summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
...
* golang: Fix CVE-2023-24539Ashish Sharma2023-06-132-0/+61
| | | | | | | | | Improper sanitization of CSS values in html/template (From OE-Core rev: 737333d41d245154eb4b26ec8db79a2f9823c873) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: Security fix CVE-2023-0494 and CVE-2023-1393Vijay Anusuri2023-06-133-0/+86
| | | | | | | | | | | | Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ec & https://gitlab.freedesktop.org/xorg/xserver/-/commit/26ef545b3502f61ca722a7a3373507e88ef64110] (From OE-Core rev: 0a29894da0b41f8494f72ded25916887b4a5c729) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Fix CVE-2023-28879Vijay Anusuri2023-06-132-0/+55
| | | | | | | | | Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;h=37ed5022cecd584de868933b5b60da2e995b3179] (From OE-Core rev: ec0c6f941826903b763be76c450f1d4e0e67908e) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: Fix CVE-2022-48434Nikhil R2023-06-132-0/+137
| | | | | | | | | | | | | | | | Add a patch to fix CVE-2022-48434 which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances Link: https://ubuntu.com/security/CVE-2022-48434 Link: https://nvd.nist.gov/vuln/detail/CVE-2022-48434 (From OE-Core rev: 51c8ffc49d03b231ce76fa00f923e5f3f833f6fc) Signed-off-by: Nikhil R <nikhilar2410@gmail.com> Signed-off-by: Ranjitsinh Rathod ranjitsinh.rathod@kpit.com Signed-off-by: Nikhil R <nikhilar2410@gmail.com> Signed-off-by: Nikhil R <nikhilar2410@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* selftest: skip virgl test on ubuntu 22.10, fedora 37, and all rockySteve Sakoman2023-05-251-0/+6
| | | | | | | | This test will fail any time the host has libdrm > 2.4.107 (From OE-Core rev: e4b98a42970574296e0da06842691b9fc1ffc9a1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/utils/metadata.py: Fix running oe-selftest running with no distro setThomas Roos2023-05-251-3/+3
| | | | | | | | | | | | | This will use default values when no distribution is set. [YOCTO #15086] (From OE-Core rev: 1a28c6cfe0e6c4b44d01778f8034231040c6d4ad) Signed-off-by: Thomas Roos <throos@amazon.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 888fe63b46efceeff08dbe8c4f66fec33d06cb7a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* populate_sdk_ext.bbclass: set METADATA_REVISION with an DISTRO overrideMartin Jansa2023-05-251-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * otherwise it ends '<unknown>' inside esdk, because of parsing order: # $METADATA_REVISION [3 operations] # set /OE/build/test-D/conf/local.conf:43 # "f2da54ef432eac89b0f18eaad68e602b6990b5de" # immediate /OE/build/test-D/layers/poky/meta/classes/metadata_scm.bbclass:9 # "${@oe.buildcfg.detect_revision(d)}" # set /OE/build/test-D/layers/poky/meta/classes/metadata_scm.bbclass:10 # [vardepvalue] "${METADATA_REVISION}" # pre-expansion value: # "<unknown>" METADATA_REVISION="<unknown>" * This causes base-files.do_install and following tasks to have different signatures between esdk and the build directory where this esdk was created: bitbake-diffsigs {test-D,poky/build-uninative-disabled}/tmp/stamps/qemux86_64-poky-linux/base-files/*do_install*sigdata* NOTE: Starting bitbake server... basehash changed from 5b6981cf58bfd57d416b0e31611b73a26baae635dd1ac31c08d46f95064c3ffc to dbdce042da4d7813d632b6d1cc87a16f728ad20e55fecbc392830e6acf72babd Variable METADATA_REVISION value changed from '<unknown>' to 'f2da54ef432eac89b0f18eaad68e602b6990b5de' and an warning from "python3 /OE/build/test-D/ext-sdk-prepare.py" when eSDK is being prepared for use: WARNING: The base-files:do_install sig is computed to be 83b9c9a6ef1145baac5a1e0d08814b9156af239c58fc42df95c25a9cd8a7f201, but the sig is locked to 3dc22233059075978e5503691e98e79e7cc60db94259dfcd886bca2291c0add7 in SIGGEN_LOCKEDSIGS_t-qemux86-64 [RP: Add commit about why we need the override for future reference] (From OE-Core rev: 8f0e2e505d11697d0a1280b0a77a3fe8d72a4d49) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 675ea7281c17f77bf5dea17cfd4d9da0928382a0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* perf: Depend on native setuptools3Khem Raj2023-05-251-1/+1
| | | | | | | | | | | | | | perf has need for python setuptools when scripting is enabled from 6.0.0 onwards it seems to throw an explicit error (From OE-Core rev: cfdaa6afaca28dd91c9738a97bb21eab5dae2817) Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit da3d00178809bbf7cc453401e0c5937796ebc2c1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cpio: Fix wrong CRC with ASCII CRC for large filesMarek Vasut2023-05-252-0/+40
| | | | | | | | | | | | | | | | Due to signedness, the checksum is not computed when filesize is bigger a 2GB. Pick a fix for this problem from CPIO ML, where the fix has been posted for 5 years. Since CPIO upstream is effectively unresponsive and any and all attempts to communicate with the maintainer and get the fix applied upstream failed, add the fix here instead. (From OE-Core rev: bfff138af4bdd356ac66571e6ad91c1a5599b935) (From OE-Core rev: 0a8fb1c00e75e8434e0ef433d9074d54f038fba1) Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-firmware: upgrade 20230210 -> 20230404Dmitry Baryshkov2023-05-251-3/+3
| | | | | | | | | | | | | | The LICENCE.qat_firmware license file was updated to reflect Intel licensing (it removed a term regarding patent licenses). License-Update: additional files (From OE-Core rev: 0a6a31e24414e156e005ef1d6a72ff668d83796a) Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit fd43b59ab32e2115fcda7ad63d3a5ccc2683c7d5) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pypi.bbclass: Set CVE_PRODUCT to PYPI_PACKAGEAlex Kiernan2023-05-251-0/+2
| | | | | | | | | | | | | | The CVE product name for PyPI packages is (usually) the same as the PyPI package name (and not our recipe name), so use that as the default. (From OE-Core rev: 1c37b96cd4fdfad21bf24b8b883e371c3bca56de) Signed-off-by: Alex Kiernan <alexk@zuma.ai> Signed-off-by: Alex Kiernan <alex.kiernan@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 61f6b0ad09bf87cdc2d3f08770b7c44cad1d0e58) Signed-off-by: Sanjay Chitroda <schitrod@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: ammend fix for CVE-2023-27534 to fix error when ssh is enabledSiddharth2023-05-253-106/+68
| | | | | | | | | | | | | | | | | | The upstream patch for CVE-2023-27534 does three things: 1) creates new path with dynbuf(dynamic buffer) 2) solves the tilde error which causes CVE-2023-27534 3) modifies the below added functionality to not add a trailing "/" to the user home dir if it already ends with one with dynbuf. dynbuf functionalities are added in curl in later versions and are not essential to fix the vulnerability but does add extra feature in later versions. This patch completes the 3rd task of the patch which was implemented without using dynbuf Upstream-Status: Backport from [https://github.com/curl/curl/commit/6c51adeb71da076c5c40a45e339e06bb4394a86b] (From OE-Core rev: df489f644e41108cf0e2ff55af7ce5e9bca40471) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2023-25652Hitendra Prajapati2023-05-252-0/+95
| | | | | | | | | | | | | | | | | | | | | | | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid using `git apply` with `--reject` when applying patches from an untrusted source. Use `git apply --stat` to inspect a patch before applying; avoid applying one that create a conflict where a link corresponding to the `*.rej` file exists. References: https://nvd.nist.gov/vuln/detail/CVE-2023-25652 Upstream-Status: Backport from https://github.com/git/git/commit/9db05711c98efc14f414d4c87135a34c13586e0b (From OE-Core rev: 6747482316b8f7839a09bf041d8c11b559f84b44) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: fix CVE-2023-29007Hitendra Prajapati2023-05-252-0/+160
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, a specially crafted `.gitmodules` file with submodule URLs that are longer than 1024 characters can used to exploit a bug in `config.c::git_config_copy_or_rename_section_in_file()`. This bug can be used to inject arbitrary configuration into a user's `$GIT_DIR/config` when attempting to remove the configuration section associated with that submodule. When the attacker injects configuration values which specify executables to run (such as `core.pager`, `core.editor`, `core.sshCommand`, etc.) this can lead to a remote code execution. A fix A fix is available in versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1. As a workaround, avoid running `git submodule deinit` on untrusted repositories or without prior inspection of any submodule sections in `$GIT_DIR/config`. References: https://nvd.nist.gov/vuln/detail/CVE-2023-29007 Upstream patches: https://github.com/git/git/commit/528290f8c61222433a8cf02fb7cfffa8438432b4 https://github.com/git/git/commit/29198213c9163c1d552ee2bdbf78d2b09ccc98b8 https://github.com/git/git/commit/a5bb10fd5e74101e7c07da93e7c32bbe60f6173a https://github.com/git/git/commit/e91cfe6085c4a61372d1f800b473b73b8d225d0d https://github.com/git/git/commit/3bb3d6bac5f2b496dfa2862dc1a84cbfa9b4449a (From OE-Core rev: db4c152441aebe4c04a7bb7aceb88d8941a6576b) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* run-postinsts: Set dependency for ldconfig to avoid boot issuesArturo Buzarra2023-05-161-1/+1
| | | | | | | | | | | | | | | | | | | | | If a package with a postsints script requires ldconfig, the package class adds a ldconfig postinst fragment to initialize it before. Systemd has its own ldconfig.service to initialize it and sometimes if both services are running at the same time in the first boot, the first one will work, but the second one will fail with the following error: ldconfig[141]: /sbin/ldconfig: Renaming of /etc/ld.so.cache~ to /etc/ld.so.cache failed: No such file or directory This commit adds a ordering dependency between them to make sure that only one service is running at the same time. (From OE-Core rev: 1bc254e7969f3d5470bacf9ad9f065d38b7b7fde) Signed-off-by: Arturo Buzarra <arturo.buzarra@digi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4e9d812e127dc6743f52f4881e509e8e2e833afe) Signed-off-by: Jermain Horsman <jermain.horsman@nedap.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libbsd: Add correct license for all packagesRanjitsinh Rathod2023-05-161-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | BSD-4-Clause is only applicable to the {PN}-doc package as when I check for the source code I find below files which only uses the license BSD-4-Clause ~/sources/libbsd$ grep -rl "All advertising materials mentioning features or use of this software" *|grep -v \.1|grep -v \.5|grep -v \.8 | sort COPYING man/arc4random.3bsd man/getprogname.3bsd man/tree.3bsd ~/sources/libbsd$ grep -rnB6 "BSD-4" COPYING-9-Files: COPYING-10- man/arc4random.3bsd COPYING-11- man/tree.3bsd COPYING-12-Copyright: COPYING-13- Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de> COPYING-14- All rights reserved. COPYING:15:License: BSD-4-clause-Niels-Provos (From OE-Core rev: 187f1588240a0eb5cc753c2114fd6c0cef66e14f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-yocto: Exclude 294 CVEs already fixed upstreamYoann Congal2023-05-162-0/+1843
| | | | | | | | | | | | | Exclude CVEs that are fixed in current linux-yocto version v5.4.237. To get the commit fixing a CVE, I used the Debian kernel-sec repo [1]. [1]: https://salsa.debian.org/kernel-team/kernel-sec/-/commit/86d5040aee9275f9555458fcaf9cb43710dff398 (From OE-Core rev: ec0f3e5869c596a308a164f93cb031e04034a8ed) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* connman: Fix CVE-2023-28488 DoS in client.cAshish Sharma2023-05-162-0/+55
| | | | | | | | | | | | | | | Avoid overwriting the read packet length after the initial test. Thus move all the length checks which depends on the total length first and do not use the total lenght from the IP packet afterwards. Fixes CVE-2023-28488 Reported by Polina Smirnova <moe.hwr@gmail.com> (From OE-Core rev: 47a9ae5592392bd10740e4571b06c8c739705058) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: patch CVE-2023-28484 and CVE-2023-29469Peter Marko2023-05-163-0/+123
| | | | | | | | | | | Backports from: * https://gitlab.gnome.org/GNOME/libxml2/-/commit/e4f85f1bd2eb34d9b49da9154a4cc3a1bc284f68 * https://gitlab.gnome.org/GNOME/libxml2/-/commit/547edbf1cbdccd46b2e8ff322a456eaa5931c5df (From OE-Core rev: c0cfcd3945257efd40745e0ebb84495441acb590) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* freetype: fix CVE-2023-2004 integer overflowin in tt_hvadvance_adjust() in ↵Vivek Kumbhar2023-05-162-0/+41
| | | | | | | | | | | src/truetype/ttgxvar.c Fix An integer overflow vulnerability was discovered in Freetype in tt_hvadvance_adjust() function in src/truetype/ttgxvar.c (From OE-Core rev: 24c87e674db9c1d4a8922c3af78a0004c061e70f) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Security fix for CVE-2023-24538Shubham Kulkarni2023-05-164-0/+532
| | | | | | | | | | | html/template: disallow actions in JS template literals Backport from https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b (From OE-Core rev: c8a597b76505dab7649f4c9b18e1e14b0e3d57af) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to dunfell head revisionyocto-3.1.25dunfell-23.0.25Steve Sakoman2023-05-031-1/+1
| | | | | | (From OE-Core rev: fd4cc8d7b5156c43d162a1a5a809fae507457ef4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* populate_sdk_base: add zip optionsChristoph Lauer2023-05-031-1/+3
| | | | | | | | | | | | | Add SDK_ZIP_OPTIONS to remove symbolic link creation in zip archive or add options, e.g. for encryption of the zip archive. (From OE-Core rev: 04b62f9459b401c276255f166d0738b6f902a576) (From OE-Core rev: b9e0c3ced645cab74b2488a26b8f656a94b2a6f5) Signed-off-by: Christoph Lauer <christoph.lauer@xtronic.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24534 denial of service from excessive memory allocationVivek Kumbhar2023-05-032-0/+201
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A parsed MIME header is a map[string][]string. In the common case, a header contains many one-element []string slices. To avoid allocating a separate slice for each key, ReadMIMEHeader looks ahead in the input to predict the number of keys that will be parsed, and allocates a single []string of that length. The individual slices are then allocated out of the larger one. The prediction of the number of header keys was done by counting newlines in the input buffer, which does not take into account header continuation lines (where a header key/value spans multiple lines) or the end of the header block and the start of the body. This could lead to a substantial amount of overallocation, for example when the body consists of nothing but a large block of newlines. Fix header key count prediction to take into account the end of the headers (indicated by a blank line) and continuation lines (starting with whitespace). Thanks to Jakob Ackermann (@das7pad) for reporting this issue. Fixes CVE-2023-24534 For #58975 Fixes #59267 (From OE-Core rev: daa6aa9c7198a07322f1828a9db457fec86191cf) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Security fix CVE-2023-27533, CVE-2023-27535 and CVE-2023-27536Vijay Anusuri2023-05-035-0/+524
| | | | | | | | | Upstream-Status: Backport [https://git.launchpad.net/ubuntu/+source/curl/tree/debian/patches?h=ubuntu/focal-security & https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684 & https://github.com/curl/curl/commit/ed5095ed94281989e103c72e032200b83be37878 & https://github.com/curl/curl/commit/f18af4f874cecab82a9797e8c7541e0990c7a64c & https://github.com/curl/curl/commit/8f4608468b890dce2dad9f91d5607ee7e9c1aba1 & https://github.com/curl/curl/commit/cb49e67303dbafbab1cebf4086e3ec15b7d56ee5] (From OE-Core rev: 08ffa2437967a642a4c8e35e2158bb369454764a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: Whitelist CVE-2023-0664Virendra Thakur2023-05-031-0/+5
| | | | | | | | | | | This CVE is related to Windows. Link: https://nvd.nist.gov/vuln/detail/CVE-2023-0664 (From OE-Core rev: 8efb0fc7e7db4bad3dbc40d8f890a6c2e7be38fa) Signed-off-by: Virendra Thakur <virendrak@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Fix CVE-2023-0466Omkar Patil2023-05-032-0/+83
| | | | | | | | | | | | Add patch to fix CVE-2023-0466 Link: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=0d16b7e99aafc0b4a6d729eec65a411a7e025f0a (From OE-Core rev: a80d772593b3a38c062e546557d5f8d76eb71fe4) Signed-off-by: Omkar Patil <omkar.patil@kpit.com> Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Fix CVE-2023-0465Omkar Patil2023-05-032-0/+61
| | | | | | | | | | | | Add patch to fix CVE-2023-0465 Link: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=b013765abfa80036dc779dd0e50602c57bb3bf95 (From OE-Core rev: cbca55301bb065a6506e65cf64cc90b598e39789) Signed-off-by: Omkar Patil <omkar.patil@kpit.com> Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Fix CVE-2023-0464Nikhil R2023-05-032-0/+227
| | | | | | | | | | | | | | | | | | | Fix CVE-2023-0464 for openssl A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service(DoS) attack on affected systems. Link: https://git.openssl.org/gitweb/?p=openssl.git;a=patch;h=879f7080d7e141f415c79eaa3a8ac4a3dad0348b (From OE-Core rev: 0c50550e2c8fca3263776c2bb985a8c58b920b99) Signed-off-by: Nikhil R <nikhil.r@kpit.com> Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Ignore CVE-2022-1705Shubham Kulkarni2023-05-031-0/+3
| | | | | | | | | | | | The vulnerability was introduced in go1.15beta1 with commit d5734d4. Dunfell uses go1.14 version which does not contain the affected code. Ref: https://security-tracker.debian.org/tracker/CVE-2022-1705 (From OE-Core rev: 6e4a952efc94a3bb94216db1cbd738f4fb70217f) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: Security fix for CVE-2023-28486 and CVE-2023-28487Vijay Anusuri2023-05-033-0/+674
| | | | | | | | | | | | | | import patches from ubuntu to fix CVE-2023-28486 CVE-2023-28487 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/sudo/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca & https://github.com/sudo-project/sudo/commit/12648b4e0a8cf486480442efd52f0e0b6cab6e8b] (From OE-Core rev: 4870543273bef9831c075ee0bce108c54355a92f) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: fix CVE-2023-24537 Infinite loop in parsingVivek Kumbhar2023-04-262-0/+77
| | | | | | | | | | | | | Setting a large line or column number using a //line directive can cause integer overflow even in small source files. Limit line and column numbers in //line directives to 2^30-1, which is small enough to avoid int32 overflow on all reasonbly-sized files. (From OE-Core rev: d1943e6a0ec00653c81cd4c0bb0d6b7e0909094c) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Security fix for CVE-2020-29510Shubham Kulkarni2023-04-262-0/+66
| | | | | | | | | | | encoding/xml: replace comments inside directives with a space Backport from https://github.com/golang/go/commit/a9cfd55e2b09735a25976d1b008a0a3c767494f8 (From OE-Core rev: 76d855f3d2c250ac85ca6f24bf0e178fb32607f9) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* screen: CVE-2023-24626 allows sending SIGHUP to arbitrary PIDsHitendra Prajapati2023-04-262-0/+41
| | | | | | | | | Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/screen.git/commit/?id=e9ad41bfedb4537a6f0de20f00b27c7739f168f7 (From OE-Core rev: d1f99b928b0a57bec879dde1b1b94c3c09286ea0) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: ignore CVE-2022-41716Peter Marko2023-04-261-0/+3
| | | | | | | | | | | | | | This CVE is specific to Microsoft Windows, ignore it. Patch fixing it (https://go-review.googlesource.com/c/go/+/446916) also adds a redundant check to generic os/exec which could be backported but it should not be necessary as backport always takes a small risk to break old code. (From OE-Core rev: 4263f3fda59aacb4f159d2dffb52e5f66249b5e4) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* systemd: Fix CVE-2023-26604rajmohan r2023-04-265-0/+597
| | | | | | | | | | | | | | | | | | | | | | | | Below patch files to fix CVE-2023-26604 CVE-2023-26604-1.patch, CVE-2023-26604-2.patch and CVE-2023-26604-3.patch and CVE-2023-26604-4.patch make pager secure when under euid is changed or explicitly requested Reference: CVE-2023-26604-1.patch: https://github.com/systemd/systemd/pull/17270/commits/612ebf6c913dd0e4197c44909cb3157f5c51a2f0 CVE-2023-26604-2.patch: https://github.com/systemd/systemd/pull/17270/commits/1b5b507cd2d1d7a2b053151abb548475ad9c5c3b CVE-2023-26604-3.patch: https://github.com/systemd/systemd/pull/17270/commits/0a42426d797406b4b01a0d9c13bb759c2629d108 CVE-2023-26604-4.patch: https://github.com/systemd/systemd/pull/17359/commits/b8f736b30e20a2b44e7c34bb4e43b0d97ae77e3c (From OE-Core rev: 7880eb801dcee44a9e8920d249057492d1de6b12) Signed-off-by: rajmohan r <rajmohan.r@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41722Shubham Kulkarni2023-04-263-0/+159
| | | | | | | | | | | path/filepath: do not Clean("a/../c:/b") into c:\b on Windows Backport from https://github.com/golang/go/commit/bdf07c2e168baf736e4c057279ca12a4d674f18c (From OE-Core rev: 70135bf04eb7173434a7240ddf11639d13aab003) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27538 fix SSH connection too eager reuseHitendra Prajapati2023-04-262-0/+32
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb (From OE-Core rev: b2740d1ff74b2c55011b5d4230c7b06b5109376d) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27534 SFTP path ~ resolving discrepancyHitendra Prajapati2023-04-192-0/+124
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/4e2b52b5f7a3bf50a0f1494155717b02cc1df6d6 (From OE-Core rev: 9aefb4e46cf4fbf14b46f9adaf3771854553e7f3) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: CVE-2023-28756 ReDoS vulnerability in TimeHitendra Prajapati2023-04-192-0/+62
| | | | | | | | | Upstream-Status: Backport from https://github.com/ruby/ruby/commit/957bb7cb81995f26c671afce0ee50a5c660e540e (From OE-Core rev: 52d26edffdd0444588ecad56b40a65e225889a01) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix build error introduced by CVE-2021-3929 fixGaurav Gupta2023-04-194-15/+221
| | | | | | | | | | | | | | | | | | | | | | The patch for CVE-2021-3929 applied on dunfell returns a value for a void function. This results in the following compiler warning/error: hw/block/nvme.c:77:6: error: void function 'nvme_addr_read' should not return a value [-Wreturn-type] return NVME_DATA_TRAS_ERROR; ^ ~~~~~~~~~~~~~~~~~~~~ In newer versions of qemu, the functions is changed to have a return value, but that is not present in the version of qemu used in “dunfell”. Backport some of the patches to correct this. (From OE-Core rev: 4ad98f0b27615ad59ae61110657cf69004c61ef4) Signed-off-by: Gaurav Gupta <gauragup@cisco.com> Signed-off-by: Gaurav Gupta <gauragup@cisco.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ffmpeg: fix for CVE-2022-3341Bhabu Bindu2023-04-192-0/+68
| | | | | | | | | | | | | | | | | | | avformat/nutdec: Add check for avformat_new_stream Check for failure of avformat_new_stream() and propagate the error code. Upstream-Status: Backport [https://git.yoctoproject.org/poky/commit/?h=kirkstone&id=bba70ce34115151362bfdc49a545ee708eb297ca] (From OE-Core rev: e17ddd0fafb562ed7ebe7708dac9bcef2d6cecc1) (From OE-Core rev: 0c68435a7c0ff1c417119dbd408e75443c09afcb) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bba70ce34115151362bfdc49a545ee708eb297ca) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bmap-tools: switch to main branchMartin Jansa2023-04-141-1/+1
| | | | | | | | | | | | | | | | | | | | * master branch was removed upstream: downloads/git2/github.com.intel.bmap-tools $ git remote prune origin Pruning origin URL: https://github.com/intel/bmap-tools * [pruned] refs/heads/master * [pruned] refs/pull/73/merge * downloads/git2/github.com.intel.bmap-tools $ git branch -a --contains c0673962a8ec1624b5189dc1d24f33fe4f06785a main release-3.0 (From OE-Core rev: 4045bf02bbc6e87a05ba689a63c675e49c940772) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 369fee186d6916322b9be9d936b654d0c5910cb3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.1403 -> 9.0.1429Randy MacLeod2023-04-141-2/+2
| | | | | | | | | | | | Fixes: CVE-2023-1127, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264, CVE-2023-1355 (From OE-Core rev: 821229f48f5b31aeb646f08c7e4656dc4ce8b0f4) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2415072c3800feb164dd4d1fa0b56bd141a5cbd8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cve-check: Fix false negative version issueGeoffrey GIRY2023-04-143-1/+60
| | | | | | | | | | | | | | | | NVD DB store version and update in the same value, separated by '_'. The proposed patch check if the version from NVD DB contains a "_", ie 9.2.0_p1 is convert to 9.2.0p1 before version comparison. [YOCTO #14127] Reviewed-by: Yoann CONGAL <yoann.congal@smile.fr> (From OE-Core rev: eb439b1283b60e6665694ff28c89fbd633eda6b0) Signed-off-by: Geoffrey GIRY <geoffrey.giry@smile.fr> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 7d00f6ec578084a0a0e5caf36241d53036d996c4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix compile error which imported by CVE-2022-4144Hitendra Prajapati2023-04-142-0/+237
| | | | | | | | | Upstream-Status: Backport from https://github.com/qemu/qemu/commit/61c34fc && https://gitlab.com/qemu-project/qemu/-/commit/8efec0ef8bbc1e75a7ebf6e325a35806ece9b39f (From OE-Core rev: d17f4c741c66268ce54ff89be2be9b0402c98df2) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* git: Security fix for CVE-2023-22490 and CVE-2023-23946Vijay Anusuri2023-04-145-0/+643
| | | | | | | | | | | | | Upstream-Status: Backport from https://github.com/git/git/commit/58325b93c5b6212697b088371809e9948fee8052 & https://github.com/git/git/commit/cf8f6ce02a13f4d1979a53241afbee15a293fce9 & https://github.com/git/git/commit/bffc762f87ae8d18c6001bf0044a76004245754c (From OE-Core rev: 071fb3b177bcbdd02ae2c28aad97af681c091e42) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go-runtime: Security fix for CVE-2022-41723Shubham Kulkarni2023-04-142-0/+157
| | | | | | | | | | | | Disable cmd/internal/moddeps test, since this update includes PRIVATE track fixes. Backport from https://github.com/golang/go/commit/5c3e11bd0b5c0a86e5beffcd4339b86a902b21c3 (From OE-Core rev: 53a303fb5908edaf29e35abb08fff93e7c0ff92c) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-23916 HTTP multi-header compression denial of serviceHitendra Prajapati2023-04-142-0/+232
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/119fb187192a9ea13dc90d9d20c215fc82799ab9 (From OE-Core rev: b121b59cf6f642f46c97c96f3c4cf4cd84ff2af5) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* classes/package: Use gzip for extended package dataJoshua Watt2023-04-012-8/+6
| | | | | | | | | | | | | The master version of extended package data uses zstd for efficient compression, but it relies on the zstd tool to be present on the host system. Since dunfell supports older distros, we don't want to add this tool as an additional requirement so switch to using gzip instead. (From OE-Core rev: 1c7d555379c4b0962bccd018870989050d87675f) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-09 02:58:04 +0000