linux/poky.git/meta/recipes-multimedia, branch mickledore

libwebp: Fix CVE-2023-4863

2023-11-11T18:23:01+00:00

Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Removed CVE-2023-5129.patch as CVE-2023-5129 is duplicate of CVE-2023-4863. CVE: CVE-2023-4863 References: https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://security-tracker.debian.org/tracker/CVE-2023-4863 https://bugzilla.redhat.com/show_bug.cgi?id=2238431#c12 (From OE-Core rev: e2bd9494b59b486000320c6814371f37828d4c2d) Signed-off-by: Soumya Sambu Signed-off-by: Steve Sakoman

tiff: fix CVE-2023-41175

2023-10-18T15:25:19+00:00

libtiff: potential integer overflow in raw2tiff.c References: https://bugzilla.redhat.com/show_bug.cgi?id=2235264 https://security-tracker.debian.org/tracker/CVE-2023-41175 https://gitlab.com/libtiff/libtiff/-/issues/592 (From OE-Core rev: b2518923dff885778c550f0faa22e99bf76b6288) Signed-off-by: Yogita Urade Signed-off-by: Richard Purdie (cherry picked from commit 4ee806cbc12fbc830b09ba6222e96b1e5f24539f) Signed-off-by: Steve Sakoman

tiff: fix CVE-2023-40745

2023-10-18T15:25:19+00:00

libtiff: integer overflow in tiffcp.c References: https://security-tracker.debian.org/tracker/CVE-2023-40745 https://gitlab.com/libtiff/libtiff/-/issues/591 https://bugzilla.redhat.com/show_bug.cgi?id=2235265 (From OE-Core rev: 3340e024ae8676081488f23a0678c28c23ab0b42) Signed-off-by: Yogita Urade Signed-off-by: Richard Purdie (cherry picked from commit c3d4fbeb51278a04a6800c894c681733ad2259ca) Signed-off-by: Steve Sakoman

gstreamer: upgrade 1.22.5 -> 1.22.6

2023-10-13T14:31:04+00:00

This release only contains bugfixes and security fixes. Highlighted bugfixes in 1.22.6: Security fixes for the MXF demuxer and H.265 video parser Fix latency regression in H.264 hardware decoder base class androidmedia: fix HEVC codec profile registration and fix coded_data handling decodebin3: fix switching from a raw stream to an encoded stream gst-inspect: prettier and more correct signal and action signals printing rtmp2: Allow NULL flash version, omitting the field, for better RTMP server compatibility rtspsrc: better compatibility with buggy RTSP servers that don't set a clock-rate rtpjitterbuffer: fix integer overflow that led to more packets being declared lost than have been lost v4l2: fix video encoding regression on RPi and fix support for left and top padding waylandsink: Crop surfaces to their display width height cerbero: recognise Manjaro; add Rust support for MSVC ARM64; cmake detection fixes various bug fixes, build fixes, memory leak fixes, and other stability and reliability improvements https://nvd.nist.gov/vuln/detail/CVE-2023-40474 https://nvd.nist.gov/vuln/detail/CVE-2023-40475 https://nvd.nist.gov/vuln/detail/CVE-2023-40476 https://gstreamer.freedesktop.org/releases/1.22/#1.22.6 (From OE-Core rev: f481d973d7f942f8a9492cd71985bd1d428ac59a) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

ffmpeg: avoid neon on unsupported machines

2023-10-11T13:54:46+00:00

Disable neon if the machine does not support it. (From OE-Core rev: 866d3ca22ca30bff9d7b85b87387f40b59d60113) Signed-off-by: Benjamin Bara Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 0c3a6a74531d3860a3849a1f53f6709d6a0e88a5) Signed-off-by: Steve Sakoman

libsndfile1: upgrade 1.2.0 -> 1.2.2

2023-10-11T13:54:46+00:00

Changelog: ========= * Fixed invalid regex in src/create_symbols_file.py * Fixed passing null pointer to printf %s in tests (From OE-Core rev: 7d5a6d6c908ce7e7601c85a00a2331039f1e5fe4) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni (cherry picked from commit ff22e9ae6a237d8c48aa9eaee65de3157f52307b) Signed-off-by: Steve Sakoman

libwebp: Fix CVE-2023-5129

2023-10-04T15:21:26+00:00

Add patch for Libwebp 1.3.1 to fix CVE-2023-5129. (From OE-Core rev: 852068debb268669699ad9a8dbe44907a19aa482) Signed-off-by: Colin McAllister Signed-off-by: Steve Sakoman

ffmpeg: 5.1.2 -> 5.1.3

2023-09-29T14:33:44+00:00

drop patch which is already part of 5.1.3. 0001-avcodec-rpzaenc-stop-accessing-out-of-bounds-frame.patch(CVE-2022-3964): https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/1eb002596e3761d88de4aeea3158692b82fb6307 0001-avcodec-smcenc-stop-accessing-out-of-bounds-frame.patch(CVE-2022-3965): https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/293dc39bcaa99f213c6b7a703e11f146abf5d3be ffmpeg-fix-vulkan.patch : https://git.ffmpeg.org/gitweb/ffmpeg.git/patch/7268323193d55365f914de39fadd5dbdb1f68976 (From OE-Core rev: aeee19cda946b67f33c7b7c02c86513676bc89bd) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

gstreamer1.0: upgrade 1.22.4 -> 1.22.5

2023-09-04T14:13:24+00:00

(From OE-Core rev: 2b41b6054936ee8d5237a981f8cbdcbea54d244c) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie (cherry picked from commit a894c9499863f127380c38f0b17d51b356391821) Signed-off-by: Steve Sakoman

ffmpeg: add CVE_CHECK_IGNORE for CVE-2023-39018

2023-08-30T14:52:35+00:00

CVE-2023-39018 belongs to ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI) and not ffmpeg itself. As per CVE description, it is mentioned as FFmpeg 0.7.0 which is the version for ffmpeg-cli-wrapper and ffmpeg don't have 0.7.0 version at all. Debian & Bugzilla trackers have already marked as NOT-FOR-US/RESOLVED-INVALID. As it won't be affecting the ffmpeg package so, we can ignore the CVE-2023-39018 in ffmpeg recipe. References: https://github.com/bramp/ffmpeg-cli-wrapper https://github.com/FFmpeg/FFmpeg https://security-tracker.debian.org/tracker/CVE-2023-39018 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-39018 Upstream master patch: https://git.openembedded.org/openembedded-core/commit/?id=c21ed498b423c13463a4ae0bb475883cc7901847 (From OE-Core rev: d1c087713add2d780b4978b9d7ec33d514d68cd4) Signed-off-by: Narpat Mali Signed-off-by: Steve Sakoman