summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
AgeCommit message (Collapse)Author
2022-04-13expat: fix CVE-2022-25315Kai Kang
Backport patch to fix CVE-2022-25315. CVE: CVE-2022-25315 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-04-13expat: fix CVE-2022-25314Kai Kang
Backport patch to fix CVE-2022-25314 for expat. CVE: CVE-2022-25314 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-04-13expat: fix CVE-2022-25313Kai Kang
Backport patch to fix CVE-2022-25313. CVE: CVE-2022-25313 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-03-30zlib: backport the fix for CVE-2018-25032Ross Burton
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-03-25libxml2: Fix CVE-2022-23308Joe Slater
The first patch is the fix in version 2.9.13. The second patch was added later and fixes a regression introduced by the first. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-03-15expat: fix CVE-2022-25236Kai Kang
Backport patches to fix CVE-2022-25236 for expat. CVE: CVE-2022-25236 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-03-15expat: fix CVE-2022-25235Kai Kang
Backport patch to fix CVE-2022-25235 for expat. CVE: CVE-2022-25235 Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-02-25initramfs-framework: unmount automounts before switch_rootJustin Bronder
If mounts are left lingering, then after we switch_root, attempts to modify the block devices will result in an EBUSY with no way to unmount them. As we're about to switch_root anyways, there isn't much use to keep anything mounted unless it has the new rootfs. Signed-off-by: Justin Bronder <jsbronder@cold-front.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4dc7af6d25597ea10ea43e76c7c3d7251462c0e5) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> (cherry picked from commit 991631492f4fafc1852113a34a60b025342518b6) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-02-25expat: fix CVE-2022-23990Kai Kang
CVE: CVE-2022-23990 Based on Steve Sakoman's patch for branch dunfell, fix CVE-2022-23990 for expat in branch hardknott. And correct indent as well. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-02-20build-appliance-image: Update to hardknott head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-15glibc: upgrade glibc-2.33 to latest versionPgowda
glibc-2.33 has been upgraded to latest version that includes many CVE and other bug fixes. Ran the regressions and results are better. Signed-off-by: pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-02-07expat: add missing Upstream-status, CVE tag and sign-off to CVE-2021-46143.patchSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 7e33aa25acc0c29b8f5e78757c6557e614eb1434) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-02-07expat: fix CVE-2022-23852Steve Sakoman
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer for configurations with a nonzero XML_CONTEXT_BYTES. Backport patch from: https://github.com/libexpat/libexpat/commit/847a645152f5ebc10ac63b74b604d0c1a79fae40 CVE: CVE-2022-23852 Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit af81bb9d10c0f1e9dcaffc1bbc18ef780eea7127) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-01-26expat: fix CVE-2021-46143Steve Sakoman
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Backport patch from: https://github.com/libexpat/libexpat/pull/538/commits/85ae9a2d7d0e9358f356b33977b842df8ebaec2b CVE: CVE-2021-46143 Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 41a65d27e4ecdc11977e2944d8af2f51c48f32ec) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-01-26expat: fix CVE-2021-45960Steve Sakoman
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). Backport patch from: https://github.com/libexpat/libexpat/pull/534/commits/0adcb34c49bee5b19bd29b16a578c510c23597ea CVE: CVE-2021-45960 Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 22fe1dea3164a5cd4d5636376f3671641ada1da9) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-01-26expat fix CVE-2022-22822 through CVE-2022-22827Steve Sakoman
xmlparse.c has multiple integer overflows. The involved functions are: - addBinding (CVE-2022-22822) - build_model (CVE-2022-22823) - defineAttribute (CVE-2022-22824) - lookup (CVE-2022-22825) - nextScaffoldPart (CVE-2022-22826) - storeAtts (CVE-2022-22827) Backport patch from: https://github.com/libexpat/libexpat/pull/539/commits/9f93e8036e842329863bf20395b8fb8f73834d9e CVE: CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 3b6c47c0ebae9fdb7a13480daf8f46a8dbb2c9bd) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-01-26glibc: upgrade glibc-2.33 to latest versionpgowda
glibc-2.33 has been upgraded to latest version that includes many CVE and other bug fixes. Signed-off-by: pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-01-11glibc: Backport fix for CVE-2021-43396Pgowda
Backport the fix for CVE-2021-43396. It is disputed that this is a security issue. (From OE-Core rev: e8de9b01c6b305b2498c5f942397a49ae2af0cde) Signed-off-by: pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2022-01-11busybox: backport patches to fix CVEsChen Qi
Backport patches to fix the following CVEs: CVE-2021-42373 CVE-2021-42378 CVE-2021-42379 CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42383 CVE-2021-42384 CVE-2021-42385 CVE-2021-42386 Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-12-20busybox: upgrade 1.33.1 -> 1.33.2Anuj Mittal
Bug fix release. 1.33.2 has fixes for hush and ash (parsing fixes) and unlzma (fix a case where we could read before beginning of buffer). Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-11-29os-release: Add DISTRO_CODENAME as vardeps for do_compileDaniel Gomez
DISTRO_CODENAME is part of VERSION variable but not used as dependency for do_compile task. Append it to the vardeps list to rebuild in case it changes. Signed-off-by: Daniel Gomez <daniel@qtec.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee0345057459c6d77fb64902a955e836c6c1e8e4) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-11-29glibc: Fix i586/c3 supportRichard Purdie
CET can't be enabled on i586 or c3 for x86, adjust the configuration accordingly to fix those builds. [YOCTO #14632] Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 26e4fed594daefb6923c50171360f925c4822683) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-11-12meta: add explicit branch and protocol to SRC_URIAnuj Mittal
Add branch name explicitly to SRC_URI where it's not defined and switch to using https protocol for Github projects. The change was made using convert-srcuri script in scripts/contrib. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-11-04build-appliance-image: Update to hardknott head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-20util-linux: disable rawMarkus Volk
raw.h has been dropped in linux-libc-headers-5.14 leading to: configure: error: raw selected, but required raw.h header file not available WARNING: exit code 1 from a shell command. Signed-off-by: MarkusVolk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7f577c10913104860121f682b9b3754870c4db23) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-10-20libxml2: Use python3targetconfig to fix reproducibility issueRichard Purdie
We're seeing pthread being linked sometimes and not others leading to non-reproducible target binaries. The reason is mixing the native python config with the target one. We should use the target one. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1bc5378db760963e2ad46542f2907dd6a592eb66) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-10-20ncurses: fix CVE-2021-39537Mingli Yu
Backport patch [1] to fix CVE-2021-39537 [2]. [1] https://github.com/mirror/ncurses/commit/790a85dbd4a81d5f5d8dd02a44d84f01512ef443 [2] http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-10-18glibc: upgrade glibc-2.33 to latest versionPgowda
glibc-2.33 release version of Feb 2021 is used in Hardknott branch. There are many bug fixes in the latest glibc-2.33 version. The patch takes the latest glibc-2.33 version commit. Regression tested on X86-64 without any new issues. Signed-off-by: Pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-10-04Update mailing list addressJon Mason
Signed-off-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 83169c33f7585da25560784f79eaad2c6f029f3c) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-10-04systemd: fix CVE-2021-33910Chen Qi
Backport patch to fix CVE-2021-33910. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-09-29expat: pull from github releasesKonrad Weihmann
sometimes we can find release tarballs from sourceforge are not fully distributed along all download mirrors leading to fetching failures, depending on what download mirror will be chosen by sourceforge servers. As the project moved to github anyway, it's better to pull the tarballs directly from github releases - serving the very same static artifacts. Add an override UPSTREAM_CHECK_URI to enable devtool upgrade checks Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> (backported from commit 2a1743ace5aa41b188f77853d0f00c9e5a359c6d) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-09-09build-appliance-image: Update to hardknott head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-09-01build-appliance-image: Update to hardknott head revisionRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-25glibc: Fix CVE-2021-38604Vinay Kumar
Source: https://sourceware.org/git/glibc.git Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=28213 Backported upstream commits b805aebd42364fe696e417808a700fdb9800c9e8 and 4cc79c217744743077bf7a0ec5e0a4318f1e6641 to glibc-2.33 source. Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8] Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641] Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-08-11glibc: Fix CVE-2021-35942Vinay Kumar
Source: https://sourceware.org/git/glibc.git Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=28011 Backported upstream commit 5adda61f62b77384718b4c0d8336ade8f2b4b35c to glibc-2.33 source. Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c] Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-08-09util-linux: fix CVE 2021-37600Joe Slater
Backport patch, which should be in next release (2.37.2). Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31ovmf: Fix VLA warnings with GCC 11Khem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5406ce83e07c3f89b9f2bb26f083861467b7bc59) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31update-rc.d: update SRCREV to pull in fix for non-bash shell supportMarek Vasut
This pulls in non-bash shell fix for enable/disable command, upstream commit 8636cf4 ("update-rc.d: Fix enable/disable command"). This way update-rc.d works with e.g. dash shell again. Signed-off-by: Marek Vasut <marex@denx.de> Cc: Changqing Li <changqing.li@windriver.com> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f697332a3a753898183d7c5d2965dd75db9b0a24) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31initramfs-framework/setup-live: fix shebangUlrich Ölmann
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 71f1f6bc9402ee0fad82aaf0757fffb73da4b706) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31initramfs-framework: fix whitespace issueUlrich Ölmann
Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9eaf6f4b08144c7f5453545f2bd9fb387a2dbe2e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31initscripts: fix creation order for /var/log with VOLATILE_LOG_DIR=trueMatthias Schiffer
Create the /var/log symlink directly after /var/volatile/log, so /var/log is available for the creation of /var/log/wtmp a few lines later. Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 64b659b9e40da3280ba8911b4044b19aa7366262) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31glibc: Fix CVE-2021-33574Khairul Rohaizzat Jamaluddin
CVE: CVE-2021-33574 Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31netbase: use git fetcherMingli Yu
Use git repo as the the previous URL only stores the latest source file and fails to locate the source file which isn't the latest. Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-31systemd: fix CVE-2020-13529Chen Qi
Backport patches to fix CVE-2020-13529. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-13busybox: add tmpdir option into mktemp appletAndrej Valek
- Make mktemp applet compatible with --tmpdir option in ca-certificate update script. Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3d969e482d29da29828d1510f106f161d2b3d3c0) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-13glibc-testsuite: Fix build failures when directly running recipeRichard Purdie
If you try and run the glibc-testsuite's build task, you see failures as do_populate_sysroot can't work. We don't have a do_install, get rid of do_populate_sysroot as well. The recipe is not included in world builds by default which is why we don't see the issue more widely. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f7de32dfcc2e6b1872fbd5ea61dcba944d5553a8) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-07-13busybox: upgrade 1.33.0 -> 1.33.1zhengruoqin
0001-decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch removed since it is included in 1.33.1 Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 544236b12a72ee5be5ef0147249ead112082b871) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-06-30ifupdown: Skip wrong test itemZqiang
Skip wrong testcase(12-15) in testbuild-linux and rebase the patch tweak-ptest-script.patch. Signed-off-by: Zqiang <qiang.zhang@windriver.com> Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4edcfbace258d94d814c7d61f467e5384e2645fb) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-06-18util-linux.inc: Do not modify BPNPeter Kjellerstedt
Changing BPN to be "util-linux" regardless if it is the util-linux recipe or the util-linux-libuuid recipe that is being built was an easy way to allow ${BPN} and ${BP} to be used in the SRC_URI for both recipes. However, it causes problems for native.bbclass where there are expectations that ${BPN} and ${PN} match each other. Use "util-linux" directly in the SRC_URI instead to avoid the problem. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 701ef7ff0e1b17150424a64acfafbb83f518f9c9) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
2021-06-02expat: set CVE_PRODUCTSteve Sakoman
Upstream database uses both "expat" and "libexpat" to report CVEs Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-26 18:38:36 +0000