aboutsummaryrefslogtreecommitdiffstats
path: root/meta-oe
AgeCommit message (Collapse)Author
2024-04-02c-ares: Backport fix for CVE-2024-25629Ashish Sharma
Upstream-Status: Backport [https://github.com/c-ares/c-ares/commit/a804c04ddc8245fc8adf0e92368709639125e183] References: https://nvd.nist.gov/vuln/detail/CVE-2024-25629 https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q https://security-tracker.debian.org/tracker/CVE-2024-25629 Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-04-02postgresql: Update to 12.18Matthias Schmitz
Minor security and bugfix release. Fixes CVE-2024-0985: PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL Additional information is available in the release notes: https://www.postgresql.org/docs/release/12.18/ Signed-off-by: Matthias Schmitz <matthias.schmitz@port4949.net> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-03-03libuv: fix CVE-2024-24806Hugo SIMELIERE
Upstream-Status: Backport[https://github.com/libuv/libuv/commit/0f2d7e784a256b54b2385043438848047bc2a629] Upstream-Status: Backport[https://github.com/libuv/libuv/commit/3530bcc30350d4a6ccf35d2f7b33e23292b9de70]> Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-03-03nodejs: Set CVE_PRODUCT to "node.js"virendra thakur
Set CVE_PRODUCT to 'node.js' for nodjs recipe Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-03-03linuxptp: fix do_compile errorChangqing Li
with make 4.4, linuxptp do_compile will failed with error: In file included from clock.c:35: missing.h:61:9: error: redeclaration of enumerator 'HWTSTAMP_TX_ONESTEP_P2P' 61 | HWTSTAMP_TX_ONESTEP_P2P = 3, | ^~~~~~~~~~~~~~~~~~~~~~~ In file included from clock.c:21: /buildarea2/WRLCD_Regression/Rerun/build_dir/11201532-build_scp_world_Feature_Test/qemux86-64-standard-std-OE/build/tmp-glibc/work/core2-64-wrs-linux/linuxptp/3.1.1-r0/recipe-sysroot/usr/include/linux/net_tstamp.h:128:9: note: previous definition of 'HWTSTAMP_TX_ONESTEP_P2P' with type 'enum hwtstamp_tx_types' 128 | HWTSTAMP_TX_ONESTEP_P2P, | Following change of make 4.4 changes behavior of shell function: * WARNING: Backward-incompatibility! Previously makefile variables marked as export were not exported to commands started by the $(shell ...) function. Now, all exported variables are exported to $(shell ...). Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Backport of commit 05c1003c4 ("linuxptp: fix do_compile error"). This is present in dunfell/kirkstone as well. If net_tstamp.h of the build host disagrees with net_tstamp.h of the OE kernel or I remove the build host's net_tstamp.h do_compile fails. Changed Upstream Status to Backport with the git sha as the commit is now applied upstream. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-03-03openwsman: Change download branch from master to main.Wang Mingyu
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Joao Marcos Costa <joaomarcos.costa@bootlin.com> Backported from Kirkstone (cherry-picked from commit 84425db660a30570044e334509e174e5c92173ed) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-01-16postgresql: Update to 12.17Robert Joslyn
Minor security and bugfix release. Addresses the following CVEs: CVE-2023-5868: Memory disclosure in aggregate function calls CVE-2023-5869: Buffer overrun from integer overflow in array modification CVE-2023-5870: Role pg_signal_backend can signal certain superuser processes Additional information is available in the release notes: https://www.postgresql.org/docs/release/12.17/ Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-01-16opensc: Fix CVE-2023-40661virendra thakur
Upstream-Status: Backport[https://salsa.debian.org/opensc-team/opensc/-/commit/8026fb4ca0ed53d970c6c497252eb264d4192d50] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2024-01-16opensc: Fix CVE-2023-40660virendra thakur
Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/940e8bc764047c873f88bb1396933a5368d03533] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17spirv-tools: Use main branch for all reposFrieder Schrempf
The master branch has been removed in all of the repos used in SRC_URI. Switch to the main branch instead. Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17php: CVE-2022-4900 fix potential buffer overflowHitendra Prajapati
Upstream-Status: Backport from https://github.com/php/php-src/commit/789a37f14405e2d1a05a76c9fb4ed2d49d4580d5 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17meta-oe: Drop broken BBCLASSEXTEND variantsRichard Purdie
The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9962d57f7c235873de0a0bb192b5f56747762fc7) Backport: * Updated paths to follow PV changes * Adapted modified recipes to the ones generating warnings * NB: cups-filter needs poppler-native but its not available. To fix this, 5fa0188b8c could be backported. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17libusbmuxd: Add PVYoann Congal
This is 1.0.10 release with few more commits on top. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17emlog: ignore inapplicable CVEsYoann Congal
The CVEs: * CVE-2019-16868 * CVE-2019-17073 * CVE-2021-44584 * CVE-2022-1526 * CVE-2022-3968 * CVE-2023-43291 ... apply to the other "emlog" and can be safely ignored. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17emlog: Add PVKhem Raj
This is 0.70 release with few more commits on top. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 08edc0b6ace0d04688a5617cf05546a7b8ba6cca) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12glmark2: fix compatibility with python-3.11Martin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12libiio: use main branch instead of masterMartin Jansa
* the branch was renamed upstream Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-21libssh2: Backport fix for CVE-2020-22218Vijay Anusuri
Bug: https://github.com/libssh2/libssh2/pull/476 Upstream-Status: Backport [https://github.com/libssh2/libssh2/commit/642eec48ff3adfdb7a9e562b6d7fc865d1733f45 & https://github.com/libssh2/libssh2/commit/0b44e558f311671f6e6d14c559bc1c9bda59b8df] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30php: Fix CVE-2023-3824Siddharth Doshi
Upstream-Status: Backport from [https://github.com/php/php-src/commit/80316123f3e9dcce8ac419bd9dd43546e2ccb5ef] CVE: CVE-2023-3824 Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30open-vm-tools: Security fix for CVE-2023-20900Priyal Doshi
Backport-from: https://github.com/vmware/open-vm-tools/commit/74b6d0d9000eda1a2c8f31c40c725fb0b8520b16 Signed-off-by: Priyal Doshi <pdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30catch2: switch from master to v2.x branchKirill Esipov
"master" branch does not exist in original repo. Signed-off-by: Kirill Esipov <yesipov@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19iperf3: Fix CVE-2023-38403Bhargav Das
iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. NVD link: https://nvd.nist.gov/vuln/detail/CVE-2023-38403 Upstream-Status: Backported from https://github.com/esnet/iperf/commit/0ef151550d96cc4460f98832df84b4a1e87c65e9 Signed-off-by: Bhargav Das <bhargav.das@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-09postgresql: refresh patchesArmin Kuster
fixes: WARNING: postgresql-12.16-r0 do_patch: Fuzz detected: Applying patch 0001-Add-support-for-RISC-V.patch patching file src/include/storage/s_lock.h Hunk #2 succeeded at 339 with fuzz 1. Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04meta-oe-components: Avoid usage of nobranch=1Sourav Kumar Pramanik
The usage of nobranch=1 in SRC_URI allows using unprotected branches. This change updates the real branch name in place of nobranch=1 for these components. Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04nlohmann-json: Avoid usage of nobranch=1Sourav Pramanik
The usage of nobranch=1 in SRC_URI allows using unprotected branches. This change updates the real branch name in place of nobranch=1. Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04rapidjson: Avoid usage of nobranch=1Sourav Pramanik
The usage of nobranch=1 in SRC_URI allows using unprotected branches. This change updates the real branch name in place of nobranch=1. Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04postgresql: Update to 12.16Robert Joslyn
This is a minor release to address CVEs and other bug fixes without new features. Remove patches that are fixed in this release. Release notes are available at: https://www.postgresql.org/docs/release/12.10/ https://www.postgresql.org/docs/release/12.11/ https://www.postgresql.org/docs/release/12.12/ https://www.postgresql.org/docs/release/12.13/ https://www.postgresql.org/docs/release/12.14/ https://www.postgresql.org/docs/release/12.15/ https://www.postgresql.org/docs/release/12.16/ License-Update: Copyright year updated Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-16php: Backport fix CVE-2023-3247Ashish Sharma
Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25nodejs-14: add -fpermissive BUILD_CXXFLAGS to fix build with gcc-13 on hostMartin Jansa
Fixes nodejs-native build with gcc-13 on host: http://errors.yoctoproject.org/Errors/Details/728221/ nodejs-12 doesn't need it yet and nodejs-16 doesn't need it as well '-DV8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=64' '-D__STDC_FORMAT_MACROS' '-DOPENSSL_NO_PINSHARED' '-DOPENSSL_THREADS' '-DV8_TARGET_ARCH_X64' '-DV8_EMBEDDER_STRING="-node.84"' '-DENABLE_DISASSEMBLER' '-DV8_PROMISE_INTERNAL_FIELD_COUNT=1' '-DENABLE_MINOR_MC' '-DOBJECT_PRINT' '-DV8_INTL_SUPPORT' '-DV8_CONCURRENT_MARKING' '-DV8_ARRAY_BUFFER_EXTENSION' '-DV8_ENABLE_LAZY_SOURCE_POSITIONS' '-DV8_USE_SIPHASH' '-DDISABLE_UNTRUSTED_CODE_MITIGATIONS' '-DV8_WIN64_UNWINDING_INFO' '-DV8_ENABLE_REGEXP_INTERPRETER_THREADED_DISPATCH' '-DV8_SNAPSHOT_COMPRESSION' -ITOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -I../deps/v8 -I../deps/v8/include -I.//Release/obj/gen/torque-output-root -I.//Release/obj/gen/generate-bytecode-output-root -pthread -Wno-unused-parameter -m64 -Wno-return-type -fno-strict-aliasing -m64 -O3 -fno-omit-frame-pointer -fdata-sections -ffunction-sections -O3 -fno-rtti -fno-exceptions -std=gnu++1y -MMD -MF .//Release/.deps/Release/obj.host/v8_initializers/gen/torque-output-root/torque-generated/../../deps/v8/src/builtins/array-find-tq-csa.o.d.raw -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -O2 -pipe -c In file included from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/move.h:37, from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/stl_function.h:60, from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/functional:49, from ../deps/v8/src/codegen/code-stub-assembler.h:8, from ../deps/v8/src/builtins/builtins-promise-gen.h:8, from ../deps/v8/src/builtins/builtins-async-gen.h:8, from ../deps/v8/src/builtins/builtins-async-function-gen.cc:5: /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits: In instantiation of ‘struct std::is_convertible<v8::internal::Cell, v8::internal::Object>’: ../deps/v8/src/codegen/tnode.h:262:72: required from ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’ ../deps/v8/src/codegen/tnode.h:346:75: required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’ ../deps/v8/src/codegen/code-stub-assembler.h:1868:33: required from here /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits:1417:30: error: invalid use of incomplete type ‘class v8::internal::Cell’ [-fpermissive] 1417 | : public __bool_constant<__is_convertible(_From, _To)> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from ../deps/v8/src/objects/objects.h:26, from ../deps/v8/src/objects/fixed-array.h:10, from ../deps/v8/src/objects/contexts.h:8, from ../deps/v8/src/execution/thread-local-top.h:10, from ../deps/v8/src/execution/isolate-data.h:12, from ../deps/v8/src/execution/isolate.h:24, from ../deps/v8/src/codegen/interface-descriptors.h:14, from ../deps/v8/src/codegen/callable.h:8, from ../deps/v8/src/codegen/code-factory.h:8, from ../deps/v8/src/compiler/code-assembler.h:17, from ../deps/v8/src/codegen/code-stub-assembler.h:15: ../deps/v8/src/objects/object-list-macros.h:19:7: note: forward declaration of ‘class v8::internal::Cell’ 19 | class Cell; | ^~~~ In file included from ../deps/v8/src/codegen/interface-descriptors.h:12: ../deps/v8/src/codegen/tnode.h: In instantiation of ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’: ../deps/v8/src/codegen/tnode.h:346:75: required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’ ../deps/v8/src/codegen/code-stub-assembler.h:1868:33: required from here ../deps/v8/src/codegen/tnode.h:262:72: error: ‘value’ is not a member of ‘std::is_convertible<v8::internal::Cell, v8::internal::Object>’ 262 | std::is_convertible<T, Object>::value); | ^~~~~ Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25nodejs: Fix build with gcc13Khem Raj
* MJ: remove AUTHORS modification from the original patch from nodejs-16, so that the same patch does apply for both 14 and 12 versions used in dunfell * MJ: gcc-13 isn't used for target builds in dunfell, but can be used on host, so this is useful backport for nodejs-native * MJ: this fixes default nodejs-native-12, nodejs-native-14 with negative D_P might need additional fix on top Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22c-ares: CVE-2023-32067 0-byte UDP payload Denial of ServiceVijay Anusuri
Upstream-Status: Backport from https://github.com/c-ares/c-ares/commit/b9b8413cfdb70a3f99e1573333b23052d57ec1ae Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22sysdig: Depend on system libb64Khem Raj
avoid using vendored version Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit d8053b7e2b21c651b34b48f025f47cb511c36e37) [FIxes this error --- LOG END --- | error: downloading 'http://download.draios.com/dependencies/libb64-1.2.src.zip' failed | status_code: 22 | status_string: "HTTP response code said error" | log: | --- LOG BEGIN --- ] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22libb64: Add recipeKhem Raj
Add Base64 encode/decode library, some packages e.g. sysdig can benefit from it Disable parallel make as it races at times make[1]: *** No rule to make target 'libb64.a', needed by 'c-example1'. Stop. Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 6946f40707ed43426cd05ada1933e4867c7f6d4f) Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22Fix tigervnc crash due to missing xkbcomp rdependsAlexander Thoma
Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 447de4d47ba2deba1af80201b91bb312f184fe0e) Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit b3b00a270edfd27e2dfc05d5a6a5cab94324ad65) [Fixup for Dunfell context] Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14openldap: fix CVE-2021-27212 Assertion failure in slapdHitendra Prajapati
Upstream-Status: Backport from https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14multipath-tools: fix CVE-2022-41974Hitendra Prajapati
Upstream-Status: Backport from https://github.com/openSUSE/multipath-tools/commit/fbbf280a0e26026c19879d938ebb2a8200b6357c Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14yajl: CVE-2023-33460 memory leak in yajl_tree_parse functionHitendra Prajapati
Upstream-Status: Backport from https://github.com/openEuler-BaseService/yajl/commit/23a122eddaa28165a6c219000adcc31ff9a8a698 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14postgresql: fix CVE-2023-2454 & CVE-2023-2455vkumbhar
fixed Below security CVE: 1)CVE-2023-2454 postgresql: schema_element defeats protective search_path changes. 2)CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining. Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14c-ares: whitelist CVE-2023-31124virendra thakur
CVE-2023-31124 applies only when cross-compiling using autotools. Yocto cross-compiles via cmake which is also listed as official workaround. See: * https://nvd.nist.gov/vuln/detail/CVE-2023-31124 * https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4 Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14libssh: CVE-2020-16135 NULL pointer dereference in sftpserver.c if ↵Vijay Anusuri
ssh_buffer_new returns NULL Upstream-Status: Backport [https://gitlab.com/libssh/libssh-mirror/-/commit/533d881b0f4b24c72b35ecc97fa35d295d063e53 & https://gitlab.com/libssh/libssh-mirror/-/commit/2782cb0495b7450bd8fe43ce4af886b66fea6c40 & https://gitlab.com/libssh/libssh-mirror/-/commit/10b3ebbe61a7031a3dae97f05834442220447181 & https://gitlab.com/libssh/libssh-mirror/-/commit/245ad744b5ab0582fef7cf3905a717b791d7e08b] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23c-ares: CVE-2023-31147 Insufficient randomness in generation of DNS query IDsHitendra Prajapati
Upstream-Status: Backport from https://github.com/c-ares/c-ares/commit/823df3b989e59465d17b0a2eb1239a5fc048b4e5 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23c-ares: CVE-2023-31130 fix Buffer UnderwriteHitendra Prajapati
Upstream-Status: Backport from https://github.com/c-ares/c-ares/commit/f22cc01039b6473b736d3bf438f56a2654cdf2b2 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23c-ares: fix CVE-2022-4904 & Update SRC_URI branch and protocolsVijay Anusuri
Upstream-Status: Backport [https://git.openembedded.org/meta-openembedded-contrib/commit/?h=stable/kirkstone-nut&id=092e125f44f65427d42db95db3779daf4893d10f & https://git.openembedded.org/meta-openembedded-contrib/commit/meta-oe/recipes-support/c-ares/c-ares_1.18.1.bb?h=stable/kirkstone-nut&id=b402a3076fbafe05d0b8621e50603b65c3fe8147 Upstream-Commit: https://github.com/c-ares/c-ares/commit/9903253c347f9e0bffd285ae3829aef251cc852d] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23openldap: Fix CVE-2023-2953Vijay Anusuri
Upstream-Status: Backport [https://git.openldap.org/openldap/openldap/-/commit/752d320cf96e46f24c0900f1a8f6af0a3fc3c4ce & https://git.openldap.org/openldap/openldap/-/commit/6563fab9e2feccb0a684d0398e78571d09fb808b] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23gnulib: Update recipe name to 2018-12-18schitrod=cisco.com@lists.openembedded.org
As per gnulib_2018-03-07 recipe information, SRCREV = "0d6e3307bbdb8df4d56043d5f373eeeffe4cbef3" This revision was committed on "2018-12-18". There is a discrepancy between SRCREV and the recipe version. Which reports "CVE-2018-17942" as unpatched. To report "CVE-2018-17942" as patched, We need to align a recipe name with SRCREV commit date. Signed-off-by: Sanjay Chitroda <schitrod@cisco.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9edbe7033cc41f4a49f74717cd3146b52588ce22) Signed-off-by: Sanjay Chitroda <schitrod@cisco.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23spirv-tools: switch from master branch to main for re2Samuli Piippo
Signed-off-by: Samuli Piippo <samuli.piippo@qt.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23nodejs: fix native node-gyp to work with python-3.11Martin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16nodejs: make 14.18.1 available but not defaultNarpat Mali
Chromium 112 needs nodejs-native version 14 or later. Add the nodejs_14.18.1 recipe from kirkstone: 246b20b92 nodejs: Upgrade to 14.18.1 but, use DEFAULT_PREFERENCE to make sure that the default version of nodejs remains 12.x. 7 patches which were modified between nodejs 12 & nodejs 14 were renamed by adding the suffix "-nodejs14". Note there are some common patches used by nodejs 12 & 14 so, that will require attention during future maintenance. In addition, there were 3 CVE-2022* patches which applied cleanly to nodejs 14 so, they were added to the nodejs 14 recipe. One patch, CVE-llhttp.patch conflicted so, it has not been applied in nodejs 14 yet. Nodejs 14 compile for qemux86-64 but, no run-time testing has been performed. For chromium, we would either require users to modify the local.conf file or we may create a dunfell specific branch in meta-browser. See: https://github.com/OSSystems/meta-browser/pull/709 Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16nss: backport fix for native build failure due to dangling pointer with gcc13Jack Mitchell
Upstream-Status: Backport Link: https://github.com/nss-dev/nss/commit/cbf5a2bce75ca2c2fd3e247796b9892f5298584e Signed-off-by: Jack Mitchell <ml@embed.me.uk> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16nss: backport fix for native build failure due to implicit casting with gcc13Jack Mitchell
Upstream-Status: Backport Link: https://github.com/nss-dev/nss/commit/4e7e332b25a2794f381323518e52d8d95273b69e Signed-off-by: Jack Mitchell <ml@embed.me.uk> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-26 11:17:04 +0000