Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=master 2023-09-26T09:35:27+00:00 2023-09-26T09:35:27+00:00 Alexander Kanavin alex.kanavin@gmail.com 2023-09-22T07:24:27+00:00 urn:sha1:8c5dd21254be4775a3b4aa9e60d852e941dfa255 (From OE-Core rev: 9e80f93ada4eae638350d86b8aa514203f757d43) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-09-20T07:57:26+00:00 Yogita Urade yogita.urade@windriver.com 2023-09-15T07:34:49+00:00 urn:sha1:558f2e49a50e5c9daebd586b6a02b598aa1f6dd0 libtiff: potential integer overflow in raw2tiff.c References: https://bugzilla.redhat.com/show_bug.cgi?id=2235264 https://security-tracker.debian.org/tracker/CVE-2023-41175 https://gitlab.com/libtiff/libtiff/-/issues/592 (From OE-Core rev: 4ee806cbc12fbc830b09ba6222e96b1e5f24539f) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-09-20T07:57:26+00:00 Yogita Urade yogita.urade@windriver.com 2023-09-15T07:34:48+00:00 urn:sha1:1843db6ae3aa77aa1d4e68dd3b130c419df548f8 libtiff: integer overflow in tiffcp.c References: https://security-tracker.debian.org/tracker/CVE-2023-40745 https://gitlab.com/libtiff/libtiff/-/issues/591 https://bugzilla.redhat.com/show_bug.cgi?id=2235265 (From OE-Core rev: c3d4fbeb51278a04a6800c894c681733ad2259ca) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-07-10T10:36:34+00:00 Ross Burton ross.burton@arm.com 2023-07-03T12:19:25+00:00 urn:sha1:238b4ff55e1a1c267dda5277f12b2bcb1fb2f5ea Also remove old CVE_CHECK_IGNOREs which are no longer needed due to CPE updates. (From OE-Core rev: 2200fde7011c4206382150c2602b2eb17423d45e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-06-27T15:23:40+00:00 Natasha Bailey nat.bailey@windriver.com 2023-06-23T17:47:44+00:00 urn:sha1:a4bd1f72821d3cae65c220e35f716234766974bf Fixes a bug where a buffer was used after a potential reallocation. (From OE-Core rev: 48b8945fa570edcdf1e19ed4a4ca81c4416f1a6a) Signed-off-by: Natasha Bailey <nat.bailey@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-06-01T07:05:11+00:00 Natasha Bailey nat.bailey@windriver.com 2023-05-30T22:16:06+00:00 urn:sha1:2f56bdb289b6487ac1e1781cdd620d5ccd1f7d9c This patch fixes an issue in libtiff's LZWDecode function which could cause a null pointer dereference. (From OE-Core rev: 7da5abf23232f61bf8009b4b8e97632768867e07) Signed-off-by: Natasha Bailey <nat.bailey@windriver.com> Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-05-11T08:15:00+00:00 nikhil nikhilar2410@gmail.com 2023-05-11T05:49:20+00:00 urn:sha1:ddf68ab675787e69205f4e16002dedc408440c09 Remove 0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch file from tiff as it was removed while upgrading tiff from 4.4.0 -> 4.5.0 (From OE-Core rev: c53abdb5ce9cdbfb0f9e48b64b800c45549d18a6) Signed-off-by: Nikhil R <nikhilar2410@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-04-13T10:56:07+00:00 Pawan Badganchi Pawan.Badganchi@kpit.com 2023-04-11T14:39:11+00:00 urn:sha1:2c9488e5d2acac37e162da785584ddfd8564000f Below patch fixes the CVE-2022-4645 as well. 0001-Revised-handling-of-TIFFTAG_INKNAMES-and-related-TIF.patch Link: https://nvd.nist.gov/vuln/detail/CVE-2022-4645 (From OE-Core rev: 312393edf0aa5b2c515c08245d1c289ba79bad55) Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-02-24T11:04:27+00:00 Ross Burton ross.burton@arm.com 2023-02-20T16:28:16+00:00 urn:sha1:1e9b6bf803d8a5e1640feb0981e879362a07ee58 (From OE-Core rev: bf0cf66c10c95ddada595dd5a84b45235c09ebab) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-01-06T12:08:33+00:00 Alexander Kanavin alex.kanavin@gmail.com 2023-01-04T11:04:40+00:00 urn:sha1:eba274f60f4af04c3b850c23e0af59138993c540 Drop all CVE backports. License-Update: formatting (From OE-Core rev: 9a255a3b114686b04bf54560c7485552ec3b438c) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>