summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2023-11-28vim: use upstream generated .po filesSteve Sakoman
A previous commit attempted to fix reproducibility errors by forcing regeneration of .po files. Unfortunately this triggered a different type of reproducibility issue. Work around this by adjusting the timestamps of the troublesome .po files so they are not regenerated and we use the shipped upstream versions of the files. The shipped version of ru.cp1251.po doesn't seem to have been created with the vim tooling and specifies CP1251 instead of cp1251, fix that. Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-28vim: Upgrade 9.0.2048 -> 9.0.2068Archana Polampalli
This includes CVE fix for CVE-2023-46246. 9198c1f2b (tag: v9.0.2068) patch 9.0.2068: [security] overflow in :history References: https://nvd.nist.gov/vuln/detail/CVE-2023-46246 Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-28vim: update obsolete commentEtienne Cordonnier
vim 8.3 has been out for a long time, so this comment is obsolete. However we still need UPSTREAM_VERSION_UNKNOWN, since we ignore the last digit of the upstream version number. Test result: $ devtool check-upgrade-status vim ... INFO: vim 9.0.1592 UNKNOWN Tom Rini <trini@konsulko.com> c0370529c027abc5b1698d53fcfb8c02a0c515da (From OE-Core rev: 65f5de85c3f488136d1ec2b1f7fe8d8426d6c5b3) Signed-off-by: Etienne Cordonnier <ecordonnier@snap.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 868a19357841470eb55fb7f1c4ab1af09dea99ed) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-28vim: Improve locale handlingRichard Purdie
When making checkouts from git, the timestamps can vary and occasionally two files can end up with the same stamp. This triggers make to regenerate ru.cp1251.po from ru.po for example. If it isn't regenerated, the output isn't quite the same leading to reproducibility issues (CP1251 vs cp1251). Since we added all locales to buildtools tarball now, we can drop the locale restrictions too. We need to generate a native binary for the sjis conversion tool so also tweak that. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-28tiff: backport Debian patch to fix CVE-2022-40090Vijay Anusuri
import patch from ubuntu to fix CVE-2022-40090 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/tiff/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/c7caec9a4d8f24c17e667480d2c7d0d51c9fae41] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-28grub: fix CVE-2023-4692 & CVE-2023-4693Hitendra Prajapati
Upstream-Status: Backport from https://git.savannah.gnu.org/cgit/grub.git/commit/?id=43651027d24e62a7a463254165e1e46e42aecdea && https://git.savannah.gnu.org/gitweb/?p=grub.git;a=commit;h=0ed2458cc4eff6d9a9199527e2a0b6d445802f94 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-27avahi: backport Debian patches to fix multiple CVE'sVijay Anusuri
import patches from ubuntu to fix CVE-2023-1981 CVE-2023-38469 CVE-2023-38470 CVE-2023-38471 CVE-2023-38472 CVE-2023-38473 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/avahi/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f & https://github.com/lathiat/avahi/commit/a337a1ba7d15853fb56deef1f464529af6e3a1cf & https://github.com/lathiat/avahi/commit/c6cab87df290448a63323c8ca759baa516166237 & https://github.com/lathiat/avahi/commit/94cb6489114636940ac683515417990b55b5d66c & https://github.com/lathiat/avahi/commit/20dec84b2480821704258bc908e7b2bd2e883b24 & https://github.com/lathiat/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09 & https://github.com/lathiat/avahi/commit/b675f70739f404342f7f78635d6e2dcd85a13460 & https://github.com/lathiat/avahi/commit/b024ae5749f4aeba03478e6391687c3c9c8dee40 & https://github.com/lathiat/avahi/commit/b448c9f771bada14ae8de175695a9729f8646797] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-27bind: Backport fix for CVE-2023-3341Vijay Anusuri
Upstream-Status: Backport [https://gitlab.isc.org/isc-projects/bind9/-/commit/c4fac5ca98efd02fbaef43601627c7a3a09f5a71] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-27curl: fix CVE-2023-28321 CVE-2023-28322Lee Chee Yang
import patch from ubuntu curl_7.68.0-1ubuntu2.20. minor change to CVE-2023-28321.patch tests/data/test1397 part so the patch can be apply. Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-27shadow: backport patch to fix CVE-2023-29383Vijay Anusuri
The fix of CVE-2023-29383.patch contains a bug that it rejects all characters that are not control ones, so backup another patch named "0001-Overhaul-valid_field.patch" from upstream to fix it. (From OE-Core rev: ab48ab23de6f6bb1f05689c97724140d4bef8faa) Upstream-Status: Backport [https://github.com/shadow-maint/shadow/commit/e5905c4b84d4fb90aefcd96ee618411ebfac663d & https://github.com/shadow-maint/shadow/commit/2eaea70111f65b16d55998386e4ceb4273c19eb4] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-27python3-setuptools: fix CVE-2022-40897Lee Chee Yang
import patch from ubuntu setuptools_45.2.0-1ubuntu0.1 . Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-27wayland: fix CVE-2021-3782Lee Chee Yang
take CVE-2021-3782.patch from OE-core rev 09b8ff8d2361b2db001bc963f481db294ccf2170. Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-15libx11: Fix for CVE-2023-43785 CVE-2023-43786 and CVE-2023-43787Vijay Anusuri
import patches from ubuntu to fix CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/libx11/tree/debian/patches?h=ubuntu/focal-security Upstream commit https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/6858d468d9ca55fb4c5fd70b223dbc78a3358a7f & https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/204c3393c4c90a29ed6bef64e43849536e863a86 & https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/73a37d5f2fcadd6540159b432a70d80f442ddf4a & https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/b4031fc023816aca07fbd592ed97010b9b48784b & https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/7916869d16bdd115ac5be30a67c3749907aea6a0] Reference: https://launchpad.net/ubuntu/+source/libx11/2:1.6.9-2ubuntu1.6 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-14selftest: skip virgl test on all fedoraSteve Sakoman
This test will fail any time the host has libdrm > 2.4.107 Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13lz4: Update sstate/equiv versions to clean cacheSteve Sakoman
There are cached reproducibility issues on the autobuilder due to CFLAGS issues, flush the bad data out the system by bumping the versions. Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13lz4: use CFLAGS from bitbakeMikko Rapeli
Currently lz4 uses it's own defaults which include O3 optimization. Switch from O3 to bitbake default O2 reduces binary package size from 467056 to 331888 bytes. Enables also building with Os if needed. Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit abaaf8c6bcd368728d298937a9406eb2aebc7a7d) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13resolvconf: Fix fetch errorNaveen Saini
Branch 'master' renamed to 'unstable', which causing following failure. Error: Fetcher failure: Unable to find revision cb19bbfbe7e52174332f68bf2f295b39d119fad3 in branch master even from upstream Switch to 'unstanble' branch. Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13assimp: Explicitly use nobranch=1 in SRC_URINaveen Saini
Branch 'assimp_5.0_release' is not present in repo. Error: assimp-5.0.1-r0 do_fetch: Fetcher failure: Unable to find revision 8f0c6b04b2257a520aaab38421b2e090204b69df in branch assimp_5.0_release even from upstream Set nobranch=1, to fetch from v5.0.1 tag. Signed-off-by: Naveen Saini <naveen.kumar.saini@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13cve-check: don't warn if a patch is remoteRoss Burton
We don't make do_cve_check depend on do_unpack because that would be a waste of time 99% of the time. The compromise here is that we can't scan remote patches for issues, but this isn't a problem so downgrade the warning to a note. Also move the check for CVEs in the filename before the local file check so that even with remote patches, we still check for CVE references in the name. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0251cad677579f5b4dcc25fa2f8552c6040ac2cf) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13cve-check: slightly more verbose warning when adding the same package twiceRoss Burton
Occasionally the cve-check tool will warn that it is adding the same package twice. Knowing what this package is might be the first step towards understanding where this message comes from. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c1179faec8583a8b7df192cf1cbf221f0e3001fc) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13cve-check: sort the package list in the JSON reportRoss Burton
The JSON report generated by the cve-check class is basically a huge list of packages. This list of packages is, however, unsorted. To make things easier for people comparing the JSON, or more specifically for git when archiving the JSON over time in a git repository, we can sort the list by package name. Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e9861be0e5020830c2ecc24fd091f4f5b05da036) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13xserver-xorg: Fix for CVE-2023-5367 and CVE-2023-5380Vijay Anusuri
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/541ab2ecd41d4d8689e71855d93e492bc554719a & https://gitlab.freedesktop.org/xorg/xserver/-/commit/564ccf2ce9616620456102727acb8b0256b7bbd7] Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13Revert "qemu: Backport fix for CVE-2023-0330"Steve Sakoman
This reverts commit 45ce9885351a2344737170e6e810dc67ab3e7ea9. Unfortunately this backport results in qemuarmv5 failing to boot with a qemu lsi hw error. [YOCTO #15274] See discussion: https://bugzilla.yoctoproject.org/show_bug.cgi?id=15274 Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13zlib: Backport fix for CVE-2023-45853Ashish Sharma
Upstream-Status: Backport from [https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c] Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13libwebp: Fix CVE-2023-4863Soumya Sambu
Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. Removed CVE-2023-5129.patch as CVE-2023-5129 is duplicate of CVE-2023-4863. CVE: CVE-2023-4863 References: https://nvd.nist.gov/vuln/detail/CVE-2023-4863 https://security-tracker.debian.org/tracker/CVE-2023-4863 https://bugzilla.redhat.com/show_bug.cgi?id=2238431#c12 Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13glibc: ignore CVE-2023-4527Peter Marko
This vulnerability was introduced in 2.36, so 2.31 is not vulnerable. Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13tiff: backport Debian patch to fix CVE-2023-41175Vijay Anusuri
Upstream-Status: Backport [import from debian security.debian.org/debian-security/pool/updates/main/t/tiff/tiff_4.1.0+git191117-2~deb10u8.debian.tar.xz Upstream commit https://gitlab.com/libtiff/libtiff/-/commit/6e2dac5f904496d127c92ddc4e56eccfca25c2ee] Reference: https://security-tracker.debian.org/tracker/CVE-2023-41175 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-11-13tiff: Security fix for CVE-2023-40745Hitendra Prajapati
Upstream-Status: Backport from https://gitlab.com/libtiff/libtiff/-/commit/4fc16f649fa2875d5c388cf2edc295510a247ee5 Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-31tiff: CVE patch correction for CVE-2023-3576Vijay Anusuri
- The commit [https://gitlab.com/libtiff/libtiff/-/commit/881a070194783561fd209b7c789a4e75566f7f37] fixes CVE-2023-3576 - Hence, renamed the CVE-2023-3618-1.patch to CVE-2023-3576.patch - Reference: https://security-tracker.debian.org/tracker/CVE-2023-3576 https://security-tracker.debian.org/tracker/CVE-2023-3618 Signed-off-by: Vijay Anusuri <vanusuri@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-27kexec-tools: Ignore Fedora/RedHat specific CVE-2021-20269Lee Chee Yang
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-27build-appliance-image: Update to dunfell head revisionSteve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-24cve-exclusion_5.4.inc: update for 5.4.257Steve Sakoman
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-24patch.py: Use shlex instead of deprecated pipeSteve Sakoman
The pipe library is deprecated in Python 3.11 and will be removed in Python 3.13. pipe.quote is just an import of shlex.quote anyway. Clean up imports while we're at it. Signed-off-by: Ola x Nilsson <olani@axis.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> (cherry picked from commit 5f33c7b99a991c380d1813da8248ba5470ca4d4e) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-23resulttool/report: Avoid divide by zeroRichard Purdie
Avoid a divide by zero traceback if unfortunate test counts are encountered. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit c5aeea53dfacb53dedb8445cb3523dc3a8cb6dca) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-23linux-firmware: upgrade 20230625 -> 20230804Meenali Gupta
License-Update: additional firmwares upgrade include fix for CVE-2023-20569 CVE-2022-40982 CVE-2023-20593 Changelog: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/ References: https://nvd.nist.gov/vuln/detail/CVE-2023-20569 https://nvd.nist.gov/vuln/detail/CVE-2022-40982 https://nvd.nist.gov/vuln/detail/CVE-2023-20593 Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> (cherry picked from commit d3f1448246c9711f4f23f2e12c664e0ba3ae3f02) Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-23vim: Upgrade 9.0.2009 -> 9.0.2048Siddharth Doshi
This includes CVE fix for CVE-2023-5535. Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-23binutils: Backport fix CVE-2023-25588Ashish Sharma
Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1] CVE: CVE-2023-25588 Signed-off-by: Ashish Sharma <asharma@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-16systemd: Backport systemd-resolved: use hostname for certificate validation ↵Marek Vasut
in DoT Widely accepted certificates for IP addresses are expensive and only affordable for larger organizations. Therefore if the user provides the hostname in the DNS= option, we should use it instead of the IP address. This fixes https://nvd.nist.gov/vuln/detail/CVE-2018-21029 per suggestion https://github.com/systemd/systemd-stable/issues/72 . CVE: CVE-2018-21029 Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-16kernel.bbclass: Add force flag to rm callsRyan Eatmon
The latest 6.5 kernels do not appear to create the source file in ${D}${nonarch_base_libdir}/modules/${KERNEL_VERSION}/source so the recipe errors out when trying to remove it. Simple fix is to add the -f (force) flag to the call. (From OE-Core rev: 2e669bf797b15d803e7d6a700e449bdc467a4bcc) Signed-off-by: Ryan Eatmon <reatmon@ti.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Backported from kirkstone commit 7e177848f97e. Signed-off-by: Paul Barker <paul.barker.ct@bp.renesas.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-16libxpm: upgrade to 3.5.17Siddharth Doshi
- This upgrade includes multiple security fixes. CVE-2022-4883 CVE-2022-44617 CVE-2022-46285 CVE-2022-44617 CVE-2023-43788 CVE-2023-43789 - Removed CVE-2022-46285 as it is already fixed by this upgrade. - License-update: additional copyright holders f0857c0 man pages: Correct Copyright/License notices Due to this commit LIC_FILES_CHKSUM is changed - Disable reading compressed files as that requires compress/uncompress executables. Following the approach in oe-core/master: 7de4084634 libxpm: upgrade 3.5.14 -> 3.5.15 - Add XORG_EXT to specify tar.xz as upstream has switched from bz2 to xz compression. Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-16xorg-lib-common: Add variable to set tarball typeSiddharth Doshi
Upstream has switched some new releases from bz2 to xz compression. Add an XORG_EXT variable so recipes can set the file name extension needed for the compression type. Following the approach in oe-core/master: 6a8068e036b4b2a40b38896275b936916b4db76e xorg-lib-common: Add variable to set tarball type use a variable for the tarball suffix/compression format. Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-16vim: Upgrade 9.0.1894 -> 9.0.2009Siddharth Doshi
This includes CVE fix for CVE-2023-5441. Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-16libwebp: Update CVE ID CVE-2023-4863Pawan
Notice that it references different CVE id: https://nvd.nist.gov/vuln/detail/CVE-2023-5129 which was marked as a rejected duplicate of: https://nvd.nist.gov/vuln/detail/CVE-2023-4863 but it's the same issue. Hence update CVE ID CVE-2023-4863 to CVE-2023-5129.patch. Signed-off-by: Pawan <badganchipv@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-16glib-2.0: Fix multiple vulnerabilitiesSiddharth Doshi
CVE's Fixed: CVE-2023-29499: glib: GVariant offset table entry size is not checked in is_normal() CVE-2023-32611: glib: g_variant_byteswap() can take a long time with some non-normal inputs CVE-2023-32636: glib: Timeout in fuzz_variant_text CVE-2023-32643: glib: Heap-buffer-overflow in g_variant_serialised_get_child CVE-2023-32665: glib: GVariant deserialisation does not match spec for non-normal data Signed-off-by: Siddharth Doshi <sdoshi@mvista.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-12curl: Backport fix for CVE-2023-38546Mike Crowe
Take patch from Debian 7.64.0-4+deb10u7. Signed-off-by: Mike Crowe <mac@mcrowe.com> CVE: CVE-2023-38546 Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-12curl: Backport fix for CVE-2023-38545Mike Crowe
Backporting this change required tweaking the error value since the two-level CURLE_PROXY error reporting was introduced after curl 7.69.1. The test required some tweaks to not rely on more-recent improvements to the test infrastructure too. Signed-off-by: Mike Crowe <mac@mcrowe.com> CVE: CVE-2023-38545 Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-12libtiff: Add fix for tiffcrop CVE-2023-1916Marek Vasut
Add fix for tiffcrop tool CVE-2023-1916 [1]. A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x. The tool is no longer part of newer libtiff distributions, hence the fix is rejected by upstream in [2]. The backport is still applicable to older versions of libtiff, pick the CVE fix from ubuntu 20.04 [3]. [1] https://nvd.nist.gov/vuln/detail/CVE-2023-1916 [2] https://gitlab.com/libtiff/libtiff/-/merge_requests/535 [3] https://packages.ubuntu.com/source/focal-updates/tiff Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-09cpio: Replace fix wrong CRC with ASCII CRC for large files with upstream ↵Marek Vasut
backport Replace the original "Wrong CRC with ASCII CRC for large files" patch with upstream backport, and add additional fix on top of the same problem which upstream detected and fixed. Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-09openssl: Upgrade 1.1.1v -> 1.1.1wSourav Pramanik
https://www.openssl.org/news/openssl-1.1.1-notes.html Major changes between OpenSSL 1.1.1v and OpenSSL 1.1.1w [11 Sep 2023] * Fix POLY1305 MAC implementation corrupting XMM registers on Windows (CVE-2023-4807) Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
2023-10-09busybox: Backport CVE-2022-48174 fixMarek Vasut
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. https://nvd.nist.gov/vuln/detail/CVE-2022-48174 CVE: CVE-2022-48174 Signed-off-by: Marek Vasut <marex@denx.de> Signed-off-by: Steve Sakoman <steve@sakoman.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-26 07:33:40 +0000