summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core
AgeCommit message (Collapse)Author
2022-04-03zlib: backport the fix for CVE-2018-25032Ross Burton
(From OE-Core rev: 90b9356e4b87d8ce08b3456ec0e0185e521335a4) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-03libxml2: Fix CVE-2022-23308Joe Slater
The first patch is the fix in version 2.9.13. The second patch was added later and fixes a regression introduced by the first. (From OE-Core rev: 38e97e67f053cc7b86dd487d8e65b9e68237c73b) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-22expat: fix CVE-2022-25236Kai Kang
Backport patches to fix CVE-2022-25236 for expat. CVE: CVE-2022-25236 (From OE-Core rev: fd0271ee4ff3a45f7c04219fc7571db66fcefb10) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-22expat: fix CVE-2022-25235Kai Kang
Backport patch to fix CVE-2022-25235 for expat. CVE: CVE-2022-25235 (From OE-Core rev: 60dd7d2deeda838346f30b6f8de28dfac7efac0d) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-02initramfs-framework: unmount automounts before switch_rootJustin Bronder
If mounts are left lingering, then after we switch_root, attempts to modify the block devices will result in an EBUSY with no way to unmount them. As we're about to switch_root anyways, there isn't much use to keep anything mounted unless it has the new rootfs. (From OE-Core rev: 999883990235251127b65f2277dcb40004e7f657) Signed-off-by: Justin Bronder <jsbronder@cold-front.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4dc7af6d25597ea10ea43e76c7c3d7251462c0e5) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> (cherry picked from commit 991631492f4fafc1852113a34a60b025342518b6) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-03-02expat: fix CVE-2022-23990Kai Kang
CVE: CVE-2022-23990 Based on Steve Sakoman's patch for branch dunfell, fix CVE-2022-23990 for expat in branch hardknott. And correct indent as well. (From OE-Core rev: dc30243e7cc1b1c392b999de114b4096d432ef02) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-20build-appliance-image: Update to hardknott head revisionyocto-3.3.5hardknott-3.3.5Richard Purdie
(From OE-Core rev: 29cd1d796057ef5599fe17c39b42aa099f7b1c29) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-20glibc: upgrade glibc-2.33 to latest versionPgowda
glibc-2.33 has been upgraded to latest version that includes many CVE and other bug fixes. Ran the regressions and results are better. (From OE-Core rev: d5bdff460cc8b0f38177f1f38d625eeda729b459) Signed-off-by: pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-10expat: add missing Upstream-status, CVE tag and sign-off to CVE-2021-46143.patchSteve Sakoman
(From OE-Core rev: a32cee6c9e1ff53e424b8386c36555e6cf3bf3af) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 7e33aa25acc0c29b8f5e78757c6557e614eb1434) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-10expat: fix CVE-2022-23852Steve Sakoman
Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer for configurations with a nonzero XML_CONTEXT_BYTES. Backport patch from: https://github.com/libexpat/libexpat/commit/847a645152f5ebc10ac63b74b604d0c1a79fae40 CVE: CVE-2022-23852 (From OE-Core rev: 8a50809a0e54c66a8a7aafb1b9bffbec009f8c57) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit af81bb9d10c0f1e9dcaffc1bbc18ef780eea7127) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-31expat: fix CVE-2021-46143Steve Sakoman
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize. Backport patch from: https://github.com/libexpat/libexpat/pull/538/commits/85ae9a2d7d0e9358f356b33977b842df8ebaec2b CVE: CVE-2021-46143 (From OE-Core rev: babe185972eb71058762ca20c349ba2651d0f73d) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 41a65d27e4ecdc11977e2944d8af2f51c48f32ec) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-31expat: fix CVE-2021-45960Steve Sakoman
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). Backport patch from: https://github.com/libexpat/libexpat/pull/534/commits/0adcb34c49bee5b19bd29b16a578c510c23597ea CVE: CVE-2021-45960 (From OE-Core rev: 8d475823acf95d81596c1c125bc7dd4d0e0f5f1c) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 22fe1dea3164a5cd4d5636376f3671641ada1da9) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-31expat fix CVE-2022-22822 through CVE-2022-22827Steve Sakoman
xmlparse.c has multiple integer overflows. The involved functions are: - addBinding (CVE-2022-22822) - build_model (CVE-2022-22823) - defineAttribute (CVE-2022-22824) - lookup (CVE-2022-22825) - nextScaffoldPart (CVE-2022-22826) - storeAtts (CVE-2022-22827) Backport patch from: https://github.com/libexpat/libexpat/pull/539/commits/9f93e8036e842329863bf20395b8fb8f73834d9e CVE: CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 (From OE-Core rev: 0d195a98703d690a348719f77e7be78653d14ad3) Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit 3b6c47c0ebae9fdb7a13480daf8f46a8dbb2c9bd) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-31glibc: upgrade glibc-2.33 to latest versionpgowda
glibc-2.33 has been upgraded to latest version that includes many CVE and other bug fixes. (From OE-Core rev: f658889952dcccbd2eea415764b3e89ac738cde9) Signed-off-by: pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-14glibc: Backport fix for CVE-2021-43396Pgowda
Backport the fix for CVE-2021-43396. It is disputed that this is a security issue. (From OE-Core rev: e8de9b01c6b305b2498c5f942397a49ae2af0cde) (From OE-Core rev: 0b7e120bc3b40c0b150dd878d64bfe0ffdac79d9) Signed-off-by: pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-14busybox: backport patches to fix CVEsChen Qi
Backport patches to fix the following CVEs: CVE-2021-42373 CVE-2021-42378 CVE-2021-42379 CVE-2021-42380 CVE-2021-42381 CVE-2021-42382 CVE-2021-42383 CVE-2021-42384 CVE-2021-42385 CVE-2021-42386 (From OE-Core rev: 33f6fb263edd7dd0f5f97f1cf02f63978dbfba09) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-01-07busybox: upgrade 1.33.1 -> 1.33.2Anuj Mittal
Bug fix release. 1.33.2 has fixes for hush and ash (parsing fixes) and unlzma (fix a case where we could read before beginning of buffer). (From OE-Core rev: 0b34671cb9a91419216a532954bd2783d3384ba0) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-12-05os-release: Add DISTRO_CODENAME as vardeps for do_compileDaniel Gomez
DISTRO_CODENAME is part of VERSION variable but not used as dependency for do_compile task. Append it to the vardeps list to rebuild in case it changes. (From OE-Core rev: 92cdee5c20c917f0d7bcfa44b0751e28966f3c44) Signed-off-by: Daniel Gomez <daniel@qtec.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit ee0345057459c6d77fb64902a955e836c6c1e8e4) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-12-05glibc: Fix i586/c3 supportRichard Purdie
CET can't be enabled on i586 or c3 for x86, adjust the configuration accordingly to fix those builds. [YOCTO #14632] (From OE-Core rev: 59497e4fcef97987beb0057fe6a7dd1332ed20aa) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 26e4fed594daefb6923c50171360f925c4822683) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-11-21meta: add explicit branch and protocol to SRC_URIAnuj Mittal
Add branch name explicitly to SRC_URI where it's not defined and switch to using https protocol for Github projects. The change was made using convert-srcuri script in scripts/contrib. (From OE-Core rev: ab781d4e3fa7425d96ea770ddfd0f01f62018c5b) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-11-04build-appliance-image: Update to hardknott head revisionyocto-3.3.4hardknott-3.3.4Richard Purdie
(From OE-Core rev: 0ca080a23c2770a15138f702d4c879bbd90ca360) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-29util-linux: disable rawMarkus Volk
raw.h has been dropped in linux-libc-headers-5.14 leading to: configure: error: raw selected, but required raw.h header file not available WARNING: exit code 1 from a shell command. (From OE-Core rev: 7995098ca12f624d5d4771ac6e036240c060263a) Signed-off-by: MarkusVolk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 7f577c10913104860121f682b9b3754870c4db23) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-29libxml2: Use python3targetconfig to fix reproducibility issueRichard Purdie
We're seeing pthread being linked sometimes and not others leading to non-reproducible target binaries. The reason is mixing the native python config with the target one. We should use the target one. (From OE-Core rev: 4d1a5093675d365a3f8d2b3117062adc623d6488) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 1bc5378db760963e2ad46542f2907dd6a592eb66) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-29ncurses: fix CVE-2021-39537Mingli Yu
Backport patch [1] to fix CVE-2021-39537 [2]. [1] https://github.com/mirror/ncurses/commit/790a85dbd4a81d5f5d8dd02a44d84f01512ef443 [2] http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup (From OE-Core rev: 8fceb122a1c0240106342738de7d2484b48d9a6a) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-29glibc: upgrade glibc-2.33 to latest versionPgowda
glibc-2.33 release version of Feb 2021 is used in Hardknott branch. There are many bug fixes in the latest glibc-2.33 version. The patch takes the latest glibc-2.33 version commit. Regression tested on X86-64 without any new issues. (From OE-Core rev: 342b757d8fea2c72a6acf7befaa0b9a1f3fdd83f) Signed-off-by: Pgowda <pgowda.cve@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-07Update mailing list addressJon Mason
(From OE-Core rev: c2531bf2503e8dd736bba0acde9e329a439f3fda) Signed-off-by: Jon Mason <jdmason@kudzu.us> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 83169c33f7585da25560784f79eaad2c6f029f3c) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-07systemd: fix CVE-2021-33910Chen Qi
Backport patch to fix CVE-2021-33910. (From OE-Core rev: 866a880c4fb58dea1e8460acea8152658376cd12) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-10-02expat: pull from github releasesKonrad Weihmann
sometimes we can find release tarballs from sourceforge are not fully distributed along all download mirrors leading to fetching failures, depending on what download mirror will be chosen by sourceforge servers. As the project moved to github anyway, it's better to pull the tarballs directly from github releases - serving the very same static artifacts. Add an override UPSTREAM_CHECK_URI to enable devtool upgrade checks (From OE-Core rev: 75cdae00b80e0a64bb02f274cdf8b9a321bd57e5) Signed-off-by: Konrad Weihmann <kweihmann@outlook.com> (backported from commit 2a1743ace5aa41b188f77853d0f00c9e5a359c6d) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-09-09build-appliance-image: Update to hardknott head revisionyocto-3.3.3hardknott-3.3.3Richard Purdie
(From OE-Core rev: 567dd35d893c5d8969d41f263a24da8fbae3fc2f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-09-01build-appliance-image: Update to hardknott head revisionRichard Purdie
(From OE-Core rev: e3a7eaf9fe1420b2525e14f0c0f2936e7818b8a3) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-26glibc: Fix CVE-2021-38604Vinay Kumar
Source: https://sourceware.org/git/glibc.git Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=28213 Backported upstream commits b805aebd42364fe696e417808a700fdb9800c9e8 and 4cc79c217744743077bf7a0ec5e0a4318f1e6641 to glibc-2.33 source. Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=b805aebd42364fe696e417808a700fdb9800c9e8] Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=4cc79c217744743077bf7a0ec5e0a4318f1e6641] (From OE-Core rev: 9ba6c42c1cc0ffb690126aa93ccb529405473af5) Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-18glibc: Fix CVE-2021-35942Vinay Kumar
Source: https://sourceware.org/git/glibc.git Tracking -- https://sourceware.org/bugzilla/show_bug.cgi?id=28011 Backported upstream commit 5adda61f62b77384718b4c0d8336ade8f2b4b35c to glibc-2.33 source. Upstream-Status: Backport [https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c] (From OE-Core rev: 79adec00a3b7efb44171ac15e221cac3d3d85f20) Signed-off-by: Vinay Kumar <vinay.m.engg@gmail.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-14util-linux: fix CVE 2021-37600Joe Slater
Backport patch, which should be in next release (2.37.2). (From OE-Core rev: 15d1509861095580905cd5e9306fbda4729b9008) Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06ovmf: Fix VLA warnings with GCC 11Khem Raj
(From OE-Core rev: 811ce3e6fa51ff615b7f81126d0611ba30408c85) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 5406ce83e07c3f89b9f2bb26f083861467b7bc59) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06update-rc.d: update SRCREV to pull in fix for non-bash shell supportMarek Vasut
This pulls in non-bash shell fix for enable/disable command, upstream commit 8636cf4 ("update-rc.d: Fix enable/disable command"). This way update-rc.d works with e.g. dash shell again. (From OE-Core rev: 4e328b9195024bcc641c34a462c997d600d88a3b) Signed-off-by: Marek Vasut <marex@denx.de> Cc: Changqing Li <changqing.li@windriver.com> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f697332a3a753898183d7c5d2965dd75db9b0a24) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06initramfs-framework/setup-live: fix shebangUlrich Ölmann
(From OE-Core rev: 38e2b1876f4565b83c66643d9c71c638e732ecc5) Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 71f1f6bc9402ee0fad82aaf0757fffb73da4b706) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06initramfs-framework: fix whitespace issueUlrich Ölmann
(From OE-Core rev: 71a78ebd752a522da4d2360108e5399603c4a7ea) Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 9eaf6f4b08144c7f5453545f2bd9fb387a2dbe2e) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06initscripts: fix creation order for /var/log with VOLATILE_LOG_DIR=trueMatthias Schiffer
Create the /var/log symlink directly after /var/volatile/log, so /var/log is available for the creation of /var/log/wtmp a few lines later. (From OE-Core rev: b06867b1d842181db9dcd4ed45e4249131c3174c) Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 64b659b9e40da3280ba8911b4044b19aa7366262) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06glibc: Fix CVE-2021-33574Khairul Rohaizzat Jamaluddin
CVE: CVE-2021-33574 (From OE-Core rev: ede353df06a07d35dc66d024e2c7bd1b250d9761) Signed-off-by: Khairul Rohaizzat Jamaluddin <khairul.rohaizzat.jamaluddin@intel.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06netbase: use git fetcherMingli Yu
Use git repo as the the previous URL only stores the latest source file and fails to locate the source file which isn't the latest. (From OE-Core rev: 9557273596245f51781884a8ae7c8d9a14840df2) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-08-06systemd: fix CVE-2020-13529Chen Qi
Backport patches to fix CVE-2020-13529. (From OE-Core rev: 5dcd5071d61fac240ff95672778ba1eed1312a03) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-20busybox: add tmpdir option into mktemp appletAndrej Valek
- Make mktemp applet compatible with --tmpdir option in ca-certificate update script. (From OE-Core rev: 0c51fd928407267a5c1b664aabfdc3527aa92988) Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3d969e482d29da29828d1510f106f161d2b3d3c0) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-20glibc-testsuite: Fix build failures when directly running recipeRichard Purdie
If you try and run the glibc-testsuite's build task, you see failures as do_populate_sysroot can't work. We don't have a do_install, get rid of do_populate_sysroot as well. The recipe is not included in world builds by default which is why we don't see the issue more widely. (From OE-Core rev: eccfb470229164a106a32126db53dcf155af2569) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit f7de32dfcc2e6b1872fbd5ea61dcba944d5553a8) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-20busybox: upgrade 1.33.0 -> 1.33.1zhengruoqin
0001-decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch removed since it is included in 1.33.1 (From OE-Core rev: 4ed6b8d256c8485aa16e89deccb86a555e288911) Signed-off-by: Zheng Ruoqin <zhengrq.fnst@cn.fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 544236b12a72ee5be5ef0147249ead112082b871) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-06ifupdown: Skip wrong test itemZqiang
Skip wrong testcase(12-15) in testbuild-linux and rebase the patch tweak-ptest-script.patch. (From OE-Core rev: d96dc6345619977748a1dbb4ed981d031d7ecee6) Signed-off-by: Zqiang <qiang.zhang@windriver.com> Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 4edcfbace258d94d814c7d61f467e5384e2645fb) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-06-26util-linux.inc: Do not modify BPNPeter Kjellerstedt
Changing BPN to be "util-linux" regardless if it is the util-linux recipe or the util-linux-libuuid recipe that is being built was an easy way to allow ${BPN} and ${BP} to be used in the SRC_URI for both recipes. However, it causes problems for native.bbclass where there are expectations that ${BPN} and ${PN} match each other. Use "util-linux" directly in the SRC_URI instead to avoid the problem. (From OE-Core rev: 28a0e2cd75619ecc76293da145a81ae44f3f496f) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 701ef7ff0e1b17150424a64acfafbb83f518f9c9) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-06-03expat: set CVE_PRODUCTSteve Sakoman
Upstream database uses both "expat" and "libexpat" to report CVEs (From OE-Core rev: 30357a56df82d3ea11f7288a8c02dd2d201b498a) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-30libxml2: Fix CVE-2021-3541Tony Tascioglu
Upstream commit: This is related to parameter entities expansion and following the line of the billion laugh attack. Somehow in that path the counting of parameters was missed and the normal algorithm based on entities "density" was useless. CVE: CVE-2021-3541 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/8598060bacada41a0eb09d95c97744ff4e428f8e] (From OE-Core rev: e1e04de65e24d1596d800d7f8e85f98bb7f72632) Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-30libxml2: Fix CVE-2021-3518Tony Tascioglu
This patch fixes CVE-2021-3518. The fix for the CVE is the following 3 lines in 1098c30a: - (cur->children->type != XML_ENTITY_DECL) && - (cur->children->type != XML_XINCLUDE_START) && - (cur->children->type != XML_XINCLUDE_END)) { + ((cur->type == XML_DOCUMENT_NODE) || + (cur->type == XML_ELEMENT_NODE))) { This relies on an updated version of xinclude.c from upstream which also adds several new tests. Those changes are brought in first so that the CVE patch can be applied cleanly. The first patch updates xinclude.c and adds the new tests from upstream, and the second applies the fix for the CVE. CVE: CVE-2021-3518 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/1098c30a040e72a4654968547f415be4e4c40fe7] (From OE-Core rev: 6c59d33ee158129d5c0cca3cce65824f9bc4e7e3) Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-22libxml2: fix CVE-2021-3537Tony Tascioglu
Parsing specially crafted Mixed Content while parsing XML data may lead to invalid data structure being created, as errors were not propagated. This could lead to several NULL Pointer Dereference when post-validating documents parsed in recovery mode. CVE: CVE-2021-3537 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/babe75030c7f64a37826bb3342317134568bef61] (From OE-Core rev: 6d69f7453f78dcb19f472dcea183e859648c5243) Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-19 06:59:17 +0000