summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
Commit message (Collapse)AuthorAgeFilesLines
...
* vim: upgrade 9.0.1403 -> 9.0.1429Randy MacLeod2023-04-111-2/+2
| | | | | | | | | | | | | Fixes: CVE-2023-1127, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264, CVE-2023-1355 (From OE-Core rev: e578b685a7fca4e8a40b1863ec58b71f6c4d263c) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2415072c3800feb164dd4d1fa0b56bd141a5cbd8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add fix for CVE-2023-23914, CVE-2023-23915Pawan Badganchi2023-03-286-0/+519
| | | | | | | | | | | | | | | | | | | | | Add below patches to fix CVE-2023-23914 [1], CVE-2023-23915 [2] CVE-2023-23914_5-1.patch CVE-2023-23914_5-2.patch CVE-2023-23914_5-3.patch CVE-2023-23914_5-4.patch CVE-2023-23914_5-5.patch [1] https://curl.se/docs/CVE-2023-23914.html [2] https://curl.se/docs/CVE-2023-23915.html (From OE-Core rev: c80ede99b60cfbb0e7b339e1a7dc9f082f0da1f3) Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: set modified-by to the recipe MAINTAINERRoss Burton2023-03-231-0/+1
| | | | | | | | | | | | | | | | | | | Clause II.3 of the Vim license states that any distribution of Vim that has been extended or modified must _at least_ indicate in the :version output that this is the case. Handily, Vim has a --with-modified-by argument to add a line in that text, so use MAINTAINER. This is the distribution maintainer contact, by default it is OE-Core Developers <openembedded-core@lists.openembedded.org>. (From OE-Core rev: ec594fe190f0f41f8c0388904d72015fce0cfa55) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit acc007e23445aa53182e13902dd9509c39dd5645) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade to 9.0.1403Ross Burton2023-03-231-4/+3
| | | | | | | | | | | | | | | This incorporates fixes for CVE-2023-1127, CVE-2023-1170, CVE-2023-1175. Also remove runtime/doc/uganda.txt from the license checksum: the Vim license is also in the top-level LICENSE file so this is redundant. (From OE-Core rev: 2d9a183467def574bf3c4a2e2f9bc59965797f6e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 71111e6b62d37c5e6853d7940dec2993df127a35) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: add missing pkgconfig inheritRoss Burton2023-03-201-1/+1
| | | | | | | | | | | | | | | Vim uses pkgconfig to find dependencies but it wasn't present, so it silently doesn't enable features like GTK+ UI. [ YOCTO #15044 ] (From OE-Core rev: 01eeabdd6f01c47fa637cee81e4ae3c61c2a9bb9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 70900616298f5e70732a34e7406e585e323479ed) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iso-codes: upgrade 4.12.0 -> 4.13.0Wang Mingyu2023-03-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added ========= - ISO 3166-1: Add missing common names for Laos, Iran, and Syria. Fixes #32 Changed =========== - Translation updates for ISO 3166-1 - Kazakh from Debian BTS. Closes: #1025423 - Catalan from Debian BTS. Closes: #1026972 - Translation updates for ISO 3166-2 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 Fixed ========== - ISO 3166-3: Fix withdrawal dates of AN, CS and YU. Fixes #28 (From OE-Core rev: e2c6593b1e2bd004c233e6b9fd27170365e00c95) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f2c8b9c9a97ba5ec9c5da94da84ebe216650d6cc) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libmicrohttpd: upgrade 0.9.75 -> 0.9.76Narpat Mali2023-03-201-1/+1
| | | | | | | | | | | | | | | Changelog: ============ Fix potential DoS vector in MHD_PostProcessor.(CVE-2023-27371) Releasing GNU libmicrohttpd 0.9.76 hotfix. https://github.com/Karlson2k/libmicrohttpd/blob/v0.9.76/ChangeLog (From OE-Core rev: 017346be6c97d20b1b16d495ee9484f10973857c) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: fix CVE-2023-0361 timing side-channel in the TLS RSA key exchange codeVivek Kumbhar2023-03-202-0/+86
| | | | | | | | | | | | | Remove branching that depends on secret data. since the `ok` variable isn't used any more, we can remove all code used to calculate it (From OE-Core rev: 05b1222815bec400d573f7b06c0ad6b7b2d78a80) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nghttp2: never build python bindingsJoe Slater2023-03-091-0/+4
| | | | | | | | | | This has already been done for oe-core/master. (From OE-Core rev: 9e8cbf46fe6e4e257b76b228de56d4a891199896) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libseccomp: fix for the ptest result formatNarpat Mali2023-03-091-0/+3
| | | | | | | | | | | | | | | | | | The output of libseccomp ptest should follow a unified format as per this https://wiki.yoctoproject.org/wiki/Ptest Replaced the test results SUCCESS, FAILURE & SKIPPPED with PASS, FAIL & SKIP and printing the ptest result with the below format result: testname (From OE-Core rev: 20f15c72ad7e52fb68669bce8be57bbe5a366ca3) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 30d025a8641cfcce5412b5f021478777620b55f1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libssh2: Clean up ptest patch/coverageRichard Purdie2023-03-094-48/+25
| | | | | | | | | | | | | | | | | | Martin Jansa spotted patchreview.py reports Malformed Upstream-Status in a patch in this recipe. The patch is not being applied since there is no ptest override. The test in question was also disabled due to an issue with new versions of openssh. Add a workaround for the broken test, enable it, drop the broken patch. (From OE-Core rev: 2c05ee17d58774fc628b8a5b55a14551590fadaa) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e9f2cc084638ce9cb5339df611e473c30f0e40b1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix dependencies when building with ldap/ldapsFederico Pellegrin2023-03-091-2/+2
| | | | | | | | | | | | | | | | | | openldap is added as a dependency so the build will not fail, as otherwise ldap headers are not found during configure phase Note: due to upstream bug (now fixed) building LDAP/LDAPS support with minimal configurations can sometimes not work, see details at: https://github.com/curl/curl/pull/10445 (From OE-Core rev: e6a001c22ec1b0d5487027148dda099847474272) Signed-off-by: Federico Pellegrin <fede@evolware.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a999f62f5692687a5557f7a50c7c768c50f3d7d3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: update 9.0.1211 -> 9.0.1293 to resolve open CVEsAlexander Kanavin2023-03-091-2/+2
| | | | | | | | | | | (From OE-Core rev: 5eb050c439d891188ded3e79bf1e5b5695f24872) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6d77dbe499ee362b6e28902f1efcf52b961037a5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgit2: upgrade 1.4.4 -> 1.4.5Steve Sakoman2023-02-241-1/+1
| | | | | | | | | | | | | | | | | | Fixes: libgit2, when compiled using the optional, included libssh2 backend, fails to verify SSH keys by default. Description When using an SSH remote with the optional, included libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificate_check field of libgit2's git_remote_callbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Beginning in libgit2 v1.4.5 and v1.5.1, libgit2 will now perform host key checking by default. Users can still override the default behavior using the certificate_check function. The libgit2 security team would like to thank the Julia and Rust security teams for responsibly disclosing this vulnerability and assisting with fixing the vulnerability. (From OE-Core rev: 6c64dc88b5dac910f3760e9cd1003cc83df3ffad) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgit2: uprade 1.4.3 -> 1.4.4Steve Sakoman2023-02-241-1/+1
| | | | | | | | | | | | | | | | | This is a security release with multiple changes. This provides compatibility with git's changes to address CVE 2022-29187. As a follow up to CVE 2022-24765, now not only is the working directory of a non-bare repository examined for its ownership, but the .git directory and the .git file (if present) are also examined for their ownership. A fix for compatibility with git's (new) behavior for CVE 2022-24765 allows users on POSIX systems to access a git repository that is owned by them when they are running in sudo. A fix for further compatibility with git's (existing) behavior for CVE 2022-24765 allows users on Windows to access a git repository that is owned by the Administrator when running with escalated privileges (using runas Administrator). The bundled zlib is updated to v1.2.12, as prior versions had memory corruption bugs. It is not known that there is a security vulnerability in libgit2 based on these bugs, but we are updating to be cautious. (From OE-Core rev: 4bc31ac89eb0562bae37e2246e8001b4286f61da) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr-util: update 1.6.1 -> 1.6.3Alexander Kanavin2023-02-242-138/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes with APR-util 1.6.3 *) Correct a packaging issue in 1.6.2. The contents of the release were correct, but the top level directory was misnamed. Changes with APR-util 1.6.2 *) SECURITY: CVE-2022-25147 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. *) Teach configure how to find and build against MariaDB 10.2. PR 61517 [Kris Karas <bugs-a17 moonlit-rail.com>] *) apr_crypto_commoncrypto: Remove stray reference to -lcrypto that prevented commoncrypto being enabled. [Graham Leggett] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_dbm_gdbm: Fix handling of error codes. This makes gdbm 1.14 work. apr_dbm_gdbm will now also return error codes starting with APR_OS_START_USEERR, as apr_dbm_berkleydb does, instead of always returning APR_EGENERAL. [Stefan Fritsch] Drop backport. (From OE-Core rev: e24b38a14b3520648ec418783fb74fcf61df7ff2) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dca707f9fecc805503e17f6db3e4c88069ac0125) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 43cd36b178ebb602edd5919c26f8b8642736a3a8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: update 1.7.0 -> 1.7.2Alexander Kanavin2023-02-2410-320/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes for APR 1.7.2 *) Correct a packaging issue in 1.7.1. The contents of the release were correct, but the top level directory was misnamed. Changes for APR 1.7.1 *) SECURITY: CVE-2022-24963 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. *) SECURITY: CVE-2022-28331 (cve.mitre.org) On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow. *) SECURITY: CVE-2021-35940 (cve.mitre.org) Restore fix for out-of-bounds array dereference in apr_time_exp*() functions. (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and later 1.6.x releases, but was missing in 1.7.0.) [Stefan Sperling] *) configure: Fix various build issues for compilers enforcing strict C99 compliance. PR 66396, 66408, 66426. [Florian Weimer <fweimer redhat.com>, Sam James <sam gentoo.org>] *) apr_atomic_read64(): Fix non-atomic read on 32-bit Windows [Ivan Zhakov] *) configure: Prefer posix name-based shared memory over SysV IPC. [Jim Jagielski] *) configure: Add --disable-sctp argument to forcibly disable SCTP support, or --enable-sctp which fails if SCTP support is not detected. [Lubos Uhliarik <luhliari redhat.com>, Joe Orton] *) Fix handle leak in the Win32 apr_uid_current implementation. PR 61165. [Ivan Zhakov] *) Add error handling for lseek() failures in apr_file_write() and apr_file_writev(). [Joe Orton] *) Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp() created file to avoid a fd and inode leak when/if later passed to apr_file_setaside(). [Yann Ylavic] *) APR's configure script uses AC_TRY_RUN to detect whether the return type of strerror_r is int. When cross-compiling this defaults to no. This commit adds an AC_CACHE_CHECK so users who cross-compile APR may influence the outcome with a configure variable. [Sebastian Kemper <sebastian_ml gmx net>] *) Add a cache check with which users who cross-compile APR can influence the outcome of the /dev/zero test by setting the variable ac_cv_mmap__dev_zero=yes [Sebastian Kemper <sebastian_ml gmx net>] *) Trick autoconf into printing the correct default prefix in the help. [Stefan Fritsch] *) Don't try to use PROC_PTHREAD by default when cross compiling. [Yann Ylavic] *) Add the ability to cross compile APR. [Graham Leggett] *) While cross-compiling, the tools/gen_test_char could not be executed at build time, use AX_PROG_CC_FOR_BUILD to build native tools/gen_test_char Support explicit libtool by variable assigning before buildcheck.sh, it is helpful for cross-compiling (such as libtool=aarch64-linux-libtool) [Hongxu Jia <hongxu.jia windriver.com>] *) Avoid an overflow on 32 bit platforms. [René Hjortskov Nielsen <r... hjortskov.dk>] *) Use AC_CHECK_SIZEOF, so as to support cross compiling. PR 56053. [Mike Frysinger <vapier gentoo.org>] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_pools: Fix pool debugging output so that creation events are always emitted before allocation events and subpool destruction events are emitted on pool clear/destroy for proper accounting. [Brane Čibej] *) apr_socket_listen: Allow larger listen backlog values on Windows 8+. [Evgeny Kotkov <evgeny.kotkov visualsvn.com>] *) Fixed: apr_get_oslevel() was returning APR_WIN_XP on Windows 10 *) Fix attempt to free invalid memory on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix double free on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix a regression in apr_stat() for root path on Windows. [Ivan Zhakov] Dropped patches have all been merged, addressed separately or are backports. (From OE-Core rev: c291aefb531431b9a256740766dcb03cbdf84481) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3ffae93f24bb1e3954b232099153fd059cfd7daf) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit e5326ea0ac7e55b2d671a27c1e035c43b8bbc70d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libusb1: Strip trailing whitespacesKhem Raj2023-02-041-6/+6
| | | | | | | | | | | (From OE-Core rev: 6e981dc8df59ce0e2e85b25f240b6c5767ce22f6) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2b24ffade16fc23ddb77e26d8967c26d62f4ed6d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libusb1: Link with latomic only if compiler has no atomic builtinsKhem Raj2023-02-042-0/+47
| | | | | | | | | | | | | | | | This makes build use compiler to decide from where to get atomics instead of assuming that it should always come from libatomic, helps sharing build artifacts with OSes which may not have libatomic installed because it is not required on those hosts. (From OE-Core rev: c660d75211352a47797c3d400dd504759675a0f6) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a026d9afcbe07a8324ca951ba3439373dcb3771c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* numactl: skip test case when target platform doesn't have 2 CPU nodeXiangyu Chen2023-02-042-2/+7
| | | | | | | | | | | | | | | | when current test platform doesn't have 2 or more CPU node, the test case would report FAIL, according to numa test script and numademo code, when return code=77 should be skip test, so using SKIP instead of FAIL in test script. (From OE-Core rev: 218cf38bd3879df009e70f516c0dcb484376bf2e) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fd0a82400d419bce8605a9445db9b20b8ddc01a7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libseccomp: fix typo in DESCRIPTIONChen Qi2023-01-261-1/+1
| | | | | | | | | | | | | Fix typo in DESCRIPTION: and -> an. (From OE-Core rev: 44f59f5d8414cbe935addb57bd1ea9ffaf734fba) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 349e63045298054f9454025d793c67284fce750b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0947 -> 9.0.1211Randy MacLeod2023-01-261-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for: https://nvd.nist.gov/vuln/detail/CVE-2023-0049 https://nvd.nist.gov/vuln/detail/CVE-2023-0051 https://nvd.nist.gov/vuln/detail/CVE-2023-0054 https://nvd.nist.gov/vuln/detail/CVE-2023-0288 (From OE-Core rev: d4887e2e43e3d66e0f64299a8189b26d5aff31ef) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1c51068c78d12ee02789a6dbecf5e7e91d141af5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: update 1.6.2 -> 1.6.3Alexander Kanavin2023-01-262-4/+4
| | | | | | | | | | | | | | | | | Noteworthy changes in version 1.6.3 (2022-12-06) Fix another integer overflow in the CRL parser. [T6284,CVE-2022-47629] (From OE-Core rev: 0c1829b0e7e085ba8aef0d47852abf520ef9d635) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 83f3f21b1b84ab9e7b461ac966691c80f4ed4e97) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f098cb5073051eb371f4142678b4b3d5e7b52426) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "libksba: fix CVE-2022-47629"Steve Sakoman2023-01-262-74/+1
| | | | | | | | Prepare for stable version bump which includes this fix This reverts commit e4cb0bf273ea556db91699594046a47514c8583c. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: fix CVE-2022-47629Yogita Urade2023-01-262-1/+74
| | | | | | | | | | | | | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE: CVE-2022-47926 References: https://nvd.nist.gov/vuln/detail/CVE-2022-47629 (From OE-Core rev: e4cb0bf273ea556db91699594046a47514c8583c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add patch to fix CVE-2022-43552Ranjitsinh Rathod2023-01-062-0/+81
| | | | | | | | | | | | | | | Add patch to fix the security issue "curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations using an appropriate HTTP error response code." as per below link Link: https://curl.se/docs/CVE-2022-43552.html (From OE-Core rev: a0db3ddf6f2efe733271ff7f6c68fda4d215b1bb) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add patch to fix CVE-2022-43551Ranjitsinh Rathod2023-01-062-0/+36
| | | | | | | | | | | | | | | Add patch to fix the security issue "curl's HSTS check could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL." as per below link Link: https://curl.se/docs/CVE-2022-43551.html (From OE-Core rev: baa18f2cf107af7a5e1c7b7befad46e6c48f4222) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Correct LICENSE from MIT-open-group to curlRanjitsinh Rathod2023-01-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | LICENSE for curl is set to MIT-open-group which is wrong and proper license is 'curl' I check below link and the line "Curl and libcurl are licensed under the license below, which is inspired by MIT/X, but not identical." says that the license is identical to MIT but actual license is identical from the file "meta/files/common-licenses/curl" Link: https://curl.se/docs/copyright.html Also, I do not find the MIT-open-group license text in the entire source-code (From OE-Core rev: 34b228bd3a80a74bf4d84ef7ee362f4ab1e3a466) (From OE-Core rev: 95b5df5c9e0bdef55d0f977fb814f9de74363e68) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4a246e06cb62efff8bfd20cdf3dde31e24f9b711) Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite: fix CVE-2022-46908 safe mode authorizer callback allows disallowed UDFs.Vivek Kumbhar2023-01-062-0/+40
| | | | | | | | (From OE-Core rev: 18641988caa131436f75dd3c279ce5af3380481a) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mpfr: upgrade 4.1.0 -> 4.1.1Wang Mingyu2022-12-231-1/+1
| | | | | | | | | | | | | | | | Changelog: ========= - Bug fixes (see <https://www.mpfr.org/mpfr-4.1.0/#fixed> and/or the ChangeLog file), in particular for macros implementing functions. - Improved manual formatting. (From OE-Core rev: 9977278a12d6bc0b811077fa19c64b80e793a33d) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f733eddc428cf9537f97cb91025b73dd1fdea932) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0820 -> 9.0.0947Qiu, Zheng2022-12-131-2/+2
| | | | | | | | | | | | | | | | Includes fixes for CVE-2022-4141 https://nvd.nist.gov/vuln/detail/CVE-2022-4141 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: a7abc8754ab5fbefa23fc17571d272a77dcd2421) Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 160f459febc7fb36cc0fe85c63eb26780ace3bfd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-42915Bhabu Bindu2022-12-072-0/+54
| | | | | | | | | | | | HTTP proxy double-free Link: https://security-tracker.debian.org/tracker/CVE-2022-42915 (From OE-Core rev: 4754f33d7ec96f72351853463540c8b1a3f4bc0c) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-42916Bhabu Bindu2022-12-072-0/+137
| | | | | | | | | | | | HSTS bypass via IDN Link: https://security-tracker.debian.org/tracker/CVE-2022-42916 (From OE-Core rev: e6796b426503477620e0e5c5c9da50352269a593) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-32221Bhabu Bindu2022-12-072-0/+29
| | | | | | | | | | | | POST following PUT confusion Link: https://ubuntu.com/security/CVE-2022-32221 (From OE-Core rev: 518bea85c9496d77c70d703b818e442eda841554) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iso-codes: upgrade 4.11.0 -> 4.12.0Wang Mingyu2022-12-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: ========= - ISO 3166-1: Update name for TR. Fixes #38 - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-2. Closes: #1020633 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 (From OE-Core rev: 017abb138460978e87c84c509f9af7524a053e1b) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 99917b4b7d5642b292cb95c770871b95e411dfc5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libical: upgrade 3.0.15 -> 3.0.16Alexander Kanavin2022-12-011-1/+1
| | | | | | | | | | | | | | | Version 3.0.16 is a patch release. - Fix regressions in 3.0.15 due to improperly tested fuzz fixes - Fix argument guards in icaltime_as_timet to match documentation and tests. (From OE-Core rev: 6d68985f1a7a55cda92c177c739e51cac3faf653) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 77d4557d6f6a1405d03bb5dc7ca23d7ee78c2037) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libffi: upgrade 3.4.2 -> 3.4.4Alexander Kanavin2022-12-013-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | 3.4.4 Oct-23-2022 Important aarch64 fixes, including support for linux builds with Link Time Optimization (-flto). Fix x86 stdcall stack alignment. Fix x86 Windows msvc assembler compatibility. Fix moxie and or1k small structure args. 3.4.3 Sep-19-22 All struct args are passed by value, regardless of size, as per ABIs. Enable static trampolines for Cygwin. Add support for Loongson's LoongArch64 architecture. Fix x32 static trampolines. Fix 32-bit x86 stdcall stack corruption. Fix ILP32 aarch64 support. License-Update: copyright years (From OE-Core rev: 6ad074b1caff63e90805aac25cca8a831b57273d) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 5b42ba98ef26a52bad8de1790b402938fec4a160) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libffi: submit patch upstreamAlexander Kanavin2022-11-241-1/+1
| | | | | | | | | | | (From OE-Core rev: c8c8945ded40a36b42da4e95974cf76796c15cfb) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9555a7dc768c32a009333232e25cef041054b7f7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: upgrade 1.6.0 -> 1.6.2wangmy2022-11-101-1/+1
| | | | | | | | | | | | | | New upstream release fixing CVE-2022-3515 (From OE-Core rev: b58fa75b4cb0cc75034be5f952224d4bcee9aff6) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 4bef6fc673de958dfbab80bcbc2e0159803b97ee) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 8e453d64255ce6a01b193c3735bb0aefbaa6fb38) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* numactl: upgrade 2.0.15 -> 2.0.16wangmy2022-11-101-2/+2
| | | | | | | | | | (From OE-Core rev: 5a51b44967fff256ec298f7c3cfae1c084bf1b32) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6d9ed8d4b13c2d87dae482bbadef039de050bc9d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* numactl: upgrade 2.0.14 -> 2.0.15Richard Purdie2022-11-101-3/+3
| | | | | | | | | | | | | | | | v2.0.15 changes Various bug fixes and cleanups Supported multiple preferred nodes This release didn't include a release tarball. Furthermore, it had issues such as #135, #136 and #138 that got fixed in the follow up release. Please try to use v2.0.16 instead. License checksum change from a typo fix. (From OE-Core rev: c275a87794027b03fde68ee11fa2f5eddbf3c344) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8829fe6ee093acc6fb990f9ca6cad67c2c7549d5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libical: upgrade 3.0.14 -> 3.0.15wangmy2022-11-101-1/+1
| | | | | | | | | | | | | | | | | | | | | Changelog: ========= Add missing property parameters into libical-glib Fix CMake option USE_32BIT_TIME_T actually uses a 32-bit time_t value Fix icaltime_as_timet, which returned incorrect results for years >= 2100, to work properly between years 1902 and 10k. Fix x-property comma handling and escaping Built-in timezones updated to tzdata2022d (now with a VTIMEZONE for each time zone alias) Fix fuzzer issues Handle unreachable-code compile warnings with clang Ensure all vanew_foo() calls finish with (void*)0 (not 0) (From OE-Core rev: d0882397cb37ab19543733535c3d01d09c3845a4) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6092ae3cbe0eaf006db615c6cc3f1692e1cc1df8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libcap: upgrade 2.65 -> 2.66wangmy2022-11-102-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | RELEASE NOTES FOR 2.66 Fix documentation typos in cap_from_text.3 (Bug: 216514 reported by Paulo Andrade.) Some getpcaps code clean up and a fix for PID argument parsing from Jakub Wilk. Slightly more robust Makefiles to address an error with make -j48 test observed by Tomasz Kłoczko. Include a simple Go program, captrace, to trace kernel capability validation checks This program can be used to figure out what capabilities a program needs to operate. captrace (a wrapper for bpftrace) uses BPF kprobes to monitor the kernel for capability checks and whether or not they succeed for the system, a specific PID or a program's direct execution. Trim down the default file capabilities for contrib/sucap/su to those actually needed and set USER and HOME environment variables so bash doesn't complain about a sourcing error. (From OE-Core rev: 003a81171366956c899305ca9adc352d3c99c964) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9040e612084a561b1766bb86c9c002b811eea4c9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: Unified package names to lower-caseKeiya Nobuta2022-11-091-1/+1
| | | | | | | | | | | | | | create-spdx can't detect the license properly if the case doesn't match, so fix it. (From OE-Core rev: a96cd0df052af00215796add25373daf12a0e5ed) Signed-off-by: Keiya Nobuta <nobuta.keiya@fujitsu.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9c87828493784d996910d742006268a626ef0130) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0614 -> 9.0.0820Tim Orling2022-11-041-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for CVE-2022-3705 https://nvd.nist.gov/vuln/detail/CVE-2022-3705 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: 555fd2848b970fd38c20651b5e98cabb7f31287c) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6d917bd0f8810b5ed8d403ad25d59cda2fc9574) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0598 -> 9.0.0614Teoh Jay Shen2022-11-041-2/+2
| | | | | | | | | | | | Include fixes for CVE-2022-3352. (From OE-Core rev: 1104d02f9bac2fdd540da5ccb5dd6690e025ef33) Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 8aa707f80ae1cfe89d5e20ec1f1632a65149aed4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0541 -> 9.0.0598Richard Purdie2022-10-111-2/+2
| | | | | | | | | | | | | Includes a fix for CVE-2022-3278. (From OE-Core rev: 9837a62cc42de4120794d4ae8d0264109b8308dc) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 98c40271692147873a622e168e8b2e90a9fcc54c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.453 -> 9.0.541Richard Purdie2022-09-281-2/+2
| | | | | | | | | | | Includes a fix for CVE-2022-3234. (From OE-Core rev: 650ae29fc567e033205558fa85cc1c156d9f72a7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d6b54f37aa4db1457296b8981b630a49d251ceb5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0341 -> 9.0.0453yocto-4.0.4kirkstone-4.0.4Richard Purdie2022-09-171-2/+2
| | | | | | | | | | | Includes fixes for CVE-2022-3099 and CVE-2022-3134. (From OE-Core rev: bc2e5e961e88eb9f4d8cd1f2ee0ed56ab00774a9) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d042923262130b6b96f703b5cd4184f659caeb92) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: Cache configure tests which use AC_TRY_RUNKhem Raj2022-09-122-2/+75
| | | | | | | | | | | | | | | | | AC_TRY_RUN macro means the test needs to run to find the result and we are cross compiling so this will always get wrong results, this results in miscompiling apache2 on musl because it disables rlimit (ac_cv_struct_rlimit) wrongly. All these variables are determined with AC_TRY_RUN checks (From OE-Core rev: 8784e3712add2fbdf684d442a14fb94e5a7fc61f) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 504eb0ff1cae200ee85ec18ebae564cae9bf9c8c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-08 18:37:16 +0000