Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=yocto-4.0.14 2023-11-03T14:34:41+00:00 2023-11-03T14:34:41+00:00 Steve Sakoman steve@sakoman.com 2023-11-03T14:27:49+00:00 urn:sha1:d8d6d921fad14b82167d9f031d4fca06b5e01883 (From OE-Core rev: 0eb8e67aa6833df0cde29833568a70e65c21d7e5) Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-03T14:26:14+00:00 Steve Sakoman steve@sakoman.com 2023-10-30T15:00:29+00:00 urn:sha1:73e3b5481bc88b332a198a8ec51a3c43c5f08e7e (From meta-yocto rev: 10e9c5a4c80fe4ee717b9ff63a08c58a9ac094e2) Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-03T14:26:13+00:00 Michael Opdenacker michael.opdenacker@bootlin.com 2023-10-25T14:54:16+00:00 urn:sha1:df56d7c525af57bf7a2378a1e9bf69d78fee56a3 Now that https://bugzilla.yoctoproject.org/show_bug.cgi?id=14481 is closed. (From yocto-docs rev: 260b446a1a75d99399a3421cd8d6ba276f508f37) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-03T14:26:13+00:00 Marta Rybczynska rybczynska@gmail.com 2023-10-25T13:12:02+00:00 urn:sha1:5f21fa7de9960a1ff4da0876007bf8e1e6366ca4 Add the initial version of the section on vulnerability reports, operations of the Security Team with a transcription of https://wiki.yoctoproject.org/wiki/Security_private_reporting (From yocto-docs rev: 13927bd3e2f89f301331583b2c5752b963822976) Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-03T14:26:13+00:00 Michael Opdenacker michael.opdenacker@bootlin.com 2023-10-23T15:39:48+00:00 urn:sha1:b971ffa75ec3d90076d3d490bdfb066bce53393c (From yocto-docs rev: 689f682c175e19664c090852d5c649280ce23fa0) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-03T14:26:13+00:00 Peter Marko peter.marko@siemens.com 2023-10-31T18:03:14+00:00 urn:sha1:f966e16c3bf59a4e174675e9e45518d5f14ada2d This vulnerability was introduced in 2.36, so 2.35 is not vulnerable. (From OE-Core rev: bf60773c882483f4bfe49e89be8e2f85f78b212b) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-03T14:26:13+00:00 Vijay Anusuri vanusuri@mvista.com 2023-10-31T05:53:20+00:00 urn:sha1:83d53dc031b3d67491d95e9e1c216fbd962ba57a - The commit [https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37] fixes CVE-2023-3576 - Hence, renamed the CVE-2023-3618-1.patch to CVE-2023-3576.patch - Reference: https://security-tracker.debian.org/tracker/CVE-2023-3576 https://security-tracker.debian.org/tracker/CVE-2023-3618 (From OE-Core rev: 63daa00279c0c3a8650d6e08a68cc32a2b98d843) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-03T14:26:13+00:00 Peter Marko peter.marko@siemens.com 2023-10-29T23:39:43+00:00 urn:sha1:f948c66f7556610d24cefe56ecd06a4d26a6d134 Backport patch for gitlab issue mentioned in NVD CVE report. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 Backport also one of 14 patches for older issue with similar errors to have clean cherry-pick without patch fuzz. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 The CVE is disputed because the maintainer does not think that errors after memory allocation failures are not critical enough to warrant a CVE ID. This patch will formally fix reported error case, trying to backport another 13 patches and resolve conflicts would be probably overkill due to disputed state. This CVE was ignored on master branch (as diputed). (From OE-Core rev: d29a89412b37995857269d617e16ada116f14270) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-01T15:01:26+00:00 Fahad Arslan fahad.arslan@gmail.com 2023-10-27T14:17:48+00:00 urn:sha1:b1ddd4178d469cf0c14e8c31d0fd2ba1b53bf293 This is backport of commit dfb7d2c426b46502784bc9e199a468e6c1 from poky master. This is in continuation of earlier commit: 3ddddfc14f805fe7572bba129605869fb848fed4 linux-firmware: create separate package for cirrus and cnm firmwares And creates separate sub packages for firmwares corresponding to following list of licenses: LICENSE.amphion_vpu LICENCE.cw1200 LICENSE.ice_enhanced LICENCE.mediatek LICENCE.microchip LICENCE.moxa LICENSE.nxp_mc_firmware LICENCE.OLPC LICENCE.phanfw LICENCE.qla2xxx LICENCE.ti-keystone LICENCE.wl1251 LICENCE.xc4000 LICENCE.xc5000 LICENCE.xc5000c (From OE-Core rev: c110e5708465a6becc611acf97f166302a17ebdf) (From OE-Core rev: 56503e3e80603de3b69acef2f6d32836bc9e5e5d) Signed-off-by: Fahad Arslan <fahad.arslan@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> 2023-11-01T15:01:26+00:00 Fahad Arslan fahad.arslan@siemens.com 2023-10-27T14:17:47+00:00 urn:sha1:95b430be1671cedb985a434173e7b16d9d09259f This is cherry-pick of commit 3ddddfc14f805fe7572bba129605869fb848fed4 from poky master. Some licenses only allow usage of corresponding firmwares when a specific hardware is present. This requires split of such firmwares from linux-firmware package to firmware specific sub package. As this split is based off of licensing, it makes sense to group firmware blobs having the same license in the same package. This commit is a first step in this direction, and creates separate packages for cirrus and cnm firmware. (From OE-Core rev: 53d9d8789efc701609a5a1e985287344c2209d62) (From OE-Core rev: 9b556e63ba3e89e83ba6e2647656a1fa6def87a4) Signed-off-by: Fahad Arslan <fahad.arslan@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>