summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support
Commit message (Collapse)AuthorAgeFilesLines
* iso-codes: upgrade 4.13.0 -> 4.15.0Wang Mingyu2023-06-231-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Changelog: ========== - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-2 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 * ISO 3166-2: Fix wrong Spanish translation (From OE-Core rev: 86e8e31a413fdbb8ffa825c41d0fe83c292a6b76) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 355f2f9fe8a1e6c5e78f136cb3ed77c9004fb75c) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit b189240b211e5d8f40747a0128834ed83c38a8f4) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.1429 -> 9.0.1527Randy MacLeod2023-06-211-2/+2
| | | | | | | | | | | | Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-2426 caf642c25 patch 9.0.1499: using uninitialized memory with fuzzy matching (From OE-Core rev: 035b5d918eea3f3bb238fecd795f09505801971b) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 4f9a8df5aca99d0a5c2d2346b27ce7be08e7896c) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Correction for CVE-2023-27536Omkar Patil2023-06-141-1/+2
| | | | | | | | | | | Correction of backport link inside the patch with correct commit link as below Link: https://github.com/curl/curl/commit/cb49e67303dbafbab1cebf4086e3ec15b7d56ee5 (From OE-Core rev: 4691bc257d0bf2372e31535f0b90cf49ef0ed0d8) Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28322Bhabu Bindu2023-06-013-0/+522
| | | | | | | | | | | | | | | | | | | | | | | | | | Add patches to fix CVE-2023-28322 more POST-after-PUT confusion When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been set, if the same handle previously was used to issue a `PUT` request which used that callback. This flaw may surprise the application and cause it to misbehave and either send off the wrong data or use memory after free or similar in the second transfer.The problem exists in the logic for a reused handle when it is (expected tobe) changed from a PUT to a POST. CVE-2023-28322-1.patch is a supporting patch to resolve hunk error in the actual patch file : CVE-2023-28322-2.patch Link: https://curl.se/docs/CVE-2023-28322.html (From OE-Core rev: 9ef793eca87ac568d9c22067aa854a50837cf92f) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28321Bhabu Bindu2023-06-012-0/+303
| | | | | | | | | | | | | | | | | | | | | | | | | | Add patch to fix CVE-2023-28321 IDN wildcard match curl supports matching of wildcard patterns when listed as "Subject Alternative Name" in TLS server certificates. curl can be built to use its own name matching function for TLS rather than one provided by a TLS library. This private wildcard matching function would match IDN (International Domain Name)hosts incorrectly and could as a result accept patterns that otherwise should mismatch. IDN hostnames are converted to puny code before used for certificate checks. Puny coded names always start with `xn--` and should not be allowed to pattern match, but the wildcard check in curl could still check for `x*`,which would match even though the IDN name most likely contained nothing even resembling an `x`. Link: https://curl.se/docs/CVE-2023-28321.html (From OE-Core rev: 75d8593ab3b090266fd2cde27ddc56ad88de7ac7) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28320Bhabu Bindu2023-06-012-0/+84
| | | | | | | | | | | | | | | | | | | | | | Add patch to fix CVE-2023-28320 siglongjmp race condition libcurl provides several different backends for resolving host names, selectedat build time. If it is built to use the synchronous resolver, it allows nameresolves to time-out slow operations using `alarm()` and `siglongjmp()`. When doing this, libcurl used a global buffer that was not mutex protected anda multi-threaded application might therefore crash or otherwise misbehave. Link: https://curl.se/docs/CVE-2023-28320.html (From OE-Core rev: c761d822be5ffc4a88600fbd7282c469b1e9902a) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Fix CVE-2023-28319Bhabu Bindu2023-06-012-0/+34
| | | | | | | | | | | | | | | | | | | | | | Add patch to fix CVE-2023-28319 UAF in SSH sha256 fingerprint check libcurl offers a feature to verify an SSH server's public key using a SHA 256hash. When this check fails, libcurl would free the memory for the fingerprintbefore it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed. Link: https://curl.se/docs/CVE-2023-28319.html (From OE-Core rev: f7d6751828683ac2adbf140e77dbf7454cfa8eb1) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* p11-kit: add native to BBCLASSEXTENDJan Luebbe2023-05-301-1/+1
| | | | | | | | | | | | This recipe is needed to build softhsm (in meta-oe) in with p11-kit support, which is useful when multiple PKCS#11 modules need to be used. (From OE-Core rev: 19498bea309f19d841187a7063286b2a68ce2587) Signed-off-by: Jan Luebbe <jlu@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4942a42d5a071b283fe49047dcb4fee2c96422e8) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* nghttp2: Deleted the entries for -client and -server, and removed a ↵leimaohui2023-05-301-4/+2
| | | | | | | | | | | | | | | | | | | dependency on them from the main package. By default there is nothing in nghttp2-client and nghttp2-server ,nghttp2-client and nghttp2-server aren't created. So there are dependences error if install main package. Problem: conflicting requests - nothing provides nghttp2-client >= 1.52.0 needed by nghttp2-1.52.0-r0.core2_64 - nothing provides nghttp2-server >= 1.52.0 needed by nghttp2-1.52.0-r0.core2_64 Upstream-Status: Backport [OE-core d2cbe060955c598bd81923ecd554fbe82c17af99] (From OE-Core rev: 619a643f71eceab73bbbe4dacd1eb42b6d6b01d1) Signed-off-by: Lei Maohui <leimaohui@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libbsd: Add correct license for all packagesRanjitsinh Rathod2023-05-101-0/+7
| | | | | | | | | | | | | | | | | | | | | | | BSD-4-Clause is only applicable to the {PN}-doc package as when I check for the source code I find below files which only uses the license BSD-4-Clause ~/sources/libbsd$ grep -rl "All advertising materials mentioning features or use of this software" *|grep -v \.1|grep -v \.5|grep -v \.8 | sort COPYING man/arc4random.3bsd man/getprogname.3bsd ~/sources/libbsd$ grep -rnB5 "BSD-4" COPYING-9-Files: COPYING-10- man/arc4random.3bsd COPYING-11-Copyright: COPYING-12- Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de> COPYING-13- All rights reserved. COPYING:14:License: BSD-4-clause-Niels-Provos (From OE-Core rev: aa5bdac99e187801db56ca4bcc4d5f18b2403f40) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Security fix for CVE-2023-27535, CVE-2023-27536, CVE-2023-27538Siddharth Doshi2023-04-264-0/+421
| | | | | | | | | Upstream-Status: Backport from [https://github.com/curl/curl/commit/ed5095ed94281989e103c72e032200b83be37878, https://github.com/curl/curl/commit/8f4608468b890dce2dad9f91d5607ee7e9c1aba1, https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb, https://github.com/curl/curl/commit/af369db4d3833272b8ed443f7fcc2e757a0872eb] (From OE-Core rev: 0b35659c895e6ff2690d42f976169e4a65be07e6) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27534 SFTP path resolving discrepancyHitendra Prajapati2023-04-192-0/+123
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/4e2b52b5f7a3bf50a0f1494155717b02cc1df6d6 (From OE-Core rev: 7919a5a5eaa2689db9f0e8110b923bbfe0a610ab) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: CVE-2023-27533 TELNET option IAC injectionHitendra Prajapati2023-04-192-0/+209
| | | | | | | | | Upstream-Status: Backport from https://github.com/curl/curl/commit/0c28ba2faae2d7da780a66d2446045a560192cdc && https://github.com/curl/curl/commit/538b1e79a6e7b0bb829ab4cecc828d32105d0684 (From OE-Core rev: ff795872530975a014ae23001a4b014449783a0e) Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* curl: Add fix for CVE-2023-23916pawan2023-04-112-0/+220
| | | | | | | | | | | | | | Add below patch to fix CVE-2023-23916 CVE-2023-23916.patch Link: https://curl.se/docs/CVE-2023-23916.html (From OE-Core rev: 1b10502deb6a542acfb9dc62dbd916e8299314da) Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bmap-tools: switch to main branchMartin Jansa2023-04-111-1/+1
| | | | | | | | | | | | | | | | | | | | | * master branch was removed upstream: downloads/git2/github.com.intel.bmap-tools $ git remote prune origin Pruning origin URL: https://github.com/intel/bmap-tools * [pruned] refs/heads/master * [pruned] refs/pull/73/merge * downloads/git2/github.com.intel.bmap-tools $ git branch -a --contains c0673962a8ec1624b5189dc1d24f33fe4f06785a main release-3.0 (From OE-Core rev: 81223013571ccf4730ca1320b7ac0cd54548ec0a) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 369fee186d6916322b9be9d936b654d0c5910cb3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.1403 -> 9.0.1429Randy MacLeod2023-04-111-2/+2
| | | | | | | | | | | | | Fixes: CVE-2023-1127, CVE-2023-1170, CVE-2023-1175, CVE-2023-1264, CVE-2023-1355 (From OE-Core rev: e578b685a7fca4e8a40b1863ec58b71f6c4d263c) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 2415072c3800feb164dd4d1fa0b56bd141a5cbd8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add fix for CVE-2023-23914, CVE-2023-23915Pawan Badganchi2023-03-286-0/+519
| | | | | | | | | | | | | | | | | | | | | Add below patches to fix CVE-2023-23914 [1], CVE-2023-23915 [2] CVE-2023-23914_5-1.patch CVE-2023-23914_5-2.patch CVE-2023-23914_5-3.patch CVE-2023-23914_5-4.patch CVE-2023-23914_5-5.patch [1] https://curl.se/docs/CVE-2023-23914.html [2] https://curl.se/docs/CVE-2023-23915.html (From OE-Core rev: c80ede99b60cfbb0e7b339e1a7dc9f082f0da1f3) Signed-off-by: Pawan Badganchi <Pawan.Badganchi@kpit.com> Signed-off-by: pawan <badganchipv@gmail.com> Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: set modified-by to the recipe MAINTAINERRoss Burton2023-03-231-0/+1
| | | | | | | | | | | | | | | | | | | Clause II.3 of the Vim license states that any distribution of Vim that has been extended or modified must _at least_ indicate in the :version output that this is the case. Handily, Vim has a --with-modified-by argument to add a line in that text, so use MAINTAINER. This is the distribution maintainer contact, by default it is OE-Core Developers <openembedded-core@lists.openembedded.org>. (From OE-Core rev: ec594fe190f0f41f8c0388904d72015fce0cfa55) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit acc007e23445aa53182e13902dd9509c39dd5645) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade to 9.0.1403Ross Burton2023-03-231-4/+3
| | | | | | | | | | | | | | | This incorporates fixes for CVE-2023-1127, CVE-2023-1170, CVE-2023-1175. Also remove runtime/doc/uganda.txt from the license checksum: the Vim license is also in the top-level LICENSE file so this is redundant. (From OE-Core rev: 2d9a183467def574bf3c4a2e2f9bc59965797f6e) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 71111e6b62d37c5e6853d7940dec2993df127a35) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: add missing pkgconfig inheritRoss Burton2023-03-201-1/+1
| | | | | | | | | | | | | | | Vim uses pkgconfig to find dependencies but it wasn't present, so it silently doesn't enable features like GTK+ UI. [ YOCTO #15044 ] (From OE-Core rev: 01eeabdd6f01c47fa637cee81e4ae3c61c2a9bb9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 70900616298f5e70732a34e7406e585e323479ed) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iso-codes: upgrade 4.12.0 -> 4.13.0Wang Mingyu2023-03-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added ========= - ISO 3166-1: Add missing common names for Laos, Iran, and Syria. Fixes #32 Changed =========== - Translation updates for ISO 3166-1 - Kazakh from Debian BTS. Closes: #1025423 - Catalan from Debian BTS. Closes: #1026972 - Translation updates for ISO 3166-2 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 Fixed ========== - ISO 3166-3: Fix withdrawal dates of AN, CS and YU. Fixes #28 (From OE-Core rev: e2c6593b1e2bd004c233e6b9fd27170365e00c95) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f2c8b9c9a97ba5ec9c5da94da84ebe216650d6cc) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libmicrohttpd: upgrade 0.9.75 -> 0.9.76Narpat Mali2023-03-201-1/+1
| | | | | | | | | | | | | | | Changelog: ============ Fix potential DoS vector in MHD_PostProcessor.(CVE-2023-27371) Releasing GNU libmicrohttpd 0.9.76 hotfix. https://github.com/Karlson2k/libmicrohttpd/blob/v0.9.76/ChangeLog (From OE-Core rev: 017346be6c97d20b1b16d495ee9484f10973857c) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: fix CVE-2023-0361 timing side-channel in the TLS RSA key exchange codeVivek Kumbhar2023-03-202-0/+86
| | | | | | | | | | | | | Remove branching that depends on secret data. since the `ok` variable isn't used any more, we can remove all code used to calculate it (From OE-Core rev: 05b1222815bec400d573f7b06c0ad6b7b2d78a80) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nghttp2: never build python bindingsJoe Slater2023-03-091-0/+4
| | | | | | | | | | This has already been done for oe-core/master. (From OE-Core rev: 9e8cbf46fe6e4e257b76b228de56d4a891199896) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libseccomp: fix for the ptest result formatNarpat Mali2023-03-091-0/+3
| | | | | | | | | | | | | | | | | | The output of libseccomp ptest should follow a unified format as per this https://wiki.yoctoproject.org/wiki/Ptest Replaced the test results SUCCESS, FAILURE & SKIPPPED with PASS, FAIL & SKIP and printing the ptest result with the below format result: testname (From OE-Core rev: 20f15c72ad7e52fb68669bce8be57bbe5a366ca3) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 30d025a8641cfcce5412b5f021478777620b55f1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libssh2: Clean up ptest patch/coverageRichard Purdie2023-03-094-48/+25
| | | | | | | | | | | | | | | | | | Martin Jansa spotted patchreview.py reports Malformed Upstream-Status in a patch in this recipe. The patch is not being applied since there is no ptest override. The test in question was also disabled due to an issue with new versions of openssh. Add a workaround for the broken test, enable it, drop the broken patch. (From OE-Core rev: 2c05ee17d58774fc628b8a5b55a14551590fadaa) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e9f2cc084638ce9cb5339df611e473c30f0e40b1) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix dependencies when building with ldap/ldapsFederico Pellegrin2023-03-091-2/+2
| | | | | | | | | | | | | | | | | | openldap is added as a dependency so the build will not fail, as otherwise ldap headers are not found during configure phase Note: due to upstream bug (now fixed) building LDAP/LDAPS support with minimal configurations can sometimes not work, see details at: https://github.com/curl/curl/pull/10445 (From OE-Core rev: e6a001c22ec1b0d5487027148dda099847474272) Signed-off-by: Federico Pellegrin <fede@evolware.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a999f62f5692687a5557f7a50c7c768c50f3d7d3) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: update 9.0.1211 -> 9.0.1293 to resolve open CVEsAlexander Kanavin2023-03-091-2/+2
| | | | | | | | | | | (From OE-Core rev: 5eb050c439d891188ded3e79bf1e5b5695f24872) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6d77dbe499ee362b6e28902f1efcf52b961037a5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgit2: upgrade 1.4.4 -> 1.4.5Steve Sakoman2023-02-241-1/+1
| | | | | | | | | | | | | | | | | | Fixes: libgit2, when compiled using the optional, included libssh2 backend, fails to verify SSH keys by default. Description When using an SSH remote with the optional, included libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificate_check field of libgit2's git_remote_callbacks structure - if a certificate check callback is not set, libgit2 does not perform any certificate checking. This means that by default - without configuring a certificate check callback, clients will not perform validation on the server SSH keys and may be subject to a man-in-the-middle attack. Beginning in libgit2 v1.4.5 and v1.5.1, libgit2 will now perform host key checking by default. Users can still override the default behavior using the certificate_check function. The libgit2 security team would like to thank the Julia and Rust security teams for responsibly disclosing this vulnerability and assisting with fixing the vulnerability. (From OE-Core rev: 6c64dc88b5dac910f3760e9cd1003cc83df3ffad) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgit2: uprade 1.4.3 -> 1.4.4Steve Sakoman2023-02-241-1/+1
| | | | | | | | | | | | | | | | | This is a security release with multiple changes. This provides compatibility with git's changes to address CVE 2022-29187. As a follow up to CVE 2022-24765, now not only is the working directory of a non-bare repository examined for its ownership, but the .git directory and the .git file (if present) are also examined for their ownership. A fix for compatibility with git's (new) behavior for CVE 2022-24765 allows users on POSIX systems to access a git repository that is owned by them when they are running in sudo. A fix for further compatibility with git's (existing) behavior for CVE 2022-24765 allows users on Windows to access a git repository that is owned by the Administrator when running with escalated privileges (using runas Administrator). The bundled zlib is updated to v1.2.12, as prior versions had memory corruption bugs. It is not known that there is a security vulnerability in libgit2 based on these bugs, but we are updating to be cautious. (From OE-Core rev: 4bc31ac89eb0562bae37e2246e8001b4286f61da) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr-util: update 1.6.1 -> 1.6.3Alexander Kanavin2023-02-242-138/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes with APR-util 1.6.3 *) Correct a packaging issue in 1.6.2. The contents of the release were correct, but the top level directory was misnamed. Changes with APR-util 1.6.2 *) SECURITY: CVE-2022-25147 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. *) Teach configure how to find and build against MariaDB 10.2. PR 61517 [Kris Karas <bugs-a17 moonlit-rail.com>] *) apr_crypto_commoncrypto: Remove stray reference to -lcrypto that prevented commoncrypto being enabled. [Graham Leggett] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_dbm_gdbm: Fix handling of error codes. This makes gdbm 1.14 work. apr_dbm_gdbm will now also return error codes starting with APR_OS_START_USEERR, as apr_dbm_berkleydb does, instead of always returning APR_EGENERAL. [Stefan Fritsch] Drop backport. (From OE-Core rev: e24b38a14b3520648ec418783fb74fcf61df7ff2) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dca707f9fecc805503e17f6db3e4c88069ac0125) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 43cd36b178ebb602edd5919c26f8b8642736a3a8) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: update 1.7.0 -> 1.7.2Alexander Kanavin2023-02-2410-320/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes for APR 1.7.2 *) Correct a packaging issue in 1.7.1. The contents of the release were correct, but the top level directory was misnamed. Changes for APR 1.7.1 *) SECURITY: CVE-2022-24963 (cve.mitre.org) Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. *) SECURITY: CVE-2022-28331 (cve.mitre.org) On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow. *) SECURITY: CVE-2021-35940 (cve.mitre.org) Restore fix for out-of-bounds array dereference in apr_time_exp*() functions. (This issue was addressed as CVE-2017-12613 in APR 1.6.3 and later 1.6.x releases, but was missing in 1.7.0.) [Stefan Sperling] *) configure: Fix various build issues for compilers enforcing strict C99 compliance. PR 66396, 66408, 66426. [Florian Weimer <fweimer redhat.com>, Sam James <sam gentoo.org>] *) apr_atomic_read64(): Fix non-atomic read on 32-bit Windows [Ivan Zhakov] *) configure: Prefer posix name-based shared memory over SysV IPC. [Jim Jagielski] *) configure: Add --disable-sctp argument to forcibly disable SCTP support, or --enable-sctp which fails if SCTP support is not detected. [Lubos Uhliarik <luhliari redhat.com>, Joe Orton] *) Fix handle leak in the Win32 apr_uid_current implementation. PR 61165. [Ivan Zhakov] *) Add error handling for lseek() failures in apr_file_write() and apr_file_writev(). [Joe Orton] *) Don't silently set APR_FOPEN_NOCLEANUP for apr_file_mktemp() created file to avoid a fd and inode leak when/if later passed to apr_file_setaside(). [Yann Ylavic] *) APR's configure script uses AC_TRY_RUN to detect whether the return type of strerror_r is int. When cross-compiling this defaults to no. This commit adds an AC_CACHE_CHECK so users who cross-compile APR may influence the outcome with a configure variable. [Sebastian Kemper <sebastian_ml gmx net>] *) Add a cache check with which users who cross-compile APR can influence the outcome of the /dev/zero test by setting the variable ac_cv_mmap__dev_zero=yes [Sebastian Kemper <sebastian_ml gmx net>] *) Trick autoconf into printing the correct default prefix in the help. [Stefan Fritsch] *) Don't try to use PROC_PTHREAD by default when cross compiling. [Yann Ylavic] *) Add the ability to cross compile APR. [Graham Leggett] *) While cross-compiling, the tools/gen_test_char could not be executed at build time, use AX_PROG_CC_FOR_BUILD to build native tools/gen_test_char Support explicit libtool by variable assigning before buildcheck.sh, it is helpful for cross-compiling (such as libtool=aarch64-linux-libtool) [Hongxu Jia <hongxu.jia windriver.com>] *) Avoid an overflow on 32 bit platforms. [René Hjortskov Nielsen <r... hjortskov.dk>] *) Use AC_CHECK_SIZEOF, so as to support cross compiling. PR 56053. [Mike Frysinger <vapier gentoo.org>] *) Add --tag=CC to libtool invocations. PR 62640. [Michael Osipov] *) apr_pools: Fix pool debugging output so that creation events are always emitted before allocation events and subpool destruction events are emitted on pool clear/destroy for proper accounting. [Brane Čibej] *) apr_socket_listen: Allow larger listen backlog values on Windows 8+. [Evgeny Kotkov <evgeny.kotkov visualsvn.com>] *) Fixed: apr_get_oslevel() was returning APR_WIN_XP on Windows 10 *) Fix attempt to free invalid memory on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix double free on exit when apr_app is used on Windows. [Ivan Zhakov] *) Fix a regression in apr_stat() for root path on Windows. [Ivan Zhakov] Dropped patches have all been merged, addressed separately or are backports. (From OE-Core rev: c291aefb531431b9a256740766dcb03cbdf84481) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3ffae93f24bb1e3954b232099153fd059cfd7daf) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit e5326ea0ac7e55b2d671a27c1e035c43b8bbc70d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libusb1: Strip trailing whitespacesKhem Raj2023-02-041-6/+6
| | | | | | | | | | | (From OE-Core rev: 6e981dc8df59ce0e2e85b25f240b6c5767ce22f6) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 2b24ffade16fc23ddb77e26d8967c26d62f4ed6d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libusb1: Link with latomic only if compiler has no atomic builtinsKhem Raj2023-02-042-0/+47
| | | | | | | | | | | | | | | | This makes build use compiler to decide from where to get atomics instead of assuming that it should always come from libatomic, helps sharing build artifacts with OSes which may not have libatomic installed because it is not required on those hosts. (From OE-Core rev: c660d75211352a47797c3d400dd504759675a0f6) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit a026d9afcbe07a8324ca951ba3439373dcb3771c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* numactl: skip test case when target platform doesn't have 2 CPU nodeXiangyu Chen2023-02-042-2/+7
| | | | | | | | | | | | | | | | when current test platform doesn't have 2 or more CPU node, the test case would report FAIL, according to numa test script and numademo code, when return code=77 should be skip test, so using SKIP instead of FAIL in test script. (From OE-Core rev: 218cf38bd3879df009e70f516c0dcb484376bf2e) Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit fd0a82400d419bce8605a9445db9b20b8ddc01a7) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libseccomp: fix typo in DESCRIPTIONChen Qi2023-01-261-1/+1
| | | | | | | | | | | | | Fix typo in DESCRIPTION: and -> an. (From OE-Core rev: 44f59f5d8414cbe935addb57bd1ea9ffaf734fba) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 349e63045298054f9454025d793c67284fce750b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0947 -> 9.0.1211Randy MacLeod2023-01-261-2/+2
| | | | | | | | | | | | | | | | | Includes fixes for: https://nvd.nist.gov/vuln/detail/CVE-2023-0049 https://nvd.nist.gov/vuln/detail/CVE-2023-0051 https://nvd.nist.gov/vuln/detail/CVE-2023-0054 https://nvd.nist.gov/vuln/detail/CVE-2023-0288 (From OE-Core rev: d4887e2e43e3d66e0f64299a8189b26d5aff31ef) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1c51068c78d12ee02789a6dbecf5e7e91d141af5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: update 1.6.2 -> 1.6.3Alexander Kanavin2023-01-262-4/+4
| | | | | | | | | | | | | | | | | Noteworthy changes in version 1.6.3 (2022-12-06) Fix another integer overflow in the CRL parser. [T6284,CVE-2022-47629] (From OE-Core rev: 0c1829b0e7e085ba8aef0d47852abf520ef9d635) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 83f3f21b1b84ab9e7b461ac966691c80f4ed4e97) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit f098cb5073051eb371f4142678b4b3d5e7b52426) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "libksba: fix CVE-2022-47629"Steve Sakoman2023-01-262-74/+1
| | | | | | | | Prepare for stable version bump which includes this fix This reverts commit e4cb0bf273ea556db91699594046a47514c8583c. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libksba: fix CVE-2022-47629Yogita Urade2023-01-262-1/+74
| | | | | | | | | | | | | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. CVE: CVE-2022-47926 References: https://nvd.nist.gov/vuln/detail/CVE-2022-47629 (From OE-Core rev: e4cb0bf273ea556db91699594046a47514c8583c) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add patch to fix CVE-2022-43552Ranjitsinh Rathod2023-01-062-0/+81
| | | | | | | | | | | | | | | Add patch to fix the security issue "curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations using an appropriate HTTP error response code." as per below link Link: https://curl.se/docs/CVE-2022-43552.html (From OE-Core rev: a0db3ddf6f2efe733271ff7f6c68fda4d215b1bb) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Add patch to fix CVE-2022-43551Ranjitsinh Rathod2023-01-062-0/+36
| | | | | | | | | | | | | | | Add patch to fix the security issue "curl's HSTS check could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL." as per below link Link: https://curl.se/docs/CVE-2022-43551.html (From OE-Core rev: baa18f2cf107af7a5e1c7b7befad46e6c48f4222) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Correct LICENSE from MIT-open-group to curlRanjitsinh Rathod2023-01-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | LICENSE for curl is set to MIT-open-group which is wrong and proper license is 'curl' I check below link and the line "Curl and libcurl are licensed under the license below, which is inspired by MIT/X, but not identical." says that the license is identical to MIT but actual license is identical from the file "meta/files/common-licenses/curl" Link: https://curl.se/docs/copyright.html Also, I do not find the MIT-open-group license text in the entire source-code (From OE-Core rev: 34b228bd3a80a74bf4d84ef7ee362f4ab1e3a466) (From OE-Core rev: 95b5df5c9e0bdef55d0f977fb814f9de74363e68) Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com> Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4a246e06cb62efff8bfd20cdf3dde31e24f9b711) Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sqlite: fix CVE-2022-46908 safe mode authorizer callback allows disallowed UDFs.Vivek Kumbhar2023-01-062-0/+40
| | | | | | | | (From OE-Core rev: 18641988caa131436f75dd3c279ce5af3380481a) Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* mpfr: upgrade 4.1.0 -> 4.1.1Wang Mingyu2022-12-231-1/+1
| | | | | | | | | | | | | | | | Changelog: ========= - Bug fixes (see <https://www.mpfr.org/mpfr-4.1.0/#fixed> and/or the ChangeLog file), in particular for macros implementing functions. - Improved manual formatting. (From OE-Core rev: 9977278a12d6bc0b811077fa19c64b80e793a33d) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit f733eddc428cf9537f97cb91025b73dd1fdea932) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: upgrade 9.0.0820 -> 9.0.0947Qiu, Zheng2022-12-131-2/+2
| | | | | | | | | | | | | | | | Includes fixes for CVE-2022-4141 https://nvd.nist.gov/vuln/detail/CVE-2022-4141 For a short list of important changes, see: https://www.arp242.net/vimlog/ (From OE-Core rev: a7abc8754ab5fbefa23fc17571d272a77dcd2421) Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 160f459febc7fb36cc0fe85c63eb26780ace3bfd) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-42915Bhabu Bindu2022-12-072-0/+54
| | | | | | | | | | | | HTTP proxy double-free Link: https://security-tracker.debian.org/tracker/CVE-2022-42915 (From OE-Core rev: 4754f33d7ec96f72351853463540c8b1a3f4bc0c) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-42916Bhabu Bindu2022-12-072-0/+137
| | | | | | | | | | | | HSTS bypass via IDN Link: https://security-tracker.debian.org/tracker/CVE-2022-42916 (From OE-Core rev: e6796b426503477620e0e5c5c9da50352269a593) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Fix CVE-2022-32221Bhabu Bindu2022-12-072-0/+29
| | | | | | | | | | | | POST following PUT confusion Link: https://ubuntu.com/security/CVE-2022-32221 (From OE-Core rev: 518bea85c9496d77c70d703b818e442eda841554) Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* iso-codes: upgrade 4.11.0 -> 4.12.0Wang Mingyu2022-12-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Changelog: ========= - ISO 3166-1: Update name for TR. Fixes #38 - Translation updates for ISO 3166-1 - Translation updates for ISO 3166-2. Closes: #1020633 - Translation updates for ISO 3166-3 - Translation updates for ISO 639-2 - Translation updates for ISO 639-3 - Translation updates for ISO 639-5 - Translation updates for ISO 4217 - Translation updates for ISO 15924 (From OE-Core rev: 017abb138460978e87c84c509f9af7524a053e1b) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> (cherry picked from commit 99917b4b7d5642b292cb95c770871b95e411dfc5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-09-18 03:52:33 +0000