Re: [Buildroot] [PATCH 3/3] package/wpewebkit: bump to version 2.38.0

[Thomas Petazzoni <thomas.petazzoni@bootlin.com>]

Hello Adrian,

On Wed, 21 Sep 2022 02:00:29 +0300
Adrian Perez de Castro <aperez@igalia.com> wrote:

> Update to a new major release which brings in improvements and a few
> new features. Release notes:
> 
>   https://wpewebkit.org/release/wpewebkit-2.38.0.html
> 
> This release also includes security fixes for CVE-2022-32886,
> CVE-2022-32891, and CVE-2022-32912. Accompanying security advisory:
> 
>   https://wpewebkit.org/security/WSA-2022-0009.html

According to this page, CVE-2022-32891 only affects versions up 2.36.5,
and we're using 2.36.7 in Buildroot.

Also according to this page, the two other CVEs have been fixed in
2.36.8.

So, could you rework this patch series to:

 - Have a first patch "package/wpewebkit: security bump to version
   2.36.8", which does bump to 2.36.8

 - Has the patches updating libwpe, wpebackend-fdo.

 - Has the patch updating wpewebkit to 2.38.0

Indeed, we will want to backport the 2.36.8 bump to our stable branch,
as it contains security fixes.

Thanks a lot!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot