on master. This backport is a simple copy with no modifications, as its too complex to cherry-pick all the corresponding changes. This will give an appropriate base commit for subsequent changes and if necessary additional backport cherry-picks from master in the future. (From OE-Core rev: 48fbddf32ffa3ec44a788f42895c1730a84b5a91) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: fix wrong nobody-group assignmentPiotr Łobacz2023-04-011-1/+1
| | | | | | | | | | | | | | | | | | The generated /etc/group file had a wrong group name for nobody-group which was nobody with same id as nogroup groupd. This was leading to duplcate groups, with same ids and different names. More can be read on this link: https://bugzilla.yoctoproject.org/show_bug.cgi?id=11766 (From OE-Core rev: 0928857e4aaa524f36e028d4fe0cc48cc4d40148) Signed-off-by: Piotr Łobacz <p.lobacz@welotec.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d69fccf2e5d108dd7c6059310924588d36a45865) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pybootchartui: Fix python syntax issueRichard Purdie2023-04-011-1/+1
| | | | | | | | | | | | | | Fix: scripts/pybootchartgui/pybootchartgui/parsing.py:134: SyntaxWarning: "is" with a literal. Did you mean "=="? if pid is 0: (From OE-Core rev: 413523515dbb064680841fffa2cfdba8b2bac6f6) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c9a6511ae618035b8efad01646e37ba28ce1e3f8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lib/resulttool: fix typo breaking resulttool log --ptestRoss Burton2023-04-011-1/+1
| | | | | | | | | | | | | ptestresult_get_log() looked for a key called 'ptestresuls.sections', which should be 'ptestresult.sections' (From OE-Core rev: 288609a3bb2760b5bb9d86e9c130b227f9bd5039) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7c8c9f7283e54bf8b1521fbaad7dceb66a8fcdbb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-08 08:37:08 +0000