linux/poky.git/meta/recipes-extended, branch yocto-5.0.8

tzcode-native: Fix compiler setting from 2023d version

2025-03-10T19:30:52+00:00

Starting from 2023d version, tzcode makefile does not use anymore "cc" variable for C compiler, due to Makefile refactoring. Replacing "cc" with "CC" fixes the issue. (From OE-Core rev: c297d2cd8d28463adca5158c9895f1492754d569) Signed-off-by: Alessio Cascone Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit b3cdfca5ef84ed2054faef9abddef3aeed930e17) Signed-off-by: Steve Sakoman

tzdata/tzcode-native: upgrade 2024b -> 2025a

2025-03-10T19:30:52+00:00

(From OE-Core rev: 34b0f99ffd9beab4d400b05f259fc26f3da0386b) Signed-off-by: Priyal Doshi Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit a15c4e6793c55c8084a61298ef3695e1db2f60cd) Signed-off-by: Steve Sakoman

wget: fix CVE-2024-10524

2025-01-24T15:59:38+00:00

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-10524 Upstream-patch: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778 (From OE-Core rev: 425c3f55bd316a563597ff6ff95f8104848e2f10) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

groff: Fix race issues for parallel build

2025-01-18T14:26:45+00:00

Fixed race issues for parallel build: groff: error: couldn't exec soelim: Permission And: groff: error: couldn't exec grn: Permission denied (From OE-Core rev: 44b625a820a22c99f4fa1d4ed6b6de98c5d75884) Signed-off-by: Robert Yang (cherry picked from commit b9ee7ea9ab05a1887c863dc9fccc65cb9e6850df) Signed-off-by: Steve Sakoman

libarchive: Fix CVE-2024-20696

2025-01-09T14:25:36+00:00

Add Patch file to fix CVE-2024-20696 CVE: CVE-2024-20696 (From OE-Core rev: a3b0a4a53e99e4faa42a6e7be5713b12acc63dba) Signed-off-by: Nitin Wankhade Signed-off-by: Nikhil R Signed-off-by: Steve Sakoman

libpam: fix CVE-2024-10041

2024-12-13T13:21:54+00:00

A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. References: https://security-tracker.debian.org/tracker/CVE-2024-10041 Upstream patches: https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be (From OE-Core rev: 0e76d9bf150ac3bf96081cc1bda07e03e16fe994) Signed-off-by: Divya Chellam Signed-off-by: Steve Sakoman

tzdata&tzcode-native: upgrade 2024a -> 2024b

2024-12-06T13:50:25+00:00

(From OE-Core rev: 76fcb907f4db9ec64669d81e5e9c6baffac71973) Signed-off-by: Jinfeng Wang Signed-off-by: Steve Sakoman (cherry picked from commit c8d3edb2562ea4d980186e78b4abb5a94b1d7b22) Signed-off-by: Steve Sakoman

acpica: fix CVE-2024-24856

2024-12-06T13:50:24+00:00

The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a successful allocation, but the subsequent code directly dereferences the pointer that receives it, which may lead to null pointer dereference. To fix this issue, a null pointer check should be added. If it is null, return exception code AE_NO_MEMORY. Refer: https://nvd.nist.gov/vuln/detail/CVE-2024-24856 (From OE-Core rev: 5c590ccd1973d343f47e7b7171691400490dfc1a) Signed-off-by: Changqing Li Signed-off-by: Steve Sakoman

groff: fix rare build race in hdtbl

2024-11-26T14:11:30+00:00

It's possible to build the hdtbl examples before grn has been build: groff: error: couldn't exec grn: No such file or directory Backport a dependency fix from upstream. [ YOCTO #15610 ] (From OE-Core rev: 40003e1f1444f6202b068dcde632571be208594e) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit d590a32423d05cefc4e7282f971f633b3fa0b941) Signed-off-by: Steve Sakoman

libpam: drop cracklib from DEPENDS

2024-11-26T14:11:30+00:00

cracklib was dropped as a dependency in libpam v1.5.0 See the following commit as reference: https://github.com/linux-pam/linux-pam/commit/d702ff714c309069111899fd07c09e31c414c166 (From OE-Core rev: 7d0c32584846f6cd12e5bda046fb7ad8f8821de4) Signed-off-by: Guðni Már Gilbert Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Steve Sakoman