summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
...
* go: Update fix for CVE-2023-24538 & CVE-2023-39318Shubham Kulkarni2023-10-054-17/+802
| | | | | | | | | | | | | Add missing files in fix for CVE-2023-24538 & CVE-2023-39318 Upstream Link - CVE-2023-24538: https://github.com/golang/go/commit/b1e3ecfa06b67014429a197ec5e134ce4303ad9b CVE-2023-39318: https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c (From OE-Core rev: 0d8f7062d4fb5525f34427b1a7304f165bee0cfc) Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* json-c: define CVE_VERSIONPeter Marko2023-10-051-0/+3
| | | | | | | | | | | | | | | Recently NVD updated all CVEs for json-c and old fixed CVE-2020-12762 is reported by cve_check now. NVD match clause now includes full tag name including date which is "greater" than tag without additional numbers. Fix it by defining CVE_VERSION identical to full tag. Put it close to hash so recipe update patch includes this line. (From OE-Core rev: 55e9ff0fe1de70f226557529f73c28f34f6956ed) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* kernel.bbclass: Add force flag to rm callsRyan Eatmon2023-09-301-2/+2
| | | | | | | | | | | | | | | | The latest 6.5 kernels do not appear to create the source file in ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source so the recipe errors out when trying to remove it. Simple fix is to add the -f (force) flag to the call. (From OE-Core rev: 2e669bf797b15d803e7d6a700e449bdc467a4bcc) (From OE-Core rev: 7e177848f97eb9958619c28b5e5dadee12f67507) Signed-off-by: Ryan Eatmon <reatmon@ti.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cml1: Fix KCONFIG_CONFIG_COMMAND not conveyed fully in do_menuconfigJaeyoon Jung2023-09-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Variable overrides in KCONFIG_CONFIG_COMMAND do not work as expected due to double quote mismatches. The issue is reproducible in an environment where gold is the default linker. Below is an example snippet of run.do_terminal generated by do_menuconfig. do_terminal() { exec sh -c "make menuconfig CC="aarch64-webos-linux-gcc ..." LD="aarch64-webos-linux-ld.bfd ..." ... } Although LD override is set to bfd correctly, it is not passed to make and make menuconfig ends up with messages like: | gold linker is not supported as it is not capable of linking the kernel proper. | scripts/Kconfig.include:56: Sorry, this linker is not supported. (From OE-Core rev: 9c483765db762dbe8020423c8778518612b7e5f7) (From OE-Core rev: 536c477838fb1a318c5b283475de7f0eac99c872) Signed-off-by: Jaeyoon Jung <jaeyoon.jung@lge.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit d4664d2b7974354e73d891762ebb2c8a12d62438) Backported: File was renamed between kirkstone and master. Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* bind: update to 9.18.19Lee Chee Yang2023-09-3010-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Notes for BIND 9.18.19 Security Fixes Previously, sending a specially crafted message over the control channel could cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been fixed. (CVE-2023-3341) ISC would like to thank Eric Sesterhenn from X41 D-Sec GmbH for bringing this vulnerability to our attention. [GL #4152] A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed. (CVE-2023-4236) ISC would like to thank Robert Story from USC/ISI Root Server Operations for bringing this vulnerability to our attention. [GL #4242] Removed Features The dnssec-must-be-secure option has been deprecated and will be removed in a future release. [GL #4263] Feature Changes If the server command is specified, nsupdate now honors the nsupdate -v option for SOA queries by sending both the UPDATE request and the initial query over TCP. [GL #1181] Bug Fixes The value of the If-Modified-Since header in the statistics channel was not being correctly validated for its length, potentially allowing an authorized user to trigger a buffer overflow. Ensuring the statistics channel is configured correctly to grant access exclusively to authorized users is essential (see the statistics-channels block definition and usage section). [GL #4124] This issue was reported independently by Eric Sesterhenn of X41 D-Sec GmbH and Cameron Whitehead. The Content-Length header in the statistics channel was lacking proper bounds checking. A negative or excessively large value could potentially trigger an integer overflow and result in an assertion failure. [GL This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. Several memory leaks caused by not clearing the OpenSSL error stack were fixed. [GL #4159] This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. The introduction of krb5-subdomain-self-rhs and ms-subdomain-self-rhs UPDATE policies accidentally caused named to return SERVFAIL responses to deletion requests for non-existent PTR and SRV records. This has been fixed. [GL #4280] The stale-refresh-time feature was mistakenly disabled when the server cache was flushed by rndc flush. This has been fixed. [GL #4278] BIND’s memory consumption has been improved by implementing dedicated jemalloc memory arenas for sending buffers. This optimization ensures that memory usage is more efficient and better manages the return of memory pages to the operating system. [GL #4038] Previously, partial writes in the TLS DNS code were not accounted for correctly, which could have led to DNS message corruption. This has been fixed. [GL #4255] Known Issues There are no new known issues with this release. See above for a list of all known issues affecting this BIND 9 branch. Notes for BIND 9.18.18 Feature Changes When a primary server for a zone responds to an SOA query, but the subsequent TCP connection required to transfer the zone is refused, that server is marked as temporarily unreachable. This now also happens if the TCP connection attempt times out, preventing too many zones from queuing up on an unreachable server and allowing the refresh process to move on to the next configured primary more quickly. [GL #4215] The dialup and heartbeat-interval options have been deprecated and will be removed in a future BIND 9 release. [GL #3700] Bug Fixes Processing already-queued queries received over TCP could cause an assertion failure, when the server was reconfigured at the same time or the cache was being flushed. This has been fixed. [GL #4200] Setting dnssec-policy to insecure prevented zones containing resource records with a TTL value larger than 86400 seconds (1 day) from being loaded. This has been fixed by ignoring the TTL values in the zone and using a value of 604800 seconds (1 week) as the maximum zone TTL in key rollover timing calculations. [GL #4032] Known Issues There are no new known issues with this release. See above for a list of all known issues affecting this BIND 9 branch. Link to release notes: https://bind9.readthedocs.io/en/v9.18.19/notes.html#notes-for-bind-9-18-19 (From OE-Core rev: b88fe4581a48c1639764266380921d452a9b6132) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-git: upgrade 3.1.32 -> 3.1.37Narpat Mali2023-09-301-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The delta between 3.1.32 & 3.1.37 contains the CVE-2023-40590 and CVE-2023-41040 fixes and other bugfixes. Changelog: ========== - WIP Quick doc by @LeoDaCoda in #1608 - Partial clean up wrt mypy and black by @bodograumann in #1617 - Disable merge_includes in config writers by @bodograumann in #1618 - feat: full typing for "progress" parameter in Repo class by @madebylydia in #1634 - Fix CVE-2023-40590 by @EliahKagan in #1636 - #1566 Creating a lock now uses python built-in "open()" method to work arou… by @HageMaster3108 in #1619 - util: close lockfile after opening successfully by @skshetry in #1639 - Bump actions/checkout from 3 to 4 by @dependabot in #1643 - Fix 'Tree' object has no attribute '_name' when submodule path is normal path by @CosmosAtlas in #1645 - Fix CVE-2023-41040 by @facutuesca in #1644 - Only make config more permissive in tests that need it by @EliahKagan in #1648 - Added test for PR #1645 submodule path by @CosmosAtlas in #1647 - Fix Windows environment variable upcasing bug by @EliahKagan in #1650 - Improve Python version and OS compatibility, fixing deprecations by @EliahKagan in #1654 - Better document env_case test/fixture and cwd by @EliahKagan in #1657 - Remove spurious executable permissions by @EliahKagan in #1658 - Fix up checks in Makefile and make them portable by @EliahKagan in #1661 - Fix URLs that were redirecting to another license by @EliahKagan in #1662 - Assorted small fixes/improvements to root dir docs by @EliahKagan in #1663 - Use venv instead of virtualenv in test_installation by @EliahKagan in #1664 - Omit py_modules in setup by @EliahKagan in #1665 - Don't track code coverage temporary files by @EliahKagan in #1666 - Configure tox by @EliahKagan in #1667 - Format tests with black and auto-exclude untracked paths by @EliahKagan in #1668 - Upgrade and broaden flake8, fixing style problems and bugs by @EliahKagan in #1673 - Fix rollback bug in SymbolicReference.set_reference by @EliahKagan in #1675 - Remove @NoEffect annotations by @EliahKagan in #1677 - Add more checks for the validity of refnames by @facutuesca in #1672 Note that the changes to the license file are just removal of excess whitespace (the extra blank line at the end, and spaces appearing at the end of lines). References: https://github.com/gitpython-developers/GitPython/releases https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst https://github.com/gitpython-developers/GitPython/commit/e1af18377fd69f9c1007f8abf6ccb95b3c5a6558 (From OE-Core rev: 35cb21d6c8076428c0c60f03bb1b8f6945e2a07c) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* openssl: Upgrade 3.0.10 -> 3.0.11Peter Marko2023-09-301-1/+1
| | | | | | | | | | | https://github.com/openssl/openssl/blob/openssl-3.0/NEWS.md#major-changes-between-openssl-3010-and-openssl-3011-19-sep-2023 Major changes between OpenSSL 3.0.10 and OpenSSL 3.0.11 [19 Sep 2023] * Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807) (From OE-Core rev: 1263bb1784e8e052d903408faffcf39431fd9a10) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libwebp: Fix CVE-2023-5129Colin McAllister2023-09-302-0/+365
| | | | | | | | | Add patch from libwebp 1.2.4 to fix CVE-2023-5129 (From OE-Core rev: 544301c63801cf0c0cfcc0c8d71bdd8e2de82805) Signed-off-by: Colin McAllister <colinmca242@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: Fix CVE-2023-4504Lee Chee Yang2023-09-302-0/+43
| | | | | | | (From OE-Core rev: dc5c06da7a793e85276ce8ce9de1c06decb6e133) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* xserver-xorg: ignore CVE-2022-3553 as it is XQuartz-specificRoss Burton2023-09-301-0/+2
| | | | | | | | | | | (cherry-pick from commit 769576f36aac9652525beec5c7e8a4d26632b844 ) (From OE-Core rev: 96d36b97d9c6d1f5e79b1bea79f182561423fecb) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* webkitgtk: fix CVE-2023-32439Yogita Urade2023-09-302-0/+128
| | | | | | | | | | | | | | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, Safari 16.5.1, macOS Ventura 13.4.1, iOS 15.7.7 and iPadOS 15.7.7. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited. (From OE-Core rev: cdbc3c1548299eb78aeebb94909224eca8410158) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ruby: fix CVE-2023-36617Meenali Gupta2023-09-303-0/+101
| | | | | | | | | Backport two patches [1] [2] to fix CVE-2023-36617 (From OE-Core rev: 7a40082e4e080eaf5f88bd24f7169b7731028529) Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* linux-yocto: update CVE exclusionsRoss Burton2023-09-303-35/+7372
| | | | | | | | | | Update the CVE exclusions to match the kernel version, and add an exclusion file for 5.10. (From OE-Core rev: 33ae699eaa91900ae64e6ab46f6c2bca75eb3184) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-39318Siddharth Doshi2023-09-302-0/+239
| | | | | | | | | Upstream-Status: Backport from [https://github.com/golang/go/commit/023b542edf38e2a1f87fcefb9f75ff2f99401b4c] CVE: CVE-2023-39318 (From OE-Core rev: 35fa5c12f86bda2c8542bdb57074f55808697a42) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-bad: fix CVE-2023-40476Archana Polampalli2023-09-302-0/+45
| | | | | | | | | gst-plugins-bad: h265parser: Fix possible overflow using max_sub_layers_minus1 (From OE-Core rev: 2abcf03fbe343596de38113c655028c157763245) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-bad: fix CVE-2023-40475Archana Polampalli2023-09-302-0/+50
| | | | | | | | | gst-plugins-bad: Integer overflow leading to heap overwrite in MXF file handling with AES3 audio (From OE-Core rev: e5b5f7118320eecd77a6501a90d9cc73c578babc) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gstreamer1.0-plugins-bad: fix CVE-2023-40474Archana Polampalli2023-09-302-0/+119
| | | | | | | | | | gst-plugins-bad: Heap-based buffer overflow in the MXF file demuxer when handling malformed files with uncompressed video in GStreamer versions before 1.22.6 (From OE-Core rev: d0c8e2f78c8003ad383cc63cff32147156412650) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* ghostscript: fix CVE-2023-43115Archana Polampalli2023-09-302-0/+63
| | | | | | | | | | | | | | | | | | | In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because they can switch to the IJS device, or change the IjsServer parameter, after SAFER has been activated. NOTE: it is a documented risk that the IJS server can be specified on a gs command line (the IJS device inherently must execute a command to start the IJS server). References: https://nvd.nist.gov/vuln/detail/CVE-2023-43115 Upstream patches: https://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=8b0f20002536867bd73ff4552408a72597190cbe (From OE-Core rev: 1d169e50f28c93434461aa3ecbc47c21509143e9) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* shadow: Fix CVE-2023-4641Soumya Sambu2023-09-303-0/+185
| | | | | | | | | shadow-utils: possible password leak during passwd(1) change (From OE-Core rev: 734a3e1fb5ee8ded3097a94c7ee8696518346166) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionyocto-4.0.13kirkstone-4.0.13Steve Sakoman2023-09-241-1/+1
| | | | | | (From OE-Core rev: d90e4d5e3cca9cffe8f60841afc63667a9ac39fa) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* Revert "oeqa/utils/gitarchive: fix tag computation when creating archive"Steve Sakoman2023-09-241-4/+2
| | | | | | | | | | This reverts commit d0f8d5915a9ad3340a553b4a22f91074d7e679c9. This is causing errors with buildperf on the autobuilder. (From OE-Core rev: 87eee047cf77bc3fc2c7d6b2a4f35d2642919111) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-appliance-image: Update to kirkstone head revisionSteve Sakoman2023-09-231-1/+1
| | | | | | (From OE-Core rev: 6c7fef37d4286f6bfc7b1dcb2d1e543a110a7f6f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cargo.bbclass: set up cargo environment in common do_compileAlexander Kanavin2023-09-232-1/+4
| | | | | | | | | | | | | | | | | cargo_do_compile runs only if the recipe is built using cargo as the top level tool. Some recipes hide usage of cargo inside setuptools (or autoconf) and use do_compile definitions specific to those, and so the environment isn't properly set up. This was exposed by latest versions of python3-cryptography. (From OE-Core rev: a3f566fcbfc02e0a3b3f6a676d6dde88a5b50506) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9f4ff643a028d7f5670d80861f2ce19ca2d90faa) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dbus: Specify runstatedir configure optionPavel Zhukov2023-09-231-1/+2
| | | | | | | | | | | | | Without specifing runstatedir tmpfiles.d is configured to use /var/run for dbus and this causes deprecation warnings in system logs. (From OE-Core rev: 55529a5cb481b64ab4390728e01650bc585be602) Signed-off-by: Pavel Zhukov <pavel.zhukov@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4df1a16e5c38d0fb724f63d37cc032aa37fa122f) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tcl: prevent installing another copy of tzdataMartin Jansa2023-09-231-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It checks build host filesystem and if it doesn't find UTC or GMT files it installs another copy of tzdata files in: /usr/lib/tcl8.6/tzdata Buildhistory shows the difference: -PKGSIZE = 2227075 +PKGSIZE = 3433088 See the autodetection in configure.in: #------------------------------------------------------------------------ # Check whether the timezone data is supplied by the OS or has # to be installed by Tcl. The default is autodetection, but can # be overridden on the configure command line either way. #------------------------------------------------------------------------ AC_MSG_CHECKING([for timezone data]) AC_ARG_WITH(tzdata, AC_HELP_STRING([--with-tzdata], [install timezone data (default: autodetect)]), [tcl_ok=$withval], [tcl_ok=auto]) # # Any directories that get added here must also be added to the # search path in ::tcl::clock::Initialize (library/clock.tcl). # case $tcl_ok in no) AC_MSG_RESULT([supplied by OS vendor]) ;; yes) # nothing to do here ;; auto*) AC_CACHE_VAL([tcl_cv_dir_zoneinfo], [ for dir in /usr/share/zoneinfo \ /usr/share/lib/zoneinfo \ /usr/lib/zoneinfo do if test -f $dir/UTC -o -f $dir/GMT then tcl_cv_dir_zoneinfo="$dir" break fi done]) if test -n "$tcl_cv_dir_zoneinfo"; then tcl_ok=no AC_MSG_RESULT([$dir]) else tcl_ok=yes fi ;; *) AC_MSG_ERROR([invalid argument: $tcl_ok]) ;; esac if test $tcl_ok = yes then AC_MSG_RESULT([supplied by Tcl]) INSTALL_TZDATA=install-tzdata fi (From OE-Core rev: 79498ea0e9eb88ad0175f7376c57efb46217a4a4) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3ace9fbfeb42ebf920812e3dd6d665b8b20a1ca0) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* build-sysroots: Add SUMMARY fieldKhem Raj2023-09-231-1/+2
| | | | | | | | | | | | Fixes build QA warning about [missing-metadata] (From OE-Core rev: 29fe45fe8857f72705183a87b4e85a3723900a78) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4f4c7130f11c069ab18c374dcbfb1276ef37be60) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* oeqa/utils/gitarchive: fix tag computation when creating archiveAlexis Lothoré2023-09-231-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Sporadic errors have been observed in autobuilder when trying to store new tests results: error: failed to push some refs to 'push.yoctoproject.org:yocto-testresults' hint: Updates were rejected because the tag already exists in the remote. The new tag name is generated by gitarchive based on known tags from the repository (learnt with git tag). In autobuilder case, this repository is a shallow clone, so git tag only returns most recent tags, which mean we could miss some older tags which exist in remote but not locally. In this case, gitarchive will likely create a tag which already exists in remote, and so will fail to push Fix this tag duplication by using git ls-remote to learn about existing tags instead of git tag. Two places which wrongly read only local tags has been identified in gitarchive: expand_tag_strings and get_test_runs Fixes [YOCTO #15140] (From OE-Core rev: d0f8d5915a9ad3340a553b4a22f91074d7e679c9) Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5a0a7da85a3acfd4a20a07478eabefdab60f313a) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* externalsrc: fix dependency chain issuesPeter Suti2023-09-231-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of deleting setscene tasks, now SSTATE_SKIP_CREATION is set instead. This seems to fix the compile issues where the populate_sysroot task was not run when an externalsrc recipe was built as a dependency. [YOCTO #15164] [RP addition: The deltask was added by me in 2012 when the class was created. The trouble is bitbake assumes 'sstate' tasks have a setscene task and by deleting the setscene task, bitbake stops thinking the task can be accelerated. There is other code in the sysroot code which assumes some tasks are always sstate tasks. We cannot delete the task without changes to the way bitbake learns about 'setscene' tasks so the patch is correct, avoiding creating files is the better approach given the way the world works now. There would be concerns about exisitng sstate reuse however this shouldn't occur since SRC_URI changes and that will change the underlying hashes. Hash equivalency could potentially cause issues by joining hashes together again however if the output matches, that shouldn't in theory cause any issue.] (From OE-Core rev: f6bb8438a18dfa2a520ad6fa65662d908f4ef0ed) Signed-off-by: Peter Suti <peter.suti@streamunlimited.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee4667a24ccdd8c9d547e73aecf661e6a1283890) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* pseudo: Fix to work with glibc 2.38Richard Purdie2023-09-232-0/+73
| | | | | | | | | | | | | | | | | This adds a horrible hack to get pseudo working with glibc 2.38. We can't drop _GNU_SOURCE to something like _DEFAULT_SOURCE since we need the defines the gnu options bring in. That leaves using internal glibc defines to disable the c23 versions of strtol/fscanf and friends. Which would break pseudo build with 2.38 from running on hosts with older glibc. We'll probably need to come up with something better but this gets glibc 2.38 and working and avoids autobuilder failures. (From OE-Core rev: 909fd25c2ebd25f5d3bc560e26f9df6862e033d0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 596fb699d470d7779bfa694e04908929ffeabcf7) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: Upgrade 9.0.1664 -> 9.0.1894Richard Purdie2023-09-231-3/+3
| | | | | | | | | | | | | This includes multiple CVE fixes. The license change is due to changes in maintainership, the license itself is unchanged. (From OE-Core rev: 5f78a010a4ff53f4a216ec2ebe9b7a44c5c88790) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 91e66b93a0c0928f0c2cfe78e22898a6c9800f34) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: upgrade 9.0.1592 -> 9.0.1664Archana Polampalli2023-09-231-2/+2
| | | | | | | | | | | | | Fixes: https://nvd.nist.gov/vuln/detail/CVE-2023-3896 8154e642a (tag: v9.0.1664) patch 9.0.1664: divide by zero when scrolling with 'smoothscroll' set (From OE-Core rev: d5ba3546053cff49ee1ea66a97fe4b4a0aa76308) Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4a1ab744142c9229f03a359b45e5e89a1fbae0d3) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* vim: update obsolete commentEtienne Cordonnier2023-09-231-3/+2
| | | | | | | | | | | | | | | | | | | | | vim 8.3 has been out for a long time, so this comment is obsolete. However we still need UPSTREAM_VERSION_UNKNOWN, since we ignore the last digit of the upstream version number. Test result: $ devtool check-upgrade-status vim ... INFO: vim 9.0.1592 UNKNOWN Tom Rini <trini@konsulko.com> c0370529c027abc5b1698d53fcfb8c02a0c515da (From OE-Core rev: 65f5de85c3f488136d1ec2b1f7fe8d8426d6c5b3) (From OE-Core rev: 72af322b6b8afd64a59b30a4f0fc3f8c6dfaa06a) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 868a19357841470eb55fb7f1c4ab1af09dea99ed) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* tar: upgrade 1.34 -> 1.35Wang Mingyu2023-09-232-48/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2022-48303.patch removed since it's included in 1.35 License-Update: http changed to https Changelog: =========== * Fail when building GNU tar, if the platform supports 64-bit time_t but the build uses only 32-bit time_t. * Leave the devmajor and devminor fields empty (rather than zero) for non-special files, as this is more compatible with traditional tar. * Bug fixes ** Fix interaction of --update with --wildcards. ** When extracting archives into an empty directory, do not create hard links to files outside that directory. ** Handle partial reads from regular files. ** Warn "file changed as we read it" less often. ** Fix --ignore-failed-read to ignore file-changed read errors ** Fix --remove-files to not remove a file that changed while we read it. ** Fix --atime-preserve=replace to not fail if there was no need to replace, either because we did not read the file, or the atime did not change. ** Fix race when creating a parent directory while another process is also doing so. ** Fix handling of prefix keywords not followed by "." in pax headers. ** Fix handling of out-of-range sparse entries in pax headers. ** Fix handling of --transform='s/s/@/2'. ** Fix treatment of options ending in / in files-from list. ** Fix crash on 'tar --checkpoint-action exec=\"'. ** Fix low-memory crash when reading incremental dumps. ** Fix --exclude-vcs-ignores memory allocation misuse. (From OE-Core rev: 4910b1e46a67dcdc3f7ebbab648a2b365c1910da) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c63769de05ce08c0627d302d14316ced31816b4d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: stable 2.38 branch updatesSanjana2023-09-231-1/+1
| | | | | | | | | | | Below commits on binutils-2.38 stable branch are updated. ea5fe5d01e5 PR30697, ppc32 mix of local-dynamic and global-dynamic TLS (From OE-Core rev: e8becc003d6926cc347ec42c0f13dcd5d9042b4d) Signed-off-by: Sanjana <sanjanasanju1608@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* glibc: stable 2.35 branch updatesSanjana2023-09-231-1/+1
| | | | | | | | | | | | | | | Below commits on glibc-2.35 stable branch are updated. 561e9dadc0 x86: Fix incorrect scope of setting `shared_per_thread` 1c3ecf5858 x86: Use `3/4*sizeof(per-thread-L3)` as low bound for NT threshold. 47c7d2eb03 x86: Fix slight bug in `shared_per_thread` cache size calculation. d1b1da26ea x86: Increase `non_temporal_threshold` to roughly `sizeof_L3 / 4` e19af583b4 elf: _dl_find_object may return 1 during early startup. (From OE-Core rev: b834674ada7329ab60130ebe7350dff592060ecf) Signed-off-by: Sanjana <sanjanasanju1608@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gcc: Fix -fstack-protector issue on aarch64Ross Burton2023-09-232-0/+2894
| | | | | | | | | | | | | | | | This series of patches fixes deficiencies in GCC's -fstack-protector implementation for AArch64 when using dynamically allocated stack space. This is CVE-2023-4039. See: https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf for more details. (From OE-Core rev: e6592fc8308240872300a6295162e14d54c5a905) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* binutils: Fix CVE-2022-48065Sanjana2023-09-234-0/+271
| | | | | | | (From OE-Core rev: 860ecdbbf5cfd8737c914522af16dbc8bee0f72f) Signed-off-by: Sanjana <sanjanasanju1608@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* cups: fix CVE-2023-32360Yogita Urade2023-09-232-0/+36
| | | | | | | | | | | | | | | | An authentication issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An unauthenticated user may be able to access recently printed documents. References: https://ubuntu.com/security/CVE-2023-32360 https://security-tracker.debian.org/tracker/CVE-2023-32360 (From OE-Core rev: b04f40d7afba07ff602bffffc9a517ccfdd44850) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* go: Fix CVE-2023-39319Soumya Sambu2023-09-232-1/+256
| | | | | | | | | | | | | | | | The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39319 (From OE-Core rev: afdc322ecff4cfd8478c89a03f7fce748a132b48) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* yocto-uninative: Update to 4.3Michael Halstead2023-09-181-4/+4
| | | | | | | | | | | Add in stable updates to glibc 2.38 to fix malloc bugs (From OE-Core rev: 26309ba6ef5b776d6bc45b984261b91e6c8c5a94) Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 39f987fcb20ad7c0e45425b9f508d463c50ce0c1) Signed-off-by: Steve Sakoman <steve@sakoman.com>
* gdb: Fix CVE-2023-39128Siddharth Doshi2023-09-182-0/+76
| | | | | | | | | | | | Note: The Fix needs to be pushed in gdb rather than bintuils-gdb as we are disabling gdb in binutils configure. Upstream-Status: Backport from [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=033bc52bb6190393c8eed80925fa78cc35b40c6d] CVE: CVE-2023-39128 (From OE-Core rev: 1a19a101cecc578aac84e365a361b76f129fe655) Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* webkitgtk: fix CVE-2022-48503Yogita Urade2023-09-182-0/+226
| | | | | | | | | | | | | | | | | The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution. References: https://nvd.nist.gov/vuln/detail/CVE-2022-48503 https://support.apple.com/en-us/HT213340 https://bugs.webkit.org/show_bug.cgi?id=241931 (From OE-Core rev: 8f956bc19963a02ee7b908bb49301a2ea5052066) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* flac: fix CVE-2020-22219Meenali Gupta2023-09-182-0/+198
| | | | | | | | | | | Buffer Overflow vulnerability in function bitwriter_grow_ in flac before 1.4.0 allows remote attackers to run arbitrary code via crafted input to the encoder. (From OE-Core rev: 29c6287287c9f26c1d6f9fddf8d2852409bbbbec) Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libxml2: Fix CVE-2023-39615Soumya Sambu2023-09-183-0/+111
| | | | | | | | | | | | | | | Xmlsoft Libxml2 v2.11.0 was discovered to contain a global buffer overflow via the xmlSAX2StartElement() function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file. References: https://nvd.nist.gov/vuln/detail/CVE-2023-39615 (From OE-Core rev: 9a2ad95caffae37014fa27d9b20d45f9779d0fbf) Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* qemu: fix CVE-2021-3638Yogita Urade2023-09-182-0/+89
| | | | | | | | | | | | | | QEMU: ati-vga: inconsistent check in ati_2d_blt() may lead to out-of-bounds write. Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-3638 https://lists.nongnu.org/archive/html/qemu-devel/2021-09/msg01682.html (From OE-Core rev: ebbdbb68a7804accd5430dd05f7899599ddbacd8) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* dropbear: fix CVE-2023-36328Yogita Urade2023-09-182-0/+145
| | | | | | | | | | | | | | | Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to execute arbitrary code and cause a denial of service (DoS). References: https://nvd.nist.gov/vuln/detail/CVE-2023-36328 https://github.com/libtom/libtommath/pull/546 (From OE-Core rev: 38709b0d35e7bd6760285bfa926dc85985c5cdcd) Signed-off-by: Yogita Urade <yogita.urade@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* python3-pygments: Fix CVE-2022-40896Narpat Mali2023-09-182-0/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | CVE-2022-40896: A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. The CVE issue is fixed by 3 different commits between the releases 2.14.0 (for Smithy lexer), 2.15.0 (for SQL+Jinja lexers) and 2.15.1 (for Java properties) as per: https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2/ 1. Smithy lexer commit from 2.14.0 release applies successfully on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/dd52102c38ebe78cd57748e09f38929fd283ad04 Hence, backported the patch as CVE-2022-40896.patch. 2. SQL+Jinja lexers commit from 2.15.0 release doesn't apply on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/97eb3d5ec7c1b3ea4fcf9dee30a2309cf92bd194 Actually, this code doesn't exist in 2.11.2 version and it has been introduce by python3-pygments 2.13.0 version. Hence, this is not vulnerable for 2.11.2 version. SQL+Jinja lexers is introduced by: https://github.com/pygments/pygments/commit/0bdbd5992baca32d18e01f0ec65337e06abf9456 3. Java properties commit from 2.15.1 release also doesn't apply on 2.11.2 version. Commit: https://github.com/pygments/pygments/commit/fdf182a7af85b1deeeb637ca970d31935e7c9d52 Actually, this code also doesn't exist in 2.11.2 version as the code has been modified in python3-pygments 2.14.0 by: https://github.com/pygments/pygments/commit/a38cb38e93c9635240b3ae89d78d38cf182745da Hence, this is also not vulnerable for 2.11.2 version. (From OE-Core rev: ebb224e65a7e1402ccf0d9517bd72748c18e012e) Signed-off-by: Narpat Mali <narpat.mali@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* sysklogd: fix integration with systemd-journaldChangqing Li2023-09-083-0/+110
| | | | | | | | | Fix an issue with early log messages being lost when running in systemd. (From OE-Core rev: 47a1dd7f389e3cf4ac2dc5fc21dccc870aafab4a) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* libdnf: resolve cstdint inclusion for newer gcc versionsAbe Kohandel2023-09-084-0/+128
| | | | | | | | | | | | | | | Depending on the host gcc version, libdnf fails to compile due to missing cstdint inclusions. These issue have already been addressed upstream, add the patches to resolve this for older versions of the library. These commits are taken directly from the libdnf project at https://github.com/rpm-software-management/libdnf (From OE-Core rev: e1d9bc1f88bd989bafc20063938d7a70e1da104f) Signed-off-by: Abe Kohandel <abe.kohandel@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
* efivar: backport 5 patches to fix build with goldMartin Jansa2023-09-086-4/+423
| | | | | | | | | | | | | | | | | | | | | | | * LDFLAGS += "-fuse-ld=bfd" in the recipe doesn't work and it still fails to build with ld-is-gold in DISTRO_FEATURES removal of this line sent to master in: https://lists.openembedded.org/g/openembedded-core/message/185167 * the most important ones are the 1st which removes --add-needed and the last which removes src/include/workarounds.mk completely while 2-4 patches just update src/include/workarounds.mk for the last one to apply cleanly * alternatively we can bump SRCREV to latest 38 as master did in: https://git.openembedded.org/openembedded-core/commit/?id=4df808c616f847d90203582fd950a49bb8360dd0 which brings 23 commits, but instead of adding 5 more patches allows to remove 5 (From OE-Core rev: d5c7ec0be32aa75fa7973840adf5251d22018766) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 21:03:56 +0000