linux/poky.git, branch dunfell-23.0.31

build-appliance-image: Update to dunfell head revision

2024-01-22T13:37:47+00:00

(From OE-Core rev: 82e67bd9c77f0c5cbb652ca91071b9e57bdcfb33) Signed-off-by: Steve Sakoman

poky.conf: bump version for 3.1.31

2024-01-22T13:31:37+00:00

(From meta-yocto rev: 11fa082996c6c9e95b2f31eabaf22bc7167fe370) Signed-off-by: Steve Sakoman

documentation: update for 3.1.31

2024-01-22T13:31:37+00:00

(From yocto-docs rev: b56d349ae7cabf7d84d5dbde3751d93ab2f11747) Signed-off-by: Steve Sakoman Reviewed-by: Michael Opdenacker Signed-off-by: Steve Sakoman

ref-manual: classes: remove insserv bbclass

2024-01-22T13:31:37+00:00

insserv.bbclass was removed from oe-core: commit e6bb5dbb62257a7de730ea9085dfd89520f3e47d Author: Richard Purdie Date: Sun May 10 12:30:49 2015 +0100 insserv: Remove (From yocto-docs rev: 383fbedb057ffb28dddf201995ae622ce7b7eff5) Signed-off-by: Maxin John Reviewed-by: Michael Opdenacker Signed-off-by: Steve Sakoman

dev-manual: start.rst: update use of Download page

2024-01-22T13:31:37+00:00

The yocto website has changed its structure. Update the section for Accessing the Downloads page to match the new structure. (From yocto-docs rev: f9a3b59c130d498c02dfdc016958c92ac74737a7) Signed-off-by: Simone Weiß Reviewed-by: Michael Opdenacker Signed-off-by: Steve Sakoman

libtiff: Fix for CVE-2023-6228

2024-01-21T18:33:19+00:00

Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/1e7d217a323eac701b134afc4ae39b6bdfdbc96a] (From OE-Core rev: ff66998ef81dbc35465e30eec96ee9be51f5da80) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

qemu: Backport fix for CVE-2023-2861

2024-01-21T18:33:19+00:00

Updated 0012-fix-libcap-header-issue-on-some-distro.patch to resolve patch fuzz caused by the CVE-2023-2861 patch Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/a5804fcf7b22fc7d1f9ec794dd284c7d504bd16b & https://gitlab.com/qemu-project/qemu/-/commit/f6b0de53fb87ddefed348a39284c8e2f28dc4eda] (From OE-Core rev: cede843cdd1d1a83b2d616086aa69a2b584f9442) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

zlib: ignore CVE-2023-6992

2024-01-21T18:33:19+00:00

This CVE is for iCPE cloudflare:zlib. Alternative to ignoring would be to limit CVE_PRODUCT, but historic CVEs already have two - gnu:zlib and zlib:zlib. So limiting it could miss future CVEs. (From OE-Core rev: 5dc87309639e78195eb1283afc193f6eac63b044) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libxml2: Fix for CVE-2023-45322

2024-01-21T18:33:19+00:00

Backport patch for gitlab issue mentioned in NVD CVE report. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 Backport also one of 14 patches for older issue with similar errors to have clean cherry-pick without patch fuzz. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 The CVE is disputed because the maintainer does not think that errors after memory allocation failures are not critical enough to warrant a CVE ID. This patch will formally fix reported error case, trying to backport another 13 patches and resolve conflicts would be probably overkill due to disputed state. This CVE was ignored on master branch (as diputed). (From OE-Core rev: 03b766e42beb42a2085285308acbcf941f346b06) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

xserver-xorg: Fix for CVE-2023-6377 and CVE-2023-6478

2024-01-21T18:33:19+00:00

Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd & https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632] (From OE-Core rev: f5eff24d386215e5b5aee5c3261f5602b47c7f02) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman