linux/meta-openembedded.git/meta-oe, branch stable/kirkstone-nut

indent: fix CVE-2023-40305

2023-11-03T14:52:59+00:00

GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file. Reference: https://savannah.gnu.org/bugs/index.php?64503 Signed-off-by: Yogita Urade Signed-off-by: Armin Kuster

suiteparse: Adapt to upstream branch name changes

2023-11-03T14:49:44+00:00

meta-oe master branch already made this change. Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster

c-ares: CVE-ID correction for CVE-2022-4904

2023-09-27T14:23:10+00:00

- The c-ares commit https://github.com/c-ares/c-ares/commit/9903253c347f (Add str len check in config_sortlist to avoid stack overflow), fixes the CVE-2022-4904 instead of CVE-2022-4415 https://security-tracker.debian.org/tracker/CVE-2022-4904 - CVE-ID inside the CVE-2022-4904.patch is wrong in the OE commit[092e125f44f6] - Hence corrected the CVE-ID in CVE-2022-4904.patch Signed-off-by: Shinu Chandran Signed-off-by: Armin Kuster

openldap: update to 2.5.16

2023-09-27T14:00:32+00:00

2.5.x is an LTS version per the project. Drop patch now included. Signed-off-by: Armin Kuster Signed-off-by: Armin Kuster

freeglut: Add packageconfigs for x11/wayland/gles

2023-09-23T17:38:46+00:00

helps it compiling on on different openGL implementations which may not implement fulll openGL specs Signed-off-by: Khem Raj (cherry picked from commit a9212722c1b1a2ab29215651063ca94fb114c39b) Signed-off-by: Armin Kuster

redis: upgrade 7.0.12 -> 7.0.13

2023-09-23T17:09:01+00:00

This release has only security and bug fixes. ChangeLog: https://github.com/redis/redis/releases/tag/7.0.13 Security Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-41053 $ git log --oneline 7.0.12..7.0.13 49dbedb1d (tag: 7.0.13, origin/7.0) Redis 7.0.13 0f14d3279 Fix sort_ro get-keys function return wrong key number (#12522) 4d67bb6af do not call handleClientsBlockedOnKeys inside yielding command (#12459) 37599fe75 Ensure that the function load timeout is disabled during loading from RDB/AOF and on replicas. (#12451) ea1bc6f62 Process loss of slot ownership in cluster bus (#12344) 646069a90 Skip test for sdsRemoveFreeSpace when mem_allocator is not jemalloc (#11878) Signed-off-by: Archana Polampalli Signed-off-by: Armin Kuster

rabbitmq-c: Fix CVE-2023-35789

2023-09-23T17:06:57+00:00

An issue was discovered in the C AMQP client library (aka rabbitmq-c) through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line (e.g., for amqp-publish or amqp-consume) and are thus visible to local attackers by listing a process and its arguments. Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-35789 Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster

opensc: ignore CVE-2021-34193

2023-09-19T11:55:41+00:00

The CVE-2021-34193 is a duplicate CVE covering the 5 individual already fixed. https://github.com/OpenSC/OpenSC/pull/2855 Signed-off-by: Jose Quaresma Signed-off-by: Armin Kuster

hdf5: Fix CVE-2021-37501

2023-09-19T11:55:11+00:00

Backport a patch [1] to fix CVE-2021-37501. [1] https://github.com/HDFGroup/hdf5/commit/b16ec83d4bd79f9ffaad85de16056419f3532887 Signed-off-by: Mingli Yu Signed-off-by: Armin Kuster

hwloc: fix CVE-2022-47022

2023-09-06T13:13:26+00:00

An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c. References: https://nvd.nist.gov/vuln/detail/CVE-2022-47022 https://github.com/open-mpi/hwloc/issues/544 Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster