aboutsummaryrefslogtreecommitdiffstats
path: root/meta-oe
AgeCommit message (Collapse)Author
2021-03-16opencv: Security fixesNeetika Singh
Added patches to fix below CVE's: 1. CVE-2019-14491, CVE-2019-14492 Link: https://github.com/opencv/opencv/commit/ac425f67e4c1d0da9afb9203f0918d8d57c067ed 2. CVE-2019-14493 Link: https://github.com/opencv/opencv/commit/5691d998ead1d9b0542bcfced36c2dceb3a59023 3. CVE-2019-15939 Link: https://github.com/opencv/opencv/commit/5a497077f109d543ab86dfdf8add1c76c0e47d29 4. CVE-2019-19624 Link: https://github.com/opencv/opencv/commit/d1615ba11a93062b1429fce9f0f638d1572d3418 Signed-off-by: Neetika.Singh <Neetika.Singh@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-16nss: Fix warnings generated by getcwdAndrei Gherzan
getcwd() conforms to POSIX.1-2001 which leaves the behaviour when the buf argument is NULL, undefined. This makes gcc 10+ throw the following warning: argument 1 is null but the corresponding size argument 2 value is 4096 Initially, this was fixed by disabling NSS_ENABLE_WERROR. This patch re-enables NSS_ENABLE_WERROR (by leaving it to its default value) and takes advantage of the existing functionality in nss that wraps the getcwd call into a function making sure that the buf argument is always properly allocated. Signed-off-by: Andrei Gherzan <andrei.gherzan@huawei.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-03-16thin-provisioning-tools: switch branch from master to mainchangqing.li@windriver.com
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> [cherry picked from commit 260809cffdaad4fcd42b0977090f2c467a5474ef to dunfell] Signed-off-by: Praneeth Bajjuri <praneeth@ti.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-19postgresql: Inherit python3targetconfigKhem Raj
it now ends up searching native python shared libraries and tries to link with it and fails on non-host architectures recipe-sysroot-native/usr/lib/libpython3.9.so: file not recognized: file format not recognized collect2: error: ld returned 1 exit status Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c499aaeef80b5af8d20521658449c4148f3d0806) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 572d4148267c6ff1b43dd3498020349cb0aa77c7) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-19libplist: Inherit python3targetconfigKhem Raj
Fixes configure: error: Could not link test program to Python. Maybe the main Python library has been installed in some non-standard library path. If so, pass it to configure, via the LIBS environment variable. Example: ./configure LIBS="-L/usr/non-standard-path/python/lib" Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit be7d2286bfe80835e8e014114aaf587e2930c683) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit a0c26ca2b4c5e18a22b8d6f3c952fb00caf2bd34) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-16graphviz: use git fetcher instead of gitlab archivesMartin Jansa
* fixes: graphviz-2.40.1-r0 do_package_qa: QA Issue: graphviz: SRC_URI uses unstable GitHub/GitLab archives, convert recipe to use git protocol [src-uri-bad] * it's already fixed in gatesgarth and newer with new version from: commit 985be3901e79c9e45cd5d23774e3cfdaab476b44 Author: Khem Raj <raj.khem@gmail.com> Date: Mon Nov 2 18:33:34 2020 -0800 graphviz: Upgrade to 2.44.1 release - Refresh patches to apply on new sources - Switch away from gitlab archives - Bypass pdf documentation generation Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2021-02-15meta-oe/README: add Ubuntu prerequisite informationakuster
When building on Ubuntu 20.04, luajit needs 32bit support so install 'gcc-multilib' Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 973fe410d238e0c361f8bc4d9ba7915464217e22) [Minor fixup for Dunfell] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-15enca: Fix SRC_URIakuster
The project appears to have moved. Update HOMEPAGE and SRC_URI. bz2 is not available, use gz Update HASH accordingly. Fixes: WARNING: enca-1.9-r0 do_fetch: Failed to fetch URL http://www.sourcefiles.org/Networking/Tools/Miscellanenous/enca-1.9.tar.bz2, attempting MIRRORS if available Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 460077d30ffedca4c794f60cd0f21404fc1736d7) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-04libuv: fix CVE-2020-8252Andrej Kozemcak
Signed-off-by: Andrej Kozemcak <andrej.kozemcak@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-02-04openldap: upgrade 2.4.56 -> 2.4.57zhengruoqin
Source: meta-openembedded MR: 108384, 108398, 108412, 108426, 108440, 108454, 108468, 108482, 108496, 108510 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-oe/recipes-support/openldap?id=0282b8ce6a5a5f082a37cb0863b3e62ad8e56a5a ChangeID: 0282b8ce6a5a5f082a37cb0863b3e62ad8e56a5a Description: -License-Update: Copyright year updated to 2021. Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 0282b8ce6a5a5f082a37cb0863b3e62ad8e56a5a) [Maintance update only] Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit cef93b7b00e620d90a610112ee574fa60b691cf8) [Fixes CVE: CVE-2020-36221 CVE-2020-36222 CVE-2020-36223 CVE-2020-36224 CVE-2020-36225 CVE-2020-36226 CVE-2020-36227 CVE-2020-36228 CVE-2020-36229 CVE-2020-36230 Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-02-04openldap: upgrade 2.4.51 -> 2.4.56zangrc
Source: meta-openembedded MR: 107249 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded/commit/meta-oe/recipes-support/openldap?id=768345053e83623e286ce3140756036e75c023bc ChangeID: fbcadc7f563891b4aa489557c8d518ed46de5e9d Description: Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 768345053e83623e286ce3140756036e75c023bc) [Maintenance update only] Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit e615c6fceff7275d93e462f4cd4a14cc55b2d656) [Fixed CVE-2020-25692] Signed-off-by: Armin Kuster <akuster@mvista.com>
2021-02-03openldap: upgrade 2.4.50 -> 2.4.51Zang Ruochen
Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 70860d99bf4e8036af1adccced8f9066f6dd50a6) [Bug fix only update] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-31gpsd: mark CLEANBROKENSean Nyekjaer
Signed-off-by: Sean Nyekjaer <sean@geanix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 04afc692a3c82a93da0f079b1a3f90c8188e8c86) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-29mariadb: Fix 64bit builds if pam is enabledDan Murphy
Fix the installation of the pam.so for 64bit builds. This is an indirect backport of commit 8fa0a3ace6b8835ba623fac118e0bdb4ea0f1f24 ("mariadb: upgrade to 10.5.4") from the master branch. Signed-off-by: Dan Murphy <dmurphy@ti.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28giflib: apply patch for CVE-2019-15133 and set CVE_PRODUCTMikko Rapeli
Backport upstream patch for CVE-2019-15133. Set CVE_PRODUCT to "giflib_project:giflib" which is used in NVD. https://nvd.nist.gov/vuln/detail/CVE-2019-15133 Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28sip3: Upgrade 4.19.19 -> 4.19.23Leon Anavi
Upgrade to release 4.19.23: - Added some missing quotes to configure.py - Fixed a race condition when calling the PyQt5-specific meta-call helper. - Fixed the wrapping of methods that return a Py_Ssize_t. - The code generator now distinguishes between the copy/assignment helper and the array helper when determining which helpers can be generated. - Fixed the code generation when making a copy of C++ object on the stack to the heap when the class has no suitable ctor. - Check there is a public copy ctor when we can't using an assigment operator as a workaround. - Preserve any current exception in the implementation of the wrapper dealloc functions. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 358b3982583c93fdc0a4cebdab31f923d77b7f8b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28sip3: Consolidate in a single fileLeon Anavi
Consolidate inc and bb files into a single bb file. Fix the broken link for HOMEPAGE. Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 2bc281393aa6c6b83218f2996c32b793ac79a42a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28zram: fix sourcing of zram parametersSøren Andersen
Signed-off-by: Søren Andersen <san@skov.dk> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 3c8ad9192c1c9f4323bdc7ff28456f11db689adb) Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28rapidjson: Upgrade SRCREV to latestHarpritkaur Bhandari
Upgrade SRCREV to latest as it fixes the below issue: Running UndefinedBehaviorSanitizer on projects that use rapidjson triggers 'applying non-zero offset <NN> to null pointer' findings in 'internal/stack.h' which are hard to suppress by library users. Removed "0001-CMake-remove-hardcoded-CMAKECONFIG_INSTALL_DIR-path.patch" as the changes are already incorporated in the latest codebase. As per abi-compliance-checker report the source compatibility and binary compatibility between previous SRCREV 6a905f9311f82d306da77bd963ec5aa5da07da9c and current SRCREV 0ccdbf364c577803e2a751f5aededce935314313 is 100% and this patch is already tested on 64bit ARM (aarch64) in a product with on target CI tests. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 04d9ea0ba7ece968244bf049893dd5636675b76f) Signed-off-by: Harpritkaur Bhandari <Harpritkaur.Bhandari@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28flatbuffers: whitelist CVE-2020-35864Mikko Rapeli
CVE-2020-35864 is for the rust crate for flatbuffers, not flatbuffers itself. https://security-tracker.debian.org/tracker/CVE-2020-35864 "NOT-FOR-US: flatbuffers rust crate" Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-18xterm: provide virtual/x-terminal-emulatorDmitry Baryshkov
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 8826791d795e65851ad20bbc0f34e74b2bf72e07) (cherry picked from commit 2ed77abf132696b7f3a8b9f8f422eb33ff711038) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-18xterm: install xterm and uxterm desktop filesDmitry Baryshkov
Modify recipe to install application desktop files for xterm. Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 593f21eda5b119f6408975c6b15e94fb168cc9dc) (cherry picked from commit a653238398d483c805c3d026d890162f131ecc01) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-18postgresql: Update to 12.5Robert Joslyn
Fixes the following CVEs: CVE-2020-25694 CVE-2020-25695 CVE-2020-25696 Full release notes at: https://www.postgresql.org/docs/12/release-12-5.html Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 6ff4bd4f345b4e8030b9197d13097308df521576) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-14geoclue: select avahi-daemon if nmea enabledChenxi Mao
geoclue serivce rely on avahi-daemon, so enable it by default. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9239584e717bb2093c9bfd6972bb2f01507ab859) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-14libsdl2-mixer: set --disable-music-ogg-shared to link staticallyjabdoa2
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 69bae2a2360643805de2ae1cd9ebc4202cd5a2fb) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-14libsdl2-mixer: Fix ogg/vorbis support in libsdl2-mixerjabdoa2
Remove --enable-music-ogg-tremor as it broke vorbis support: checking tremor/ivorbisfile.h usability... no checking tremor/ivorbisfile.h presence... no checking for tremor/ivorbisfile.h... no checking for ov_open_callbacks in -lvorbisidec... no configure: WARNING: *** Unable to find Ogg Vorbis Tremor library (http://www.xiph.org/) configure: WARNING: Ogg Vorbis support disabled With this change: checking vorbis/vorbisfile.h usability... yes checking vorbis/vorbisfile.h presence... yes checking for vorbis/vorbisfile.h... yes checking for ov_open_callbacks in -lvorbisfile... yes -- dynamic libvorbisfile -> libvorbisfile.so.3 Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 074c7d9a1ebb86674f02d8a5545e1ed54f6d87fe) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13nodejs: 12.19.1 -> 12.20.1Sean Nyekjaer
Signed-off-by: Sean Nyekjaer <sean@geanix.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit cde1019804c2f7b67bf89d178eec9f4efafea414) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit ac6bc96e7da6b3c9d5b9c9272b487a926fbb462e) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13nodejs: 12.19.0 -> 12.19.1Stacy Gaikovaia
Uprev nodejs in order to fix CVE-2020-8277. This CVE allows an attacker to trigger a DNS request for a host of their choice, which could trigger a Denial of Service in nodejs versions < 12.19.1. See https://nvd.nist.gov/vuln/detail/CVE-2020-8277 for details. CVE: CVE-2020-8277 Signed-off-by: Stacy Gaikovaia <Stacy.Gaikovaia@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a44015408253d8a4f64055f41fa1f497aeacfc30) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 387f40ce8068ec8848c2e3b76ce2e3267b98c3d6) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13nodejs: Update to 12.19.0Khem Raj
This perhaps is last release in 12.x LTS Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a10f894a8e7f800d2412fff8d47fb37d363fa322) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13nodejs: Fix arm32/thumb builds with clangKhem Raj
Backport a patch from upstream to take care of build failure e.g. | ../deps/v8/src/codegen/arm/cpu-arm.cc:38:16: error: write to reserved register 'R7' | asm volatile("svc 0\n" | ^ | 1 error generated. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 45a2dfdd0f16ed6941926e2dca1ad90f36e120bc) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13nodejs: Upgrade to 12.18.3Khem Raj
Drop already upstreamed patches use builtin uv, it does not build without it Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit bda3ee6276d76a10d2b5564da5709db4c21b8f13) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13nodejs: Fix build with icu 67.1Khem Raj
Remove soon-to-be removed getAllFieldPositions Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Andrej Valek <andrej.valek@siemens.com> (cherry picked from commit 7910f2b64575dcd3352effd441accb3b56e3554d) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12nss: Security fix CVE-2020-12401Armin Kuster
Source: Mozilla.org MR: 106876 Type: Security Fix Disposition: Backport from https://hg.mozilla.org/projects/nss/raw-rev/aeb2e583ee957a699d949009c7ba37af76515c20 ChangeID: a61d4926f8ab5afc54c23e58cd86b4a7609c9708 Description: Fixes CVE-2020-12401 Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12lua: update to 5.3.6Armin Kuster
LIC_FILES_CHKSUM changed to do year updates This is the last 5.3.x update. This will give us the best starting point for doing Maintence moving forward. Its a bug fix only update. See http://www.lua.org/work/diffs-lua-5.3.5-lua-5.3.6.html Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12lua: fix CVE-2020-24371Wenlin Kang
Source: openembedded.org MR: 105165 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded gatesgarth ChangeID: 747161877824daae061bc4fb458f55ab033f62f4 Description: Fix CVE-2020-24371 Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12lua: fix CVE-2020-15945Wenlin Kang
Source: openembedded.org MR: 104897 Type: Security Fix Disposition: Backport from https://git.openembedded.org/meta-openembedded gatesgarth ChangeID: 6c43941d116bbb9f0d62ca5376da24ae03eb9eab Description: Fixes CVE-2020-15945 Backport with modifications to apply successfully. Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-12mariadb: update to 10.4.17 for cve fixesArmin Kuster
Source: mariadb.org MR: 107836, 107837, 107838, 107839, 107840, 107852, 106414, 106414, 107864, 107876, 107888 Type: Security Fix Disposition: Backport from mariadb.org ChangeID: 75fb83ced15990b94659af6e107c063d288cb037 Description: refresh several patches Drop 0001-Fix-build-breakage-from-lock_guard-error-6161.patch as fix included in update Bugfix only update including these cves: 10.4.13 CVE-2020-2752 CVE-2020-2812 CVE-2020-2814 CVE-2020-2760 CVE-2020-13249 10.4.15 CVE-2020-15180 10.4.16 CVE-2020-14812 CVE-2020-14765 CVE-2020-14776 CVE-2020-14789 CVE-2020-28912 (MDEV-24040) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10php: CVE-2020-7069Zheng Ruoqin
Security Advisory References https://nvd.nist.gov/vuln/detail/CVE-2020-7069 https://bugs.php.net/patch-display.php?bug_id=79601&patch=openssl_aes_ccm_iv_fix&revision=latest Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit fa80193468745a11bc12d5845f66412a0d62e0e2) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 992e09f09a40e7a8d03c7c4b5adf40f821ed3774) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10php: CVE-2020-7070Zheng Ruoqin
Security Advisory References https://nvd.nist.gov/vuln/detail/CVE-2020-7070 https://bugs.php.net/patch-display.php?bug=79699&patch=fix-urldecode&revision=1600650364 https://github.com/php/php-src/blob/master/main/php_variables.c Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit aff8a1fefb9a1a311e5ba14ad69871514270803a) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 09f5a2ac5ab8550f5f0bd05417f2f54d27995dac) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10php: remove the failing ${D}/${TMPDIR} codeMax Kellermann
Appending ${TMPDIR} to ${D} doesn't make any sense, because both are absolute paths. And additionally, the code fails: rmdir: failed to remove '/usr/src/oe/tmp-musl/work/core2-64-oe-linux-musl/php/7.1.9-r0/image//usr': Directory not empty Signed-off-by: Max Kellermann <max.kellermann@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit f6338892d9c57c51ed48b04f587b468f7718a8ba) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10php: Upgrade 7.4.4 -> 7.4.9Leon Anavi
Upgrade to release 7.4.9: - Fixed: Upgrade apache2handler's php_apache_sapi_get_request_time to return usec - Fixed: BSTR to PHP string conversion not binary safe - Fixed: DCOM does not work with Username, Password parameter - Fixed: serialize() and unserialize() methods can not be called statically - Fixed: Segfault in php_str_replace_common - Fixed: Assertion failure if dumping closure with unresolved static variable - Fixed: Assertion failure when assigning property of string offset by reference - Fixed: HT iterators not removed if empty array is destroyed - Fixed: Changing array during undef index RW error segfaults - Fixed: Use after free if changing array during undef var during array write fetch - Fixed: Use after free if string used in undefined index warning is changed - Fixed: Public non-static property in child should take priority over private static - Fixed: getimagesize function silently truncates after a null byte - Fixed: finfo_file crash (FILEINFO_MIME) - Fixed: ftp_size on large files - Fixed: mb_strimwidth does not trim string - Fixed: Use of freed hash key in the phar_parse_zipfile function - Fixed: ::getStaticProperties() ignores property modifications - Fixed: ::getStaticPropertyValue() throws on protected props - Fixed: Use after free when type duplicated into ReflectionProperty gets resolved - Fixed: Can't copy() large 'data://' with open_basedir - Fixed: dns_check_record() always return true on Alpine - Fixed: array_walk() does not respect property types Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit f46931abf073a4c5b02a160a89fe073f1b67632b) [Bug fix on update. lts version] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10zabbix: CVE-2020-15803 Security AdvisoryWang Mingyu
References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15803 Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d259144422bb44af9dbc7397fc4077d0bf3fc83f) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit d9911b087c83e0c73fbe7eeb497ca388b62d7706) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-10mcpp: Normalize the patch format of CVEZang Ruochen
Because CVE-2019-14274.patch is included in ice-mcpp.patch, the cve-check-tool fails to correctly judge the CVE of the OSS. CVE-2019-14274.patch is separated from ice-mcpp.patch to fix the problem. Signed-off-by: Zang Ruochen <zangrc.fnst@cn.fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9301b77e3266160ffb7e9bfd69d445f0392076c8) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 81874b239287126805aa176907bd52e9a7801655) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-10pcsc-lite: provide pcsc-lite-lib-native explicitly for native buildRoland Hieber
Commits e2180b00b3b8fcf776c3 and 8edd760e66b48e411d2a added support for native builds for the opensc and pcsc-lite recipes, but building opensc-native fails after commit 40b3a5123120da0e4586 (2019-12-04, "opensc: fix RDEPENDS in pcsc PACKAGECONFIG"): ERROR: Required build target 'opensc-native' has no buildable providers. Missing or unbuildable dependency chain was: ['opensc-native', 'pcsc-lite-lib-native'] The commit in question is correct for target builds, but native builds don't have packages. The -lib part is also provided along with pcsc-lite-native, and there is no pcsc-lite-lib-native package. Ideally we would fix this in the opensc recipe. However, using syntax like "PACKAGECONFIG_class-native[pcsc]" in the opensc recipe is apparently not possible to overwrite the dependency for a native build, and using RDEPENDS_remove has no effect either – apparently dependencies from PACKAGECONFIG are added after RDEPENDS_remove is evaluated. Therefore let pcsc-lite provide the missing package name for native builds, even if fixing this unrelated package is not the most elegant solution. Fixes: 40b3a5123120da0e4586 (2019-12-04, "opensc: fix RDEPENDS in pcsc PACKAGECONFIG") Signed-off-by: Roland Hieber <rhi@pengutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-12-10dlt-daemon: add upstream patch to fix CVE-2020-29394Gianfranco
More information on: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976228 | A buffer overflow in the dlt_filter_load function in dlt_common.c in | dlt-daemon 2.8.5 (GENIVI Diagnostic Log and Trace) allows arbitrary | code execution because fscanf is misused (no limit on the number of | characters to be read in a format argument). Signed-off-by: Gianfranco Costamagna <costamagnagianfranco@yahoo.it> Signed-off-by: Gianfranco Costamagna <locutusofborg@debian.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> [Fix up for Dunfell context - AK] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-15remmina: use git fetcherMartin Jansa
* fixes QA recently backported to dunfell: WARNING: remmina-1.3.6-r0 do_package_qa: QA Issue: remmina: SRC_URI uses unstable GitHub/GitLab archives, convert recipe to use git protocol [src-uri-bad] Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-09Add missing dependencies for rsnapshot.Gianluca Pacchiella
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit dfd5685ca7fc5688a8b808e6784d1ab22ec12b47) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-09hplip: use libexecdirDiego Rondini
In oe-core commit: 2ce6ef29b9bb4f16ed9d78e166d455b7a6d968bf cups crossscripts have been fixed to report the correct serverbin folder, so backend, filters, etc, need to go in ${libexecdir} now. Signed-off-by: Diego Rondini <diego.rondini@kynetics.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit db7fc115e058e2e0e481e284768538f097cfdd90) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-09libeigen: update SRC_URI to use gitlab gitDiego Rondini
Update SRC_URI to use gitlab git repository. As discussed here gitlab archive stability is not fully guaranteed, so repository is preferred: https://forum.gitlab.com/t/gitlab-release-tarball-stability/41888/3 Signed-off-by: Diego Rondini <diego.rondini@kynetics.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit a6b2a0c3d045bd09d4049ca8fb155f881657c31f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2020-11-09libeigen: update SRC_URI to download from gitlabDiego Rondini
Bitbucket is no longer the official home of eigen, which has moved to gitlab. Update SRC_URI to download releases from gitlab, fixing: WARNING: libeigen-3.3.7-r0 do_fetch: Failed to fetch URL https://bitbucket.org/eigen/eigen/get/3.3.7.tar.bz2;downloadfilename=libeigen-3.3.7.tar.bz2, attempting MIRRORS if available Signed-off-by: Diego Rondini <diego.rondini@kynetics.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 605c28165ba02c160888fedd510bf8b04c9e2c49) Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-06-11 12:51:58 +0000