Commit Graph

8383 Commits

Author SHA1 Message Date
Frieder Schrempf
a005377cdf spirv-tools: Use main branch for all repos
The master branch has been removed in all of the repos used
in SRC_URI. Switch to the main branch instead.

Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:42 -05:00
Hitendra Prajapati
db0a8862fc php: CVE-2022-4900 fix potential buffer overflow
Upstream-Status: Backport from 789a37f144

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:42 -05:00
Richard Purdie
bc22fe3465 meta-oe: Drop broken BBCLASSEXTEND variants
The command "bitbake universe -c fetch" currently throws a ton of warnings
as there are many 'impossible' dependencies.

In some cases these variants may never have worked and were just added by copy
and paste of recipes. In some cases they once clearly did work but became
broken somewhere along the way. Users may also be carrying local bbappend files
which add further BBCLASSEXTEND.

Having universe fetch work without warnings is desireable so clean up the broken
variants. Anyone actually needing something dropped here can propose adding it
and the correct functional dependencies back quite easily. This also then
ensures we're not carrying or fixing things nobody uses.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9962d57f7c)
Backport:
* Updated paths to follow PV changes
* Adapted modified recipes to the ones generating warnings
* NB: cups-filter needs poppler-native but its not available. To fix
  this, 5fa0188b8c could be backported.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Yoann Congal
8c13e8dc28 libusbmuxd: Add PV
This is 1.0.10 release with few more commits on top.

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Yoann Congal
b9c0cacc11 emlog: ignore inapplicable CVEs
The CVEs:
 * CVE-2019-16868
 * CVE-2019-17073
 * CVE-2021-44584
 * CVE-2022-1526
 * CVE-2022-3968
 * CVE-2023-43291
... apply to the other "emlog" and can be safely ignored.

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Khem Raj
77a7a2881d emlog: Add PV
This is 0.70 release with few more commits on top.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 08edc0b6ac)
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Martin Jansa
9135c7ea73 glmark2: fix compatibility with python-3.11
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:42:03 -05:00
Martin Jansa
7c74ee839d libiio: use main branch instead of master
* the branch was renamed upstream

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-11-12 10:41:03 -05:00
Vijay Anusuri
300be97535 libssh2: Backport fix for CVE-2020-22218
Bug: https://github.com/libssh2/libssh2/pull/476

Upstream-Status: Backport [642eec48ff
&
0b44e558f3]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-21 16:31:35 -04:00
Siddharth Doshi
0f10a0d394 php: Fix CVE-2023-3824
Upstream-Status: Backport from [80316123f3]
CVE: CVE-2023-3824
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:55:03 -04:00
Priyal Doshi
2f4f70a703 open-vm-tools: Security fix for CVE-2023-20900
Backport-from: 74b6d0d900

Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:54:36 -04:00
Kirill Esipov
56f8513464 catch2: switch from master to v2.x branch
"master" branch does not exist in original repo.

Signed-off-by: Kirill Esipov <yesipov@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:54:04 -04:00
Bhargav Das
0fb607b8db iperf3: Fix CVE-2023-38403
iperf3 before 3.14 allows peers to cause an integer overflow and heap
corruption via a crafted length field.

NVD link: https://nvd.nist.gov/vuln/detail/CVE-2023-38403

Upstream-Status: Backported from 0ef151550d

Signed-off-by: Bhargav Das <bhargav.das@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:30:51 -04:00
Armin Kuster
e42d1e758f postgresql: refresh patches
fixes:

WARNING: postgresql-12.16-r0 do_patch: Fuzz detected:

Applying patch 0001-Add-support-for-RISC-V.patch
patching file src/include/storage/s_lock.h
Hunk #2 succeeded at 339 with fuzz 1.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-09 12:52:03 -04:00
Sourav Kumar Pramanik
ffa6aff5da meta-oe-components: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1 for these components.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:55 -04:00
Sourav Pramanik
a84764cd13 nlohmann-json: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:52 -04:00
Sourav Pramanik
637cd4fd96 rapidjson: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:48 -04:00
Robert Joslyn
d96f8c4853 postgresql: Update to 12.16
This is a minor release to address CVEs and other bug fixes without new
features. Remove patches that are fixed in this release. Release notes are
available at:

https://www.postgresql.org/docs/release/12.10/
https://www.postgresql.org/docs/release/12.11/
https://www.postgresql.org/docs/release/12.12/
https://www.postgresql.org/docs/release/12.13/
https://www.postgresql.org/docs/release/12.14/
https://www.postgresql.org/docs/release/12.15/
https://www.postgresql.org/docs/release/12.16/

License-Update: Copyright year updated

Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:03 -04:00
Ashish Sharma
1ff41cb9c6 php: Backport fix CVE-2023-3247
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-16 08:39:45 -04:00
Martin Jansa
172fc48573 nodejs-14: add -fpermissive BUILD_CXXFLAGS to fix build with gcc-13 on host
Fixes nodejs-native build with gcc-13 on host:
http://errors.yoctoproject.org/Errors/Details/728221/

nodejs-12 doesn't need it yet and nodejs-16 doesn't need it as well

'-DV8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=64' '-D__STDC_FORMAT_MACROS' '-DOPENSSL_NO_PINSHARED' '-DOPENSSL_THREADS' '-DV8_TARGET_ARCH_X64' '-DV8_EMBEDDER_STRING="-node.84"' '-DENABLE_DISASSEMBLER' '-DV8_PROMISE_INTERNAL_FIELD_COUNT=1' '-DENABLE_MINOR_MC' '-DOBJECT_PRINT' '-DV8_INTL_SUPPORT' '-DV8_CONCURRENT_MARKING' '-DV8_ARRAY_BUFFER_EXTENSION' '-DV8_ENABLE_LAZY_SOURCE_POSITIONS' '-DV8_USE_SIPHASH' '-DDISABLE_UNTRUSTED_CODE_MITIGATIONS' '-DV8_WIN64_UNWINDING_INFO' '-DV8_ENABLE_REGEXP_INTERPRETER_THREADED_DISPATCH' '-DV8_SNAPSHOT_COMPRESSION' -ITOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -I../deps/v8 -I../deps/v8/include -I.//Release/obj/gen/torque-output-root -I.//Release/obj/gen/generate-bytecode-output-root  -pthread -Wno-unused-parameter -m64 -Wno-return-type -fno-strict-aliasing -m64 -O3 -fno-omit-frame-pointer -fdata-sections -ffunction-sections -O3 -fno-rtti -fno-exceptions -std=gnu++1y -MMD -MF .//Release/.deps/Release/obj.host/v8_initializers/gen/torque-output-root/torque-generated/../../deps/v8/src/builtins/array-find-tq-csa.o.d.raw -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -O2 -pipe -c
In file included from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/move.h:37,
                 from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/stl_function.h:60,
                 from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/functional:49,
                 from ../deps/v8/src/codegen/code-stub-assembler.h:8,
                 from ../deps/v8/src/builtins/builtins-promise-gen.h:8,
                 from ../deps/v8/src/builtins/builtins-async-gen.h:8,
                 from ../deps/v8/src/builtins/builtins-async-function-gen.cc:5:
/usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits: In instantiation of ‘struct std::is_convertible<v8::internal::Cell, v8::internal::Object>’:
../deps/v8/src/codegen/tnode.h:262:72:   required from ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’
../deps/v8/src/codegen/tnode.h:346:75:   required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’
../deps/v8/src/codegen/code-stub-assembler.h:1868:33:   required from here
/usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits:1417:30: error: invalid use of incomplete type ‘class v8::internal::Cell’ [-fpermissive]
 1417 |     : public __bool_constant<__is_convertible(_From, _To)>
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../deps/v8/src/objects/objects.h:26,
                 from ../deps/v8/src/objects/fixed-array.h:10,
                 from ../deps/v8/src/objects/contexts.h:8,
                 from ../deps/v8/src/execution/thread-local-top.h:10,
                 from ../deps/v8/src/execution/isolate-data.h:12,
                 from ../deps/v8/src/execution/isolate.h:24,
                 from ../deps/v8/src/codegen/interface-descriptors.h:14,
                 from ../deps/v8/src/codegen/callable.h:8,
                 from ../deps/v8/src/codegen/code-factory.h:8,
                 from ../deps/v8/src/compiler/code-assembler.h:17,
                 from ../deps/v8/src/codegen/code-stub-assembler.h:15:
../deps/v8/src/objects/object-list-macros.h:19:7: note: forward declaration of ‘class v8::internal::Cell’
   19 | class Cell;
      |       ^~~~
In file included from ../deps/v8/src/codegen/interface-descriptors.h:12:
../deps/v8/src/codegen/tnode.h: In instantiation of ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’:
../deps/v8/src/codegen/tnode.h:346:75:   required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’
../deps/v8/src/codegen/code-stub-assembler.h:1868:33:   required from here
../deps/v8/src/codegen/tnode.h:262:72: error: ‘value’ is not a member of ‘std::is_convertible<v8::internal::Cell, v8::internal::Object>’
  262 |                                        std::is_convertible<T, Object>::value);
      |                                                                        ^~~~~

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:29:13 -04:00
Khem Raj
0aa6a3ddc6 nodejs: Fix build with gcc13
* MJ: remove AUTHORS modification from the original patch from
  nodejs-16, so that the same patch does apply for both 14 and 12
  versions used in dunfell

* MJ: gcc-13 isn't used for target builds in dunfell, but can be used
  on host, so this is useful backport for nodejs-native

* MJ: this fixes default nodejs-native-12, nodejs-native-14 with negative
  D_P might need additional fix on top

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:29:04 -04:00
Vijay Anusuri
3c62000f88 c-ares: CVE-2023-32067 0-byte UDP payload Denial of Service
Upstream-Status: Backport from b9b8413cfd

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Khem Raj
b8b0b06821 sysdig: Depend on system libb64
avoid using vendored version

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d8053b7e2b)
[FIxes this error
 --- LOG END ---
 |          error: downloading 'http://download.draios.com/dependencies/libb64-1.2.src.zip' failed
 |          status_code: 22
 |          status_string: "HTTP response code said error"
 |          log:
 |          --- LOG BEGIN ---
 ]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Khem Raj
98982f3f3e libb64: Add recipe
Add Base64 encode/decode library, some packages e.g. sysdig can benefit
from it

Disable parallel make as it races at times
make[1]: *** No rule to make target 'libb64.a', needed by 'c-example1'.  Stop.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6946f40707)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Alexander Thoma
74f90db833 Fix tigervnc crash due to missing xkbcomp rdepends
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 447de4d47b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit b3b00a270e)
[Fixup for Dunfell context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-22 07:49:35 -04:00
Hitendra Prajapati
b5282ece91 openldap: fix CVE-2021-27212 Assertion failure in slapd
Upstream-Status: Backport from 9badb73425

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
3e51eb35ae multipath-tools: fix CVE-2022-41974
Upstream-Status: Backport from fbbf280a0e

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
7ca27d5cf3 yajl: CVE-2023-33460 memory leak in yajl_tree_parse function
Upstream-Status: Backport from 23a122edda

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
vkumbhar
5f94e67479 postgresql: fix CVE-2023-2454 & CVE-2023-2455
fixed Below security CVE:
1)CVE-2023-2454 postgresql: schema_element defeats protective search_path changes.
2)CVE-2023-2455 postgresql: row security policies disregard user ID changes after inlining.

Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
virendra thakur
e5808a69cd c-ares: whitelist CVE-2023-31124
CVE-2023-31124 applies only when cross-compiling using autotools.
Yocto cross-compiles via cmake which is also listed as official workaround.

See:
* https://nvd.nist.gov/vuln/detail/CVE-2023-31124
* https://github.com/c-ares/c-ares/security/advisories/GHSA-54xr-f67r-4pc4

Signed-off-by: virendra thakur <virendrak@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Vijay Anusuri
00de17fa46 libssh: CVE-2020-16135 NULL pointer dereference in sftpserver.c if ssh_buffer_new returns NULL
Upstream-Status: Backport
[533d881b0f
&
2782cb0495
&
10b3ebbe61
&
245ad744b5]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Hitendra Prajapati
6334241447 c-ares: CVE-2023-31147 Insufficient randomness in generation of DNS query IDs
Upstream-Status: Backport from 823df3b989

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Hitendra Prajapati
1b4564b6d9 c-ares: CVE-2023-31130 fix Buffer Underwrite
Upstream-Status: Backport from f22cc01039

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Vijay Anusuri
eae14f75ed c-ares: fix CVE-2022-4904 & Update SRC_URI branch and protocols
Upstream-Status: Backport
[https://git.openembedded.org/meta-openembedded-contrib/commit/?h=stable/kirkstone-nut&id=092e125f44f65427d42db95db3779daf4893d10f
& https://git.openembedded.org/meta-openembedded-contrib/commit/meta-oe/recipes-support/c-ares/c-ares_1.18.1.bb?h=stable/kirkstone-nut&id=b402a3076fbafe05d0b8621e50603b65c3fe8147
Upstream-Commit:
9903253c34]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Vijay Anusuri
d8c29311e5 openldap: Fix CVE-2023-2953
Upstream-Status: Backport
[752d320cf9
&
6563fab9e2]

Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
schitrod=cisco.com@lists.openembedded.org
65efd68735 gnulib: Update recipe name to 2018-12-18
As per gnulib_2018-03-07 recipe information,
SRCREV = "0d6e3307bbdb8df4d56043d5f373eeeffe4cbef3"
This revision was committed on "2018-12-18".

There is a discrepancy between SRCREV and the recipe version.
Which reports "CVE-2018-17942" as unpatched.

To report "CVE-2018-17942" as patched,
We need to align a recipe name with SRCREV commit date.

Signed-off-by: Sanjay Chitroda <schitrod@cisco.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9edbe7033c)
Signed-off-by: Sanjay Chitroda <schitrod@cisco.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Samuli Piippo
bb928e789c spirv-tools: switch from master branch to main for re2
Signed-off-by: Samuli Piippo <samuli.piippo@qt.io>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Martin Jansa
d25f2f1cac nodejs: fix native node-gyp to work with python-3.11
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Narpat Mali
116bfe8d5e nodejs: make 14.18.1 available but not default
Chromium 112 needs nodejs-native version 14 or later.
Add the nodejs_14.18.1 recipe from kirkstone:
   246b20b92 nodejs: Upgrade to 14.18.1
but, use DEFAULT_PREFERENCE to make sure that the default version of nodejs
remains 12.x.

7 patches which were modified between nodejs 12 & nodejs 14 were renamed by
adding the suffix "-nodejs14". Note there are some common patches used by
nodejs 12 & 14 so, that will require attention during future maintenance.
In addition, there were 3 CVE-2022* patches which applied cleanly to nodejs
14 so, they were added to the nodejs 14 recipe. One patch, CVE-llhttp.patch
conflicted so, it has not been applied in nodejs 14 yet.

Nodejs 14 compile for qemux86-64 but, no run-time testing has been performed.

For chromium, we would either require users to modify the local.conf file or
we may create a dunfell specific branch in meta-browser.
See: https://github.com/OSSystems/meta-browser/pull/709

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Jack Mitchell
4c533a5f90 nss: backport fix for native build failure due to dangling pointer with gcc13
Upstream-Status: Backport
Link: cbf5a2bce7

Signed-off-by: Jack Mitchell <ml@embed.me.uk>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Jack Mitchell
c69846bfc6 nss: backport fix for native build failure due to implicit casting with gcc13
Upstream-Status: Backport
Link: 4e7e332b25

Signed-off-by: Jack Mitchell <ml@embed.me.uk>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Hitendra Prajapati
e39b002df9 multipath-tools: CVE-2022-41973 Symlink attack multipathd operates insecurely
Upstream-Status: Backport from cb57b930fa

dev/shm may have unsafe permissions. Use /run instead.
Use systemd's tmpfiles.d mechanism to create /run/multipath
early during boot.

For backward compatibilty, make the runtime directory configurable
via the "runtimedir" make variable.

QA Issue: non -dev/-dbg/nativesdk- package multipath-tools-libs
  contains symlink .so '/usr/lib/libdmmp.so'
  ...

Fix this by making the new pattern for multipath-tools-libs package
more specific.

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Alex Yao
eca75eba7d lcov: Fix Perl Path
Fixes an issue where lcov is using the system Perl rather than the yocto
provided Perl. This causes packages to not be found during runtime such
as PerlIO::gzip.

Signed-off-by: Alex Yao <alexyao1@meraki.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Viktor Rosendahl
765cfa779d jsoncpp: Fix broken handling of escape characters
Applying this backported patch from upstream fixes the following
BAT test failure:

jsoncpp.jsoncpp_system_tests.TestJsoncpp.test_run_jsoncpp_test
(from systemtests--bmt--BAT) :
* Detail of EscapeSequenceTest/writeEscapeSequence test failure:
/usr/src/debug/jsoncpp/1.9.2-r0/git/src/test_lib_json/main.cpp(3370): expected == result
  Expected: '["\"","\\","\b","\f","\n","\r","\t","\u0278","\ud852\udf62"]
  '
  Actual  : '["\"","\\","\b","\f","\n","\r","\t","ɸ","𤭢"]

This test failure happens because aarch64 uses unsigned char as
default type for char, while x86 uses signed char. Also, there
is another bug in the code that is fixed by this upstream patch:

 "static_cast<unsigned char>(*cur) < 0x80" should be:
 "static_cast<unsigned char>(*cur) >= 0x80"

Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Hugo SIMELIERE
34f5646bba libmodbus: Fix CVE-2022-0367
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-03 11:16:53 -04:00
Armin Kuster
7007d14c25 mariadb: Update to latest lts 10.4.28
Source: Mariadb.org
MR: 119595, 119604, 119613, 119622, 119631, 119640, 119649, 119658, 119573
Type: Security Fix
Disposition: Backport from mariadb.org
ChangeID: 2aacce87739247d98ee5b61d1b714930da961a30
Description:

This is a bug fix only update. Includes these CVES:
CVE-2022-32081
CVE-2022-32083
CVE-2022-32084
CVE-2022-32085
CVE-2022-32086
CVE-2022-32087
CVE-2022-32088
CVE-2022-32089
CVE-2022-32091

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

--
V2]
Missed on CVE reference.
2023-04-06 07:32:45 -04:00
Hitendra Prajapati
94b30b7d85 syslog-ng: CVE-2022-38725 An integer overflow in the RFC3164 parser
Upstream-Status: Backport from b5a060f2eb && 81a07263f1 && 4b8dc56ca8 && 73b5c300b8 && 45f0512393 && 09f489c89c && 8c6e2c1c41 && 56f881c5ea

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
vkumbhar
f1d4acc09d mariadb: fix CVE-2022-47015 NULL pointer dereference in spider_db_mbase::print_warnings()
The function spider_db_mbase::print_warnings() can potentially result
in a null pointer dereference.

Remove the null pointer dereference by cleaning up the function.

Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
Hitendra Prajapati
4f78732be2 postgresql: CVE-2022-41862 Client memory disclosure when connecting with Kerberos to modified server
Upstream-Status: Backport from https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=3f7342671341a7a137f2d8b06ab3461cdb0e1d88

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
Virendra Thakur
7b7913fd47 nss: Fix CVE CVE-2023-0767
Add CVE-2023-0767.patch to fix CVE-2023-0767

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
Signed-off-by: Bhabu Bindu <bindudaniel1996@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00