Re: [Buildroot] [PATCH 3/3] package/wpewebkit: bump to version 2.38.0

[Adrian Perez de Castro <aperez@igalia.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1390 bytes --]

Hello Thomas, all,

On Wed, 21 Sep 2022 20:18:54 +0200 Thomas Petazzoni <thomas.petazzoni@bootlin.com> wrote:
> Hello Adrian,
> 
> On Wed, 21 Sep 2022 02:00:29 +0300
> Adrian Perez de Castro <aperez@igalia.com> wrote:
> 
> > Update to a new major release which brings in improvements and a few
> > new features. Release notes:
> > 
> >   https://wpewebkit.org/release/wpewebkit-2.38.0.html
> > 
> > This release also includes security fixes for CVE-2022-32886,
> > CVE-2022-32891, and CVE-2022-32912. Accompanying security advisory:
> > 
> >   https://wpewebkit.org/security/WSA-2022-0009.html
> 
> According to this page, CVE-2022-32891 only affects versions up 2.36.5,
> and we're using 2.36.7 in Buildroot.
> 
> Also according to this page, the two other CVEs have been fixed in
> 2.36.8.
> 
> So, could you rework this patch series to:
> 
>  - Have a first patch "package/wpewebkit: security bump to version
>    2.36.8", which does bump to 2.36.8
> 
>  - Has the patches updating libwpe, wpebackend-fdo.
> 
>  - Has the patch updating wpewebkit to 2.38.0

Of course, no problem. I'll send an update in the next days.

> Indeed, we will want to backport the 2.36.8 bump to our stable branch,
> as it contains security fixes.

Makes sense. Allowing LTS/stable distros to pick the update more easily is
one of the reasons why I made one more 2.36.x with the fixes :)


Cheers,
—Adrián

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot