Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=halstead%2Fhashclient 2024-02-24T16:10:23+00:00 2024-02-24T16:10:23+00:00 Simone Weiß simone.p.weiss@posteo.com 2024-02-18T22:32:32+00:00 urn:sha1:2bcd651a0871a2a3789c2f2907cb372ad45d9b14 Set CVE_STATUS as none of the issues apply against the versions used in the recipes. (From OE-Core rev: cea8c8bf73e84133f566d1c2ca0637494f2d7afe) Signed-off-by: Simone Weiß <simone.p.weiss@posteo.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2024-02-08T10:53:13+00:00 Yogita Urade yogita.urade@windriver.com 2024-02-02T08:26:32+00:00 urn:sha1:eba805ace44c6884377e765860059d39c61405a2 CVE-2023-52355: An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB. Issue fixed by providing a documentation update. CVE-2023-52356: A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service. References: https://nvd.nist.gov/vuln/detail/CVE-2023-52355 https://security-tracker.debian.org/tracker/CVE-2023-52355 https://gitlab.com/libtiff/libtiff/-/issues/621 https://gitlab.com/libtiff/libtiff/-/merge_requests/553 https://nvd.nist.gov/vuln/detail/CVE-2023-52356 https://gitlab.com/libtiff/libtiff/-/issues/622 https://gitlab.com/libtiff/libtiff/-/merge_requests/546 (From OE-Core rev: 831d7a2fffb3dec94571289292f0940bc7ecd70a) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2024-01-21T12:27:12+00:00 Yogita Urade yogita.urade@windriver.com 2024-01-18T05:52:29+00:00 urn:sha1:fcc39f3e04c66e4d698edad7887dc01f85f86979 CVE-2023-6228: An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash. References: https://nvd.nist.gov/vuln/detail/CVE-2023-6228 https://gitlab.com/libtiff/libtiff/-/issues/606 (From OE-Core rev: 55735e0d75820d59e569a630679f9ac403c7fdbe) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-12-06T22:55:50+00:00 Khem Raj raj.khem@gmail.com 2023-12-05T17:53:49+00:00 urn:sha1:2b32e0fd6e6d892552636b452ef1e7a8d3fb587f (From OE-Core rev: d115e17ad7775cf5bbfd402e98e61f362ac96efa) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-09-26T09:35:27+00:00 Alexander Kanavin alex.kanavin@gmail.com 2023-09-22T07:24:27+00:00 urn:sha1:8c5dd21254be4775a3b4aa9e60d852e941dfa255 (From OE-Core rev: 9e80f93ada4eae638350d86b8aa514203f757d43) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-09-20T07:57:26+00:00 Yogita Urade yogita.urade@windriver.com 2023-09-15T07:34:49+00:00 urn:sha1:558f2e49a50e5c9daebd586b6a02b598aa1f6dd0 libtiff: potential integer overflow in raw2tiff.c References: https://bugzilla.redhat.com/show_bug.cgi?id=2235264 https://security-tracker.debian.org/tracker/CVE-2023-41175 https://gitlab.com/libtiff/libtiff/-/issues/592 (From OE-Core rev: 4ee806cbc12fbc830b09ba6222e96b1e5f24539f) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-09-20T07:57:26+00:00 Yogita Urade yogita.urade@windriver.com 2023-09-15T07:34:48+00:00 urn:sha1:1843db6ae3aa77aa1d4e68dd3b130c419df548f8 libtiff: integer overflow in tiffcp.c References: https://security-tracker.debian.org/tracker/CVE-2023-40745 https://gitlab.com/libtiff/libtiff/-/issues/591 https://bugzilla.redhat.com/show_bug.cgi?id=2235265 (From OE-Core rev: c3d4fbeb51278a04a6800c894c681733ad2259ca) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-07-21T10:52:26+00:00 Andrej Valek andrej.valek@siemens.com 2023-07-20T07:19:50+00:00 urn:sha1:c15e506a4674e558922c5a75512ca2b5c296cd44 - Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version (From OE-Core rev: 1634ed4048cf56788cd5c2c1bdc979b70afcdcd7) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-07-10T10:36:34+00:00 Ross Burton ross.burton@arm.com 2023-07-03T12:19:25+00:00 urn:sha1:238b4ff55e1a1c267dda5277f12b2bcb1fb2f5ea Also remove old CVE_CHECK_IGNOREs which are no longer needed due to CPE updates. (From OE-Core rev: 2200fde7011c4206382150c2602b2eb17423d45e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2023-06-27T15:23:40+00:00 Natasha Bailey nat.bailey@windriver.com 2023-06-23T17:47:44+00:00 urn:sha1:a4bd1f72821d3cae65c220e35f716234766974bf Fixes a bug where a buffer was used after a potential reallocation. (From OE-Core rev: 48b8945fa570edcdf1e19ed4a4ca81c4416f1a6a) Signed-off-by: Natasha Bailey <nat.bailey@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>