summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended
Commit message (Collapse)AuthorAgeFilesLines
* wget: fix CVE-2024-10524Divya Chellam2025-01-242-0/+198
| | | | | | | | | | | | | | | | | | Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-10524 Upstream-patch: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c419542d956a2607bbce5df64b9d378a8588d778 (From OE-Core rev: eed5d59c138c210df91f31ac718383ccaf921faf) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: Fix CVE-2024-20696aszh072025-01-092-0/+115
| | | | | | | | | | | | Add Patch file to fix CVE-2024-20696 CVE: CVE-2024-20696 (From OE-Core rev: 8885aa23d77fcec288a416d199e08c6eee27e027) Signed-off-by: Nitin Wankhade <nitin.wankhade@kpit.com> Signed-off-by: Nikhil R <nikhilr5@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore CVE-2024-46954Peter Marko2025-01-091-1/+1
| | | | | | | | | | | | | | | Issue in the GhostPCL. GhostPCL not part of this GhostScript recipe. [1] points to [2] as patch, while file base/gp_utf8.c is not part of ghostscript source tarball. [1] https://nvd.nist.gov/vuln/detail/CVE-2024-46954 [2] https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=55f587dd039282316f512e1bea64218fd991f934 (From OE-Core rev: 7f1b174b8f12fcf377c45c27022bac99b6652823) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* unzip: Fix configure tests to use modern CKhem Raj2024-12-162-0/+113
| | | | | | | | | | | | Newer compilers end up with errors while compiling these test snippets and build results in failures. (From OE-Core rev: 61bd7eccd8e305e2dd95f0b0b86b09d72e99fc1a) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libpam: fix CVE-2024-10041Divya Chellam2024-12-162-0/+99
| | | | | | | | | | | | | | | | | | | | | A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications. References: https://security-tracker.debian.org/tracker/CVE-2024-10041 Upstream patches: https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be (From OE-Core rev: 3422c2533caaa2664944315580c52a2272815305) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cpio: ignore CVE-2023-7216Peter Marko2024-12-091-0/+2
| | | | | | | | | | Same was done in newer Yocto releases. See commit See commit 0f2cd2bbaddba3b8c80d71db274bbcd941d0e60e (From OE-Core rev: 50d8a653104abb9b5cd8a708a7bd97446e894bcf) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata&tzcode-native: upgrade 2024a -> 2024bJinfeng Wang2024-12-021-3/+3
| | | | | | | | | (From OE-Core rev: 5aa73ec35a3c65df62f17bc8196a35f28fd3522e) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit c8d3edb2562ea4d980186e78b4abb5a94b1d7b22) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Backport fix for multiple CVE'sVijay Anusuri2024-11-276-0/+255
| | | | | | | | | | | | | | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2024-46951 CVE-2024-46952 CVE-2024-46953 CVE-2024-46955 CVE-2024-46956 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/ghostscript/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ada21374f0c90cc3acf7ce0e96302394560c7aee & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=1fb76aaddac34530242dfbb9579d9997dae41264 & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=294a3755e33f453dd92e2a7c4cfceb087ac09d6a & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ca1fc2aefe9796e321d0589afe7efb35063c8b2a & https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ea69a1388245ad959d31c272b5ba66d40cebba2c] (From OE-Core rev: 21a81b592a33504d90f8c53842719cb1fcf96271) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2023-46361Archana Polampalli2024-11-152-0/+33
| | | | | | | | | | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. (From OE-Core rev: 3e9018fb14466495be7472a8620918347c732e86) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zstd: patch CVE-2022-4899Peter Marko2024-11-113-1/+153
| | | | | | | | | | | | | Pick commits from [1] linked from [2] via [3]. [1] https://github.com/facebook/zstd/pull/3220 [2] https://nvd.nist.gov/vuln/detail/CVE-2022-4899 [3] https://github.com/facebook/zstd/issues/3200 (From OE-Core rev: eb9c9818088105f9bf20b7fdc04a380ce488a5e6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cracklib: Modify patch to compile with GCC 14Zoltan Boszormenyi2024-11-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | GCC 14 implicitly turns a warning into a compiler error: | ../../git/src/lib/packlib.c: In function ‘PWClose’: | ../../git/src/lib/packlib.c:554:40: error: passing argument 1 of ‘HwmsHostToBigEndian’ from incompatible pointer type [-Wincompatible-pointer-types] | 554 | HwmsHostToBigEndian(tmp_pwp.hwms, sizeof(tmp_pwp.hwms), en_is32); | | ~~~~~~~^~~~~ | | | | | uint32_t * {aka unsigned int *} | ../../git/src/lib/packlib.c:142:27: note: expected ‘char *’ but argument is of type ‘uint32_t *’ {aka ‘unsigned int *’} | 142 | HwmsHostToBigEndian(char *pHwms, int nLen,int nBitType) | | ~~~~~~^~~~~ Add the cast to (char *) to silence it. (From OE-Core rev: 7cca344feaa16cfabbaa2f34e4aab91cc1af39ee) Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zip: Fix build with gcc-14Khem Raj2024-11-023-36/+46
| | | | | | | | | | | | | | | | | | | | | | | | zip's configure fails to link this piece of test code: int main() { return closedir(opendir(".")); } with GCC-14 because it now treats implicit declaration of function as error, unline older GCC version where it was just a warning and this test would build fine. Remove 0002-unix.c-Do-not-redefine-DIR-as-FILE.patch which is now unnecessary (MJ: this part wasn't applicable for kirkstone). (From OE-Core rev: fd31dd1abc8199a1865801259e6f96b78a17d994) Signed-off-by: Zoltán Böszörményi <zboszor@gmail.com> Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3422411eb750c7e960b81676637cfb321dbadefb) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zip: Make configure checks to be more robustKhem Raj2024-11-023-0/+171
| | | | | | | | | | | | | | Newer compilers are strict and have turned some warnings into hard errors which results in subtle configure check failures. Therefore fix these tests and also enable largefile support via cflags when its desired (From OE-Core rev: 03b7a44e2ff4364cb85758f91d78efa0cf85682d) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Backport CVE-2024-29508Ashish Sharma2024-11-023-0/+339
| | | | | | | | | | | | | Import patch from ubuntu to fix CVE-2024-29508 Upstream-Status: Backport [https://git.launchpad.net/ubuntu/+source/ghostscript/commit/?h=ubuntu/focal-security&id=22b23aa6de7613a4d9c1da9c84d72427c9d0cf1a] Upstream commit: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=ff1013a0ab485b66783b70145e342a82c670906a (From OE-Core rev: c5a85dfe661543137e40976e832ac22e4815406a) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: Fix CVE-2024-48957 & CVE-2024-48958Ashish Sharma2024-10-243-0/+72
| | | | | | | | | | | | Backport fix: * CVE-2024-48957 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/3006bc5d02ad3ae3c4f9274f60c1f9d2d834734b * CVE-2024-48958 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/a1cb648d52f5b6d3f31184d9b6a7cbca628459b7 (From OE-Core rev: 584ce77f3aae332c66e2140497506301200ec9ca) Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zstd: fix LICENSE statementMassimiliano Minella2024-10-121-1/+1
| | | | | | | | | | | | | | [Backport from OE-Core: 40f85de590c188c9c3985e64a83efaf06b0b4fbc] zstd is dual-licensed under BSD _OR_ GPLv2 which was updated in the README for v1.5.6. License wording in the README for v1.5.2 is misleading, but license headers in the code clearly state that there is a choice between the two licenses. (From OE-Core rev: 4ef9b4d947b6e8ed7637cdd9e722c3f0c83990dd) Signed-off-by: Massimiliano Minella <massimiliano.minella@se.com> Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: Backport fix for CVE-2024-47175Vijay Anusuri2024-10-126-0/+628
| | | | | | | | | | | | | | | | | | | Upstream-Status: Backport from https://github.com/OpenPrinting/cups/commit/9939a70b750edd9d05270060cc5cf62ca98cfbe5 & https://github.com/OpenPrinting/cups/commit/04bb2af4521b56c1699a2c2431c56c05a7102e69 & https://github.com/OpenPrinting/cups/commit/e0630cd18f76340d302000f2bf6516e99602b844 & https://github.com/OpenPrinting/cups/commit/1e6ca5913eceee906038bc04cc7ccfbe2923bdfd & https://github.com/OpenPrinting/cups/commit/2abe1ba8a66864aa82cd9836b37e57103b8e1a3b Reference: https://security-tracker.debian.org/tracker/CVE-2024-47175 (From OE-Core rev: 528e2a27564f3093a6a3bb7ac907caae674edab4) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* procps: patch CVE-2023-4016Jinfeng Wang2024-10-072-1/+62
| | | | | | | | | | | | | | | Previous patch[1] for CVE-2023-4016 is insufficent. Backport more from upstream master. There is one change needed to apply this patch: * change file location from local/xalloc.h to include/xalloc.h [1] https://git.openembedded.org/openembedded-core/commit/meta/recipes-extended/procps/procps/CVE-2023-4016.patch?h=kirkstone&id=71d0683d625c09d4db5e0473a0b15a266aa787f4 (From OE-Core rev: 94521a1e49e8fd9193211f486995d2e504f99d3f) Signed-off-by: Jinfeng Wang <jinfeng.wang.cn@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: Security fix for CVE-2024-35235Rohini Sangam2024-09-272-0/+122
| | | | | | | | | | | | CVE fixed: - CVE-2024-35235: cups: Cupsd Listen arbitrary chmod 0140777 Upstream-Status: Backport from https://github.com/OpenPrinting/cups/commit/a436956f374b0fd7f5da9df482e4f5840fa1c0d2, https://github.com/OpenPrinting/cups/commit/e3952d3ecd231588bb382529281a294124db9348#diff-6fc0a5ba57f83c8177d28f44729276fe35fcaaceae8b774481e6973fcbdf733d (From OE-Core rev: 7fadda8f9605f826744438cefc35658047bbdb01) Signed-off-by: Rohini Sangam <rsangam@mvista.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* zip: Fix LICENSENiko Mauno2024-09-161-1/+1
| | | | | | | | | | | | | | | | The contents of the LICENSE file included in the current source code package match those of Info-ZIP license, which seems to originate from the year 2007: This is version 2007-Mar-4 of the Info-ZIP license. (From OE-Core rev: 3739a1af61ff6f0faca23bb565f9e71666953715) (From OE-Core rev: 1aeb18b575ab31f779599ffd108d578012a8b800) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* unzip: Fix LICENSENiko Mauno2024-09-161-1/+1
| | | | | | | | | | | | | | | | The contents of the LICENSE file included in the current source code package match those of Info-ZIP license, which seems to originate from the year 2009: This is version 2009-Jan-02 of the Info-ZIP license. (From OE-Core rev: e7c9368e56a6ad90b4ffbba1b765e2b3a331c796) (From OE-Core rev: 33e92e85b1632e933c3099a45ba53c6904eb6b88) Signed-off-by: Niko Mauno <niko.mauno@vaisala.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2024-29506Archana Polampalli2024-08-162-0/+46
| | | | | | | (From OE-Core rev: 68a6482244532e61bc467e1ef23661260bac8572) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2024-29509Archana Polampalli2024-08-162-0/+46
| | | | | | | (From OE-Core rev: 18c55a131b0627b906de29f8c4cbd1526154cd60) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2024-29511Archana Polampalli2024-08-163-0/+321
| | | | | | | (From OE-Core rev: 1710676f80df2ba1ee77d15b4e0e532df10be5a5) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: ignore CVE-2024-37407Peter Marko2024-07-241-0/+2
| | | | | | | | | | | | | | | | History of code changes: * introduced: https://github.com/ilibarchive/libarchive/commit/390d83012fdba8c8db7fc9915338805882b0597a (v3.7.2-52-g390d8301) * reverted: 6https://github.com/libarchive/libarchive/commit/2c8caf6611a7d0662d80176c4fdb40f85794699 (v3.7.2-53-g62c8caf6) * re-introduced: 9https://github.com/libarchive/libarchive/commit/1f27004a5c88589658e38d68e46d223da6b75ca (v3.7.3-14-g91f27004) * fixed: bhttps://github.com/libarchive/libarchive/commit/6a979481b7d77c12fa17bbed94576b63bbcb0c0 (v3.7.3-24-gb6a97948) Since there is no release where this CVE was present, we can safely ignore it. (From OE-Core rev: 2b407f34df5a768c271fc7049e7272d1a79c04a0) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* wget: Fix for CVE-2024-38428Vijay Anusuri2024-07-092-0/+80
| | | | | | | | | | Upstream-Status: Backport [https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace] (From OE-Core rev: 4f7fb1cf937b0cefa5b0079417859b56c3171c0a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* man-pages: remove conflict pagesChangqing Li2024-06-261-9/+4
| | | | | | | | | | | | | | | | | | | | Remove the pages which libxcrypt and shadow already have to avoid following conflicts during install man-pages and libxcrypt/shadow at the same time. Error: Transaction test error: file /usr/share/man/man3/crypt.3 from install of libcrypt-doc-4.4.33-r0.x86_64 conflicts with file from package man-pages-6.04-r0.x86_64 (From OE-Core rev: fbc8f5381e8e1da0d06f7f8e5b8c63a49b1858c2) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 605b4a91dc44d33bd4742841e71645275bc039e8) Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* man-pages: add an alternative link name for crypt_r.3Thomas Perrot2024-06-261-3/+4
| | | | | | | | | | | | | Because crypt_r.3 is also provided by libxcrypt-doc. (From OE-Core rev: 5160fb6bf6ef49c0c33b000f377a56effd398fd0) Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ae5a8629ea72d6b3567047c7b858deae28623aba) Signed-off-by: Jonas Gorski <jonas.gorski@bisdn.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* acpica: fix CVE-2024-24856Yogita Urade2024-06-262-1/+36
| | | | | | | | | | | | | | | | | The memory allocation function ACPI_ALLOCATE_ZEROED does not guarantee a successful allocation, but the subsequent code directly dereferences the pointer that receives it, which may lead to null pointer dereference. To fix this issue, a null pointer check should be added. If it is null, return exception code AE_NO_MEMORY. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-24856 (From OE-Core rev: 0920aacb2a042e10e54db949428471ef9b20c96d) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2023-52722Archana Polampalli2024-06-012-0/+44
| | | | | | | (From OE-Core rev: 66228a9e8177e70a5653b61742836a3ad83e78af) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2024-29510Archana Polampalli2024-06-012-0/+85
| | | | | | | (From OE-Core rev: 18e03cadcad0b416ef9fe65627e2e5c2924e3f26) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2024-33871Archana Polampalli2024-06-013-0/+4908
| | | | | | | | | | | Added dependent patch [1] for backporting this CVE [1] https://github.com/ArtifexSoftware/ghostpdl/commit/8b47f269b83b172b22606806fe5ec272d974e797 (From OE-Core rev: edcaa55aa53d51528ae77d1f4b544309c8e1e48e) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2024-33869Archana Polampalli2024-06-013-0/+93
| | | | | | | (From OE-Core rev: fb0271a2d4e847764816b673aa37ea03ee4b3325) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2024-33870Archana Polampalli2024-06-012-0/+93
| | | | | | | (From OE-Core rev: 9f0c63b568312da93daeb31eeb2874b98d1e3eea) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: fix CVE-2024-26256Yogita Urade2024-05-292-2/+32
| | | | | | | | | | | | | libarchive Remote Code Execution Vulnerability References: https://nvd.nist.gov/vuln/detail/CVE-2024-26256 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-26256 (From OE-Core rev: 1ee5ba41cab2ce490fa0ddf67b83f57af1206c35) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libarchive: fix multiple security vulnerabilities in pax writerPeter Marko2024-05-152-1/+110
| | | | | | | | | There was no CVE assigned but the commit message is clear. (From OE-Core rev: 3743a82162546eceb8d54b240dc70c521c53bed8) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* less: backport Debian patch for CVE-2024-32487Vijay Anusuri2024-05-152-0/+70
| | | | | | | | | | | | | | import patch from ubuntu to fix CVE-2024-32487 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/less/tree/debian/patches?h=ubuntu/jammy-security Upstream commit https://github.com/gwsw/less/commit/007521ac3c95bc76e3d59c6dbfe75d06c8075c33] (From OE-Core rev: 1456b309963d3121e5ab2bc9de02b19663ee3a43) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: fix typo in CVE-2023-32360 backport patchJonathan GUILLOT2024-04-191-1/+1
| | | | | | | | | | | | | | Typo prevents cupsd to start correctly with following error: Unable to read "/etc/cups/cupsd.conf" due to errors. Using `/usr/sbin/cupsd -t` to check the configuration: Unknown authorization type Defaul on line 77 of /etc/cups/cupsd.conf. Unknown Policy Limit directive AuthType on line 77 of /etc/cups/cupsd.conf. (From OE-Core rev: eab100205bc5cdffc5ccc7752e1ee5abd9ebb58a) Signed-off-by: Jonathan GUILLOT <jonathan@joggee.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* stress-ng: avoid calling sync during do_compileMartin Jansa2024-03-252-0/+36
| | | | | | | | | | calling 'sync' from do_compile in the middle of big OE world build harms the build time. (From OE-Core rev: b2de7d75692fd4c9e0a6f46a099b89089edb10d4) Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata : Upgrade to 2024aPriyal Doshi2024-03-071-3/+3
| | | | | | | | | | (From OE-Core rev: 5f9463d8c9954944c44ca9f25702753895b02745) Signed-off-by: Priyal Doshi <pdoshi@mvista.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 5abbd0abf992ce8d11f3ae31fb1d83d97f5319fa) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* less: Fix for CVE-2022-48624Vijay Anusuri2024-03-072-0/+42
| | | | | | | | | Upstream-Status: Backport [https://github.com/gwsw/less/commit/c6ac6de49698be84d264a0c4c0c40bb870b10144] (From OE-Core rev: 8d91ab209398a8415009bc3093d407bf8871dafd) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: correct LICENSE with AGPLv3Kai Kang2024-02-151-1/+1
| | | | | | | | | | | | | | | | The license of ghostscript has switched to Affero GPL since version 9.07 via commit: * 3cc5318 Switch Ghostscript/GhostPDL to Affero GPL https://github.com/ArtifexSoftware/ghostpdl/commit/3cc5318 Correct it with `AGPL-3.0-or-later`. (From OE-Core rev: 8e192a2e0c2fdad18ea4c08774493225f31931a0) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pam: fix CVE-2024-22365 pam_namespace missesHitendra Prajapati2024-01-242-0/+63
| | | | | | | | | Upstream-Status: Backport from https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb (From OE-Core rev: 9af2e012ee4483541559788dfb9510e0223daefe) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cpio: upgrade to 2.14Soumya Sambu2024-01-217-1016/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes fix for CVE-2023-7207. Drop all submitted patches. Apply a patch from git to fix the build with clang. [ YOCTO #11674 ] $git log --oneline release_2_13..v2.14 4a41909 (HEAD, tag: v2.14) Version 2.14 6f9e5d3 Update NEWS 807b3ea Use GNU ls algorithm for deciding timestamp format 19219d1 Fix integer overflows in timestamp output ed28f14 Whitespace cleanup 4ab2813 Update version of gnulib 0987d63 Fix appending to archives bigger than 2G 1df0062 Fix combination of --create, --append, --directory 6a94d5e New option --ignore-dirnlink 376d663 Fix 45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca. beba8c0 Require automake 1.16.5 70fffa7 Update for newer autotools a1b2f78 Fix calculation of CRC in copy-out mode. 18ea636 Upgrade gnulib 1a61f62 Update copyright years a1c97c8 Fix wording in the manpage 97fab48 Update copyright years 86dacfe Remove redundant condition check 4d16930 Use inttostr to represent integer values as strings 236684f Fix dynamic string reallocations dfc801c Fix previous commit dd96882 Rewrite dynamic string support. 269d204 Improve online version of the documentation. 7dd8ba9 Update gnulib 905907c Update copyright years 4a78d77 Formatting changes in the documentation. 9fe8494 Update copyright years 641d3f4 Minor fix * src/global.c: Remove superfluous declaration of program_name 0c4ffde Fix handling of device numbers (part 2) df55fb1 Fix handling of device numbers on copy out. b1c8583 Improve 684b7ac5 684b7ac Fix cpio header verification. (From OE-Core rev: 203804370997eeb015ef9da90b567ea2c2f9f3a6) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tzdata: Upgrade to 2023dShubham Kulkarni2024-01-041-3/+3
| | | | | | | | | (From OE-Core rev: 227b3d4edad31b0d0045f41133271693265240b0) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2956b1aa22129951b8c08ac06ff1ffd66811a26c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: Backport fix for CVE-2023-46751Vijay Anusuri2023-12-222-0/+42
| | | | | | | | | Upstream-Status: Backport [https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=5d2da96e81c7455338302c71a291088a8396245a] (From OE-Core rev: f01a0e7fcf3c2d277be0cd85c0cd6b2eff2e5f0a) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bash: changes to SIGINT handler while waiting for a childWenlin Kang2023-12-122-0/+230
| | | | | | | | | | | | | | | | | | It rarely observes the problem while running shell script aborting test repeatedly, at the problem, the test shell script never returns to shell Steps to reproduce: 1. Run test script and ctrl-c repeatedly 2. Observe whether returns to shell after ctrl-c Fixed issue: https://lists.gnu.org/archive/html/bug-bash/2023-10/msg00131.html (From OE-Core rev: a351d62ca7deff548542c849a6fa696280b5533a) Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sudo: upgrade 1.9.13p3 -> 1.9.15p2Soumya Sambu2023-11-283-30/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | License-update: file removed upstream Drop patch as issue fixed upstream. Changelog: =========== 1.9.15p2 * Fixed a bug on BSD systems where sudo would not restore the terminal settings on exit if the terminal had parity enabled. GitHub issue #326. 1.9.15p1 * Fixed a bug introduced in sudo 1.9.15 that prevented LDAP-based sudoers from being able to read the ldap.conf file. GitHub issue #325. 1.9.15 * Fixed an undefined symbol problem on older versions of macOS when "intercept" or "log_subcmds" are enabled in sudoers. GitHub issue #276. * Fixed "make check" failure related to getpwent(3) wrapping on NetBSD. * Fixed the warning message for "sudo -l command" when the command is not permitted. There was a missing space between "list" and the actual command due to changes in sudo 1.9.14. * Fixed a bug where output could go to the wrong terminal if "use_pty" is enabled (the default) and the standard input, output or error is redirected to a different terminal. Bug #1056. * The visudo utility will no longer create an empty file when the specified sudoers file does not exist and the user exits the editor without making any changes. GitHub issue #294. * The AIX and Solaris sudo packages on www.sudo.ws now support "log_subcmds" and "intercept" with both 32-bit and 64-bit binaries. Previously, they only worked when running binaries with the same word size as the sudo binary. GitHub issue #289. * The sudoers source is now logged in the JSON event log. This makes it possible to tell which rule resulted in a match. * Running "sudo -ll command" now produces verbose output that includes matching rule as well as the path to the sudoers file the matching rule came from. For LDAP sudoers, the name of the matching sudoRole is printed instead. * The embedded copy of zlib has been updated to version 1.3. * The sudoers plugin has been modified to make it more resilient to ROWHAMMER attacks on authentication and policy matching. This addresses CVE-2023-42465. * The sudoers plugin now constructs the user time stamp file path name using the user-ID instead of the user name. This avoids a potential problem with user names that contain a path separator ('/') being interpreted as part of the path name. A similar issue in sudo-rs has been assigned CVE-2023-42456. * A path separator ('/') in a user, group or host name is now replaced with an underbar character ('_') when expanding escapes in @include and @includedir directives as well as the "iolog_file" and "iolog_dir" sudoers Default settings. * The "intercept_verify" sudoers option is now only applied when the "intercept" option is set in sudoers. Previously, it was also applied when "log_subcmds" was enabled. Sudo 1.9.14 contained an incorrect fix for this. Bug #1058. * Changes to terminal settings are now performed atomically, where possible. If the command is being run in a pseudo-terminal and the user's terminal is already in raw mode, sudo will not change the user's terminal settings. This prevents concurrent sudo processes from restoring the terminal settings to the wrong values. GitHub issue #312. * Reverted a change from sudo 1.9.4 that resulted in PAM session modules being called with the environment of the command to be run instead of the environment of the invoking user. GitHub issue #318. * New Indonesian translation from translationproject.org. * The sudo_logsrvd server will now raise its open file descriptor limit to the maximum allowed value when it starts up. Each connection can require up to nine open file descriptors so the default soft limit may be too low. * Better log message when rejecting a command if the "intercept" option is enabled and the "intercept_allow_setid" option is disabled. Previously, "command not allowed" would be logged and the user had no way of knowing what the actual problem was. * Sudo will now log the invoking user's environment as "submitenv" in the JSON logs. The command's environment ("runenv") is no longer logged for commands rejected by the sudoers file or an approval plugin. 1.9.14p3 * Fixed a crash with Python 3.12 when the sudo Python plugin is unloaded. This only affects "make check" for the Python plugin. * Adapted the sudo Python plugin test output to match Python 3.12. 1.9.14p2 * Fixed a crash on Linux systems introduced in version 1.9.14 when running a command with a NULL argv[0] if "log_subcmds" or "intercept" is enabled in sudoers. * Fixed a problem with "stair-stepped" output when piping or redirecting the output of a sudo command that takes user input. * Fixed a bug introduced in sudo 1.9.14 that affects matching sudoers rules containing a Runas_Spec with an empty Runas user. These rules should only match when sudo's -g option is used but were matching even without the -g option. GitHub issue #290. 1.9.14p1 * Fixed an invalid free bug in sudo_logsrvd that was introduced in version 1.9.14 which could cause sudo_logsrvd to crash. * The sudoers plugin no longer tries to send the terminal name to the log server when no terminal is present. This bug was introduced in version 1.9.14. 1.9.14 * Fixed a bug where if the "intercept" or "log_subcmds" sudoers option was enabled and a sub-command was run where the first entry of the argument vector didn't match the command being run. This resulted in commands like "sudo su -" being killed due to the mismatch. Bug #1050. * The sudoers plugin now canonicalizes command path names before matching (where possible). This fixes a bug where sudo could execute the wrong path if there are multiple symbolic links with the same target and the same base name in sudoers that a user is allowed to run. GitHub issue #228. * Improved command matching when a chroot is specified in sudoers. The sudoers plugin will now change the root directory id needed before performing command matching. Previously, the root directory was simply prepended to the path that was being processed. * When NETGROUP_BASE is set in the ldap.conf file, sudo will now perform its own netgroup lookups of the host name instead of using the system innetgr(3) function. This guarantees that user and host netgroup lookups are performed using the same LDAP server (or servers). * Fixed a bug introduced in sudo 1.9.13 that resulted in a missing " ; " separator between environment variables and the command in log entries. * The visudo utility now displays a warning when it ignores a file in an include dir such as /etc/sudoers.d. * When running a command in a pseudo-terminal, sudo will initialize the terminal settings even if it is the background process. Previously, sudo only initialized the pseudo-terminal when running in the foreground. This fixes an issue where a program that checks the window size would read the wrong value when sudo was running in the background. * Fixed a bug where only the first two digits of the TSID field being was logged. Bug #1046. * The "use_pty" sudoers option is now enabled by default. To restore the historic behavior where a command is run in the user's terminal, add "Defaults !use_pty" to the sudoers file. GitHub issue #258. * Sudo's "-b" option now works when the command is run in a pseudo-terminal. * When disabling core dumps, sudo now only modifies the soft limit and leaves the hard limit as-is. This avoids problems on Linux when sudo does not have CAP_SYS_RESOURCE, which may be the case when run inside a container. GitHub issue #42. * Sudo configuration file paths have been converted to colon-separated lists of paths. This makes it possible to have configuration files on a read-only file system while still allowing for local modifications in a different (writable) directory. The new --enable-adminconf configure option can be used to specify a directory that is searched for configuration files in preference to the sysconfdir (which is usually /etc). * The NETGROUP_QUERY ldap.conf parameter can now be disabled for LDAP servers that do not support querying the nisNetgroup object by its nisNetgroupTriple attribute, while still allowing sudo to query the LDAP server directly to determine netgroup membership. * Fixed a long-standing bug where a sudoers rule without an explicit runas list allowed the user to run a command as root and any group instead of just one of the groups that root is a member of. For example, a rule such as "myuser ALL = ALL" would permit "sudo -u root -g othergroup" even if root did not belong to "othergroup". * Fixed a bug where a sudoers rule with an explicit runas list allowed a user to run sudo commands as themselves. For example, a rule such as "myuser ALL = (root) ALL", "myuser" should only allow commands to be run as root (optionally using one of root's groups). However, the rule also allowed the user to run "sudo -u myuser -g myuser command". * Fixed a bug that prevented the user from specifying a group on the command line via "sudo -g" if the rule's Runas_Spec contained a Runas_Alias. * Sudo now requires a C compiler that conforms to ISO C99 or higher to build. (From OE-Core rev: 55f1437e2e7f11724ace489677ae214611244faf) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: ignore GhostPCL CVE-2023-38560Lee Chee Yang2023-11-281-0/+3
| | | | | | | | | | issue in GhostPCL. GhostPCL not part of this GhostScript recipe. (From OE-Core rev: 7c4b4daeeca8fab257475eacb83c58b7e5dfee24) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gawk: backport Debian patch to fix CVE-2023-4156Vijay Anusuri2023-10-252-0/+29
| | | | | | | | | | | | Upstream-Status: Backport [https://git.launchpad.net/ubuntu/+source/gawk/tree/debian/patches?h=ubuntu/jammy-security & https://git.savannah.gnu.org/gitweb/?p=gawk.git;a=commitdiff;h=e709eb829448ce040087a3fc5481db6bfcaae212] (From OE-Core rev: 0547b60d3485c2e3853e5a9e0a3e051882b283f3) Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-07-27 12:44:37 +0000