linux/poky.git/meta, branch yocto-4.0.14

build-appliance-image: Update to kirkstone head revision

2023-11-03T14:34:41+00:00

(From OE-Core rev: 0eb8e67aa6833df0cde29833568a70e65c21d7e5) Signed-off-by: Steve Sakoman

glibc: ignore CVE-2023-4527

2023-11-03T14:26:13+00:00

This vulnerability was introduced in 2.36, so 2.35 is not vulnerable. (From OE-Core rev: bf60773c882483f4bfe49e89be8e2f85f78b212b) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

tiff: CVE patch correction for CVE-2023-3576

2023-11-03T14:26:13+00:00

- The commit [https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37] fixes CVE-2023-3576 - Hence, renamed the CVE-2023-3618-1.patch to CVE-2023-3576.patch - Reference: https://security-tracker.debian.org/tracker/CVE-2023-3576 https://security-tracker.debian.org/tracker/CVE-2023-3618 (From OE-Core rev: 63daa00279c0c3a8650d6e08a68cc32a2b98d843) Signed-off-by: Vijay Anusuri Signed-off-by: Steve Sakoman

libxml2: Patch CVE-2023-45322

2023-11-03T14:26:13+00:00

Backport patch for gitlab issue mentioned in NVD CVE report. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/583 Backport also one of 14 patches for older issue with similar errors to have clean cherry-pick without patch fuzz. * https://gitlab.gnome.org/GNOME/libxml2/-/issues/344 The CVE is disputed because the maintainer does not think that errors after memory allocation failures are not critical enough to warrant a CVE ID. This patch will formally fix reported error case, trying to backport another 13 patches and resolve conflicts would be probably overkill due to disputed state. This CVE was ignored on master branch (as diputed). (From OE-Core rev: d29a89412b37995857269d617e16ada116f14270) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

linux-firmware: create separate packages

2023-11-01T15:01:26+00:00

This is backport of commit dfb7d2c426b46502784bc9e199a468e6c1 from poky master. This is in continuation of earlier commit: 3ddddfc14f805fe7572bba129605869fb848fed4 linux-firmware: create separate package for cirrus and cnm firmwares And creates separate sub packages for firmwares corresponding to following list of licenses: LICENSE.amphion_vpu LICENCE.cw1200 LICENSE.ice_enhanced LICENCE.mediatek LICENCE.microchip LICENCE.moxa LICENSE.nxp_mc_firmware LICENCE.OLPC LICENCE.phanfw LICENCE.qla2xxx LICENCE.ti-keystone LICENCE.wl1251 LICENCE.xc4000 LICENCE.xc5000 LICENCE.xc5000c (From OE-Core rev: c110e5708465a6becc611acf97f166302a17ebdf) (From OE-Core rev: 56503e3e80603de3b69acef2f6d32836bc9e5e5d) Signed-off-by: Fahad Arslan Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

linux-firmware: create separate package for cirrus and cnm firmwares

2023-11-01T15:01:26+00:00

This is cherry-pick of commit 3ddddfc14f805fe7572bba129605869fb848fed4 from poky master. Some licenses only allow usage of corresponding firmwares when a specific hardware is present. This requires split of such firmwares from linux-firmware package to firmware specific sub package. As this split is based off of licensing, it makes sense to group firmware blobs having the same license in the same package. This commit is a first step in this direction, and creates separate packages for cirrus and cnm firmware. (From OE-Core rev: 53d9d8789efc701609a5a1e985287344c2209d62) (From OE-Core rev: 9b556e63ba3e89e83ba6e2647656a1fa6def87a4) Signed-off-by: Fahad Arslan Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

package_rpm: Allow compression mode override

2023-11-01T15:01:26+00:00

Commit 4a4d5f78a6962dda5f63e9891825c80a8a87bf66 ("package_rpm: use zstd instead of xz") changed the rpm package compressor from 'xz' to 'zstd' which results in decompression failure with BusyBox-provided 'rpm2cpio' applet and 'rpm' applet when given the '-i' (Install package) option: rpm2cpio: no gzip/bzip2/xz magic Introduce a variable which makes it possible to use a different compression mode, making it possible to override the default value for example like RPMBUILD_COMPMODE = "${@'w6T%d.xzdio' % int(d.getVar('XZ_THREADS'))}" to enable rpm decompression without including the full rpm package in the resulting root filesystem. (From OE-Core rev: a40d9258148e28cbee2168c93179cd4c1232fb62) (From OE-Core rev: ad4ea9f225b0dd6396088cc70b34f886c5fa62b4) Signed-off-by: Niko Mauno Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman

openssl: Upgrade 3.0.11 -> 3.0.12

2023-11-01T15:01:25+00:00

https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3011-and-openssl-3012-24-oct-2023 Major changes between OpenSSL 3.0.11 and OpenSSL 3.0.12 [24 Oct 2023] * Mitigate incorrect resize handling for symmetric cipher keys and IVs. (CVE-2023-5363) (From OE-Core rev: 5cf9f9426de71a35b06c7b4b9b092f22243676fb) Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

curl: fix CVE-2023-38546

2023-11-01T15:01:25+00:00

A flaw was found in the Curl package. This flaw allows an attacker to insert cookies into a running program using libcurl if the specific series of conditions are met. (From OE-Core rev: 9c0c09b81594979aafd74511366316419d23046e) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman

curl: fix CVE-2023-38545

2023-11-01T15:01:25+00:00

This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. (From OE-Core rev: 44971c945a615d07c91100f514377f7247796334) Signed-off-by: Archana Polampalli Signed-off-by: Steve Sakoman