linux/poky.git/meta/recipes-extended, branch dunfell-23.0.20

tzdata: Update from 2022b to 2022c

2022-09-30T15:34:52+00:00

(From OE-Core rev: efcb0b30244007545ab8b0231e003271dcd7fab2) Signed-off-by: Robert Joslyn Signed-off-by: Richard Purdie (cherry picked from commit ecf88d151f265e5efb8e1dde5aba3ee2a8b76d8d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libarchive: Fix CVE-2021-31566 issue

2022-09-12T07:41:51+00:00

Add patch to fix CVE-2021-31566 issue for libarchive Link: http://deb.debian.org/debian/pool/main/liba/libarchive/libarchive_3.4.3-2+deb11u1.debian.tar.xz (From OE-Core rev: 7028803d7d10c0b041a7bda16f9d9261f220459f) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libarchive: Fix CVE-2021-23177 issue

2022-09-12T07:41:51+00:00

Add patch to fix CVE-2021-23177 issue for libarchive Link: http://deb.debian.org/debian/pool/main/liba/libarchive/libarchive_3.4.3-2+deb11u1.debian.tar.xz (From OE-Core rev: 01d7e2c7a0da55a7c00aebed107c1338f5f032b1) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

tzdata: upgrade 2022a -> 2022b

2022-09-03T12:10:37+00:00

(From OE-Core rev: b0a0abbcc5e631e693b9e896bd0fc9b9432dd297) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit b301d5203a4da0a0985670848126c5db762ddc86) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libtirpc: CVE-2021-46828 DoS vulnerability with lots of connections

2022-08-08T15:23:34+00:00

Source: http://git.linux-nfs.org/?p=steved/libtirpc.git; MR: 120231 Type: Security Fix Disposition: Backport from http://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=86529758570cef4c73fb9b9c4104fdc510f701ed ChangeID: 544120a5f10a4717cd2c7291821a012e26b14b7f Description: CVE-2021-46828 libtirpc: DoS vulnerability with lots of connections. (From OE-Core rev: 73d2b640ad665f6ff3c4fbe8f5da4ef0dbb175f2) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

unzip: Port debian fixes for two CVEs

2022-07-08T07:27:20+00:00

Add two fixes from debian for two CVEs. From: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010355 I wans't able to get the reproducers to work but the added error checking isn't probably a bad thing. (From OE-Core rev: 097469513f6dea7c678438e71a152f4e77fe670d) Signed-off-by: Richard Purdie (cherry picked from commit 054be00a632c2918dd1f973e76514e459fc6f017) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

unzip: fix CVE-2021-4217

2022-07-08T07:27:20+00:00

Avoid a null pointer dereference. (From OE-Core rev: 357791da82f767ad695e4476aa12fea3d7db5e04) Signed-off-by: Joe Slater Signed-off-by: Alexandre Belloni (cherry picked from commit 36db85b9b127e5a9f5d3d6e428168cf597ab95f3) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

cups: fix CVE-2022-26691

2022-06-22T22:46:32+00:00

In scheduler/cert.c the previous algorithm didn't expect the strings can have a different length, so one string can be a substring of the other and such substring was reported as equal to the longer string. Backport patch from upstream to fix: https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444 CVE: CVE-2022-26691 (From OE-Core rev: cc657868d31cc8b4218a07aa10fa098c379e473c) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

xz: fix CVE-2022-1271

2022-04-21T20:26:01+00:00

Malicious filenames can make xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. Upstream-Status: Backport [https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch] CVE: CVE-2022-1271 (From OE-Core rev: da4180062f12aa855a0dd2c0dbe4f0721df67055) Signed-off-by: Ralph Siemsen Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

gzip: fix CVE-2022-1271

2022-04-21T20:26:01+00:00

zgrep applied to a crafted file name with two or more newlines can no longer overwrite an arbitrary, attacker-selected file. Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148b7bd3c147a81ea00c7c] CVE: CVE-2022-1271 (From OE-Core rev: b7f0696bc60409af215549d26621526c1a93a002) Signed-off-by: Ralph Siemsen Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie