diff options
| author | Ross Burton <ross.burton@arm.com> | 2022-10-31 15:19:10 +0000 |
|---|---|---|
| committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2022-11-24 15:30:00 +0000 |
| commit | b17eb5180b0cca4fb83bee32abce7a86f04998c5 (patch) | |
| tree | 40315a3754c685f92e7c0238e54155116a9cee53 /scripts/lib/devtool/build_sdk.py | |
| parent | 4c5ac60f32f7106b81e22f4a9cc53a18cc6f94ad (diff) | |
| download | poky-b17eb5180b0cca4fb83bee32abce7a86f04998c5.tar.gz | |
expat: upgrade to 2.5.0
Release 2.5.0 Tue October 25 2022
Security fixes:
#616 #649 #650 CVE-2022-43680 -- Fix heap use-after-free after overeager
destruction of a shared DTD in function
XML_ExternalEntityParserCreate in out-of-memory situations.
Expected impact is denial of service or potentially
arbitrary code execution.
Bug fixes:
#612 #645 Fix curruption from undefined entities
#613 #654 Fix case when parsing was suspended while processing nested
entities
#616 #652 #653 Stop leaking opening tag bindings after a closing tag
mismatch error where a parser is reset through
XML_ParserReset and then reused to parse
#656 CMake: Fix generation of pkg-config file
#658 MinGW|CMake: Fix static library name
Other changes:
#663 Protect header expat_config.h from multiple inclusion
#666 examples: Make use of XML_GetBuffer and be more
consistent across examples
#648 Address compiler warnings
#667 #668 Version info bumped from 9:9:8 to 9:10:8;
see https://verbump.de/ for what these numbers do
Includes a fix for CVE-2022-43680.
(From OE-Core rev: 8dda30a9c64a4ad1f8eee11deb2e5143ba5fd719)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a257a674272dc638f09167e9b9202adfb477ef1e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'scripts/lib/devtool/build_sdk.py')
0 files changed, 0 insertions, 0 deletions