summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
Commit message (Collapse)AuthorAgeFilesLines
...
* libgit2: Fix CVE-2024-24575 and CVE-2024-24577Soumya Sambu2024-02-153-1/+112
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2024-24575: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function in `src/libgit2/revparse.c` uses a loop to parse the user-provided spec string. There is an edge-case during parsing that allows a bad actor to force the loop conditions to access arbitrary memory. Potentially, this could also leak memory if the extracted rev spec is reflected back to the attacker. As such, libgit2 versions before 1.4.0 are not affected. Users should upgrade to version 1.6.5 or 1.7.2. CVE-2024-24577: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2. References: https://nvd.nist.gov/vuln/detail/CVE-2024-24575 https://security-tracker.debian.org/tracker/CVE-2024-24575 https://nvd.nist.gov/vuln/detail/CVE-2024-24577 https://security-tracker.debian.org/tracker/CVE-2024-24577 (From OE-Core rev: 942254eb3ef29c8672a35015c086721c4fbe5a4f) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-46219Archana Polampalli2024-02-154-0/+259
| | | | | | | | | | | When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file unaware of the HSTS status they should otherwise use. (From OE-Core rev: e0f503594e7bc0da9771b69ca7243a34dcadbdde) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: ignore CVE-2023-42915Peter Marko2024-02-091-0/+3
| | | | | | | | | | | | | | This CVE reports that apple had to upgrade curl because of other already reported CVEs: * CVE-2023-38039: not affected, introduced in 7.84.0 * CVE-2023-38545: patch already backported * CVE-2023-38546: patch already backported * CVE-2023-42915: reference to itself (From OE-Core rev: 2771a1248a251650f6e2e64731f56ed928c29ce5) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: Fix for CVE-2024-0553 and CVE-2024-0567Vijay Anusuri2024-01-243-0/+311
| | | | | | | | | | | | | | | | | | | | | CVE-2024-0553 A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK key exchange, potentially leading to the leakage of sensitive data. CVE-2024-0553 is designated as an incomplete resolution for CVE-2023-5981. CVE-2024-0567 A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote client or attacker to initiate a denial of service attack. Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/40dbbd8de499668590e8af51a15799fbc430595e & https://gitlab.com/gnutls/gnutls/-/commit/9edbdaa84e38b1bfb53a7d72c1de44f8de373405] Reference: https://ubuntu.com/security/CVE-2024-0553 https://ubuntu.com/security/CVE-2024-0567 (From OE-Core rev: de74fd5dea8cc71af1d457b4e688cfbe0f39e4d8) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: backport patch for CVE-2023-7104Peter Marko2024-01-212-0/+45
| | | | | | | | | Backport https://sqlite.org/src/info/0e4e7a05c4204b47 (From OE-Core rev: 31fb83ac3dcd2dd55b184de22a296ab4dc150d2e) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "curl: Backport fix CVE-2023-32001"Poonam Jadhav2024-01-212-40/+0
| | | | | | | | | | | | | | This reverts commit 5eab65275dc9faa0b9a4371d5bcb6e95cfda61cd. CVE-2023-32001 has been marked "REJECT" in the NVD CVE List as there is no safe measure against it. These CVEs are stored in the NVD, but do not show up in search results. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-32001 (From OE-Core rev: a3b6216bcb3425b6e30ca73488a5eb6ba58e4836) Signed-off-by: Poonam Jadhav poonam.jadhav@kpit.com Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-46218Poonam Jadhav2023-12-222-0/+53
| | | | | | | | | | | | Add patch to fix CVE-2023-46218 Link: https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/curl/7.88.1-8ubuntu2.4/curl_7.88.1-8ubuntu2.4.debian.tar.xz https://github.com/curl/curl/commit/2b0994c29a721c91c57 (From OE-Core rev: f27a93299f554e0bde610f70e6a042b4a24abf20) Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: Backport fix for CVE-2023-5981Vijay Anusuri2023-12-152-0/+207
| | | | | | | | | | | | | Upstream-Status: Backport [import from debian https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gnutls28/3.7.3-4ubuntu1.3/gnutls28_3.7.3-4ubuntu1.3.debian.tar.xz Upstream-Commit: https://gitlab.com/gnutls/gnutls/-/commit/29d6298d0b04cfff970b993915db71ba3f580b6d] References: https://ubuntu.com/security/CVE-2023-5981 (From OE-Core rev: 421b468cf48f0d2c493356f482d92e61e39d7e0e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.2068 -> 9.0.2130Tim Orling2023-12-121-2/+2
| | | | | | | | | | | | | | | | | | | https://github.com/vim/vim/compare/v9.0.2068...v9.0.2130 CVE: CVE-2023-48231 CVE: CVE-2023-48232 CVE: CVE-2023-48233 CVE: CVE-2023-48234 CVE: CVE-2023-48235 CVE: CVE-2023-48236 CVE: CVE-2023-48237 (From OE-Core rev: 7a6aab8b28b57bbaa4d4cf436a8cae18f1a43eba) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 5978d565a9e700485fc563dfe2e3c0045dd74b59) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.0.2048 -> 9.0.2068Archana Polampalli2023-12-021-2/+2
| | | | | | | | | | | | | | | This includes CVE fix for CVE-2023-46246. 9198c1f2b (tag: v9.0.2068) patch 9.0.2068: [security] overflow in :history References: https://nvd.nist.gov/vuln/detail/CVE-2023-46246 (From OE-Core rev: 8c83a25494f99ebe63f59a267001e4a19d0a6b14) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 63bc72ccb63d2f8eb591d7cc481657a538f0fd42) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: use upstream generated .po filesSteve Sakoman2023-12-021-2/+4
| | | | | | | | | | | | | | | | | | | | A previous commit attempted to fix reproducibility errors by forcing regeneration of .po files. Unfortunately this triggered a different type of reproducibility issue. Work around this by adjusting the timestamps of the troublesome .po files so they are not regenerated and we use the shipped upstream versions of the files. The shipped version of ru.cp1251.po doesn't seem to have been created with the vim tooling and specifies CP1251 instead of cp1251, fix that. (From OE-Core rev: 3c1e35562c31b8fa94ea10d18ddfdb4267566bf3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 13d9551ba626f001c71bf908df16caf1d739cf13) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Improve locale handlingRichard Purdie2023-12-021-10/+4
| | | | | | | | | | | | | | | | | When making checkouts from git, the timestamps can vary and occasionally two files can end up with the same stamp. This triggers make to regenerate ru.cp1251.po from ru.po for example. If it isn't regenerated, the output isn't quite the same leading to reproducibility issues (CP1251 vs cp1251). Since we added all locales to buildtools tarball now, we can drop the locale restrictions too. We need to generate a native binary for the sjis conversion tool so also tweak that. (From OE-Core rev: b2e62fb4d52b019728a4920553fa24f4626b881a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 042c1a501b1dae5ddb31307b461be02c3591c589) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: fix CVE-2023-38546Archana Polampalli2023-11-012-0/+138
| | | | | | | | | | A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met. (From OE-Core rev: 9c0c09b81594979aafd74511366316419d23046e) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: fix CVE-2023-38545Archana Polampalli2023-11-012-0/+134
| | | | | | | | | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. (From OE-Core rev: 44971c945a615d07c91100f514377f7247796334) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.0.2009 -> 9.0.2048Siddharth Doshi2023-10-251-2/+2
| | | | | | | | | This includes CVE fix for CVE-2023-5535. (From OE-Core rev: 7681436190354b5c5b6c3a82b3094badd81113de) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.0.1894 -> 9.0.2009Siddharth Doshi2023-10-181-2/+2
| | | | | | | | | This includes CVE fix for CVE-2023-5441. (From OE-Core rev: 6c88137d4ab36054ac97cff0457d78ef503f383e) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.0.1664 -> 9.0.1894Richard Purdie2023-09-231-3/+3
| | | | | | | | | | | | | This includes multiple CVE fixes. The license change is due to changes in maintainership, the license itself is unchanged. (From OE-Core rev: 5f78a010a4ff53f4a216ec2ebe9b7a44c5c88790) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 91e66b93a0c0928f0c2cfe78e22898a6c9800f34) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.1592 -> 9.0.1664Archana Polampalli2023-09-231-2/+2
| | | | | | | | | | | | | Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-3896 8154e642a (tag: v9.0.1664) patch 9.0.1664: divide by zero when scrolling with 'smoothscroll' set (From OE-Core rev: d5ba3546053cff49ee1ea66a97fe4b4a0aa76308) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4a1ab744142c9229f03a359b45e5e89a1fbae0d3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: update obsolete commentEtienne Cordonnier2023-09-231-3/+2
| | | | | | | | | | | | | | | | | | | | | vim 8.3 has been out for a long time, so this comment is obsolete. However we still need UPSTREAM_VERSION_UNKNOWN, since we ignore the last digit of the upstream version number. Test result: $ devtool check-upgrade-status vim ... INFO: vim 9.0.1592 UNKNOWN Tom Rini <trini@konsulko.com> c0370529c027abc5b1698d53fcfb8c02a0c515da (From OE-Core rev: 65f5de85c3f488136d1ec2b1f7fe8d8426d6c5b3) (From OE-Core rev: 72af322b6b8afd64a59b30a4f0fc3f8c6dfaa06a) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 868a19357841470eb55fb7f1c4ab1af09dea99ed) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: fix CVE-2020-22218Chee Yang Lee2023-09-082-0/+35
| | | | | | | (From OE-Core rev: a0b41511766130883e93b5b8a07801a836beeb67) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nghttp2: fix CVE-2023-35945Yogita Urade2023-08-302-0/+152
| | | | | | | | | | | | | | | | | | | | | | | | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11. References: https://nvd.nist.gov/vuln/detail/CVE-2023-35945 https://github.com/envoyproxy/envoy/security/advisories/GHSA-jfxv-29pc-x22r (From OE-Core rev: 0e6eb0f417079eaf76b003973c9d93338e6363b5) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* acl/attr: ptest fixes and improvementsRichard Purdie2023-08-264-0/+15
| | | | | | | | | | | | | | | Add a missing perl module dependency for the ptest packages and also improve the run-ptest script so that the error log is saved allowing easier debugging if this fails in future. (From OE-Core rev: fbb9c596b8e6a8a1260dd7aefddf138d20bf64df) (From OE-Core rev: 5908ccf65b5ca4a0473a57774f06515d6bc9f56c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2c948fa0250b765bc5f2fbe63c82258601cc77ff) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Backport fix CVE-2023-32001Ashish Sharma2023-08-192-0/+40
| | | | | | | (From OE-Core rev: 10df7553d1107438408f680ac28a2daf87d4163e) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpcre2: patch CVE-2022-41409Peter Marko2023-08-072-0/+76
| | | | | | | | | | Backport commit mentioned in NVD DB links. https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35 (From OE-Core rev: 410cdbc70cfba709ec5bef508e772f52514ba28a) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libksba: upgrade 1.6.3 -> 1.6.4Wang Mingyu2023-08-021-1/+1
| | | | | | | | | | | | Changelog: Correctly detect CMS write errors. (From OE-Core rev: 4bc2f5c3a46b76d152fda326f7c8227fe938b97e) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0296cf63007542c1cb209a4288be1c82aa2ba843) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libassuan: upgrade 2.5.5 -> 2.5.6Wang Mingyu2023-08-021-1/+1
| | | | | | | | | | | | | | | | Changelog: =========== * Fix logging of confidential data. [rA0fc31770fa] * Fix memory wiping. [T5977] * Fix macOS build problem. [T5440,T5610] * Upgrade autoconf stuff. (From OE-Core rev: a905094c4e7ff3475de657adcf7a0afcc132191a) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 90126be6dc32170c08eb90223b6a6cc06c2133ce) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.1527 -> 9.0.1592Trevor Gamblin2023-07-211-2/+2
| | | | | | | | | | | | | | | | | Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-2609 d1ae836 patch 9.0.1531: crash when register contents ends up being invalid https://nvd.nist.gov/vuln/detail/CVE-2023-2610 ab9a2d8 patch 9.0.1532: crash when expanding "~" in substitute causes very long text (From OE-Core rev: a71153cb0a509456dd36466ac15a603f953eb6b8) Signed-off-by: Trevor Gamblin <tgamblin@baylibre.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1e4b4dfb4145bc00eb6937b5f54a41170e9a5b4c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* serf: upgrade 1.3.9 -> 1.3.10Alexander Kanavin2023-07-215-92/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | Apache Serf 1.3.10 [2023-05-31, from tags/1.3.10, r1910048] Support for OpenSSL 3 (r1901937, ...) Fix issue #171: Win32: Running tests fails with "no OPENSSL_Applink" error Fix issue #194: Win32: Linking error when building against OpenSSL 1.1+ Fix issue #198: OpenSSL BIO control method incorrectly handles unknown requests Fix issue #202: SSL tests are not passing with OpenSSL 3 Fix error handling when reading the outgoing request body (r1804534, ...) Fix handling of invalid chunk lengths in the dechunk bucket (r1804005, ...) Fix an endless loop in the deflate bucket with truncated input (r1805301) Fix BIO control handlers to support BIO_CTRL_EOF (r1902208) Fix a CRT mismatch issue caused by using certain OpenSSL functions (r1909252) Build changes to support VS2017, VS2019 and VS2022 (r1712131, ...) Build changes to support Python 3 (r1875933) As serf is undead, we need to reassess all the remaining patches. (From OE-Core rev: 275c6b7ac72330e14ba55907e8494314b63a9adf) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 775cbcc876edcb6c339f342a3253f5afcf6ef163) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 17a46eee905f0ecfdbebb014533848dc7e906ec7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Added CVE-2023-28320 Follow-up patchVivek Kumbhar2023-07-212-0/+198
| | | | | | | | | | | Introduced by: https://github.com/curl/curl/commit/3c49b405de4fbf1fd7127f91908261268640e54f (curl-7_9_8) Fixed by: https://github.com/curl/curl/commit/13718030ad4b3209a7583b4f27f683cd3a6fa5f2 (curl-8_1_0) Follow-up: https://github.com/curl/curl/commit/f446258f0269a62289cca0210157cb8558d0edc3 (curl-8_1_0) (From OE-Core rev: f19c20c429395c1b4c62a6e0388ef51b830871c5) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: CVE-2023-36191 CLI fault on missing -nonceVijay Anusuri2023-07-212-0/+38
| | | | | | | | | Upstream-Status: Backport [https://sqlite.org/src/info/cd24178bbaad4a1d] (From OE-Core rev: 663713b2f95dee1e70f8921ece23b21d84d93805) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libcap: fix CVE-2023-2603 Integer Overflow in _libcap_strdup()Vivek Kumbhar2023-07-122-0/+61
| | | | | | | (From OE-Core rev: 92340bc3161259c962b5ed5f9d9055f5bd36a3ce) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* fribidi: upgrade 1.0.12 -> 1.0.13Wang Mingyu2023-07-011-1/+1
| | | | | | | | | | | | Changelog: * Adding missing man pages to the tar release file. (From OE-Core rev: 7e4915c4be7dca35a63a912a55bcfa525a532e22) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 0f6da8601fd4d992550e8afe7b09ba7c491250fd) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libcap: CVE-2023-2602 Memory Leak on pthread_create() ErrorHitendra Prajapati2023-07-012-0/+46
| | | | | | | | | Upstream-Status: Backport from https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=bc6b36682f188020ee4770fae1d41bde5b2c97bb (From OE-Core rev: 7e4f3c51c0bac772bf56f69a3c065b2b2d095335) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* iso-codes: upgrade 4.13.0 -> 4.15.0Wang Mingyu2023-06-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-2 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 * ISO 3166-2: Fix wrong Spanish translation (From OE-Core rev: 86e8e31a413fdbb8ffa825c41d0fe83c292a6b76) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 355f2f9fe8a1e6c5e78f136cb3ed77c9004fb75c) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit b189240b211e5d8f40747a0128834ed83c38a8f4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.1429 -> 9.0.1527Randy MacLeod2023-06-211-2/+2
| | | | | | | | | | | | Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-2426 caf642c25 patch 9.0.1499: using uninitialized memory with fuzzy matching (From OE-Core rev: 035b5d918eea3f3bb238fecd795f09505801971b) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 4f9a8df5aca99d0a5c2d2346b27ce7be08e7896c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Correction for CVE-2023-27536Omkar Patil2023-06-141-1/+2
| | | | | | | | | | | Correction of backport link inside the patch with correct commit link as below Link: https://github.com/curl/curl/commit/cb49e67303dbafbab1cebf4086e3ec15b7d56ee5 (From OE-Core rev: 4691bc257d0bf2372e31535f0b90cf49ef0ed0d8) Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28322Bhabu Bindu2023-06-013-0/+522
| | | | | | | | | | | | | | | | | | | | | | | | | | Add patches to fix CVE-2023-28322 more POST-after-PUT confusion When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer.The problem exists in the logic for a reused handle when it is (expected tobe) changed from a PUT to a POST. CVE-2023-28322-1.patch is a supporting patch to resolve hunk error in the actual patch file : CVE-2023-28322-2.patch Link: https://curl.se/docs/CVE-2023-28322.html (From OE-Core rev: 9ef793eca87ac568d9c22067aa854a50837cf92f) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28321Bhabu Bindu2023-06-012-0/+303
| | | | | | | | | | | | | | | | | | | | | | | | | | Add patch to fix CVE-2023-28321 IDN wildcard match curl supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name)hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`,which would match even though the IDN name most likely contained nothing even resembling an `x`. Link: https://curl.se/docs/CVE-2023-28321.html (From OE-Core rev: 75d8593ab3b090266fd2cde27ddc56ad88de7ac7) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28320Bhabu Bindu2023-06-012-0/+84
| | | | | | | | | | | | | | | | | | | | | | Add patch to fix CVE-2023-28320 siglongjmp race condition libcurl provides several different backends for resolving host names, selectedat build time. If it is built to use the synchronous resolver, it allows nameresolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected anda multi-threaded application might therefore crash or otherwise misbehave. Link: https://curl.se/docs/CVE-2023-28320.html (From OE-Core rev: c761d822be5ffc4a88600fbd7282c469b1e9902a) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28319Bhabu Bindu2023-06-012-0/+34
| | | | | | | | | | | | | | | | | | | | | | Add patch to fix CVE-2023-28319 UAF in SSH sha256 fingerprint check libcurl offers a feature to verify an SSH server's public key using a SHA 256hash. When this check fails, libcurl would free the memory for the fingerprintbefore it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed. Link: https://curl.se/docs/CVE-2023-28319.html (From OE-Core rev: f7d6751828683ac2adbf140e77dbf7454cfa8eb1) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* p11-kit: add native to BBCLASSEXTENDJan Luebbe2023-05-301-1/+1
| | | | | | | | | | | | This recipe is needed to build softhsm (in meta-oe) in with p11-kit support, which is useful when multiple PKCS#11 modules need to be used. (From OE-Core rev: 19498bea309f19d841187a7063286b2a68ce2587) Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4942a42d5a071b283fe49047dcb4fee2c96422e8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nghttp2: Deleted the entries for -client and -server, and removed a ↵leimaohui2023-05-301-4/+2
| | | | | | | | | | | | | | | | | | | dependency on them from the main package. By default there is nothing in nghttp2-client and nghttp2-server ,nghttp2-client and nghttp2-server aren't created. So there are dependences error if install main package. Problem: conflicting requests - nothing provides nghttp2-client >= 1.52.0 needed by nghttp2-1.52.0-r0.core2_64 - nothing provides nghttp2-server >= 1.52.0 needed by nghttp2-1.52.0-r0.core2_64 Upstream-Status: Backport [OE-core d2cbe060955c598bd81923ecd554fbe82c17af99] (From OE-Core rev: 619a643f71eceab73bbbe4dacd1eb42b6d6b01d1) Signed-off-by: Lei Maohui <leimaohui@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libbsd: Add correct license for all packagesRanjitsinh Rathod2023-05-101-0/+7
| | | | | | | | | | | | | | | | | | | | | | | BSD-4-Clause is only applicable to the {PN}-doc package as when I check for the source code I find below files which only uses the license BSD-4-Clause ~/sources/libbsd$ grep -rl "All advertising materials mentioning features or use of this software" *|grep -v \.1|grep -v \.5|grep -v \.8 | sort COPYING man/arc4random.3bsd man/getprogname.3bsd ~/sources/libbsd$ grep -rnB5 "BSD-4" COPYING-9-Files: COPYING-10- man/arc4random.3bsd COPYING-11-Copyright: COPYING-12- Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de> COPYING-13- All rights reserved. COPYING:14:License: BSD-4-clause-Niels-Provos (From OE-Core rev: aa5bdac99e187801db56ca4bcc4d5f18b2403f40) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Security fix for CVE-2023-27535, CVE-2023-27536, CVE-2023-27538Siddharth Doshi2023-04-264-0/+421
| | | | | | | | | Upstream-Status: Backport from [https://github.com/curl/curl/commit/ed5095ed94281989e103c72e032200b83be37878, https://github.com/curl/curl/commit/8f4608468b890dce2dad9f91d5607ee7e9c1aba1, https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb, https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb] (From OE-Core rev: 0b35659c895e6ff2690d42f976169e4a65be07e6) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27534 SFTP path resolving discrepancyHitendra Prajapati2023-04-192-0/+123
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/4e2b52b5f7a3bf50a0f1494155717b02cc1df6d6 (From OE-Core rev: 7919a5a5eaa2689db9f0e8110b923bbfe0a610ab) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27533 TELNET option IAC injectionHitendra Prajapati2023-04-192-0/+209
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/0c28ba2faae2d7da780a66d2446045a560192cdc && https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684 (From OE-Core rev: ff795872530975a014ae23001a4b014449783a0e) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Add fix for CVE-2023-23916pawan2023-04-112-0/+220
| | | | | | | | | | | | | | Add below patch to fix CVE-2023-23916 CVE-2023-23916.patch Link: https://curl.se/docs/CVE-2023-23916.html (From OE-Core rev: 1b10502deb6a542acfb9dc62dbd916e8299314da) Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bmap-tools: switch to main branchMartin Jansa2023-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | * master branch was removed upstream: downloads/git2/github.com.intel.bmap-tools $ git remote prune origin Pruning origin URL: https://github.com/intel/bmap-tools * [pruned] refs/heads/master * [pruned] refs/pull/73/merge * downloads/git2/github.com.intel.bmap-tools $ git branch -a --contains c0673962a8ec1624b5189dc1d24f33fe4f06785a main release-3.0 (From OE-Core rev: 81223013571ccf4730ca1320b7ac0cd54548ec0a) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 369fee186d6916322b9be9d936b654d0c5910cb3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.1403 -> 9.0.1429Randy MacLeod2023-04-111-2/+2
| | | | | | | | | | | | | Fixes: CVE-2023-1127, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264, CVE-2023-1355 (From OE-Core rev: e578b685a7fca4e8a40b1863ec58b71f6c4d263c) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2415072c3800feb164dd4d1fa0b56bd141a5cbd8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add fix for CVE-2023-23914, CVE-2023-23915Pawan Badganchi2023-03-286-0/+519
| | | | | | | | | | | | | | | | | | | | | Add below patches to fix CVE-2023-23914 [1], CVE-2023-23915 [2] CVE-2023-23914_5-1.patch CVE-2023-23914_5-2.patch CVE-2023-23914_5-3.patch CVE-2023-23914_5-4.patch CVE-2023-23914_5-5.patch [1] https://curl.se/docs/CVE-2023-23914.html [2] https://curl.se/docs/CVE-2023-23915.html (From OE-Core rev: c80ede99b60cfbb0e7b339e1a7dc9f082f0da1f3) Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-08 09:11:49 +0000