summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
Commit message (Collapse)AuthorAgeFilesLines
* libseccomp: fix typo in DESCRIPTIONChen Qi2023-01-261-1/+1
| | | | | | | | | | | | | Fix typo in DESCRIPTION: and -> an. (From OE-Core rev: 44f59f5d8414cbe935addb57bd1ea9ffaf734fba) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 349e63045298054f9454025d793c67284fce750b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0947 -> 9.0.1211Randy MacLeod2023-01-261-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for: https://nvd.nist.gov/vuln/detail/CVE-2023-0049 https://nvd.nist.gov/vuln/detail/CVE-2023-0051 https://nvd.nist.gov/vuln/detail/CVE-2023-0054 https://nvd.nist.gov/vuln/detail/CVE-2023-0288 (From OE-Core rev: d4887e2e43e3d66e0f64299a8189b26d5aff31ef) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1c51068c78d12ee02789a6dbecf5e7e91d141af5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: update 1.6.2 -> 1.6.3Alexander Kanavin2023-01-262-4/+4
| | | | | | | | | | | | | | | | | Noteworthy changes in version 1.6.3 (2022-12-06) Fix another integer overflow in the CRL parser. [T6284,CVE-2022-47629] (From OE-Core rev: 0c1829b0e7e085ba8aef0d47852abf520ef9d635) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 83f3f21b1b84ab9e7b461ac966691c80f4ed4e97) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f098cb5073051eb371f4142678b4b3d5e7b52426) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "libksba: fix CVE-2022-47629"Steve Sakoman2023-01-262-74/+1
| | | | | | | | Prepare for stable version bump which includes this fix This reverts commit e4cb0bf273ea556db91699594046a47514c8583c. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: fix CVE-2022-47629Yogita Urade2023-01-262-1/+74
| | | | | | | | | | | | | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE: CVE-2022-47926 References: https://nvd.nist.gov/vuln/detail/CVE-2022-47629 (From OE-Core rev: e4cb0bf273ea556db91699594046a47514c8583c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add patch to fix CVE-2022-43552Ranjitsinh Rathod2023-01-062-0/+81
| | | | | | | | | | | | | | | Add patch to fix the security issue "curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations using an appropriate HTTP error response code." as per below link Link: https://curl.se/docs/CVE-2022-43552.html (From OE-Core rev: a0db3ddf6f2efe733271ff7f6c68fda4d215b1bb) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add patch to fix CVE-2022-43551Ranjitsinh Rathod2023-01-062-0/+36
| | | | | | | | | | | | | | | Add patch to fix the security issue "curl's HSTS check could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL." as per below link Link: https://curl.se/docs/CVE-2022-43551.html (From OE-Core rev: baa18f2cf107af7a5e1c7b7befad46e6c48f4222) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Correct LICENSE from MIT-open-group to curlRanjitsinh Rathod2023-01-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | LICENSE for curl is set to MIT-open-group which is wrong and proper license is 'curl' I check below link and the line "Curl and libcurl are licensed under the license below, which is inspired by MIT/X, but not identical." says that the license is identical to MIT but actual license is identical from the file "meta/files/common-licenses/curl" Link: https://curl.se/docs/copyright.html Also, I do not find the MIT-open-group license text in the entire source-code (From OE-Core rev: 34b228bd3a80a74bf4d84ef7ee362f4ab1e3a466) (From OE-Core rev: 95b5df5c9e0bdef55d0f977fb814f9de74363e68) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4a246e06cb62efff8bfd20cdf3dde31e24f9b711) Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite: fix CVE-2022-46908 safe mode authorizer callback allows disallowed UDFs.Vivek Kumbhar2023-01-062-0/+40
| | | | | | | | (From OE-Core rev: 18641988caa131436f75dd3c279ce5af3380481a) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mpfr: upgrade 4.1.0 -> 4.1.1Wang Mingyu2022-12-231-1/+1
| | | | | | | | | | | | | | | | Changelog: ========= - Bug fixes (see <https://www.mpfr.org/mpfr-4.1.0/#fixed> and/or the ChangeLog file), in particular for macros implementing functions. - Improved manual formatting. (From OE-Core rev: 9977278a12d6bc0b811077fa19c64b80e793a33d) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f733eddc428cf9537f97cb91025b73dd1fdea932) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0820 -> 9.0.0947Qiu, Zheng2022-12-131-2/+2
| | | | | | | | | | | | | | | | Includes fixes for CVE-2022-4141 https://nvd.nist.gov/vuln/detail/CVE-2022-4141 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: a7abc8754ab5fbefa23fc17571d272a77dcd2421) Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 160f459febc7fb36cc0fe85c63eb26780ace3bfd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-42915Bhabu Bindu2022-12-072-0/+54
| | | | | | | | | | | | HTTP proxy double-free Link: https://security-tracker.debian.org/tracker/CVE-2022-42915 (From OE-Core rev: 4754f33d7ec96f72351853463540c8b1a3f4bc0c) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-42916Bhabu Bindu2022-12-072-0/+137
| | | | | | | | | | | | HSTS bypass via IDN Link: https://security-tracker.debian.org/tracker/CVE-2022-42916 (From OE-Core rev: e6796b426503477620e0e5c5c9da50352269a593) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-32221Bhabu Bindu2022-12-072-0/+29
| | | | | | | | | | | | POST following PUT confusion Link: https://ubuntu.com/security/CVE-2022-32221 (From OE-Core rev: 518bea85c9496d77c70d703b818e442eda841554) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iso-codes: upgrade 4.11.0 -> 4.12.0Wang Mingyu2022-12-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: ========= - ISO 3166-1: Update name for TR. Fixes #38 - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-2. Closes: #1020633 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 (From OE-Core rev: 017abb138460978e87c84c509f9af7524a053e1b) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 99917b4b7d5642b292cb95c770871b95e411dfc5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libical: upgrade 3.0.15 -> 3.0.16Alexander Kanavin2022-12-011-1/+1
| | | | | | | | | | | | | | | Version 3.0.16 is a patch release. - Fix regressions in 3.0.15 due to improperly tested fuzz fixes - Fix argument guards in icaltime_as_timet to match documentation and tests. (From OE-Core rev: 6d68985f1a7a55cda92c177c739e51cac3faf653) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 77d4557d6f6a1405d03bb5dc7ca23d7ee78c2037) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libffi: upgrade 3.4.2 -> 3.4.4Alexander Kanavin2022-12-013-10/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | 3.4.4 Oct-23-2022 Important aarch64 fixes, including support for linux builds with Link Time Optimization (-flto). Fix x86 stdcall stack alignment. Fix x86 Windows msvc assembler compatibility. Fix moxie and or1k small structure args. 3.4.3 Sep-19-22 All struct args are passed by value, regardless of size, as per ABIs. Enable static trampolines for Cygwin. Add support for Loongson's LoongArch64 architecture. Fix x32 static trampolines. Fix 32-bit x86 stdcall stack corruption. Fix ILP32 aarch64 support. License-Update: copyright years (From OE-Core rev: 6ad074b1caff63e90805aac25cca8a831b57273d) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 5b42ba98ef26a52bad8de1790b402938fec4a160) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libffi: submit patch upstreamAlexander Kanavin2022-11-241-1/+1
| | | | | | | | | | | (From OE-Core rev: c8c8945ded40a36b42da4e95974cf76796c15cfb) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9555a7dc768c32a009333232e25cef041054b7f7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: upgrade 1.6.0 -> 1.6.2wangmy2022-11-101-1/+1
| | | | | | | | | | | | | | New upstream release fixing CVE-2022-3515 (From OE-Core rev: b58fa75b4cb0cc75034be5f952224d4bcee9aff6) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 4bef6fc673de958dfbab80bcbc2e0159803b97ee) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 8e453d64255ce6a01b193c3735bb0aefbaa6fb38) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* numactl: upgrade 2.0.15 -> 2.0.16wangmy2022-11-101-2/+2
| | | | | | | | | | (From OE-Core rev: 5a51b44967fff256ec298f7c3cfae1c084bf1b32) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6d9ed8d4b13c2d87dae482bbadef039de050bc9d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* numactl: upgrade 2.0.14 -> 2.0.15Richard Purdie2022-11-101-3/+3
| | | | | | | | | | | | | | | | v2.0.15 changes Various bug fixes and cleanups Supported multiple preferred nodes This release didn't include a release tarball. Furthermore, it had issues such as #135, #136 and #138 that got fixed in the follow up release. Please try to use v2.0.16 instead. License checksum change from a typo fix. (From OE-Core rev: c275a87794027b03fde68ee11fa2f5eddbf3c344) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8829fe6ee093acc6fb990f9ca6cad67c2c7549d5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libical: upgrade 3.0.14 -> 3.0.15wangmy2022-11-101-1/+1
| | | | | | | | | | | | | | | | | | | | | Changelog: ========= Add missing property parameters into libical-glib Fix CMake option USE_32BIT_TIME_T actually uses a 32-bit time_t value Fix icaltime_as_timet, which returned incorrect results for years >= 2100, to work properly between years 1902 and 10k. Fix x-property comma handling and escaping Built-in timezones updated to tzdata2022d (now with a VTIMEZONE for each time zone alias) Fix fuzzer issues Handle unreachable-code compile warnings with clang Ensure all vanew_foo() calls finish with (void*)0 (not 0) (From OE-Core rev: d0882397cb37ab19543733535c3d01d09c3845a4) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 6092ae3cbe0eaf006db615c6cc3f1692e1cc1df8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libcap: upgrade 2.65 -> 2.66wangmy2022-11-102-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | RELEASE NOTES FOR 2.66 Fix documentation typos in cap_from_text.3 (Bug: 216514 reported by Paulo Andrade.) Some getpcaps code clean up and a fix for PID argument parsing from Jakub Wilk. Slightly more robust Makefiles to address an error with make -j48 test observed by Tomasz Kłoczko. Include a simple Go program, captrace, to trace kernel capability validation checks This program can be used to figure out what capabilities a program needs to operate. captrace (a wrapper for bpftrace) uses BPF kprobes to monitor the kernel for capability checks and whether or not they succeed for the system, a specific PID or a program's direct execution. Trim down the default file capabilities for contrib/sucap/su to those actually needed and set USER and HOME environment variables so bash doesn't complain about a sourcing error. (From OE-Core rev: 003a81171366956c899305ca9adc352d3c99c964) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 9040e612084a561b1766bb86c9c002b811eea4c9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: Unified package names to lower-caseKeiya Nobuta2022-11-091-1/+1
| | | | | | | | | | | | | | create-spdx can't detect the license properly if the case doesn't match, so fix it. (From OE-Core rev: a96cd0df052af00215796add25373daf12a0e5ed) Signed-off-by: Keiya Nobuta <nobuta.keiya@fujitsu.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9c87828493784d996910d742006268a626ef0130) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0614 -> 9.0.0820Tim Orling2022-11-041-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for CVE-2022-3705 https://nvd.nist.gov/vuln/detail/CVE-2022-3705 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: 555fd2848b970fd38c20651b5e98cabb7f31287c) Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f6d917bd0f8810b5ed8d403ad25d59cda2fc9574) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0598 -> 9.0.0614Teoh Jay Shen2022-11-041-2/+2
| | | | | | | | | | | | Include fixes for CVE-2022-3352. (From OE-Core rev: 1104d02f9bac2fdd540da5ccb5dd6690e025ef33) Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 8aa707f80ae1cfe89d5e20ec1f1632a65149aed4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0541 -> 9.0.0598Richard Purdie2022-10-111-2/+2
| | | | | | | | | | | | | Includes a fix for CVE-2022-3278. (From OE-Core rev: 9837a62cc42de4120794d4ae8d0264109b8308dc) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 98c40271692147873a622e168e8b2e90a9fcc54c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.453 -> 9.0.541Richard Purdie2022-09-281-2/+2
| | | | | | | | | | | Includes a fix for CVE-2022-3234. (From OE-Core rev: 650ae29fc567e033205558fa85cc1c156d9f72a7) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d6b54f37aa4db1457296b8981b630a49d251ceb5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0341 -> 9.0.0453yocto-4.0.4kirkstone-4.0.4Richard Purdie2022-09-171-2/+2
| | | | | | | | | | | Includes fixes for CVE-2022-3099 and CVE-2022-3134. (From OE-Core rev: bc2e5e961e88eb9f4d8cd1f2ee0ed56ab00774a9) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d042923262130b6b96f703b5cd4184f659caeb92) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: Cache configure tests which use AC_TRY_RUNKhem Raj2022-09-122-2/+75
| | | | | | | | | | | | | | | | | AC_TRY_RUN macro means the test needs to run to find the result and we are cross compiling so this will always get wrong results, this results in miscompiling apache2 on musl because it disables rlimit (ac_cv_struct_rlimit) wrongly. All these variables are determined with AC_TRY_RUN checks (From OE-Core rev: 8784e3712add2fbdf684d442a14fb94e5a7fc61f) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 504eb0ff1cae200ee85ec18ebae564cae9bf9c8c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lz4: upgrade 1.9.3 -> 1.9.4wangmy2022-09-122-33/+4
| | | | | | | | | | | | | | | | | CVE-2021-3520.patch removed since it's included in 1.9.4 License-Update: Copyright year updated to 2020 description of 3rd party applications changed (From OE-Core rev: 8883d3992078ae24c2601ebf844223fa6e056ded) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f95c66050bc69af7769d1868b0118cefb24e5b0d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libatomic-ops: upgrade 7.6.12 -> 7.6.14wangmy2022-09-121-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | License-Update: Adjust/reformat content of LICENSING.txt ========================================================= "libatomic_ops_gpl.a" changed to "libatomic_ops_gpl.a file" "sysdeps" changed to "atomic_ops/sysdeps" "This applies only to test code, sample applications," changed to "This applies only to the test code" Changelog: ========== Add note to README that AO malloc code has same license as AO stack Adjust/reformat content of LICENSING.txt Avoid AO_stack_t to cross CPU cache line boundary Do not assume 'ordered except earlier write' for UWP/arm64 Do not name GCC intrinsics as C11 ones in ChangeLog and configure Eliminate '-pedantic is not option that controls warnings' GCC-6.3 message Ensure result of AO_test_and_set is always AO_TS_CLEAR or AO_TS_SET Fix 'AO_malloc redefinition' MS VC warning caused by attributes mismatch Fix 'use of undeclared SIG_BLOCK' Clang error if -std=c89 on Cygwin Fix AO_compare_and_swap_full asm code for clang on sparc Fix a typo in comment of AO_stack_push_explicit_aux_release Fix code indentation in main() of test_stack.c Refine AO_UNIPROCESSOR macro description in configure Remove outdated comment about unsupported Win64 in atomic_ops_stack.h Repeat black list check on CAS fail in stack_push_explicit_aux_release (From OE-Core rev: 8bcf5d5885abbc405f17a56027aa19f826dcdb71) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit a0f177ef7f52bab06d8fff752ba8390defd71ed5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* liburcu: upgrade 0.13.1 -> 0.13.2wangmy2022-09-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 2022-08-18 Userspace RCU 0.13.2 * Revert "Fix: remove type constness in URCU_FORCE_CAST's C++ version" * Fix: futex.h: include headers outside extern C * Fix: add missing unused attribute to _rcu_dereference * Fix: change method used by _rcu_dereference to strip type constness * Fix: remove type constness in URCU_FORCE_CAST's C++ version * Move extern "C" down in include/urcu/urcu-bp.h * fix: ifdef linux specific cpu count compat * Set git-review branch to stable-0.13 * fix: sysconf(_SC_NPROCESSORS_CONF) can be less than max cpu id * Fix: revise obsolete command in README.md * Fix: workqueue: remove unused variable "ret" * Fix: urcu-qsbr: futex wait: handle spurious futex wakeups * Fix: urcu: futex wait: handle spurious futex wakeups * Fix: urcu-wait: futex wait: handle spurious futex wakeups * Fix: defer_rcu: futex wait: handle spurious futex wakeups * Fix: call_rcu: futex wait: handle spurious futex wakeups * Fix: workqueue: futex wait: handle spurious futex wakeups * Fix: Use %lu rather than %ld to print count (From OE-Core rev: 2852ebcba6c718640b306adfd33907411ac02d21) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit b9ce9d9ab53baab7ba84187d17b34e48ff9eb16e) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtasn1: upgrade 4.18.0 -> 4.19.0wangmy2022-09-121-1/+1
| | | | | | | | | | | | | | | | Changelog: =========== - Clarify libtasn1.map license. Closes: #38. - Fix ETYPE_OK out of bounds read. Closes: #32. - Update gnulib files and various maintenance fixes. (From OE-Core rev: 005bfa0639724248f2a257cae0108ecd16e7314b) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit b8f2c6ec61ffcc607a35bd5c11f5020c9b676226) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0242 -> 9.0.0341Richard Purdie2022-09-121-2/+2
| | | | | | | | | | | | Addresses CVE-2022-2980, CVE-2022-2946 and CVE-2022-2982. (From OE-Core rev: b6eb009351d2bb04ae7ea828800e0e1b6934213e) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 01c08d47ecfcc7aefacc8280e0055c75b13795b2) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Backport patch for CVE-2022-35252Robert Joslyn2022-09-122-0/+73
| | | | | | | | | | https://curl.se/docs/CVE-2022-35252.html (From OE-Core rev: 40bbdb43b247ffc5dd1990f51fb824a089c0987f) Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite: add CVE-2022-35737 patch to SRC_URIChee Yang Lee2022-09-121-1/+3
| | | | | | | | | | | SRC_URI include patch introduced in oe-core commit fdc82b2314b580c0135c16b7278ebf8786311dec (From OE-Core rev: f28dc527d4a3e3aa6ef2b446e863264c0e874fa1) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: Use correct strerror_r implementation based on libc typeKhem Raj2022-09-032-0/+56
| | | | | | | | | | | | | | | | | | | musl does not implement GNU extention of strerror_r but XSI compliant version, therefore add it via a packageconfig to set right variables during configure to cache the value. configure detection logic depends on runtime test which will always be wrong on cross compiles therefore backport a patch to make it possible to cache the needed configure variable. (From OE-Core rev: b59027f32e4b2896dccced6d9cb75fbb41651abe) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ded3d76a844dd1aef9ac610fbe506bf76285369b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pinentry: enable _XOPEN_SOURCE on musl for wchar usage in cursesKhem Raj2022-09-031-0/+3
| | | | | | | | | | | | | | This is defined for glibc automatically with _GNU_SOURCE but not for musl (From OE-Core rev: 9c9dd76aee4f9d9e25e8e46bd84fe802007e9c0c) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 84375186570af548b49e44e884925f4feaddcc7a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite: fix CVE-2022-35737ghassaneben2022-09-031-0/+26
| | | | | | | | | | | | Increase the size of loop variables in the printf() implementation to avoid integer overflow on multi-gigabyte string arguments. CVE-2022-35737. This bug fix refers to: CVE-2022-35737 and it's a backport of a fix added in sqlite 3.39.2 (2022-07-21). (From OE-Core rev: fdc82b2314b580c0135c16b7278ebf8786311dec) Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0115 -> 9.0.0242Richard Purdie2022-08-281-2/+2
| | | | | | | | | | | | | | | | | | | | Includes fixes for: CVE-2022-2816 CVE-2022-2817 CVE-2022-2819 CVE-2022-2845 CVE-2022-2849 CVE-2022-2862 CVE-2022-2874 CVE-2022-2889 (From OE-Core rev: 54ee67b1a805a07288925d56e9956aabc23b6ab2) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3ec2d27d09444213ec1c9b91c6f8c4363f297294) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libcap: upgrade 2.64 -> 2.65Alexander Kanavin2022-08-282-2/+2
| | | | | | | | | | | | | | | | | | | | CHanges from 2.64: - Fix syntax error in DEBUG build of protected code in setcap.c. (Bug reported by yixiangzhike.) - Prevent bash from reading the wrong startup files when the capsh --user=xxx argument is used to invoke a shell as the user xxx. (Bug: 215926) - Man page info for cap_get_pid() and cap_reset_ambient(). (Bug reports from nomonemo and Tinkerer One.) - Improve documentation and help for the captree program. - Updated go/Makefile comment about an unfixed Go runtime bug in go1.16 and go1.17 (resolved in go1.18+), and the deadlock behavior of the psx-fd test. - Refresh the signatures on the two GPG keys morgan@ uses. The 4096 bit one is preferred, but the older one is also used for continuity reasons. This set of signatures should also be available from the various key servers out there. (From OE-Core rev: 70cd3c073512084fccb85b311911794ea895d3f2) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c3b16a6d0d0d4246b44dec3b1818f435d32d04e5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libcap: upgrade 2.63 -> 2.64wangmy2022-08-281-1/+1
| | | | | | | | | | | | | | | | | Changes from 2.63: - Fix memory leak in libpsx at program exit. (Bug: 215551 reported by Kalen Hall) - Be more resilient to CGo configuration with Go compiler when building tests. (Bug: 215603) - Fix cap_*prctl() return code/errno handling. (Bug: 215772 reported by Anderson Toshiyuki Sasaki) - Minor clarification to cap_get_pid() man page concerning pid value within namespaces. (Bug: 215812) (From OE-Core rev: b23e43ea7c677b5450969d3586d1f68cc278fc73) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit bfbf8f05d1789b8a8a6826b83a21fd09b8e903ad) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iso-codes: upgrade 4.10.0 -> 4.11.0Alexander Kanavin2022-08-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Changes from 4.10.0: - Update ISO 639-3 codes from SIL website. Fixes #40 - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-2 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 (From OE-Core rev: 2d0254acde343c2d9cdcb94b488dc1308bae319f) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a269e59a960a56ac038f4e96c199a7577202b186) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* boost: fix install of fiber shared librariesMikko Rapeli2022-08-232-0/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For fiber, only CMake modules were installed in boost 1.78.0. In 1.79.0 and versions before 1.78.0 also the shared libraries are installed. This upstream patch fixes the issue in 1.78.0. Note that boost git repo does not show changes in tools/build directory between 1.78.0 and 1.79.0 tags but the release tar balls contain a large update of which this one is needed to fix the missing shared libraries. Only kirkstone is affected. buildhistory shows the difference in metadata boost-fiber binary package without and with this patch: --- a/packages/core2-64-poky-linux/boost/boost-fiber/latest +++ b/packages/core2-64-poky-linux/boost/boost-fiber/latest @@ -1,8 +1,9 @@ PV = 1.78.0 PR = r0 -RPROVIDES = -RDEPENDS = +PKG = libboost-fiber1.78.0 +RPROVIDES = boost-fiber (=1.78.0) +RDEPENDS = boost-context (>= 1.78.0) glibc (>= 2.35) libgcc (>= 11.3.0) libstdc++ (>= 11.3.0) RRECOMMENDS = -PKGSIZE = 0 +PKGSIZE = 80032 FILES = /usr/lib/libboost_fiber*.so.* -FILELIST = +FILELIST = /usr/lib/libboost_fiber.so.1.78.0 (From OE-Core rev: f5952401a89a84b40f98c1c946daba2d83a2b18a) Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: update from 9.0.0063 to 9.0.0115Randy MacLeod2022-08-233-92/+2
| | | | | | | | | | | | | | | | | | | | Drop crosscompile.patch which was merged as part of: 509695c1c (tag: v9.0.0065) patch 9.0.0065: \ cross-compiling doesn't work because of timer_create check Also drop: racefix.patch which may have been fixed upstream and is being tracked by: https://github.com/vim/vim/pull/10776 where upstream is asking if the different approach resolves the race condition. Let's see what's out there! (From OE-Core rev: 27e4c6f98be296fb5f67ac7775461854d48f6c9a) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 6996472cd33d2d4b91821f2dfe24a27a697e4afe) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: CVE-2022-2509 Double free during gnutls_pkcs7_verifyHitendra Prajapati2022-08-232-0/+283
| | | | | | | | | | | | | | | | Source: https://gitlab.com/gnutls/gnutls MR: 120416 Type: Security Fix Disposition: Backport from https://gitlab.com/gnutls/gnutls/-/commit/ce37f9eb265dbe9b6d597f5767449e8ee95848e2 ChangeID: 703e01956915cf9543fdc47cfd5edb87403294f9 Description: CVE-2022-2509 gnutls: Double free during gnutls_pkcs7_verify. (From OE-Core rev: 49781a79fd7764ef2e0d61ffa793acd59f210ecf) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Upgrade 9.0.0021 -> 9.0.0063Richard Purdie2022-08-013-6/+66
| | | | | | | | | | | | | | | | Pulls in several CVE fixes. Added a patch to avoid timer_create cross compile issue (and submitted upstream). Also submit the race fix upstream. We disable timer_create in the native case since some systems have it and some don't so this makes us consistent. (From OE-Core rev: 8b42e405fc630537398116a1429a9bc7cb2152ab) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d0c1de084c7ce030d47a428e4bbfbc4ce2996057) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnupg: upgrade to 2.3.7 to fix CVE-2022-34903Yue Tao2022-08-011-1/+1
| | | | | | | | | (From OE-Core rev: c0c7214f8bdc1942a53f9a86b937eb4977e09452) Signed-off-by: Yue Tao <yue.tao@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnupg: update 2.3.4 -> 2.3.6Alexander Kanavin2022-08-014-43/+13
| | | | | | | | | | | | | | Remove 0003-dirmngr-uses-libgpg-error.patch (upstream addressed the issue). (From OE-Core rev: 4e9c180baf5fea79a2ca472651b782038051b837) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Yue Tao <yue.tao@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-09-28 12:41:53 +0000