summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
Commit message (Collapse)AuthorAgeFilesLines
...
* libsoup-2.4: Fix CVE-2025-32909Vijay Anusuri2025-05-162-0/+37
| | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/comm it/ba4c3a6f988beff59e45801ab36067293d24ce92 (From OE-Core rev: ad1244ee75b4169eab21c2c8744b86342b32dd07) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Fix CVE-2025-32906Vijay Anusuri2025-05-163-0/+146
| | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/1f509f31b6f8420a3661c3f990424ab7b9164931 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/af5b9a4a3945c52b940d5ac181ef51bb12011f1f (From OE-Core rev: 2b938dd6beb1badca59804ffbe395deb679bc1b1) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Update fix CVE-2024-52532Vijay Anusuri2025-05-162-0/+47
| | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/4c9e75c6676a37b6485620c332e568e1a3f530ff (From OE-Core rev: 144d067ed5b98b8ca477a6a0e8c958c0b15e9643) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: patch CVE-2025-29088Peter Marko2025-05-022-0/+180
| | | | | | | | | | | | Pick commit [1] mentioned in [2]. [1] https://github.com/sqlite/sqlite/commit/56d2fd008b108109f489339f5fd55212bb50afd4 [2] https://nvd.nist.gov/vuln/detail/CVE-2025-29088 (From OE-Core rev: 70d2d56f89d6f4589d65a0b4f0cbda20d2172167) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: ignore CVE-2025-0725Yogita Urade2025-04-111-0/+2
| | | | | | | | | | | | | | | CVE-2025-0725 can only trigger for curl when using a runtime zlib version 1.2.0.3 or older and kirkstone supports zlib 1.2.11 version, hence ignore cve for kirkstone. Reference: https://curl.se/docs/CVE-2025-0725.html https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=8c3b4a604b40260e7ca9575715dd8017e17d35c0 (From OE-Core rev: 9077246122b1284e8b6430384cccaf6f0b6c80c3) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.1115 -> 9.1.1198Vijay Anusuri2025-04-011-2/+2
| | | | | | | | | | | | | | | | This includes CVE-fix for CVE-2025-27423 and CVE-2025-29768 Changes between 9.1.1115 -> 9.1.1198 ==================================== https://github.com/vim/vim/compare/v9.1.1115...v9.1.1198 (From OE-Core rev: 0ace90f2918496ceae32aebea05bb826d1e3dad6) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8e540bd287fd56e3a714f81395b59dd508a6d957) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: Fix for CVE-2025-24855Vijay Anusuri2025-03-272-0/+135
| | | | | | | | | Upstream-Commit: https://gitlab.gnome.org/GNOME/libxslt/-/commit/c7c7f1f78dd202a053996fcefe57eb994aec8ef2 (From OE-Core rev: eced74ca3be7d6c47e7c50152a36e0b1e8eba74a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxslt: Fix for CVE-2024-55549Vijay Anusuri2025-03-272-1/+52
| | | | | | | | | Upstream-Commit: https://gitlab.gnome.org/GNOME/libxslt/-/commit/46041b65f2fbddf5c284ee1a1332fa2c515c0515 (From OE-Core rev: eae0c33539f302124544373b74bd6883467ff549) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.1043 -> 9.1.1115Divya Chellam2025-03-191-2/+2
| | | | | | | | | | | | | This includes CVE-fix for CVE-2025-26603 and CVE-2025-1215 Changes between 9.1.1043 -> 9.1.1115 ==================================== https://github.com/vim/vim/compare/v9.1.1043...v9.1.1115 (From OE-Core rev: acb88b244e89bc1300a24f60d0a44c21e0ab1af6) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libtasn1: upgrade 4.19.0 -> 4.20.0Vijay Anusuri2025-03-131-4/+3
| | | | | | | | | | | | | | | | * Noteworthy changes in release 4.20.0 (2025-02-01) [stable] - The release tarball is now reproducible. - We publish a minimal source-only tarball generated by 'git archive'. - Update gnulib files and various build/maintenance fixes. - Fix CVE-2024-12133: Potential DoS in handling of numerous SEQUENCE OF or SET OF elements License-Update: file COPYING.LESSER renamed to COPYING.LESSERv2 & Copyright year updated to 2025 (From OE-Core rev: 0ff5d08053d92eeae5b2a23f8e0d7a280488723c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* boost: fix do_fetch errorJiaying Song2025-03-041-1/+1
| | | | | | | | | | | | | | Change the SRC_URI to the correct value due to the following error: WARNING: boost-native-1.86.0-r0 do_fetch: Checksum failure encountered with download of https://boostorg.jfrog.io/artifactory/main/release/1.86.0/source/boost_1_86_0.tar.bz2 - will attempt other sources if available (From OE-Core rev: 3b4c5ce6b89477307f3a2c30c7e275473b0c9f00) Signed-off-by: Jiaying Song <jsong-cn@ala-lpggp7.wrs.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> backport to kirkstone. Signed-off-by: Libo Chen <libo.chen.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.0764 -> 9.1.1043Divya Chellam2025-02-281-2/+2
| | | | | | | | | | | | | This includes CVE-fix for CVE-2025-22134 and CVE-2025-24014 Changes between 9.1.0764 -> 9.1.1043 ==================================== https://github.com/vim/vim/compare/v9.1.0764...v9.1.1043 (From OE-Core rev: 73b5570a16708d1e749b1ec525299d10557cbf56) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libcap: fix CVE-2025-1390Hitendra Prajapati2025-02-282-0/+37
| | | | | | | | | Upstream-Status: Backport from https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=1ad42b66c3567481cc5fa22fc1ba1556a316d878 (From OE-Core rev: 142715b83fb2c5f4dfeeab2c6e7feccecd1ca46f) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: fix CVE-2024-12243Archana Polampalli2025-02-242-0/+1161
| | | | | | | | | | | | | A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition. (From OE-Core rev: 5fbe46de6d2e3862316cf486503f18e616c3c0a7) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpcre2: ignore CVE-2022-1586Peter Marko2025-02-241-0/+4
| | | | | | | | | | | | | This CVE is fixed in 10.40 NVD wrongly changed <10.40 to =10.40 when adding debian_linux=10.0 Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-1586#VulnChangeHistorySection (From OE-Core rev: 63cbfcd0262d65c66762aa6a8b17b8e8b809737f) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vte: fix CVE-2024-37535Zhang Peng2025-01-243-2/+155
| | | | | | | | | | | | | | | | | | | CVE-2024-37535: GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related issue to CVE-2000-0476. Reference: [https://nvd.nist.gov/vuln/detail/CVE-2024-37535] Upstream patches: [https://gitlab.gnome.org/GNOME/vte/-/commit/036bc3ddcbb56f05c6ca76712a53b89dee1369e2] [https://gitlab.gnome.org/GNOME/vte/-/commit/c313849c2e5133802e21b13fa0b141b360171d39] (From OE-Core rev: 132a5168b125d6f4fb9391d982bc64d73429ab8f) Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* diffoscope: fix CVE-2024-25711Jiaying Song2024-12-092-0/+117
| | | | | | | | | | | | | | | | | | diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-25711 Upstream patches: https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/458f7f04bc053a0066aa7d2fd3251747d4899476 (From OE-Core rev: da4977e9414361a30eb322d1456a664515b35693) Signed-off-by: Jiaying Song <jiaying.song.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnupg: ignore CVE-2022-3515Peter Marko2024-12-091-0/+2
| | | | | | | | | | This is vulnerability of libksba and we use fixed libksba version (currently 1.6.4). (From OE-Core rev: 12007a6d19db220e6540948de9818332192ecde1) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Backport fix for CVE-2024-52531Vijay Anusuri2024-12-093-0/+169
| | | | | | | | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2024-52531 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libsoup2.4/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://gitlab.gnome.org/GNOME/libsoup/-/commit/a35222dd0bfab2ac97c10e86b95f762456628283 & https://gitlab.gnome.org/GNOME/libsoup/-/commit/825fda3425546847b42ad5270544e9388ff349fe] Reference: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/ https://ubuntu.com/security/CVE-2024-52531 (From OE-Core rev: 763af055ccb1cbcc4f8fa0944815ec02e3bff87c) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix CVE-2024-52531Changqing Li2024-12-094-0/+295
| | | | | | | | | | | | | | | | CVE-2024-52531: GNOME libsoup before 3.6.1 allows a buffer overflow in applications that perform conversion to UTF-8 in soup_header_parse_param_list_strict. Input received over the network cannot trigger this. Refer: https://nvd.nist.gov/vuln/detail/CVE-2024-52531 https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/407/ (From OE-Core rev: 1159c7ef071fa2849f44e921c9b7c27fcbb6bfb3) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup-2.4: Backport fix for CVE-2024-52530 and CVE-2024-52532Vijay Anusuri2024-11-274-0/+230
| | | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/04df03bc092ac20607f3e150936624d4f536e68b & https://gitlab.gnome.org/GNOME/libsoup/-/commit/6adc0e3eb74c257ed4e2a23eb4b2774fdb0d67be & https://gitlab.gnome.org/GNOME/libsoup/-/commit/29b96fab2512666d7241e46c98cc45b60b795c0c (From OE-Core rev: 87b0badcb1d10eddae31ac7b282a4e44778d63af) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: Fix for CVE-2024-52530 and CVE-2024-52532Vijay Anusuri2024-11-274-1/+232
| | | | | | | | | | | | | Upstream-Status: Backport from https://gitlab.gnome.org/GNOME/libsoup/-/commit/04df03bc092ac20607f3e150936624d4f536e68b & https://gitlab.gnome.org/GNOME/libsoup/-/commit/6adc0e3eb74c257ed4e2a23eb4b2774fdb0d67be & https://gitlab.gnome.org/GNOME/libsoup/-/commit/29b96fab2512666d7241e46c98cc45b60b795c0c (From OE-Core rev: 5c96ff64b5c29e589d776d23dbbed64ad526a997) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: patch CVE-2024-9681Peter Marko2024-11-152-0/+86
| | | | | | | | | | | | Picked commit [1] per solution described in [2]. [1] https://github.com/curl/curl/commit/a94973805df96269bf [2] https://curl.se/docs/CVE-2024-9681.html (From OE-Core rev: fbb8928ea85980bb866febd66e5e18ad843dbef8) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* at-spi2-core: backport a patch to fix build with gcc-14 on hostMartin Jansa2024-11-022-0/+28
| | | | | | | | | | | | | | | | | | * fixes: | ../at-spi2-core-2.42.0/atspi/atspi-device-listener.c: In function ?atspi_device_listener_new_simple?: | ../at-spi2-core-2.42.0/atspi/atspi-device-listener.c:252:37: error: passing argument 1 of ?atspi_device_listener_new? from incompatible pointer type [-Wincompatible-pointer-types] | 252 | return atspi_device_listener_new (device_remove_datum, callback, callback_destroyed); | | ^~~~~~~~~~~~~~~~~~~ | | | | | gboolean (*)(const AtspiDeviceEvent *, void *) {aka int (*)(const struct _AtspiDeviceEvent *, void *)} | ../at-spi2-core-2.42.0/atspi/atspi-device-listener.c:222:50: note: expected ?AtspiDeviceListenerCB? {aka ?int (*)(struct _AtspiDeviceEvent *, void *)?} but argument is of type ?gboolean (*)(const AtspiDeviceEvent *, void *)? {aka ?int (*)(const struct _AtspiDeviceEvent *, void *)?} | 222 | atspi_device_listener_new (AtspiDeviceListenerCB callback, | | ~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~ (From OE-Core rev: e361d9e1021d7715d2b4e3af95832c910de67cad) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libffi: backport a fix to build libffi-native with gcc-14Martin Jansa2024-11-022-0/+48
| | | | | | | (From OE-Core rev: 1054417a217417ab192dc4aee8307133451fb0e4) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bmap-tools: update HOMEPAGE and SRC_URISteve Sakoman2024-11-021-2/+2
| | | | | | | | | | | The bmaptool (previously: bmap-tools, bmap-tool, bmaptool) has been moved to be under the Yocto Project umbrella and is now hosted at: github.com/yoctoproject/bmaptool (From OE-Core rev: 7678ae7fc255621d91271599b5f4491520387279) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.0698 -> 9.1.0764Rohini Sangam2024-11-021-2/+2
| | | | | | | | | | | | | | | | | This includes CVE-fix for CVE-2024-45306 and CVE-2024-47814 Changes between 9.1.0698 -> 9.1.0764 ==================================== https://github.com/vim/vim/compare/v9.1.0698...v9.1.0764 (From OE-Core rev: 774fae9cb522683f722f3075531075be9fa36770) Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2f0e5e63399e544063c79b0b1f9555c820b0604c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.0682 -> 9.1.0698Siddharth Doshi2024-11-021-2/+2
| | | | | | | | | | | | | | | This includes CVE-fix for CVE-2024-43790 and CVE-2024-43802 Changes between 9.1.0682 -> 9.1.0698 ==================================== https://github.com/vim/vim/compare/v9.1.0682...v9.1.0698 (From OE-Core rev: 45ef5c80b1085d88d08679025bab13161c1f1fb2) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e530265415d93e3f49ec7874cf720aad18ab2e22) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: free old conn better on reuseMingli Yu2024-10-072-0/+96
| | | | | | | | | | | | | Backport a patch [1] to free old conn better on reuse to fix the memory leak issue [2]. [1] https://github.com/curl/curl/commit/06d1210 [2] https://github.com/curl/curl/issues/8841 (From OE-Core rev: fbb820cdfc480e2481d51b9a1057454832f02b23) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnupg: Document CVE-2022-3219 and mark wontfixPeter Marko2024-10-071-0/+2
| | | | | | | | | | | | (From OE-Core rev: f10f9c3a8d2c17d5a6c3f0b00749e5b34a66e090) (From OE-Core rev: fe094c2d50ffe11627efa6c0807a289c1ee6eb74) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: backport Debian patch for CVE-2024-8096Vijay Anusuri2024-10-072-0/+211
| | | | | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2024-8096 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://github.com/curl/curl/commit/aeb1a281cab13c7ba791cb104e556b20e713941f] Reference: https://curl.se/docs/CVE-2024-8096.html (From OE-Core rev: 5383b18d4f8023b49cdadf7c777aaecf55d95dc1) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* apr: upgrade 1.7.2 -> 1.7.5Vijay Anusuri2024-09-072-2/+2
| | | | | | | | | | | | | | | Refreshed patch 0001-configure-Remove-runtime-test-for-mmap-that-can-map-.patch Includes security fix CVE-2023-49582 changelog: https://downloads.apache.org/apr/CHANGES-APR-1.7 (From OE-Core rev: 4eb12d8683bd22b6503a64070b81b52f0d2f373a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: Rename patch for CVE-2022-35737Vrushti Dabhi2024-09-072-1/+1
| | | | | | | | | | The patch "0001-sqlite-Increased-the-size-of-loop-variables-in-the-printf-implementation.patch" fixes CVE-2022-35737. (From OE-Core rev: 9a875873e566a6673a65a8264fd0868c568e2a2c) Signed-off-by: Vrushti Dabhi <vrushti.dabhi@einfochips.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sqlite3: CVE-ID correction for CVE-2023-7104Vrushti Dabhi2024-09-072-5/+7
| | | | | | | | | | | | | - The commit [https://sqlite.org/src/info/0e4e7a05c4204b47] ("Fix a buffer overread in the sessions extension that could occur when processing a corrupt changeset.") fixes CVE-2023-7104 instead of CVE-2022-46908. - Hence, corrected the CVE-ID in CVE-2023-7104.patch. - Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-7104 (From OE-Core rev: 9d7f21f3d0ae24d0005076396e9a929bb32d648e) Signed-off-by: Vrushti Dabhi <vrushti.dabhi@einfochips.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.1.0114 -> 9.1.0682Siddharth Doshi2024-09-042-42/+2
| | | | | | | | | | | | | | | | | | | | This includes CVE-fix for CVE-2024-41957, CVE-2024-41965 and CVE-2024-43374 Changes between 9.1.0114 -> 9.1.0682 ==================================== https://github.com/vim/vim/compare/v9.1.0114...v9.1.0682 Note: ==== Removed patch "vim-add-knob-whether-elf.h-are-checked.patch" as libelf checks are removed from configure.ac as per commit https://github.com/vim/vim/commit/1acc67ac4412aa9a75d1c58ebf93f2b29585a960 (From OE-Core rev: 3312a57ce631ea6235055b3d4b4ac31d06c8a2ae) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6d2938e53cad5d9bf2e78a5403e9f9fab1db77b4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade from 9.0.2190 -> 9.1.0114Hitendra Prajapati2024-09-043-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | https://www.vim.org/vim-9.1-released.php Vim 9.1 is available The Vim project is happy to announce that Vim 9.1 has finally been released. This release is dedicated to Bram Moolenaar, Vim's lead developer for more than 30 years, who passed away half a year ago. The Vim project wouldn't exist without his work! Vim 9.1 is mainly a bug fix release, it contains hundreds of bug fixes, a few new features and there are many minor improvements. Changes: https://github.com/vim/vim/compare/v9.0.2190...v9.1.0114 CVE: CVE-2024-22667 (includes commit https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47) (From OE-Core rev: d5ae0ec5eca9324cffaa8f95d2cbdd8475979c45) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Ignore CVE-2024-32928Peter Marko2024-09-041-0/+2
| | | | | | | | | | | | | | This CVE affects google cloud services that utilize libcurl wrongly. (From OE-Core rev: 27ac7879711e7119b4ec8b190b0a9da5b3ede269) Changed CVE ignore syntax (From OE-Core rev: ad703de483258f459acc6a40385ad00a5182eb64) Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libyaml: Ignore CVE-2024-35325Peter Marko2024-09-041-0/+2
| | | | | | | | | | | This is similar CVE as the previous ones from the same author. https://github.com/yaml/libyaml/issues/303 explain why this is misuse (or wrong use) of libyaml. (From OE-Core rev: a28240d49c111050e253e373507ac3094b74f6e1) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libsoup: fix compile error on centos7Guocai He2024-08-282-1/+47
| | | | | | | | | | | | | | | | | | Backport a patch [1] to fix the below build failure. FAILED: libsoup/libsoup-2.4.so.1.11.0.p/soup-address.c.o In file included from /usr/include/glib-2.0/gio/gnetworking.h:40, from ../libsoup-2.72.0/libsoup/soup-address.c:14: /usr/include/resolv.h:75:15: error: unknown type name ‘u_char’ const u_char **__query, ^~~~~~ [1] https://gitlab.gnome.org/GNOME/libsoup/-/commit/5c3d431bdb094c59997f2a23e31e83f815ab667c (From OE-Core rev: 963085afced737863cf4ff8515a1cf08365d5d87) Signed-off-by: Guocai He <guocai.he.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Security fix for CVE-2024-7264Siddharth Doshi2024-08-283-0/+388
| | | | | | | | | | | | | Upstream-Status: Backport from [https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519] CVE's Fixed: ============ CVE-2024-7264 libcurl: ASN.1 date parser overread (From OE-Core rev: cf0b1ed6c4cd9f61e39befb9c9785b1433777988) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libyaml: ignore CVE-2024-35326Peter Marko2024-08-281-1/+1
| | | | | | | | | | | This is the same problem as already ignored CVE-2024-35328. See laso this comment in addition: https://github.com/yaml/libyaml/issues/298#issuecomment-2167684233 (From OE-Core rev: 18e011245dd978985eecc368c503822f61d52f21) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libyaml: Update status of CVE-2024-35328Peter Marko2024-08-161-0/+3
| | | | | | | | | | | | | | | | This is open yet but seems to be disputed This has not yet been disputed officially Based on: OE-Core rev: 4cba8ad405b1728afda3873f99ac88711ab85644 OE-Core rev: 7ec7384837f3e3fb68b25a6108ed7ec0f261a4aa OE-Core rev: c66d9a2a0d197498fa21ee8ca51a4afb59f75473 Squashed and converted to CVE_CHECK_IGNORE syntax (From OE-Core rev: 70489234bff3f2b8613ce6f8069bae448fbc61ed) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: fix CVE-2024-28835Archana Polampalli2024-05-022-0/+407
| | | | | | | | | | | A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command. (From OE-Core rev: e63819fbabbde3d12df06ae302da70ab990df26d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gnutls: fix CVE-2024-28834Archana Polampalli2024-05-022-0/+458
| | | | | | | | | | | | | A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it can result in a noticeable step in nonce size from 513 to 512 bits, exposing a potential timing side-channel. (From OE-Core rev: 18c4f65934331da48c597201c33334578e91a45d) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nghttp2: Fix CVE-2024-28182Soumya Sambu2024-04-213-0/+217
| | | | | | | | | | | | | | | | | | | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability. References: https://nvd.nist.gov/vuln/detail/CVE-2024-28182 (From OE-Core rev: 85e65af4727695d61c225a5911325764f423c331) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libssh2: fix CVE-2023-48795Meenali Gupta2024-04-212-0/+460
| | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2023-48795 (From OE-Core rev: a4a727839e608d114becc709c511651b4f546c6f) Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: backport Debian patch for CVE-2024-2398Vijay Anusuri2024-04-052-0/+90
| | | | | | | | | | | | | import patch from ubuntu to fix CVE-2024-2398 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches/?h=ubuntu%2Fjammy-security Upstream commit https://github.com/curl/curl/commit/deca8039991886a559b67bcd6701db800a5cf764] (From OE-Core rev: 67026cbb62e166b6a9f5509708531ebe0f36c36d) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nghttp2: fix CVE-2023-44487aszh072024-04-052-0/+928
| | | | | | | | | | | | | | | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. References: https://nvd.nist.gov/vuln/detail/CVE-2023-44487 https://github.com/nghttp2/nghttp2/commit/72b4af6143681f528f1d237b21a9a7aee1738832 (From OE-Core rev: 0156b57dcdb2e5acdd9421a7c24c235f13da2d97) Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: don't enable debug buildsRoss Burton2024-02-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | In oe-core 27824261 --enable-debug was added to the configure arguments to turn on debugging symbols. However, enabling debug mode does more than turn on debugging symbols and introduces some codepaths that can be controlled with environment variables. Bluntly, the curl maintainer says that --enable-debug should not be used in production: https://curl.se/mail/lib-2023-01/0039.html I did a build and verified that the curl-dbg package doesn't massively shrink, so the debug symbols are still being built. Remove the debug options and hide them behind a PACKAGECONFIG, with a comment that it should not be used in production. (From OE-Core rev: 01440b4968ded30c1970c335fe1598b684527831) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade v9.0.2130 -> v9.0.2190Tim Orling2024-02-281-2/+2
| | | | | | | | | | | | | | | | This is the latest/last of the 9.0.z upgrades, since 9.1 is now released. CVE: CVE-2024-22667 (includes the patch for .2142 https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47) Changes: https://github.com/vim/vim/compare/v9.0.2130...v9.0.2190 (From OE-Core rev: e7976311a79f05608bbac46a5699ef9206a2aaf5) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-07 06:03:50 +0000