linux/meta-openembedded.git, branch mickledore-next

nginx: fix CVE-2023-44487

2024-01-07T18:15:11+00:00

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Signed-off-by: Meenali Gupta Signed-off-by: Armin Kuster

poco: fix branch

2024-01-07T18:15:11+00:00

The current SRCREV is not on any branch anymore, switch to the 1.12.4 branch HEAD which is similar and the only change is irrelevant. Signed-off-by: Alexandre Belloni Signed-off-by: Martin Jansa Signed-off-by: Armin Kuster

python3-django: move to version 4.2.7

2023-12-04T14:47:03+00:00

Version 4.2.5 fixes CVE-2023-36053 and CVE-2023-41164. Version 4.2.7 fixes CVE-2023-46695 and CVE-2023-43665. Signed-off-by: Joe Slater Signed-off-by: Armin Kuster

python3-gcovr: switch to main branch

2023-12-04T14:47:03+00:00

Branch "master" has been renamed to "main". Signed-off-by: Christian Eggers Signed-off-by: Armin Kuster

gattlib: Upgrade to latest tip of trunk

2023-12-04T14:47:03+00:00

License-Update: Year changed [1] Remove build directory from include directives in generated sourcecode via gdbus-codegen Upgrade includes fix for CVE-2019-6498 [1] https://github.com/labapart/gattlib/commit/5c87eda925c597e72107b5026c6b8d490ce76d62 Signed-off-by: Khem Raj Signed-off-by: Tan Wen Yan Signed-off-by: Armin Kuster

libvpx: upgrade 1.13.0 -> 1.13.1

2023-12-04T14:47:03+00:00

Changelog: ========= This release contains two security related fixes. One each for VP8 and VP9. - Upgrading: This release is ABI compatible with the previous release. - Bug fixes: https://crbug.com/1486441 (CVE-2023-5217) Fix to a crash related to VP9 encoding (#1642) Signed-off-by: Benjamin Bara Signed-off-by: Khem Raj Signed-off-by: Tan Wen Yan Signed-off-by: Armin Kuster

wireshark: Fix CVE-2023-2906

2023-12-04T14:47:03+00:00

Upstream-Status: Backport from https://gitlab.com/wireshark/wireshark/-/commit/44dc70cc5aadca91cb8ba3710c59c3651b7b0d4d Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster (cherry picked from commit 919a2074586ff957362ae2dbd3438fa648bb9bee) Signed-off-by: Deepak Rathore Signed-off-by: Armin Kuster

nlohmann-json: Add ptest support

2023-11-17T02:49:15+00:00

* Backport 2 patches [1] [2] to fix the build failure under tests dir. * Fetch the test data during do_fetch phase to avoid internet access during test as some tests need test data. # ./run-ptest PASS: test-algorithms_cpp11 PASS: test-allocator_cpp11 PASS: test-alt-string_cpp11 PASS: test-assert_macro_cpp11 PASS: test-binary_formats_cpp11 [snip] PASS: test-unicode5_cpp11 PASS: test-user_defined_input_cpp11 PASS: test-windows_h_cpp11 PASS: test-wstring_cpp11 [1] https://github.com/nlohmann/json/commit/6cec5aefc97ad219b6fd5a4132f88f7c8f6800ee [2] https://github.com/nlohmann/json/commit/660d0b58565073975d6f5d94365d6cbf150a4cf8 Signed-off-by: Mingli Yu Signed-off-by: Khem Raj (cherry picked from commit 013b4d50432a3eba08a9cb54b9edf6b25a6378a8) Signed-off-by: Armin Kuster

traceroute: upgrade 2.1.2 -> 2.1.3

2023-11-17T02:49:15+00:00

This upgrade incorporates the CVE-2023-46316 fix. Changelog: ---------- - Fix command line parsing in wrappers. References: https://security-tracker.debian.org/tracker/CVE-2023-46316 https://sourceforge.net/projects/traceroute/files/traceroute/traceroute-2.1.3/ Signed-off-by: Narpat Mali Signed-off-by: Armin Kuster

open-vm-tools: fix CVE-2023-34058

2023-11-17T02:49:15+00:00

A flaw was found in open-vm-tools. This flaw allows a malicious actor that has been granted Guest Operation Privileges in a target virtual machine to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-34058 Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster