summaryrefslogtreecommitdiffstats
path: root/meta-oe
Commit message (Collapse)AuthorAgeFilesLines
...
* giflib: fix build with gold and avoid imagemagick-native dependencyMartin Jansa2024-07-173-45/+39
| | | | | | | | * avoid imagemagick-native like upstream did in: https://sourceforge.net/p/giflib/code/ci/d54b45b0240d455bbaedee4be5203d2703e59967/ Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* krb5: Fix for CVE-2024-37370 and CVE-2024-37371Vijay Anusuri2024-07-173-0/+708
| | | | | | | | | | Upstream-Status: Backport [https://github.com/krb5/krb5/commit/548da160b52b25a106e9f6077d6a42c2c049586c & https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: Upgrade to 8.1.29Soumya Sambu2024-06-271-1/+1
| | | | | | | | | | Includes fix for CVE-2024-5458, CVE-2024-2408 and other bugs Changelog: https://www.php.net/ChangeLog-8.php#8.1.29 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* rdfind: fix build with gcc-13Jiaqing Zhao2024-06-272-0/+42
| | | | | | | | <cstdint> need to be included explicitly when compiling with gcc-13. Upstream-Status: Backport [1.6.0 https://github.com/pauldreik/rdfind/commit/f6c3f698dd680931b5c2f05688319290bdf0d930] Signed-off-by: Jiaqing Zhao <jiaqing.zhao@linux.intel.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* giflib: upgrade to version 5.2.2nikhil2024-06-273-43/+46
| | | | | | | | | | | | | | | | | | | | | Upgrade to latest version giflib v5.2.2. This version fixes bugs listed in link below: Link: https://sourceforge.net/p/giflib/code/ci/5.2.2/tree/NEWS Fixes for CVE-2023-48161, CVE-2022-28506, CVE-2023-39742 Link: https://clients.neighbourhood.ie/yocto/1-40.html#:~:text=CVE%2D2023%2D39742%3A%20giflib%3Agiflib%2Dnative Added dependency on ImageMagick which includes "convert" utility, to ensure availability of required tool during compilation process. Add patch to rename binary used in Makefile from "convert" to "convert.im7" as installed by imagemagick package. Drop CVE-2022-28506.patch as it is fixed in this version. Signed-off-by: Bhabu Bindu <bhabubindu@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nano: Security fix for CVE-2024-5742Siddharth Doshi2024-06-272-1/+103
| | | | | | | | | | Upstream-Status: Backport from [https://git.savannah.gnu.org/cgit/nano.git/commit/?id=5e7a3c2e7e118c7f12d5dfda9f9140f638976aa2] CVE's Fixed: CVE-2024-5742 nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* yajl: backport Debian patch for CVE-2022-24795Vijay Anusuri2024-06-272-0/+62
| | | | | | | | | | | | import patch from ubuntu to fix CVE-2022-24795 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/yajl/tree/debian/patches/?h=ubuntu%2Ffocal-security Upstream commit https://github.com/ppisar/yajl/commit/23cea2d7677e396efed78bbf1bf153961fab6bad] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Fix segmentation faultRob Woolley2024-06-272-17412/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The first version of this patch introduced a problem with python3-pyqt5. Python emitted the following error message when one attempted to import PyQt5.Qt: ImportError: dynamic module does not define module export function (PyInit_Qt) This came about due to segfault in sip when executed in do_configure of python3-pyqt5. This resulted in a zero-length sipQtcmodule.c file being produced. This compiled successfully which meant no build failure was observed. The segfault was caused by a mistake in backporting the patch from SIP 6. The generateCompositeCpp() function uses the generate_include_sip_h() helper function in later versions which doesn't exist in SIP 4. We must replace the first parameter passed to isPY_SSIZE_T_CLEAN() from mod to pt->module to account for this. The change is not necessary for generateInternalAPIHeader() To simplify the patch we can remove the generated lexer and parser files and run flex and bison in do_configure instead. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Tested-by: Toby Flynn <campingandskiing@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: fix CVE-2023-46809Archana Polampalli2024-06-022-0/+626
| | | | | Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: fix CVE-2024-22025Archana Polampalli2024-06-022-0/+149
| | | | | Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: fix CVE-2024-22019Archana Polampalli2024-06-022-0/+557
| | | | | Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ITS#10094 libldap/OpenSSL: fix setting ciphersuitesPriyal Doshi2024-05-282-0/+70
| | | | | | | Backport-from: https://git.openldap.org/openldap/openldap/-/merge_requests/654/diffs?commit_id=8c482cec9a68e74b3609b1e44738bee352f6577a Signed-off-by: Priyal Doshi <pdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: Backport fix CVE-2023-0767Vivek Kumbhar2024-05-262-0/+103
| | | | | | | Upstream-Status: Backport from [https://hg.mozilla.org/projects/nss/rev/684586ec163ad4fbbf15ea2cd1ee5c2da43036ad] Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* uriparser: upgrade 0.9.6 -> 0.9.8Peter Marko2024-05-261-1/+1
| | | | | | | | | | | | Handle CVEs: * https://nvd.nist.gov/vuln/detail/CVE-2024-34402 * https://nvd.nist.gov/vuln/detail/CVE-2024-34403 Cherry-pick from master was not possible due to usage of github-releases class which is not in kirkstone yet. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* php: upgrade 8.1.22 -> 8.1.28Soumya Sambu2024-05-261-1/+1
| | | | | | | | | | | | | Upgrade php to 8.1.28 Security fixes: CVE-2024-3096 CVE-2024-2756 https://www.php.net/ChangeLog-8.php#8.1.28 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libssh: Fix CVE CVE-2023-6004nikhil2024-05-268-0/+1017
| | | | | | | | | | | | A flaw was found in libssh. By utilizing the ProxyCommand or ProxyJump feature, users can exploit unchecked hostname syntax on the client. This issue may allow an attacker to inject malicious code into the command of the features mentioned through the hostname parameter Signed-off-by: Nikhil R <nikhil.r@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: patch CVE-2024-0743Peter Marko2024-05-262-0/+41
| | | | | | | | https://nvd.nist.gov/vuln/detail/CVE-2024-0743 mentions bug 1867408 as tracking fix for this issue. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nss: patch CVE-2023-5388Peter Marko2024-05-262-0/+682
| | | | | | | | https://nvd.nist.gov/vuln/detail/CVE-2023-5388 mentions bug 1780432 as tracking fix for this issue. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libeigen: Update GPL-3.0-only to GPL-2.0-onlyakash hadke2024-05-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | libeigen source contains GPL-3.0-only code but it is not being packaged hence update LICENSE with GPL-2.0-only Below are the GPL-3.0-only files from libeigen source bench/btl/actions/action_aat_product.hh bench/btl/actions/action_ata_product.hh bench/btl/actions/action_atv_product.hh bench/btl/actions/action_axpby.hh bench/btl/actions/action_axpy.hh bench/btl/actions/action_cholesky.hh bench/btl/actions/action_ger.hh bench/btl/actions/action_hessenberg.hh bench/btl/actions/action_lu_decomp.hh bench/btl/actions/action_lu_solve.hh bench/btl/actions/action_matrix_matrix_product_bis.hh bench/btl/actions/action_matrix_matrix_product.hh bench/btl/actions/action_matrix_vector_product.hh bench/btl/actions/action_partial_lu.hh bench/btl/actions/action_rot.hh bench/btl/actions/action_symv.hh bench/btl/actions/action_syr2.hh bench/btl/actions/action_trisolve.hh bench/btl/actions/action_trisolve_matrix.hh bench/btl/actions/action_trmm.hh bench/btl/COPYING bench/btl/data/mean.cxx bench/btl/data/regularize.cxx bench/btl/data/smooth.cxx bench/btl/generic_bench/bench.hh bench/btl/generic_bench/bench_parameter.hh bench/btl/generic_bench/btl.hh bench/btl/generic_bench/init/init_function.hh bench/btl/generic_bench/init/init_matrix.hh bench/btl/generic_bench/init/init_vector.hh bench/btl/generic_bench/static/bench_static.hh bench/btl/generic_bench/static/intel_bench_fixed_size.hh bench/btl/generic_bench/static/static_size_generator.hh bench/btl/generic_bench/timers/mixed_perf_analyzer.hh bench/btl/generic_bench/timers/portable_perf_analyzer.hh bench/btl/generic_bench/timers/portable_perf_analyzer_old.hh bench/btl/generic_bench/timers/portable_timer.hh bench/btl/generic_bench/timers/STL_perf_analyzer.hh bench/btl/generic_bench/timers/STL_timer.hh bench/btl/generic_bench/utils/size_lin_log.hh bench/btl/generic_bench/utils/size_log.hh bench/btl/generic_bench/utils/xy_file.hh bench/btl/libs/BLAS/blas_interface.hh bench/btl/libs/BLAS/main.cpp bench/btl/libs/blaze/blaze_interface.hh bench/btl/libs/blaze/main.cpp bench/btl/libs/blitz/blitz_interface.hh bench/btl/libs/blitz/blitz_LU_solve_interface.hh bench/btl/libs/blitz/btl_blitz.cpp bench/btl/libs/blitz/btl_tiny_blitz.cpp bench/btl/libs/blitz/tiny_blitz_interface.hh bench/btl/libs/eigen2/btl_tiny_eigen2.cpp bench/btl/libs/eigen2/eigen2_interface.hh bench/btl/libs/eigen2/main_adv.cpp bench/btl/libs/eigen2/main_linear.cpp bench/btl/libs/eigen2/main_matmat.cpp bench/btl/libs/eigen2/main_vecmat.cpp bench/btl/libs/eigen3/btl_tiny_eigen3.cpp bench/btl/libs/eigen3/eigen3_interface.hh bench/btl/libs/eigen3/main_adv.cpp bench/btl/libs/eigen3/main_linear.cpp bench/btl/libs/eigen3/main_matmat.cpp bench/btl/libs/eigen3/main_vecmat.cpp bench/btl/libs/gmm/gmm_interface.hh bench/btl/libs/gmm/gmm_LU_solve_interface.hh bench/btl/libs/gmm/main.cpp bench/btl/libs/mtl4/main.cpp bench/btl/libs/mtl4/mtl4_interface.hh bench/btl/libs/mtl4/mtl4_LU_solve_interface.hh bench/btl/libs/STL/main.cpp bench/btl/libs/STL/STL_interface.hh bench/btl/libs/tvmet/main.cpp bench/btl/libs/tvmet/tvmet_interface.hh bench/btl/libs/ublas/main.cpp bench/btl/libs/ublas/ublas_interface.hh libeigen project dropped all GPL code in their 'master' branch and moved to 'Apache-2.0' Signed-off-by: Akash Hadke <akash.hadke27@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* giflib: Fix CVE CVE-2022-28506nikhil2024-04-282-1/+43
| | | | | | | | | | | | | | There is a heap buffer overflow in DumpScreen2RGB() in gif2rgb.c. This occurs when a crafted gif file, where size of color table is < 256 but image data contains pixels with color code highier than size of color table. This causes oferflow of ColorMap->Colors array. Fix the issue by checking if value of each pixel is within bounds of given color table. If the value is out of color table, print error message and exit. Signed-off-by: Nikhil R <nikhil.r@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* bats: fix bats-format-pretty report error when multilib enabledXiangyu Chen2024-04-281-0/+1
| | | | | | | | bat-format-pretty hardcoded the lib folder that cause it reports missing formatter.bash error when multilib is enabled. Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xterm: Security fix for CVE-2023-40359Rohini Sangam2024-04-282-0/+389
| | | | | | | | | | | | | CVE fixed: - CVE-2023-40359 xterm: ReGIS reporting for character-set names containing characters other than alphanumerics or underscore Upstream-Status: Backport from https://github.com/ThomasDickey/xterm-snapshots/commit/41ba5cf31da5e43477811b28009d64d3f643fd29 Note: The CVE patch is part of minor version-up and is extracted from the snapshot of xterm-379c. Documentation of the commit shows 2 different overflows being fixed and hence the fix was extracted from the commit. Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* iniparser: Fix CVE-2023-33461Soumya Sambu2024-04-282-1/+54
| | | | | | | | | | | | iniparser v4.1 is vulnerable to NULL Pointer Dereference in function iniparser_getlongint which misses check NULL for function iniparser_getstring's return. References: https://nvd.nist.gov/vuln/detail/CVE-2023-33461 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* unixodbc: Fix CVE-2024-1013Soumya Sambu2024-03-252-0/+54
| | | | | | | | | | | | | An out-of-bounds stack write flaw was found in unixODBC on 64-bit architectures where the caller has 4 bytes and callee writes 8 bytes. This issue may go unnoticed on little-endian architectures, while big-endian architectures can be broken. References: https://nvd.nist.gov/vuln/detail/CVE-2024-1013 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openjpeg: Backport fix CVE-2021-3575Vivek Kumbhar2024-03-252-0/+46
| | | | | | | Upstream-Status: Backport from https://github.com/uclouvain/openjpeg/commit/7bd884f8750892de4f50bf4642fcfbe7011c6bdf Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* c-ares: fix CVE-2024-25629Yogita Urade2024-03-252-0/+35
| | | | | | | | | | | | | | | | | | | | | c-ares is a C library for asynchronous DNS requests. `ares__read_line()` is used to parse local configuration files such as `/etc/resolv.conf`, `/etc/nsswitch.conf`, the `HOSTALIASES` file, and if using a c-ares version prior to 1.27.0, the `/etc/hosts` file. If any of these configuration files has an embedded `NULL` character as the first character in a new line, it can lead to attempting to read memory prior to the start of the given buffer which may result in a crash. This issue is fixed in c-ares 1.27.0. No known workarounds exist. References: https://nvd.nist.gov/vuln/detail/CVE-2024-25629 https://github.com/c-ares/c-ares/security/advisories/GHSA-mg26-v6qh-x48q https://security-tracker.debian.org/tracker/CVE-2024-25629 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opencv: fix reproducibility issuesAnuj Mittal2024-03-251-17/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Download and unpack contrib modules and other repositories in S instead of WORKDIR so they don't escape file-prefix-map substitutions. Fixes a number of reproducibility problems because of OpenCV check macros that were embedding path to files in contrib/. MJ: this is backport from langdale and fixes not only reproducibility issues but also pseudo aborts in do_install when do_install is executed again after do_package (in incremental builds): | DEBUG: Executing shell function do_install | NOTE: DESTDIR=opencv/4.5.5-r0/image VERBOSE=1 cmake --build opencv/4.5.5-r0/build --target install -- | abort()ing pseudo client by server request. See https://wiki.yoctoproject.org/wiki/Pseudo_Abort for more details on this. | Check logfile: opencv/4.5.5-r0/pseudo//pseudo.log | Subprocess aborted and pseudo.log file shows: path mismatch [3 links]: ino 214373575 db 'opencv/4.5.5-r0/package/usr/src/debug/lib32-opencv/4.5.5-r0/contrib/modules/intensity_transform/src/bimef.cpp' req 'opencv/4.5.5-r0/contrib/modules/intensity_transform/src/bimef.cpp'. easily reproducible with: bitbake -c cleansstate opencv; bitbake -c package opencv; bitbake -c install -f opencv unlike ${S} ${WORKDIR}/contrib isn't in default PSEUDO_IGNORE_PATHS Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: Upgrade to 14.11Soumya Sambu2024-03-255-535/+5
| | | | | | | | | | | | | | | | Addresses CVEs and other bug fixes. Remove patches that are fixed in this release. Release notes are available at: https://www.postgresql.org/docs/release/14.10/ https://www.postgresql.org/docs/release/14.11/ 0001-configure.ac-bypass-autoconf-2.69-version-check.patch refreshed for new version. License-Update: Copyright year updated Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* graphviz: fix CVE-2023-46045Meenali Gupta2024-02-284-0/+111
| | | | | | | | Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE: exploitability may be uncommon because this file is typically owned by root. Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* mariadb: fix CVE-2023-22084Yogita Urade2024-02-282-0/+92
| | | | | | | | | | | | | | | | | | | | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). References: https://nvd.nist.gov/vuln/detail/CVE-2023-22084 https://security-tracker.debian.org/tracker/CVE-2023-22084 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* nodejs: Set CVE_PRODUCT to "node.js"virendra thakur2024-02-281-0/+2
| | | | | | | Set CVE_PRODUCT to 'node.js' for nodjs recipe Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linuxptp: fix do_compile errorChangqing Li2024-02-072-0/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | with make 4.4, linuxptp do_compile will failed with error: In file included from clock.c:35: missing.h:61:9: error: redeclaration of enumerator 'HWTSTAMP_TX_ONESTEP_P2P' 61 | HWTSTAMP_TX_ONESTEP_P2P = 3, | ^~~~~~~~~~~~~~~~~~~~~~~ In file included from clock.c:21: /buildarea2/WRLCD_Regression/Rerun/build_dir/11201532-build_scp_world_Feature_Test/qemux86-64-standard-std-OE/build/tmp-glibc/work/core2-64-wrs-linux/linuxptp/3.1.1-r0/recipe-sysroot/usr/include/linux/net_tstamp.h:128:9: note: previous definition of 'HWTSTAMP_TX_ONESTEP_P2P' with type 'enum hwtstamp_tx_types' 128 | HWTSTAMP_TX_ONESTEP_P2P, | Following change of make 4.4 changes behavior of shell function: * WARNING: Backward-incompatibility! Previously makefile variables marked as export were not exported to commands started by the $(shell ...) function. Now, all exported variables are exported to $(shell ...). Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Backport of commit 05c1003c4 ("linuxptp: fix do_compile error"). This is present in dunfell/kirkstone as well. If net_tstamp.h of the build host disagrees with net_tstamp.h of the OE kernel or I remove the build host's net_tstamp.h do_compile fails. Changed Upstream Status to Backport with the git sha as the commit is now applied upstream. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libssh: Backport fix for CVE-2023-48795Vijay Anusuri2024-02-074-0/+561
| | | | | | | | | | | | Upstream-Status: Backport [https://gitlab.com/libssh/libssh-mirror/-/commit/4cef5e965a46e9271aed62631b152e4bd23c1e3c & https://gitlab.com/libssh/libssh-mirror/-/commit/0870c8db28be9eb457ee3d4f9a168959d9507efd & https://gitlab.com/libssh/libssh-mirror/-/commit/5846e57538c750c5ce67df887d09fa99861c79c6] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* xscreensaver: Add osuosl backup MIRRORJoao Marcos Costa2024-02-071-0/+2
| | | | | | | | | | | | | old tarballs disappear from main location, use a backup location to fetch it in such cases. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Joao Marcos Costa <joaomarcos.costa@bootlin.com> Backported from Nanbield (cherry-picked from commit 8d34444c749a466f35445fd4c2212b3fbdb8d844) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opensc: Fix CVE-2023-40661virendra thakur2024-02-078-0/+245
| | | | | | | | | Add patch file to fix CVE Upstream-Status: Backport[https://salsa.debian.org/opensc-team/opensc/-/commit/8026fb4ca0ed53d970c6c497252eb264d4192d50] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* opensc: Fix CVE-2023-40660virendra thakur2024-02-072-0/+56
| | | | | | | | | Add patch file to fix CVE Upstream-Status: Backport [https://salsa.debian.org/opensc-team/opensc/-/commit/940e8bc764047c873f88bb1396933a5368d03533] Signed-off-by: virendra thakur <virendrak@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* zabbix: fix CVE-2023-32726 and CVE-2023-32727Yogita Urade2024-02-074-0/+405
| | | | | | | | | | | | | | | | | | | | | | CVE-2023-32726: The vulnerability is caused by improper check for check if RDLENGTH does not overflow the buffer in response from DNS server. CVE-2023-32727: An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server. Refernces: https://nvd.nist.gov/vuln/detail/CVE-2023-32726 https://security-tracker.debian.org/tracker/CVE-2023-32726 https://nvd.nist.gov/vuln/detail/CVE-2023-32727 https://security-tracker.debian.org/tracker/CVE-2023-32727 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* layer.conf: Add libdevmapper-native PREFERRED_RPROVIDERJose Quaresma2024-02-071-0/+1
| | | | | | | | | | | | | | | | The libdevmapper recipe don't provide any package and is only there to resolve circular dependencies [1]. We already have the libdevmapper PREFERRED_RPROVIDER but the native it's missing. Fixes: | NOTE: Multiple providers are available for runtime libdevmapper-native (libdevmapper-native, lvm2-native) | Consider defining a PREFERRED_RPROVIDER entry to match libdevmapper-native [1] https://git.openembedded.org/meta-openembedded/commit/meta-oe/recipes-support/lvm2?id=3f64779eae2d8312f569bee863f90ec4f8176e6c Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* p7zip: fix CVE-2018-5996 & CVE-2016-9296Zahir Hussain2024-02-073-0/+260
| | | | | | | | | | | | | | References: https://nvd.nist.gov/vuln/detail/CVE-2018-5996 https://nvd.nist.gov/vuln/detail/CVE-2016-9296 Upstream patches: https://sources.debian.org/data/non-free/p/p7zip-rar/16.02-3/debian/patches/06-CVE-2018-5996.patch https://snapshot.debian.org/archive/debian-debug/20180205T215659Z/pool/main/p/p7zip/p7zip_16.02%2Bdfsg-6.debian.tar.xz Signed-off-by: Zahir Hussain <zahir.basha@kpit.com> Signed-off-by: aszh07 <mail2szahir@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cjson: upgrade 1.7.15 -> 1.7.17Archana Polampalli2024-01-121-1/+1
| | | | | | | | | | | The following CVEs are addressed in this release. CVE-2023-50471 CVE-2023-50472 https://github.com/DaveGamble/cJSON/releases/tag/v1.7.17 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add py_ssize_t_clean argumentRob Woolley2024-01-122-0/+17681
| | | | | | | | | | | | | | An unintentional breakage was made upstream in sip4 which results in builds reporting: QtCoremod.sip:23: syntax error This was reported in Debian, but not resolved: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998605 A backport of a fix from the upstream project fixes the parser to prevent it from complaining about the syntax error. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sip3: Add sipconfig.pyRob Woolley2024-01-121-1/+18
| | | | | | | | | | | | Add the destdir option to ensure that sipconfig.py gets installed to the site-packages directory and included in python3-sip3. Remove references to the build paths from sipconfig.py as part of the install stage. One may then prepend STAGING_DIR_NATIVE to sip_bin and STAGING_DIR_TARGET to *_dir in any recipe that uses sipconfig.py. Signed-off-by: Rob Woolley <rob.woolley@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* glmark2: inherit python3native to fix build with python-3.12 on build hostMartin Jansa2024-01-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fixes: | WARNING: Unable to execute waf --version, exit code 1. Assuming waf version without bindir/libdir support. | DEBUG: Python function waf_preconfigure finished | DEBUG: Executing shell function do_configure | Traceback (most recent call last): | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/./waf", line 163, in <module> | from waflib import Scripting | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Scripting.py", line 6, in <module> | from waflib import Utils,Configure,Logs,Options,ConfigSet,Context,Errors,Build,Node | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Configure.py", line 6, in <module> | from waflib import ConfigSet,Utils,Options,Logs,Context,Build,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Options.py", line 6, in <module> | from waflib import Logs,Utils,Context,Errors | File "/OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/git/waflib/Context.py", line 5, in <module> | import os,re,imp,sys | ModuleNotFoundError: No module named 'imp' | WARNING: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/run.do_configure.1263276:146 exit 1 from 'waf_do_configure' * this first issue can be fixed easily by backporting: https://gitlab.com/ita1024/waf/-/commit/d2060dfd8af4edb5824153ff24e207b39ecd67a2 * but then it still fails a bit later, because of SyntaxWarning in waf --version output: ERROR: glmark2-2021.12-r0 do_configure: Error executing a python function in exec_func_python() autogenerated: The stack trace of python calls that resulted in this exception/failure was: File: 'exec_func_python() autogenerated', lineno: 2, function: <module> 0001: *** 0002:waf_preconfigure(d) 0003: File: '/OE/build/luneos-kirkstone/openembedded-core/meta/classes/waf.bbclass', lineno: 52, function: waf_preconfigure 0048: wafbin = os.path.join(subsrcdir, 'waf') 0049: try: 0050: result = subprocess.check_output([python, wafbin, '--version'], cwd=subsrcdir, stderr=subprocess.STDOUT) 0051: version = result.decode('utf-8').split()[1] *** 0052: if bb.utils.vercmp_string_op(version, "1.8.7", ">="): 0053: d.setVar("WAF_EXTRA_CONF", "--bindir=${bindir} --libdir=${libdir}") 0054: except subprocess.CalledProcessError as e: 0055: bb.warn("Unable to execute waf --version, exit code %d. Assuming waf version without bindir/libdir support." % e.returncode) 0056: except FileNotFoundError: File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 148, function: vercmp_string_op 0144: Compare two versions and check if the specified comparison operator matches the result of the comparison. 0145: This function is fairly liberal about what operators it will accept since there are a variety of styles 0146: depending on the context. 0147: """ *** 0148: res = vercmp_string(a, b) 0149: if op in ('=', '=='): 0150: return res == 0 0151: elif op == '<=': 0152: return res <= 0 File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 138, function: vercmp_string 0134: return r 0135: 0136:def vercmp_string(a, b): 0137: """ Split version strings and compare them """ *** 0138: ta = split_version(a) 0139: tb = split_version(b) 0140: return vercmp(ta, tb) 0141: 0142:def vercmp_string_op(a, b, op): File: '/OE/build/luneos-kirkstone/bitbake/lib/bb/utils.py', lineno: 89, function: split_version 0085: """Split a version string into its constituent parts (PE, PV, PR)""" 0086: s = s.strip(" <>=") 0087: e = 0 0088: if s.count(':'): *** 0089: e = int(s.split(":")[0]) 0090: s = s.split(":")[1] 0091: r = "" 0092: if s.count('-'): 0093: r = s.rsplit("-", 1)[1] Exception: ValueError: invalid literal for int() with base 10: 'SyntaxWarning' ERROR: Logfile of failure stored in: /OE/build/luneos-kirkstone/tmp-glibc/work/core2-64-webos-linux/glmark2/2021.12-r0/temp/log.do_configure.1264918 so it's safer to just use python3-native everywhere, instead of more patches for waf Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libbytesize: update github branch to 'main'Wentao Zhang2024-01-121-1/+1
| | | | | | | | | the repo of libbytesize doesn't have a branch named master. Change the branch from master to main. Signed-off-by: Zhang Xiao <xiao.zhang@windriver.com> Signed-off-by: Wentao Zhang <wentao.zhang@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* yasm: fix CVE-2023-37732Soumya2024-01-122-0/+42
| | | | | | | | | | | | | | | Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial of service via a crafted file. References: https://github.com/yasm/yasm/issues/233 https://nvd.nist.gov/vuln/detail/CVE-2023-37732 Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> (cherry picked from commit 41fffef6b044b2722aa13f7e7648a3f848231851) Signed-off-by: Armin Kuster <akuster808@gmail.com>
* postgresql: fix CVE-2023-5868 CVE-2023-5869 CVE-2023-5870Yogita Urade2023-12-134-0/+530
| | | | | | | | | | | | | | | | | | | | | | CVE-2023-5868: postgresql: Compute aggregate argument types correctly in transformAggregateCall() CVE-2023-5869: postgresql: Detect integer overflow while computing new array dimensions CVE-2023-5870: postgresql: Ban role pg_signal_backend from more superuser backend types. References: https://nvd.nist.gov/vuln/detail/CVE-2023-5868 https://nvd.nist.gov/vuln/detail/CVE-2023-5869 https://nvd.nist.gov/vuln/detail/CVE-2023-5870 Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* sdbus-c++: Update ptest pathPoonam Jadhav2023-12-131-1/+6
| | | | | | | Update ptest path to run sdbus-c++ ptest Signed-off-by: Poonam Jadhav <poonam.jadhav@kpit.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-oe: Drop broken BBCLASSEXTEND variantsRichard Purdie2023-11-177-11/+2
| | | | | | | | | | | | | | | | | | | | | | | | The command "bitbake universe -c fetch" currently throws a ton of warnings as there are many 'impossible' dependencies. In some cases these variants may never have worked and were just added by copy and paste of recipes. In some cases they once clearly did work but became broken somewhere along the way. Users may also be carrying local bbappend files which add further BBCLASSEXTEND. Having universe fetch work without warnings is desireable so clean up the broken variants. Anyone actually needing something dropped here can propose adding it and the correct functional dependencies back quite easily. This also then ensures we're not carrying or fixing things nobody uses. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit 9962d57f7c235873de0a0bb192b5f56747762fc7) Backport: * Updated paths to follow PV changes * Adapted modified recipes to the ones generating warnings Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libwebsockets: Support building for nativePeter Kjellerstedt2023-11-171-0/+3
| | | | | | | | | | | | | | | | | This is needed to be able to build mosquitto-native. The dependency on libcap when building for native is needed because cmake will pick up the existence of libcap from the host, but then the build fails if it is not available in the sysroot. Unfortunately, there does not seem to be any way to explicitly tell cmake to not build with libcap. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> (cherry picked from commit c083e0569ad80d11b4f5cfdfa89acdd4264d8152) Backported: Updated paths to follow PV changes. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-meta-oe-extended: RDEPENDS on an existing mozjs-91 packageYoann Congal2023-11-171-1/+1
| | | | | | | "mozjs" does not exist but "mozjs-91" does. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-08-13 20:37:50 +0000