[OE-core][dunfell 00/22] Patch review

["Steve Sakoman" <steve@sakoman.com>]

Please review this next set of patches for dunfell and have comments back by
end of day Friday.

Passed a-full on autobuilder:

https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2144

The following changes since commit 5b2ad70cd82c3b812652886ee4bf29f88dcac42c:

  reproducible.py: add quilt-ptest and valgrind-ptest (2021-05-07 05:21:23 -1000)

are available in the Git repository at:

  git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
  http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut

Alexander Kanavin (1):
  linux-firmware: upgrade 20210208 -> 20210315

Anuj Mittal (1):
  lsb-release: fix reproducibility failure

Bruce Ashfield (1):
  linux-yocto/5.4: qemuppc32: reduce serial shutdown issues

Chen Qi (1):
  db: update CVE_PRODUCT

Lee Chee Yang (4):
  subversion: fix CVE-2020-17525
  qemu: fix CVE-2021-3392
  tiff: fix CVE-2020-35523 CVE-2020-35524
  python3-jinja2: 2.11.2 -> 2.11.3

Richard Purdie (9):
  glibc: Document and whitelist CVE-2019-1010022-25
  qemu: Exclude CVE-2017-5957 from cve-check
  qemu: Exclude CVE-2007-0998 from cve-check
  qemu: Exclude CVE-2018-18438 from cve-check
  jquery: Exclude CVE-2007-2379 from cve-check
  logrotate: Exclude CVE-2011-1548,1549,1550 from cve-check
  openssh: Exclude CVE-2007-2768 from cve-check
  oeqa/qemurunner: Fix binary vs str issue
  oeqa/qemurunner: Improve handling of run_serial for shutdown commands

Romain Naour (1):
  dejagnu: needs expect at runtime

Ross Burton (3):
  cairo: backport patch for CVE-2020-35492
  libnotify: whitelist CVE-2013-7381 (specific to the NodeJS bindings)
  builder: whitelist CVE-2008-4178 (a different builder)

Yann Dirson (1):
  linux-firmware: include all relevant files in -bcm4356

 meta/lib/oeqa/utils/qemurunner.py             |  11 +-
 .../openssh/openssh_8.2p1.bb                  |   3 +
 meta/recipes-core/glibc/glibc_2.31.bb         |  13 ++
 .../recipes-devtools/dejagnu/dejagnu_1.6.2.bb |   1 +
 meta/recipes-devtools/jquery/jquery_3.5.0.bb  |   5 +
 ...ja2_2.11.2.bb => python3-jinja2_2.11.3.bb} |   2 +-
 meta/recipes-devtools/qemu/qemu.inc           |  12 ++
 .../qemu/qemu/CVE-2021-3392.patch             |  92 ++++++++++++++
 .../subversion/CVE-2020-17525.patch           | 117 ++++++++++++++++++
 .../subversion/subversion_1.13.0.bb           |   1 +
 .../logrotate/logrotate_3.15.1.bb             |   3 +
 .../help2man-reproducibility.patch            |  27 ++++
 meta/recipes-extended/lsb/lsb-release_1.4.bb  |   1 +
 .../libnotify/libnotify_0.7.8.bb              |   3 +
 meta/recipes-graphics/builder/builder_0.1.bb  |   2 +
 .../cairo/cairo/CVE-2020-35492.patch          |  60 +++++++++
 meta/recipes-graphics/cairo/cairo_1.16.0.bb   |   1 +
 ...20210208.bb => linux-firmware_20210315.bb} |   8 +-
 .../linux/linux-yocto-rt_5.4.bb               |   2 +-
 .../linux/linux-yocto-tiny_5.4.bb             |   2 +-
 meta/recipes-kernel/linux/linux-yocto_5.4.bb  |   2 +-
 .../libtiff/files/CVE-2020-35523.patch        |  55 ++++++++
 .../libtiff/files/CVE-2020-35524-1.patch      |  42 +++++++
 .../libtiff/files/CVE-2020-35524-2.patch      |  36 ++++++
 meta/recipes-multimedia/libtiff/tiff_4.1.0.bb |   3 +
 meta/recipes-support/db/db_5.3.28.bb          |   2 +-
 26 files changed, 494 insertions(+), 12 deletions(-)
 rename meta/recipes-devtools/python/{python3-jinja2_2.11.2.bb => python3-jinja2_2.11.3.bb} (92%)
 create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2021-3392.patch
 create mode 100644 meta/recipes-devtools/subversion/subversion/CVE-2020-17525.patch
 create mode 100644 meta/recipes-extended/lsb/lsb-release/help2man-reproducibility.patch
 create mode 100644 meta/recipes-graphics/cairo/cairo/CVE-2020-35492.patch
 rename meta/recipes-kernel/linux-firmware/{linux-firmware_20210208.bb => linux-firmware_20210315.bb} (99%)
 create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2020-35523.patch
 create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2020-35524-1.patch
 create mode 100644 meta/recipes-multimedia/libtiff/files/CVE-2020-35524-2.patch

-- 
2.25.1