linux/poky.git/meta/recipes-devtools, branch kirkstone-4.0.13

tcl: prevent installing another copy of tzdata

2023-09-23T15:26:16+00:00

It checks build host filesystem and if it doesn't find UTC or GMT files it installs another copy of tzdata files in: /usr/lib/tcl8.6/tzdata Buildhistory shows the difference: -PKGSIZE = 2227075 +PKGSIZE = 3433088 See the autodetection in configure.in: #------------------------------------------------------------------------ # Check whether the timezone data is supplied by the OS or has # to be installed by Tcl. The default is autodetection, but can # be overridden on the configure command line either way. #------------------------------------------------------------------------ AC_MSG_CHECKING([for timezone data]) AC_ARG_WITH(tzdata, AC_HELP_STRING([--with-tzdata], [install timezone data (default: autodetect)]), [tcl_ok=$withval], [tcl_ok=auto]) # # Any directories that get added here must also be added to the # search path in ::tcl::clock::Initialize (library/clock.tcl). # case $tcl_ok in no) AC_MSG_RESULT([supplied by OS vendor]) ;; yes) # nothing to do here ;; auto*) AC_CACHE_VAL([tcl_cv_dir_zoneinfo], [ for dir in /usr/share/zoneinfo \ /usr/share/lib/zoneinfo \ /usr/lib/zoneinfo do if test -f $dir/UTC -o -f $dir/GMT then tcl_cv_dir_zoneinfo="$dir" break fi done]) if test -n "$tcl_cv_dir_zoneinfo"; then tcl_ok=no AC_MSG_RESULT([$dir]) else tcl_ok=yes fi ;; *) AC_MSG_ERROR([invalid argument: $tcl_ok]) ;; esac if test $tcl_ok = yes then AC_MSG_RESULT([supplied by Tcl]) INSTALL_TZDATA=install-tzdata fi (From OE-Core rev: 79498ea0e9eb88ad0175f7376c57efb46217a4a4) Signed-off-by: Martin Jansa Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 3ace9fbfeb42ebf920812e3dd6d665b8b20a1ca0) Signed-off-by: Steve Sakoman

pseudo: Fix to work with glibc 2.38

2023-09-23T15:26:15+00:00

This adds a horrible hack to get pseudo working with glibc 2.38. We can't drop _GNU_SOURCE to something like _DEFAULT_SOURCE since we need the defines the gnu options bring in. That leaves using internal glibc defines to disable the c23 versions of strtol/fscanf and friends. Which would break pseudo build with 2.38 from running on hosts with older glibc. We'll probably need to come up with something better but this gets glibc 2.38 and working and avoids autobuilder failures. (From OE-Core rev: 909fd25c2ebd25f5d3bc560e26f9df6862e033d0) Signed-off-by: Richard Purdie (cherry picked from commit 596fb699d470d7779bfa694e04908929ffeabcf7) Signed-off-by: Steve Sakoman

binutils: stable 2.38 branch updates

2023-09-23T15:26:15+00:00

Below commits on binutils-2.38 stable branch are updated. ea5fe5d01e5 PR30697, ppc32 mix of local-dynamic and global-dynamic TLS (From OE-Core rev: e8becc003d6926cc347ec42c0f13dcd5d9042b4d) Signed-off-by: Sanjana Signed-off-by: Steve Sakoman

gcc: Fix -fstack-protector issue on aarch64

2023-09-23T15:26:15+00:00

This series of patches fixes deficiencies in GCC's -fstack-protector implementation for AArch64 when using dynamically allocated stack space. This is CVE-2023-4039. See: https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf for more details. (From OE-Core rev: e6592fc8308240872300a6295162e14d54c5a905) Signed-off-by: Ross Burton Signed-off-by: Steve Sakoman

binutils: Fix CVE-2022-48065

2023-09-23T15:26:15+00:00

(From OE-Core rev: 860ecdbbf5cfd8737c914522af16dbc8bee0f72f) Signed-off-by: Sanjana Signed-off-by: Steve Sakoman

go: Fix CVE-2023-39319

2023-09-23T15:26:15+00:00

The html/template package does not apply the proper rules for handling occurrences of " contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39319 (From OE-Core rev: afdc322ecff4cfd8478c89a03f7fce748a132b48) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

gdb: Fix CVE-2023-39128

2023-09-18T14:28:04+00:00

Note: The Fix needs to be pushed in gdb rather than bintuils-gdb as we are disabling gdb in binutils configure. Upstream-Status: Backport from [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=033bc52bb6190393c8eed80925fa78cc35b40c6d] CVE: CVE-2023-39128 (From OE-Core rev: 1a19a101cecc578aac84e365a361b76f129fe655) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

qemu: fix CVE-2021-3638

2023-09-18T14:28:03+00:00

QEMU: ati-vga: inconsistent check in ati_2d_blt() may lead to out-of-bounds write. Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3638 https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html (From OE-Core rev: ebbdbb68a7804accd5430dd05f7899599ddbacd8) Signed-off-by: Yogita Urade Signed-off-by: Steve Sakoman

python3-pygments: Fix CVE-2022-40896

2023-09-18T14:28:03+00:00

CVE-2022-40896: A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. The CVE issue is fixed by 3 different commits between the releases 2.14.0 (for Smithy lexer), 2.15.0 (for SQL+Jinja lexers) and 2.15.1 (for Java properties) as per: https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/ 1. Smithy lexer commit from 2.14.0 release applies successfully on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04 Hence, backported the patch as CVE-2022-40896.patch. 2. SQL+Jinja lexers commit from 2.15.0 release doesn't apply on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194 Actually, this code doesn't exist in 2.11.2 version and it has been introduce by python3-pygments 2.13.0 version. Hence, this is not vulnerable for 2.11.2 version. SQL+Jinja lexers is introduced by: https://github.com/pygments/pygments/commit/0bdbd5992baca32d18e01f0ec65337e06abf9456 3. Java properties commit from 2.15.1 release also doesn't apply on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52 Actually, this code also doesn't exist in 2.11.2 version as the code has been modified in python3-pygments 2.14.0 by: https://github.com/pygments/pygments/commit/a38cb38e93c9635240b3ae89d78d38cf182745da Hence, this is also not vulnerable for 2.11.2 version. (From OE-Core rev: ebb224e65a7e1402ccf0d9517bd72748c18e012e) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman

libdnf: resolve cstdint inclusion for newer gcc versions

2023-09-09T02:09:42+00:00

Depending on the host gcc version, libdnf fails to compile due to missing cstdint inclusions. These issue have already been addressed upstream, add the patches to resolve this for older versions of the library. These commits are taken directly from the libdnf project at https://github.com/rpm-software-management/libdnf (From OE-Core rev: e1d9bc1f88bd989bafc20063938d7a70e1da104f) Signed-off-by: Abe Kohandel Signed-off-by: Steve Sakoman