From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][dunfell 00/11] Patch review
Date: Tue, 10 Oct 2023 04:14:17 -1000 [thread overview]
Message-ID: <cover.1696946306.git.steve@sakoman.com> (raw)
Please review this set of changes for dunfell and have comments back by
end of day Thursday, October 12.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6026
The following changes since commit 9a800a2e2c2b14eab8c1f83cb4ac3b94a70dd23c:
glibc: Fix CVE-2023-4911 "Looney Tunables" (2023-10-05 13:10:56 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Hitendra Prajapati (1):
xdg-utils: Fix CVE-2022-4055
Julian Haller (2):
dbus: Backport fix for CVE-2023-34969
dbus: Add missing CVE_PRODUCT
Marek Vasut (2):
busybox: Backport CVE-2022-48174 fix
cpio: Replace fix wrong CRC with ASCII CRC for large files with
upstream backport
Shinu Chandran (1):
libpcre2 : Follow up fix CVE-2022-1586
Shubham Kulkarni (1):
go: Update fix for CVE-2023-24538 & CVE-2023-39318
Sourav Pramanik (1):
openssl: Upgrade 1.1.1v -> 1.1.1w
Vijay Anusuri (3):
cups: Backport fix for CVE-2023-32360 and CVE-2023-4504
gawk: backport Debian patch to fix CVE-2023-4156
ghostscript: Backport fix CVE-2023-43115
.../{openssl_1.1.1v.bb => openssl_1.1.1w.bb} | 2 +-
.../busybox/busybox/CVE-2022-48174.patch | 82 +++
meta/recipes-core/busybox/busybox_1.31.1.bb | 1 +
meta/recipes-core/dbus/dbus.inc | 3 +
.../dbus/dbus/CVE-2023-34969.patch | 96 +++
meta/recipes-devtools/go/go-1.14.inc | 5 +-
.../go/go-1.14/CVE-2023-24538-1.patch | 4 +-
.../go/go-1.14/CVE-2023-24538-2.patch | 447 ++++++++++++-
.../go/go-1.14/CVE-2023-24538_3.patch | 393 ++++++++++++
.../go/go-1.14/CVE-2023-24538_4.patch | 497 +++++++++++++++
.../go/go-1.14/CVE-2023-24538_5.patch | 585 ++++++++++++++++++
...3-24538-3.patch => CVE-2023-24538_6.patch} | 175 +++++-
.../go/go-1.14/CVE-2023-39318.patch | 38 +-
...g-CRC-with-ASCII-CRC-for-large-files.patch | 39 --
...-calculation-of-CRC-in-copy-out-mode.patch | 58 ++
...appending-to-archives-bigger-than-2G.patch | 312 ++++++++++
meta/recipes-extended/cpio/cpio_2.13.bb | 3 +-
meta/recipes-extended/cups/cups.inc | 2 +
.../cups/cups/CVE-2023-32360.patch | 31 +
.../cups/cups/CVE-2023-4504.patch | 40 ++
.../gawk/gawk/CVE-2023-4156.patch | 28 +
meta/recipes-extended/gawk/gawk_5.0.1.bb | 1 +
.../ghostscript/CVE-2023-43115.patch | 62 ++
.../ghostscript/ghostscript_9.52.bb | 1 +
.../xdg-utils/xdg-utils/CVE-2022-4055.patch | 165 +++++
.../xdg-utils/xdg-utils_1.1.3.bb | 1 +
.../libpcre2/CVE-2022-1586-regression.patch | 30 +
.../recipes-support/libpcre/libpcre2_10.34.bb | 1 +
28 files changed, 3041 insertions(+), 61 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl_1.1.1v.bb => openssl_1.1.1w.bb} (98%)
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2022-48174.patch
create mode 100644 meta/recipes-core/dbus/dbus/CVE-2023-34969.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_3.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_4.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_5.patch
rename meta/recipes-devtools/go/go-1.14/{CVE-2023-24538-3.patch => CVE-2023-24538_6.patch} (53%)
delete mode 100644 meta/recipes-extended/cpio/cpio-2.13/0001-Wrong-CRC-with-ASCII-CRC-for-large-files.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0003-Fix-calculation-of-CRC-in-copy-out-mode.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0004-Fix-appending-to-archives-bigger-than-2G.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-32360.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-4504.patch
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-43115.patch
create mode 100644 meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch
create mode 100644 meta/recipes-support/libpcre/libpcre2/CVE-2022-1586-regression.patch
--
2.34.1
next reply other threads:[~2023-10-10 14:14 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-10 14:14 Steve Sakoman [this message]
2023-10-10 14:14 ` [OE-core][dunfell 01/11] cups: Backport fix for CVE-2023-32360 and CVE-2023-4504 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 02/11] gawk: backport Debian patch to fix CVE-2023-4156 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 03/11] go: Update fix for CVE-2023-24538 & CVE-2023-39318 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 04/11] dbus: Backport fix for CVE-2023-34969 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 05/11] dbus: Add missing CVE_PRODUCT Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 06/11] xdg-utils: Fix CVE-2022-4055 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 07/11] libpcre2 : Follow up fix CVE-2022-1586 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 08/11] ghostscript: Backport fix CVE-2023-43115 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 09/11] busybox: Backport CVE-2022-48174 fix Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 10/11] openssl: Upgrade 1.1.1v -> 1.1.1w Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 11/11] cpio: Replace fix wrong CRC with ASCII CRC for large files with upstream backport Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-12-06 13:55 [OE-core][dunfell 00/11] Patch review Steve Sakoman
2023-06-08 2:35 Steve Sakoman
2023-05-20 16:04 Steve Sakoman
2022-11-12 14:09 Steve Sakoman
2022-08-18 16:56 Steve Sakoman
2022-08-10 22:31 Steve Sakoman
2022-06-02 2:30 Steve Sakoman
2022-04-16 19:14 Steve Sakoman
2022-01-20 21:23 Steve Sakoman
2022-01-13 14:37 Steve Sakoman
2021-04-08 16:31 Steve Sakoman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1696946306.git.steve@sakoman.com \
--to=steve@sakoman.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.