linux/poky.git/meta/recipes-support, branch mickledore

curl: Fix CVE-2023-38039

2023-11-11T18:23:01+00:00

Backport patch [1] to fix CVE-2023-38039 and reference [2] and [3] to fix the build error. [1] https://github.com/curl/curl/commit/3ee79c1674fd6f9 [2] https://github.com/curl/curl/commit/2cb0d346aaa [3] https://github.com/curl/curl/commit/83319e027179 (From OE-Core rev: 77a7921660e8da1cb618ba3634835790ae8adfdd) Signed-off-by: Mingli Yu Signed-off-by: Steve Sakoman

libevent: fix patch Upstream-Status

2023-10-25T14:51:01+00:00

(From OE-Core rev: 6afee5ac3b419532d290d8a0c533e5d144913e92) Signed-off-by: Michael Opdenacker Signed-off-by: Richard Purdie (cherry picked from commit 8c987afb2054f24d9bf86305774c186a6e015a8f) Signed-off-by: Steve Sakoman

vim: Upgrade 9.0.2009 -> 9.0.2048

2023-10-25T14:51:01+00:00

This includes CVE fix for CVE-2023-5535. (From OE-Core rev: b385544941a4d974ab95b0a886031d5c9f3971ba) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

libsoup-2.4: Only specify --cross-file when building for target

2023-10-18T15:25:19+00:00

The soup.cross file is only created when building for target so only tell meson to read it when it exists. This allows libsoup-2.4-native to be built again. (From OE-Core rev: d52003dd13cb17e32ccfa717f8462c8301334dd1) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie (cherry picked from commit 4acbd2269931b500846d56885c3304d244e514f8) Signed-off-by: Steve Sakoman

vim: Upgrade 9.0.1894 -> 9.0.2009

2023-10-18T15:25:19+00:00

This includes CVE fix for CVE-2023-5441. (From OE-Core rev: 7166f503211c39542d828aa3fef5006dccf2c07a) Signed-off-by: Siddharth Doshi Signed-off-by: Steve Sakoman

curl: fix CVE-2023-38546

2023-10-18T15:25:19+00:00

A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met. (From OE-Core rev: a6c5931192a1315cfc5f708585d22bc7bed9f7fd) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

curl: fix CVE-2023-38545

2023-10-18T15:25:19+00:00

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. (From OE-Core rev: 9b0867861a9c053f19bdb99bd6cba44ee5cb64e1) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

libsoup-2.4: update PACKAGECONFIG

2023-10-13T14:31:05+00:00

Add explicit PACKAGECONFIGs for brotli,ntlm, and sysprof. libsoup needs to be told where ntlm_auth will be on the target, so write a cross file to do so. (From OE-Core rev: c78a34caf466524356572b8cdd2ada615081bfc2) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit 54b6ea078daeb58a3bb20bb4275d1140640a77d2) Signed-off-by: Steve Sakoman

gnupg: upgrade 2.4.2 -> 2.4.3

2023-10-13T14:31:04+00:00

New stable GnuPG release: version 2.4.3. This version fixes some minor bugs and improves the performance on Windows. (From OE-Core rev: e0641f1ff96e7f3835bde0196ea8d4d3a734f0f2) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie (cherry picked from commit 0c2365540ae61fe6fab61fb076ddb976ca26ce47) Signed-off-by: Steve Sakoman

nettle: avoid neon on unsupported machines

2023-10-11T13:54:46+00:00

Disable neon if the machine does not support it. --enable-fat also includes the neon assembler code, therefore also disable it. (From OE-Core rev: 9a0c8796cc5788a88b3e4fea50de130185b11a18) Signed-off-by: Benjamin Bara Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 768c6bb46e1cc4a1d8c12c6f30408bb821ec4534) Signed-off-by: Steve Sakoman