aboutsummaryrefslogtreecommitdiffstats
path: root/meta-oe
AgeCommit message (Collapse)Author
2022-08-02meta-oe: Add leading whitespace for append operatorKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 92441f9d6a958c245a03f89ec44ef2c17dd6b0ee) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-16xterm: CVE-2022-24130 Buffer overflow in set_sixel in graphics_sixel.cHitendra Prajapati
Source: https://github.com/ThomasDickey/xterm-snapshots/ MR: 115675 Type: Security Fix Disposition: Backport from https://github.com/ThomasDickey/xterm-snapshots/commit/1584fc227673264661250d3a8d673c168ac9512d ChangeID: 6ad000b744527ae863187b570714792fc29467d9 Description: CVE-2022-24130 xterm: Buffer overflow in set_sixel in graphics_sixel.c. Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-16openldap: CVE-2022-29155 OpenLDAP SQL injectionHitendra Prajapati
Source: https://git.openldap.org/openldap/openldap MR: 117821 Type: Security Fix Disposition: Backport from https://git.openldap.org/openldap/openldap/-/commit/87df6c19915042430540931d199a39105544a134 ChangeID: d534808c796600ca5994bcda28938d45405bc7b4 Description: CVE-2022-29155 openldap: OpenLDAP SQL injection Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15php: move to version v7.4.28Jeroen Hofstee
CVE: CVE-2021-21703 CVE-2021-21706 CVE-2021-21707 CVE-2021-21708 Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com> [Didn't apply cleanly, corrected.] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15iperf: Set CVE_PRODUCT to "iperf_project:iperf"Akash Hadke
Set CVE_PRODUCT as 'iperf_project:iperf' for iperf2 and iperf3 recipes, cve-check class is setting default CVE_PRODUCT to 'iperf2' and 'iperf3' respectively which ignores the iperf CVEs from NVD Database. Reference: CVE-2016-4303 Link: https://nvd.nist.gov/vuln/detail/CVE-2016-4303 Signed-off-by: Akash Hadke <akash.hadke@kpit.com> Signed-off-by: Akash Hadke <hadkeakash4@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15grpc: switch from master branch to main for upbMartin Jansa
* hardknott and newer branches don't need this as upb repo was removed in: commit 15cff67fd6cdb34e3621368fe9ce94a98356f27a Author: Anatol Belski <anbelski@linux.microsoft.com> Date: Fri Feb 19 12:39:55 2021 +0000 grpc: Upgrade 1.24.3 -> 1.35.0 Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15leveldb: switch from master branch to mainMartin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15tesseract-lang: switch from master branch to mainMartin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-05mariadb: update to 10.4.25Armin Kuster
Source: mariadb.org MR: 117530, 117522, 117514, 117506, 117497, 117489, 117481, 117473, 117465, 117457, 117449, 117380, 117364, 117356, 117336, 117212, 117204, 117196, 117180, 117188, 117169, 117161, 117441, 117372 Type: Security Fix Disposition: Backport from mariagdb.org ChangeID: 8bf787570ebe8503d2974af92e17b505e70440e5 Description: LTS version, bug fix only. Include these CVES: CVE-2022-27458 CVE-2022-27457 CVE-2022-27456 CVE-2022-27455 CVE-2022-27452 CVE-2022-27451 CVE-2022-27449 CVE-2022-27448 CVE-2022-27447 CVE-2022-27446 CVE-2022-27445 CVE-2022-27444 CVE-2022-27387 CVE-2022-27386 CVE-2022-27385 CVE-2022-27384 CVE-2022-27383 CVE-2022-27382 CVE-2022-27381 CVE-2022-27380 CVE-2022-27379 CVE-2022-27378 CVE-2022-27377 CVE-2022-27376 Signed-off-by: Armin Kuster <akuster@mvista.com>
2022-05-25opencl-headers: switch to main branchJulien STEPHAN
master branch was renamed main on upstream project, so update the URI Signed-off-by: Julien STEPHAN <jstephan@baylibre.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25opencl-icd-loader: switch to main branchJulien STEPHAN
master branch was renamed main, so update the URI Signed-off-by: Julien STEPHAN <jstephan@baylibre.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25openjpeg: Whitelist CVE-2020-27844 and CVE-2015-1239Sana Kazi
Whitelist CVE-2020-27844 as it is introduced by https://github.com/uclouvain/openjpeg/commit/4edb8c83374f52cd6a8f2c7c875e8ffacccb5fa5 but the contents of this patch is not present in openjpeg_2.3.1 Link: https://security-tracker.debian.org/tracker/CVE-2020-27844 Whitelist CVE-2015-1239 as the CVE description clearly states that j2k_read_ppm_v3 function in openjpeg is affected due to CVE-2015-1239 but in openjpeg_2.3.1 this function is not present. Hence, CVE-2015-1239 does not affect openjpeg_2.3.1. Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25ostree: prevent ostree-native depending on target virtual/kernel to provide ↵Martin Jansa
kernel-module-overlay Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25lua: fix CVE-2022-28805Steve Sakoman
singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code. https://nvd.nist.gov/vuln/detail/CVE-2022-28805 (From OE-Core rev: d2ba3b8850d461bc7b773240cdf15b22b31a3f9e) Signed-off-by: Sana Kazi <sana.kazi@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 91e14d3a8e6e67267047473f5c449f266b44f354) Signed-off-by: Omkar Patil <omkar.patil@kpit.com> Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-19postgresql: Fix build on riscvKhem Raj
Remove duplicate code Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit aa22894fa352986a62c4530ad8facd8868b2e535) [Fixup for Dunfell context] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18mongodb: Pass OBJCOPY to scons so it does not use it from hostKhem Raj
Fixes objcopy: Unable to recognise the format of the input file `build/opt/mongo/mongos' Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Vincent Prince <vincent.prince.fr@gmail.com.com> (cherry picked from commit e91940073af4e19cd18a09cd12aa381ff60fe54b) [Fix up for Dunfell context: also fixes Please add a conforming MONGO_VERSION=x.y.z[-extra] as an argument to SCons] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18Mariadb: update to 10.4.24Armin Kuster
Source: Mariadb.org MR: 115460, 115507, 1115549, 115549, 115488 Type: Security Fix Disposition: Backport from mariadb.org ChangeID: 722782cefa6805e907ee377a340f1b8bec174079 Description: Bug fix only update, includes these CVES: CVE-2021-46665 CVE-2021-46664 CVE-2021-46661 CVE-2021-46668 CVE-2021-46663 For more information see: https://mariadb.com/kb/en/mariadb-10424-release-notes/ drop mariadb/c11_atomics.patch as its include in the update. drop mariadb/clang_version_header_conflict.patch different fix applied Signed-off-by: Armin Kuster <akuster@mvista.com>
2022-04-18polkit: fix overlapping changes in recent CVE patchesRalph Siemsen
Commit 17e931e77 ("polkit: fix CVE-2021-3560") contains - upstream commit a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81 Commit 67ec3e049 ("polkit: Fix for CVE-2021-4115") contains both: - upstream commit a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81 (CVE-2021-3560) - upstream commit 41cb093f554da8772362654a128a84dd8a5542a7 (CVE-2021-4115) Thus the fix for CVE-2021-3560 is applied twice, resulting in warnings during do_patch. Curiously it neither fails nor complains about patch already applied. Also devtool silently discards the duplicate patch. Drop the duplicate patch, to resolve following warnings: WARNING: polkit-0.116-r0 do_patch: Fuzz detected: Applying patch 0001-GHSL-2021-074-authentication-bypass-vulnerability-in.patch patching file src/polkit/polkitsystembusname.c Hunk #1 succeeded at 438 with fuzz 2 (offset 3 lines). Applying patch CVE-2021-4115.patch patching file src/polkit/polkitsystembusname.c Hunk #4 succeeded at 439 with fuzz 2. Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18multipath-tools: update SRC_URIMinjae Kim
The git repo for multipath-tools was changed, so update the SRC_URI accordingly with the new link. Signed-off-by:Minjae Kim <flowergom@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18nodejs: upgrade to 12.22.2Nisha Parrakat
upgrading to next maintainence LTS version Signed-off-by: Nisha Parrakat <nishaparrakat@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18spirv-tools: update SRC_URI for googletest to mainArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18breakpad: Update SRC_URI for protobuf and lssArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18breakpad: fix branch for gtest in SRC_URIThomas Perrot
The commit 4fe018038f87 is in the main branch, so the do_fetch task failed. Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit b8bb7dc157b248802218fcf80215f80a6c7cd6f3) [Fix up for Dunfell context] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18cli11: switch from default master branch to main to fix do_fetch failureChristian Ege
The branch was renamed in the upstream repository Signed-off-by: Christian Ege <christian.ege@ifm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18imagemagick: update SRC_URI branch from master to mainDaniel Stadelmann
master branch in imagemagick was renamed to main (https://github.com/ImageMagick/ImageMagick). Similar change is already in master branch for version 7.0.10 (see 248739128389) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27openjpeg: Fix multiple CVESana Kazi
Add patch to fix below CVE: CVE-2019-12973 CVE-2020-15389 CVE-2020-27814 CVE-2020-27823 CVE-2020-27824 CVE-2020-27841 CVE-2020-27842 CVE-2020-27843 CVE-2020-27845 Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27p7zip: Fix for CVE-2016-9296Virendra Thakur
Add patch to fix CVE-2016-9296 Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27polkit: fix CVE-2021-3560Mingli Yu
Backport a patch [1] to fix CVE-2021-3560. [1] https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81 Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Squashed together 6000f5a3b and 7f4f1ee71 Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27p7zip: refresh patchesArmin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-03-27p7zip: build and package lib7z.so needed for fastbootNisha Parrakat
a) use option 7z to build the lib7z.so library This is needed for android-tools for building fastboot from android-tools b) Packaged the lib7z.so and codec libraries as a part of this recipe Fastboot RDepends on it lib7z.so c) Fixed a C++17 forbidden error when lib7z.so is built fixes the below error | ../../../../CPP/7zip/Archive/Wim/WimHandler.cpp: In member function 'virtual LONG NArchive::NWim::CHandler::GetArchiveProperty(PROPID, PROPVARIANT*)': | ../../../../CPP/7zip/Archive/Wim/WimHandler.cpp:308:11: error: use of an operand of type 'bool' in 'operator++' is forbidden in C++17 | 308 | numMethods++; | | ^~~~~~~~~~ | ../../../../CPP/7zip/Archive/Wim/WimHandler.cpp:318:9: error: use of an operand of type 'bool' in 'operator++' is forbidden in C++17 | 318 | numMethods++; Signed-off-by: Nisha Parrakat <Nisha.Parrakat@kpit.com> Signed-off-by: Nisha Parrakat <nishaparrakat@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Akash Hadke <Akash.Hadke@kpit.com> Signed-off-by: Akash Hadke <hadkeakash4@gmail.com> (cherry picked from commit 3c36a8efe2a964c3aa9bfcd836cee3f80a837fcd) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27googletest: Switch branch from master to mainPeter Kjellerstedt
The master branch has been renamed to main in the github repo. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27protobuf: fix patch fuzzRoss Burton
Applying patch CVE-2021-22570.patch patching file src/google/protobuf/descriptor.cc Hunk #1 succeeded at 2603 with fuzz 1 (offset -23 lines). Hunk #2 succeeded at 2817 with fuzz 1 (offset -14 lines). Hunk #3 succeeded at 4006 (offset -17 lines). Hunk #4 succeeded at 4050 (offset -18 lines). Hunk #5 succeeded at 4368 (offset -18 lines). Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27polkit: Fix for CVE-2021-4115Ranjitsinh Rathod
Add patch to fix CVE-2021-4115 Also, add a support patch to cleanly apply CVE patch Link: https://gitlab.freedesktop.org/polkit/polkit/-/merge_requests/109 Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-23protobuf: Fix CVE-2021-22570Sana Kazi
Fix CVE-2021-22570. Link: https://koji.fedoraproject.org/koji/buildinfo?buildID=1916865 Link: https://src.fedoraproject.org/rpms/protobuf/blob/394beeacb500861f76473d47e10314e6a3600810/f/CVE-2021-22570.patch Remove first and second hunk because the second argument in InsertIfNotPresent() function is of type const char* const& but the first and second hunk makes the type of second argument as const string which is not compatible with the type of second argument in InsertIfNotPresent(). Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-23cryptsetup: Add runtime dependency on lvm2-udevrules for udevKristian Klausen
Without the udevrules cryptsetup luksOpen will be hanging with "Udev cookie 0xd4de0f6 (semid 5) waiting for zero". Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 60b33e376b2331cd20950f0745336397790d2201) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 32f1d758a14bba35d67a75778ae747f1ff5c5482) [Minor fixup for Dunfell] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-20graphviz: native: create /usr/lib/graphviz/config6 in populate_sysrootChristian Eggers
The `dot` tool requires to be run once after installation in order to create its configuration file. The do_prepare_recipe_sysroot task uses do_populate_sysroot in order to prepare the recipe-sysroot-native. Package postinstall scripts are not executed for -native packages, but files under ${BINDIR}/postinst-* are. This is quite the same as graphviz-setup.sh does for nativesdk. The general idea has been taken from OECORE/meta/classes/pixbufcache.bbclass. Signed-off-by: Christian Eggers <ceggers@arri.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-13nss: Add fix for CVE-2022-22747Ranjitsinh Rathod
Add a patch to fix CVE-2022-22747 Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-06nodejs: Fix for CVE-2021-44532Virendra Thakur
Add patch to fix CVE-2021-44532 Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-06linuxptp: Update to 2.0.1Robert Joslyn
Fixes CVE-2021-3570 and CVE-2021-3571 Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-06p7zip: fix for CVE-2018-5996Virendra Thakur
Add patch to fix CVE-2018-5996 Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-29udisks2: Fix for CVE-2021-3802Virendra Thakur
Add patch to fix CVE-2021-3802 Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-29dbus-daemon-proxy: add missing `return` statementLeif Middelschulte
The missing `return` statement leads to a `SIGABRT`. Signed-off-by: Leif Middelschulte <Leif.Middelschulte@klsmartin.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 77479e1c9b7bffb6ad89ae68f80605ad1c65ea75) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-27CVE-2021-4034: polkit Local privilege escalation in pkexec due to incorrect ↵Jeremy Puhlman
handling of argument vector Upstream-Status: Backport CVE: CVE-2021-4034 Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-01-27c-ares: bump PV in recipe to 1.16.1Armin Kuster
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27postgresql: Update to 12.9Robert Joslyn
Bug and security fixes. Fix patch fuzz as well to remove bitbake warning. Release notes available at: https://www.postgresql.org/docs/release/12.8/ https://www.postgresql.org/docs/release/12.9/ 12.8 fixes: CVE-2021-3677 12.9 fixes: CVE-2021-23214 CVE-2021-23222 Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-27libmicrohttpd: Add patch to fix CVE-2021-3466Ernst Sjöstrand
Extract patch from the 0.9.71 release commit. Upstream-Status: Backport CVE: CVE-2021-3466 Signed-off-by: Ernst Sjöstrand <ernst.sjostrand@verisure.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-18nss: Fix CVE-2021-43527sana kazi
Add patch to fix CVE-2021-43527 which causes heap overflow in nss. Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-18c-ares: switch from master to mainJeremy Puhlman
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-12-03brotli: add patch to fix CVE-2020-8927Spectrejan
Port patch to fix CVE-2020-8927 for brotli from Debian Buster CVE: CVE-2020-8927 Signed-off-by: Jan Kraemer <jan@spectrejan.de> [Fixup to apply with URL changes] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-30jansson: whitelist CVE-2020-36325Marta Rybczynska
According to the upstream [1], the bug happens only if the programmer does not follow the API definition. [1] https://github.com/akheron/jansson/issues/548 Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-08 00:46:34 +0000