linux/poky.git/meta/recipes-support, branch yocto-4.0.7

libseccomp: fix typo in DESCRIPTION

2023-01-26T23:37:05+00:00

Fix typo in DESCRIPTION: and -> an. (From OE-Core rev: 44f59f5d8414cbe935addb57bd1ea9ffaf734fba) Signed-off-by: Chen Qi Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 349e63045298054f9454025d793c67284fce750b) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

vim: upgrade 9.0.0947 -> 9.0.1211

2023-01-26T23:37:05+00:00

Includes fixes for: https://nvd.nist.gov/vuln/detail/CVE-2023-0049 https://nvd.nist.gov/vuln/detail/CVE-2023-0051 https://nvd.nist.gov/vuln/detail/CVE-2023-0054 https://nvd.nist.gov/vuln/detail/CVE-2023-0288 (From OE-Core rev: d4887e2e43e3d66e0f64299a8189b26d5aff31ef) Signed-off-by: Randy MacLeod Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 1c51068c78d12ee02789a6dbecf5e7e91d141af5) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

libksba: update 1.6.2 -> 1.6.3

2023-01-26T23:37:05+00:00

Noteworthy changes in version 1.6.3 (2022-12-06) Fix another integer overflow in the CRL parser. [T6284,CVE-2022-47629] (From OE-Core rev: 0c1829b0e7e085ba8aef0d47852abf520ef9d635) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 83f3f21b1b84ab9e7b461ac966691c80f4ed4e97) Signed-off-by: Steve Sakoman (cherry picked from commit f098cb5073051eb371f4142678b4b3d5e7b52426) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

Revert "libksba: fix CVE-2022-47629"

2023-01-26T23:37:05+00:00

Prepare for stable version bump which includes this fix This reverts commit e4cb0bf273ea556db91699594046a47514c8583c. Signed-off-by: Richard Purdie

libksba: fix CVE-2022-47629

2023-01-26T23:37:05+00:00

Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE: CVE-2022-47926 References: https://nvd.nist.gov/vuln/detail/CVE-2022-47629 (From OE-Core rev: e4cb0bf273ea556db91699594046a47514c8583c) Signed-off-by: Yogita Urade Signed-off-by: Richard Purdie

curl: Add patch to fix CVE-2022-43552

2023-01-06T17:33:23+00:00

Add patch to fix the security issue "curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations using an appropriate HTTP error response code." as per below link Link: https://curl.se/docs/CVE-2022-43552.html (From OE-Core rev: a0db3ddf6f2efe733271ff7f6c68fda4d215b1bb) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

curl: Add patch to fix CVE-2022-43551

2023-01-06T17:33:23+00:00

Add patch to fix the security issue "curl's HSTS check could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL." as per below link Link: https://curl.se/docs/CVE-2022-43551.html (From OE-Core rev: baa18f2cf107af7a5e1c7b7befad46e6c48f4222) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

curl: Correct LICENSE from MIT-open-group to curl

2023-01-06T17:33:23+00:00

LICENSE for curl is set to MIT-open-group which is wrong and proper license is 'curl' I check below link and the line "Curl and libcurl are licensed under the license below, which is inspired by MIT/X, but not identical." says that the license is identical to MIT but actual license is identical from the file "meta/files/common-licenses/curl" Link: https://curl.se/docs/copyright.html Also, I do not find the MIT-open-group license text in the entire source-code (From OE-Core rev: 34b228bd3a80a74bf4d84ef7ee362f4ab1e3a466) (From OE-Core rev: 95b5df5c9e0bdef55d0f977fb814f9de74363e68) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Ranjitsinh Rathod Signed-off-by: Richard Purdie (cherry picked from commit 4a246e06cb62efff8bfd20cdf3dde31e24f9b711) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

sqlite: fix CVE-2022-46908 safe mode authorizer callback allows disallowed UDFs.

2023-01-06T17:33:23+00:00

(From OE-Core rev: 18641988caa131436f75dd3c279ce5af3380481a) Signed-off-by: Vivek Kumbhar Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

mpfr: upgrade 4.1.0 -> 4.1.1

2022-12-23T23:05:50+00:00

Changelog: ========= - Bug fixes (see and/or the ChangeLog file), in particular for macros implementing functions. - Improved manual formatting. (From OE-Core rev: 9977278a12d6bc0b811077fa19c64b80e793a33d) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni (cherry picked from commit f733eddc428cf9537f97cb91025b73dd1fdea932) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie