* [OE-core][dunfell 00/11] Patch review
@ 2021-04-08 16:31 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2021-04-08 16:31 UTC (permalink / raw)
To: openembedded-core
Please review this next set of patches for dunfell and have comments back by
end of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2031
except for a known autobuilder intermittent issue on qemuppc which passed on
subsequent retest:
https://autobuilder.yoctoproject.org/typhoon/#/builders/63/builds/3261
The following changes since commit d044d9c0cb672c499059eb273e399ce4aee17e0d:
image,populate_sdk_base: move 'func' flag setting for sdk command vars (2021-04-02 04:21:56 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (3):
selftest/reproducible: enable world reproducibility test
selftest/reproducible: add an exclusion list for items that are not
yet reproducible
selftest/reproducible: track unusued entries in the exclusion list
Guillaume Champagne (1):
image-live.bbclass: optional depends when ROOTFS empty
Mike Crowe (1):
curl: Patch CVE-2021-22876 & CVE-2021-22890
Peter Morrow (2):
goarch: map target os to windows for mingw* TARGET_OS
go_1.14: don't set -buildmode=pie when building for windows targets
Richard Purdie (3):
selftest/reproducible: Sort the unused exclusion list
diffoscope: Upgrade 136 -> 168
diffoscope: Upgrade 168 -> 172
Steve Sakoman (1):
selftest/reproducible: adjust exclusion list for dunfell
meta/classes/go.bbclass | 8 +-
meta/classes/goarch.bbclass | 2 +
meta/classes/image-live.bbclass | 2 +-
meta/lib/oeqa/selftest/cases/reproducible.py | 80 ++-
meta/recipes-devtools/go/go_1.14.bb | 8 +-
.../curl/curl/CVE-2021-22876.patch | 59 +++
.../curl/curl/CVE-2021-22890.patch | 464 ++++++++++++++++++
meta/recipes-support/curl/curl_7.69.1.bb | 2 +
.../{diffoscope_136.bb => diffoscope_172.bb} | 15 +-
9 files changed, 620 insertions(+), 20 deletions(-)
create mode 100644 meta/recipes-support/curl/curl/CVE-2021-22876.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2021-22890.patch
rename meta/recipes-support/diffoscope/{diffoscope_136.bb => diffoscope_172.bb} (46%)
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2022-01-13 14:37 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-01-13 14:37 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3112
The following changes since commit da3bd5e0934b6462ae53225a58305235849b32d5:
asciidoc: properly detect and compare Python versions >= 3.10 (2022-01-09 06:49:29 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Akash Hadke (1):
glibc: Add fix for data races in pthread_create and TLS access
Alexander Kanavin (1):
parselogs: add a couple systemd false positives
Anuj Mittal (1):
xserver-xorg: update CVE_PRODUCT
Konrad Weihmann (1):
cve-check: add lockfile to task
Mingli Yu (1):
wic: use shutil.which
Ricardo Ribalda Delgado (1):
wic: misc: Do not find for executables in ASSUME_PROVIDED
Richard Purdie (1):
expat: Update HOMEPAGE to current url
Ross Burton (2):
cve-update-db-native: use fetch task
xserver-xorg: whitelist two CVEs
Steve Sakoman (2):
valgrind: skip flakey ptest (gdbserver_tests/hginfo)
oeqa/selftest/cases/tinfoil.py: increase timeout 60->120s
test_wait_event
meta/classes/cve-check.bbclass | 3 +-
meta/lib/oeqa/runtime/cases/parselogs.py | 2 +
meta/lib/oeqa/selftest/cases/tinfoil.py | 4 +-
meta/recipes-core/expat/expat_2.2.9.bb | 2 +-
...ate-slotinfo-to-avoid-use-after-free.patch | 66 +++++
...hread_create-and-TLS-access-BZ-19329.patch | 191 ++++++++++++
...d-atomics-for-racy-accesses-BZ-19329.patch | 206 +++++++++++++
.../0033-elf-Add-test-case-for-BZ-19329.patch | 144 +++++++++
...elf-Fix-DTV-gap-reuse-logic-BZ-27135.patch | 180 ++++++++++++
...-lazy-relocation-of-tlsdesc-BZ-27137.patch | 56 ++++
...-lazy-relocation-of-tlsdesc-BZ-27137.patch | 124 ++++++++
...ock-between-pthread_create-and-ctors.patch | 276 ++++++++++++++++++
meta/recipes-core/glibc/glibc_2.31.bb | 8 +
.../recipes-core/meta/cve-update-db-native.bb | 9 +-
.../valgrind/valgrind/remove-for-aarch64 | 1 +
.../valgrind/valgrind/remove-for-all | 1 +
.../xorg-xserver/xserver-xorg.inc | 10 +-
scripts/lib/wic/engine.py | 6 +-
scripts/lib/wic/misc.py | 16 +-
scripts/wic | 4 +-
20 files changed, 1292 insertions(+), 17 deletions(-)
create mode 100644 meta/recipes-core/glibc/glibc/0030-elf-Refactor_dl_update-slotinfo-to-avoid-use-after-free.patch
create mode 100644 meta/recipes-core/glibc/glibc/0031-elf-Fix-data-races-in-pthread_create-and-TLS-access-BZ-19329.patch
create mode 100644 meta/recipes-core/glibc/glibc/0032-elf-Use-relaxed-atomics-for-racy-accesses-BZ-19329.patch
create mode 100644 meta/recipes-core/glibc/glibc/0033-elf-Add-test-case-for-BZ-19329.patch
create mode 100644 meta/recipes-core/glibc/glibc/0034-elf-Fix-DTV-gap-reuse-logic-BZ-27135.patch
create mode 100644 meta/recipes-core/glibc/glibc/0035-x86_64-Avoid-lazy-relocation-of-tlsdesc-BZ-27137.patch
create mode 100644 meta/recipes-core/glibc/glibc/0036-i386-Avoid-lazy-relocation-of-tlsdesc-BZ-27137.patch
create mode 100644 meta/recipes-core/glibc/glibc/0037-Avoid-deadlock-between-pthread_create-and-ctors.patch
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2022-01-20 21:23 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-01-20 21:23 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Monday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3141
The following changes since commit 01f256bc72fb45c80b6a6c77506bc4c375965a3a:
glibc: Add fix for data races in pthread_create and TLS access (2022-01-12 04:37:31 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Bruce Ashfield (5):
linux-yocto/5.4: update to v5.4.169
linux-yocto/5.4: update to v5.4.170
linux-yocto/5.4: update to v5.4.171
linux-yocto/5.4: update to v5.4.172
kernel: introduce python3-dtschema-wrapper
Kai Kang (1):
speex: fix CVE-2020-23903
Marek Vasut (1):
Revert "weston: Use systemd notify,"
Richard Purdie (1):
lttng-tools: Add missing DEPENDS on bison-native
Steve Sakoman (3):
expat fix CVE-2022-22822 through CVE-2022-22827
expat: fix CVE-2021-45960
expat: fix CVE-2021-46143
meta/conf/distro/include/maintainers.inc | 1 +
.../expat/expat/CVE-2021-45960.patch | 65 +++++
.../expat/expat/CVE-2021-46143.patch | 43 +++
.../expat/expat/CVE-2022-22822-27.patch | 257 ++++++++++++++++++
meta/recipes-core/expat/expat_2.2.9.bb | 3 +
.../wayland/weston-init/weston-start | 12 -
.../wayland/weston-init/weston@.service | 6 -
.../weston/systemd-notify.weston-start | 9 -
.../wayland/weston/xwayland.weston-start | 3 +-
meta/recipes-graphics/wayland/weston_8.0.0.bb | 6 -
.../python3-dtschema-wrapper/dt-doc-validate | 20 ++
.../dtc/python3-dtschema-wrapper/dt-mk-schema | 20 ++
.../dtc/python3-dtschema-wrapper/dt-validate | 20 ++
.../dtc/python3-dtschema-wrapper_2021.10.bb | 17 ++
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
.../lttng/lttng-tools_2.11.5.bb | 2 +-
.../speex/speex/CVE-2020-23903.patch | 30 ++
meta/recipes-multimedia/speex/speex_1.2.0.bb | 4 +-
20 files changed, 500 insertions(+), 54 deletions(-)
create mode 100644 meta/recipes-core/expat/expat/CVE-2021-45960.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2021-46143.patch
create mode 100644 meta/recipes-core/expat/expat/CVE-2022-22822-27.patch
delete mode 100644 meta/recipes-graphics/wayland/weston/systemd-notify.weston-start
create mode 100644 meta/recipes-kernel/dtc/python3-dtschema-wrapper/dt-doc-validate
create mode 100644 meta/recipes-kernel/dtc/python3-dtschema-wrapper/dt-mk-schema
create mode 100644 meta/recipes-kernel/dtc/python3-dtschema-wrapper/dt-validate
create mode 100644 meta/recipes-kernel/dtc/python3-dtschema-wrapper_2021.10.bb
create mode 100644 meta/recipes-multimedia/speex/speex/CVE-2020-23903.patch
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2022-04-16 19:14 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-04-16 19:14 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3537
with the exception of a known issue with meta-intel due to the zlib CVE fix, see:
https://lists.openembedded.org/g/openembedded-core/message/163793
The intent is to fix meta-intel after this patch set is merged to dunfell.
The following changes since commit aa762b7ca2417b80dd114a4ab263d69074912f82:
tzdata: update to 2022a (2022-04-04 04:22:32 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexandre Belloni (1):
pseudo: Fix handling of absolute links
Martin Jansa (1):
license_image.bbclass: close package.manifest file
Peter Kjellerstedt (1):
metadata_scm.bbclass: Use immediate expansion for the METADATA_*
variables
Ralph Siemsen (3):
gzip: fix CVE-2022-1271
xz: fix CVE-2022-1271
apt: add -fno-strict-aliasing to CXXFLAGS to fix SHA256 bug
Richard Purdie (4):
vim: Upgrade 8.2.4524 -> 8.2.4681
git: Ignore CVE-2022-24975
pseudo: Add patch to workaround paths with crazy lengths
libxshmfence: Correct LICENSE to HPND
Ross Burton (1):
zlib: backport the fix for CVE-2018-25032
.../recipeutils/recipeutils-test_1.2.bb | 2 +-
meta/classes/license_image.bbclass | 4 +-
meta/classes/metadata_scm.bbclass | 10 +-
.../zlib/zlib/CVE-2018-25032.patch | 347 ++++++++++++++++++
meta/recipes-core/zlib/zlib_1.2.11.bb | 1 +
meta/recipes-devtools/apt/apt.inc | 4 +
meta/recipes-devtools/git/git.inc | 5 +
meta/recipes-devtools/pseudo/pseudo_git.bb | 2 +-
.../gzip/gzip-1.10/CVE-2022-1271.patch | 45 +++
meta/recipes-extended/gzip/gzip_1.10.bb | 1 +
.../xz/xz/CVE-2022-1271.patch | 96 +++++
meta/recipes-extended/xz/xz_5.2.4.bb | 4 +-
.../xorg-lib/libxshmfence_1.3.bb | 2 +-
meta/recipes-support/vim/vim.inc | 6 +-
14 files changed, 515 insertions(+), 14 deletions(-)
create mode 100644 meta/recipes-core/zlib/zlib/CVE-2018-25032.patch
create mode 100644 meta/recipes-extended/gzip/gzip-1.10/CVE-2022-1271.patch
create mode 100644 meta/recipes-extended/xz/xz/CVE-2022-1271.patch
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2022-06-02 2:30 Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 01/11] ruby: Upgrade ruby to 2.7.6 for security fix Steve Sakoman
` (10 more replies)
0 siblings, 11 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/3738
The following changes since commit add860e1a69f848097bbc511137a62d5746e5019:
oeqa/selftest/cve_check: add tests for recipe and image reports (2022-05-24 04:31:18 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Dan Tran (1):
ncurses: Fix CVE-2022-29458
Ernst Sjöstrand (2):
cve-check: Add helper for symlink handling
cve-check: Only include installed packages for rootfs manifest
Ranjitsinh Rathod (3):
ruby: Upgrade ruby to 2.7.6 for security fix
ruby: Whitelist CVE-2021-28966 as this affects Windows OS only
libsdl2: Add fix for CVE-2021-33657
Richard Purdie (2):
vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs
cve-check: Allow warnings to be disabled
Riyaz (1):
libxml2: Fix CVE-2022-29824 for libxml2
Virendra Thakur (1):
ffmpeg: Fix for CVE-2022-1475
leimaohui (1):
cve-check.bbclass: Added do_populate_sdk[recrdeptask].
meta/classes/cve-check.bbclass | 109 ++++--
.../libxml2/CVE-2022-29824-dependent.patch | 53 +++
.../libxml/libxml2/CVE-2022-29824.patch | 348 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 2 +
.../ncurses/files/CVE-2022-29458.patch | 135 +++++++
meta/recipes-core/ncurses/ncurses_6.2.bb | 1 +
.../ruby/{ruby_2.7.5.bb => ruby_2.7.6.bb} | 8 +-
.../libsdl2/libsdl2/CVE-2021-33657.patch | 38 ++
.../libsdl2/libsdl2_2.0.12.bb | 1 +
.../ffmpeg/ffmpeg/CVE-2022-1475.patch | 36 ++
.../recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb | 1 +
meta/recipes-support/vim/vim.inc | 4 +-
12 files changed, 694 insertions(+), 42 deletions(-)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2022-29824.patch
create mode 100644 meta/recipes-core/ncurses/files/CVE-2022-29458.patch
rename meta/recipes-devtools/ruby/{ruby_2.7.5.bb => ruby_2.7.6.bb} (90%)
create mode 100644 meta/recipes-graphics/libsdl2/libsdl2/CVE-2021-33657.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-1475.patch
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 01/11] ruby: Upgrade ruby to 2.7.6 for security fix
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 02/11] ruby: Whitelist CVE-2021-28966 as this affects Windows OS only Steve Sakoman
` (9 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Upgrade ruby to 2.7.6
Link: https://www.ruby-lang.org/en/news/2022/04/12/ruby-2-7-6-released/
This includes CVE-2022-28739 security fix
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/ruby/{ruby_2.7.5.bb => ruby_2.7.6.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-devtools/ruby/{ruby_2.7.5.bb => ruby_2.7.6.bb} (95%)
diff --git a/meta/recipes-devtools/ruby/ruby_2.7.5.bb b/meta/recipes-devtools/ruby/ruby_2.7.6.bb
similarity index 95%
rename from meta/recipes-devtools/ruby/ruby_2.7.5.bb
rename to meta/recipes-devtools/ruby/ruby_2.7.6.bb
index 44a2527ee7..658a17659a 100644
--- a/meta/recipes-devtools/ruby/ruby_2.7.5.bb
+++ b/meta/recipes-devtools/ruby/ruby_2.7.6.bb
@@ -9,8 +9,8 @@ SRC_URI += " \
file://0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch \
"
-SRC_URI[md5sum] = "ede247b56fb862f1f67f9471189b04d4"
-SRC_URI[sha256sum] = "2755b900a21235b443bb16dadd9032f784d4a88f143d852bc5d154f22b8781f1"
+SRC_URI[md5sum] = "f972fb0cce662966bec10d5c5f32d042"
+SRC_URI[sha256sum] = "e7203b0cc09442ed2c08936d483f8ac140ec1c72e37bb5c401646b7866cb5d10"
PACKAGECONFIG ??= ""
PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 02/11] ruby: Whitelist CVE-2021-28966 as this affects Windows OS only
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 01/11] ruby: Upgrade ruby to 2.7.6 for security fix Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 03/11] libsdl2: Add fix for CVE-2021-33657 Steve Sakoman
` (8 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
As per below debian link, CVE-2021-28966 affects Windows only
Link: https://security-tracker.debian.org/tracker/CVE-2021-28966
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/ruby/ruby_2.7.6.bb | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/meta/recipes-devtools/ruby/ruby_2.7.6.bb b/meta/recipes-devtools/ruby/ruby_2.7.6.bb
index 658a17659a..3af321a83e 100644
--- a/meta/recipes-devtools/ruby/ruby_2.7.6.bb
+++ b/meta/recipes-devtools/ruby/ruby_2.7.6.bb
@@ -12,6 +12,10 @@ SRC_URI += " \
SRC_URI[md5sum] = "f972fb0cce662966bec10d5c5f32d042"
SRC_URI[sha256sum] = "e7203b0cc09442ed2c08936d483f8ac140ec1c72e37bb5c401646b7866cb5d10"
+# CVE-2021-28966 is Windows specific and not affects Linux OS
+# https://security-tracker.debian.org/tracker/CVE-2021-28966
+CVE_CHECK_WHITELIST += "CVE-2021-28966"
+
PACKAGECONFIG ??= ""
PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 03/11] libsdl2: Add fix for CVE-2021-33657
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 01/11] ruby: Upgrade ruby to 2.7.6 for security fix Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 02/11] ruby: Whitelist CVE-2021-28966 as this affects Windows OS only Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 04/11] ffmpeg: Fix for CVE-2022-1475 Steve Sakoman
` (7 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Add patch to fix CVE-2021-33657 issue for libsdl2
Link: https://security-tracker.debian.org/tracker/CVE-2021-33657
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libsdl2/libsdl2/CVE-2021-33657.patch | 38 +++++++++++++++++++
.../libsdl2/libsdl2_2.0.12.bb | 1 +
2 files changed, 39 insertions(+)
create mode 100644 meta/recipes-graphics/libsdl2/libsdl2/CVE-2021-33657.patch
diff --git a/meta/recipes-graphics/libsdl2/libsdl2/CVE-2021-33657.patch b/meta/recipes-graphics/libsdl2/libsdl2/CVE-2021-33657.patch
new file mode 100644
index 0000000000..a4ed7ab8e6
--- /dev/null
+++ b/meta/recipes-graphics/libsdl2/libsdl2/CVE-2021-33657.patch
@@ -0,0 +1,38 @@
+From 8c91cf7dba5193f5ce12d06db1336515851c9ee9 Mon Sep 17 00:00:00 2001
+From: Sam Lantinga <slouken@libsdl.org>
+Date: Tue, 30 Nov 2021 12:36:46 -0800
+Subject: [PATCH] Always create a full 256-entry map in case color values are
+ out of range
+
+Fixes https://github.com/libsdl-org/SDL/issues/5042
+
+CVE: CVE-2021-33657
+Upstream-Status: Backport [https://github.com/libsdl-org/SDL/commit/8c91cf7dba5193f5ce12d06db1336515851c9ee9.patch]
+Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
+
+---
+ src/video/SDL_pixels.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/video/SDL_pixels.c b/src/video/SDL_pixels.c
+index ac04533c5d5..9bb02f771d0 100644
+--- a/src/video/SDL_pixels.c
++++ b/src/video/SDL_pixels.c
+@@ -947,7 +947,7 @@ Map1to1(SDL_Palette * src, SDL_Palette * dst, int *identical)
+ }
+ *identical = 0;
+ }
+- map = (Uint8 *) SDL_malloc(src->ncolors);
++ map = (Uint8 *) SDL_calloc(256, sizeof(Uint8));
+ if (map == NULL) {
+ SDL_OutOfMemory();
+ return (NULL);
+@@ -971,7 +971,7 @@ Map1toN(SDL_PixelFormat * src, Uint8 Rmod, Uint8 Gmod, Uint8 Bmod, Uint8 Amod,
+ SDL_Palette *pal = src->palette;
+
+ bpp = ((dst->BytesPerPixel == 3) ? 4 : dst->BytesPerPixel);
+- map = (Uint8 *) SDL_malloc(pal->ncolors * bpp);
++ map = (Uint8 *) SDL_calloc(256, bpp);
+ if (map == NULL) {
+ SDL_OutOfMemory();
+ return (NULL);
diff --git a/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb b/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb
index 8e77c18f2d..44d36fca22 100644
--- a/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb
+++ b/meta/recipes-graphics/libsdl2/libsdl2_2.0.12.bb
@@ -21,6 +21,7 @@ SRC_URI = "http://www.libsdl.org/release/SDL2-${PV}.tar.gz \
file://directfb-spurious-curly-brace-missing-e.patch \
file://directfb-renderfillrect-fix.patch \
file://CVE-2020-14409-14410.patch \
+ file://CVE-2021-33657.patch \
"
S = "${WORKDIR}/SDL2-${PV}"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 04/11] ffmpeg: Fix for CVE-2022-1475
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (2 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 03/11] libsdl2: Add fix for CVE-2021-33657 Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 05/11] ncurses: Fix CVE-2022-29458 Steve Sakoman
` (6 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Virendra Thakur <virendra.thakur@kpit.com>
Add patch to fix CVE-2022-1475
Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ffmpeg/ffmpeg/CVE-2022-1475.patch | 36 +++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb | 1 +
2 files changed, 37 insertions(+)
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-1475.patch
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-1475.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-1475.patch
new file mode 100644
index 0000000000..bd8a08a216
--- /dev/null
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-1475.patch
@@ -0,0 +1,36 @@
+From: Michael Niedermayer <michael@niedermayer.cc>
+Date: Sun, 27 Feb 2022 14:43:04 +0100
+Subject: [PATCH] avcodec/g729_parser: Check channels
+
+Fixes: signed integer overflow: 10 * 808464428 cannot be represented in type 'int'
+Fixes: assertion failure
+Fixes: ticket9651
+
+Reviewed-by: Paul B Mahol <onemda@gmail.com>
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+(cherry picked from commit 757da974b21833529cc41bdcc9684c29660cdfa8)
+Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
+
+CVE: CVE-2022-1475
+Upstream-Status: Backport [https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e9e2ddbc6c78cc18b76093617f82c920e58a8d1f]
+Comment: Patch is refreshed as per ffmpeg codebase
+Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
+
+---
+ libavcodec/g729_parser.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+Index: ffmpeg-4.2.2/libavcodec/g729_parser.c
+===================================================================
+--- a/libavcodec/g729_parser.c
++++ b/libavcodec/g729_parser.c
+@@ -48,6 +48,9 @@ static int g729_parse(AVCodecParserConte
+ av_assert1(avctx->codec_id == AV_CODEC_ID_G729);
+ /* FIXME: replace this heuristic block_size with more precise estimate */
+ s->block_size = (avctx->bit_rate < 8000) ? G729D_6K4_BLOCK_SIZE : G729_8K_BLOCK_SIZE;
++ // channels > 2 is invalid, we pass the packet on unchanged
++ if (avctx->channels > 2)
++ s->block_size = 0;
+ s->block_size *= avctx->channels;
+ s->duration = avctx->frame_size;
+ }
diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb
index 1d6f2e528b..cbfdbf0563 100644
--- a/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb
+++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb
@@ -29,6 +29,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \
file://0001-libavutil-include-assembly-with-full-path-from-sourc.patch \
file://CVE-2021-3566.patch \
file://CVE-2021-38291.patch \
+ file://CVE-2022-1475.patch \
"
SRC_URI[md5sum] = "348956fc2faa57a2f79bbb84ded9fbc3"
SRC_URI[sha256sum] = "cb754255ab0ee2ea5f66f8850e1bd6ad5cac1cd855d0a2f4990fb8c668b0d29c"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 05/11] ncurses: Fix CVE-2022-29458
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (3 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 04/11] ffmpeg: Fix for CVE-2022-1475 Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 06/11] libxml2: Fix CVE-2022-29824 for libxml2 Steve Sakoman
` (5 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Dan Tran <MSFT.DanTran@gmail.com>
ncurses 6.3 before patch 20220416 has an out-of-bounds read and
segmentation violation in convert_strings in tinfo/read_entry.c in the
terminfo library.
Backported from the link below, extracting only the relevant changes.
https://github.com/ThomasDickey/ncurses-snapshots/commit/9d1d651878d4bf0695872a64cc65ba0acb825f36
Signed-off-by: Gustavo Lima Chaves <gustavo.chaves@microsoft.com>
Signed-off-by: Dan Tran <dantran@microsoft.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../ncurses/files/CVE-2022-29458.patch | 135 ++++++++++++++++++
meta/recipes-core/ncurses/ncurses_6.2.bb | 1 +
2 files changed, 136 insertions(+)
create mode 100644 meta/recipes-core/ncurses/files/CVE-2022-29458.patch
diff --git a/meta/recipes-core/ncurses/files/CVE-2022-29458.patch b/meta/recipes-core/ncurses/files/CVE-2022-29458.patch
new file mode 100644
index 0000000000..eb1b7c96f9
--- /dev/null
+++ b/meta/recipes-core/ncurses/files/CVE-2022-29458.patch
@@ -0,0 +1,135 @@
+From 5f40697e37e195069f55528fc7a1d77e619ad104 Mon Sep 17 00:00:00 2001
+From: Dan Tran <dantran@microsoft.com>
+Date: Fri, 13 May 2022 13:28:41 -0700
+Subject: [PATCH] ncurses 6.3 before patch 20220416 has an out-of-bounds read
+ and segmentation violation in convert_strings in tinfo/read_entry.c in the
+ terminfo library.
+
+CVE: CVE-2022-29458
+Upstream-Status: Backport
+[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009870]
+
+Signed-off-by: Gustavo Lima Chaves <gustavo.chaves@microsoft.com>
+Signed-off-by: Dan Tran <dantran@microsoft.com>
+---
+ ncurses/tinfo/alloc_entry.c | 14 ++++++--------
+ ncurses/tinfo/read_entry.c | 25 +++++++++++++++++++------
+ 2 files changed, 25 insertions(+), 14 deletions(-)
+
+diff --git a/ncurses/tinfo/alloc_entry.c b/ncurses/tinfo/alloc_entry.c
+index 4bf7d6c8..b49ad6aa 100644
+--- a/ncurses/tinfo/alloc_entry.c
++++ b/ncurses/tinfo/alloc_entry.c
+@@ -48,13 +48,11 @@
+
+ #include <tic.h>
+
+-MODULE_ID("$Id: alloc_entry.c,v 1.64 2020/02/02 23:34:34 tom Exp $")
++MODULE_ID("$Id: alloc_entry.c,v 1.69 2022/04/16 22:46:53 tom Exp $")
+
+ #define ABSENT_OFFSET -1
+ #define CANCELLED_OFFSET -2
+
+-#define MAX_STRTAB 4096 /* documented maximum entry size */
+-
+ static char *stringbuf; /* buffer for string capabilities */
+ static size_t next_free; /* next free character in stringbuf */
+
+@@ -71,8 +69,8 @@ _nc_init_entry(ENTRY * const tp)
+ }
+ #endif
+
+- if (stringbuf == 0)
+- TYPE_MALLOC(char, (size_t) MAX_STRTAB, stringbuf);
++ if (stringbuf == NULL)
++ TYPE_MALLOC(char, (size_t) MAX_ENTRY_SIZE, stringbuf);
+
+ next_free = 0;
+
+@@ -108,11 +106,11 @@ _nc_save_str(const char *const string)
+ * Cheat a little by making an empty string point to the end of the
+ * previous string.
+ */
+- if (next_free < MAX_STRTAB) {
++ if (next_free < MAX_ENTRY_SIZE) {
+ result = (stringbuf + next_free - 1);
+ }
+- } else if (next_free + len < MAX_STRTAB) {
+- _nc_STRCPY(&stringbuf[next_free], string, MAX_STRTAB);
++ } else if (next_free + len < MAX_ENTRY_SIZE) {
++ _nc_STRCPY(&stringbuf[next_free], string, MAX_ENTRY_SIZE);
+ DEBUG(7, ("Saved string %s", _nc_visbuf(string)));
+ DEBUG(7, ("at location %d", (int) next_free));
+ next_free += len;
+diff --git a/ncurses/tinfo/read_entry.c b/ncurses/tinfo/read_entry.c
+index 5b570b0f..23c2cebc 100644
+--- a/ncurses/tinfo/read_entry.c
++++ b/ncurses/tinfo/read_entry.c
+@@ -1,5 +1,5 @@
+ /****************************************************************************
+- * Copyright 2018-2019,2020 Thomas E. Dickey *
++ * Copyright 2018-2021,2022 Thomas E. Dickey *
+ * Copyright 1998-2016,2017 Free Software Foundation, Inc. *
+ * *
+ * Permission is hereby granted, free of charge, to any person obtaining a *
+@@ -42,7 +42,7 @@
+
+ #include <tic.h>
+
+-MODULE_ID("$Id: read_entry.c,v 1.157 2020/02/02 23:34:34 tom Exp $")
++MODULE_ID("$Id: read_entry.c,v 1.162 2022/04/16 21:00:00 tom Exp $")
+
+ #define TYPE_CALLOC(type,elts) typeCalloc(type, (unsigned)(elts))
+
+@@ -145,6 +145,7 @@ convert_strings(char *buf, char **Strings, int count, int size, char *table)
+ {
+ int i;
+ char *p;
++ bool corrupt = FALSE;
+
+ for (i = 0; i < count; i++) {
+ if (IS_NEG1(buf + 2 * i)) {
+@@ -154,8 +155,20 @@ convert_strings(char *buf, char **Strings, int count, int size, char *table)
+ } else if (MyNumber(buf + 2 * i) > size) {
+ Strings[i] = ABSENT_STRING;
+ } else {
+- Strings[i] = (MyNumber(buf + 2 * i) + table);
+- TR(TRACE_DATABASE, ("Strings[%d] = %s", i, _nc_visbuf(Strings[i])));
++ int nn = MyNumber(buf + 2 * i);
++ if (nn >= 0 && nn < size) {
++ Strings[i] = (nn + table);
++ TR(TRACE_DATABASE, ("Strings[%d] = %s", i,
++ _nc_visbuf(Strings[i])));
++ } else {
++ if (!corrupt) {
++ corrupt = TRUE;
++ TR(TRACE_DATABASE,
++ ("ignore out-of-range index %d to Strings[]", nn));
++ _nc_warning("corrupt data found in convert_strings");
++ }
++ Strings[i] = ABSENT_STRING;
++ }
+ }
+
+ /* make sure all strings are NUL terminated */
+@@ -776,7 +789,7 @@ _nc_read_tic_entry(char *filename,
+ * looking for compiled (binary) terminfo data.
+ *
+ * cgetent uses a two-level lookup. On the first it uses the given
+- * name to return a record containing only the aliases for an entry.
++ * name to return a record containing only the aliases for an entry.
+ * On the second (using that list of aliases as a key), it returns the
+ * content of the terminal description. We expect second lookup to
+ * return data beginning with the same set of aliases.
+@@ -833,7 +846,7 @@ _nc_read_tic_entry(char *filename,
+ #endif /* NCURSES_USE_DATABASE */
+
+ /*
+- * Find and read the compiled entry for a given terminal type, if it exists.
++ * Find and read the compiled entry for a given terminal type, if it exists.
+ * We take pains here to make sure no combination of environment variables and
+ * terminal type name can be used to overrun the file buffer.
+ */
+--
+2.36.1
+
diff --git a/meta/recipes-core/ncurses/ncurses_6.2.bb b/meta/recipes-core/ncurses/ncurses_6.2.bb
index 700464f70b..451bfbcb5d 100644
--- a/meta/recipes-core/ncurses/ncurses_6.2.bb
+++ b/meta/recipes-core/ncurses/ncurses_6.2.bb
@@ -4,6 +4,7 @@ SRC_URI += "file://0001-tic-hang.patch \
file://0002-configure-reproducible.patch \
file://0003-gen-pkgconfig.in-Do-not-include-LDFLAGS-in-generated.patch \
file://CVE-2021-39537.patch \
+ file://CVE-2022-29458.patch \
"
# commit id corresponds to the revision in package version
SRCREV = "a669013cd5e9d6434e5301348ea51baf306c93c4"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 06/11] libxml2: Fix CVE-2022-29824 for libxml2
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (4 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 05/11] ncurses: Fix CVE-2022-29458 Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 07/11] vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs Steve Sakoman
` (4 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Riyaz <Riyaz.Khan@kpit.com>
Add patch for CVE issue: CVE-2022-29824
CVE-2022-29824
Link: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab]
Dependent patch: [https://gitlab.gnome.org/GNOME/libxml2/-/commit/b07251215ef48c70c6e56f7351406c47cfca4d5b]
Signed-off-by: Riyaz <Riyaz.Khan@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libxml2/CVE-2022-29824-dependent.patch | 53 +++
.../libxml/libxml2/CVE-2022-29824.patch | 348 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 2 +
3 files changed, 403 insertions(+)
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch
create mode 100644 meta/recipes-core/libxml/libxml2/CVE-2022-29824.patch
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch b/meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch
new file mode 100644
index 0000000000..63d613cc21
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2022-29824-dependent.patch
@@ -0,0 +1,53 @@
+From b07251215ef48c70c6e56f7351406c47cfca4d5b Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Fri, 10 Jan 2020 15:55:07 +0100
+Subject: [PATCH] Fix integer overflow in xmlBufferResize
+
+Found by OSS-Fuzz.
+
+CVE: CVE-2022-29824
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/b07251215ef48c70c6e56f7351406c47cfca4d5b]
+
+Signed-off-by: Riyaz Ahmed Khan <Riyaz.Khan@kpit.com>
+
+---
+ tree.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/tree.c b/tree.c
+index 0d7fc98c..f43f6de1 100644
+--- a/tree.c
++++ b/tree.c
+@@ -7424,12 +7424,17 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+ if (size < buf->size)
+ return 1;
+
++ if (size > UINT_MAX - 10) {
++ xmlTreeErrMemory("growing buffer");
++ return 0;
++ }
++
+ /* figure out new size */
+ switch (buf->alloc){
+ case XML_BUFFER_ALLOC_IO:
+ case XML_BUFFER_ALLOC_DOUBLEIT:
+ /*take care of empty case*/
+- newSize = (buf->size ? buf->size*2 : size + 10);
++ newSize = (buf->size ? buf->size : size + 10);
+ while (size > newSize) {
+ if (newSize > UINT_MAX / 2) {
+ xmlTreeErrMemory("growing buffer");
+@@ -7445,7 +7450,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+ if (buf->use < BASE_BUFFER_SIZE)
+ newSize = size;
+ else {
+- newSize = buf->size * 2;
++ newSize = buf->size;
+ while (size > newSize) {
+ if (newSize > UINT_MAX / 2) {
+ xmlTreeErrMemory("growing buffer");
+--
+GitLab
+
+
diff --git a/meta/recipes-core/libxml/libxml2/CVE-2022-29824.patch b/meta/recipes-core/libxml/libxml2/CVE-2022-29824.patch
new file mode 100644
index 0000000000..ad7b87dbc6
--- /dev/null
+++ b/meta/recipes-core/libxml/libxml2/CVE-2022-29824.patch
@@ -0,0 +1,348 @@
+From 2554a2408e09f13652049e5ffb0d26196b02ebab Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnhofer@aevum.de>
+Date: Tue, 8 Mar 2022 20:10:02 +0100
+Subject: [PATCH] [CVE-2022-29824] Fix integer overflows in xmlBuf and
+ xmlBuffer
+
+In several places, the code handling string buffers didn't check for
+integer overflow or used wrong types for buffer sizes. This could
+result in out-of-bounds writes or other memory errors when working on
+large, multi-gigabyte buffers.
+
+Thanks to Felix Wilhelm for the report.
+
+CVE: CVE-2022-29824
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a2408e09f13652049e5ffb0d26196b02ebab]
+
+Signed-off-by: Riyaz Ahmed Khan <Riyaz.Khan@kpit.com>
+
+---
+ buf.c | 86 +++++++++++++++++++++++-----------------------------------
+ tree.c | 72 ++++++++++++++++++------------------------------
+ 2 files changed, 61 insertions(+), 97 deletions(-)
+
+diff --git a/buf.c b/buf.c
+index 24368d37..40a5ee06 100644
+--- a/buf.c
++++ b/buf.c
+@@ -30,6 +30,10 @@
+ #include <libxml/parserInternals.h> /* for XML_MAX_TEXT_LENGTH */
+ #include "buf.h"
+
++#ifndef SIZE_MAX
++#define SIZE_MAX ((size_t) -1)
++#endif
++
+ #define WITH_BUFFER_COMPAT
+
+ /**
+@@ -156,6 +160,8 @@ xmlBufPtr
+ xmlBufCreateSize(size_t size) {
+ xmlBufPtr ret;
+
++ if (size == SIZE_MAX)
++ return(NULL);
+ ret = (xmlBufPtr) xmlMalloc(sizeof(xmlBuf));
+ if (ret == NULL) {
+ xmlBufMemoryError(NULL, "creating buffer");
+@@ -166,8 +172,8 @@ xmlBufCreateSize(size_t size) {
+ ret->error = 0;
+ ret->buffer = NULL;
+ ret->alloc = xmlBufferAllocScheme;
+- ret->size = (size ? size+2 : 0); /* +1 for ending null */
+- ret->compat_size = (int) ret->size;
++ ret->size = (size ? size + 1 : 0); /* +1 for ending null */
++ ret->compat_size = (ret->size > INT_MAX ? INT_MAX : ret->size);
+ if (ret->size){
+ ret->content = (xmlChar *) xmlMallocAtomic(ret->size * sizeof(xmlChar));
+ if (ret->content == NULL) {
+@@ -442,23 +448,17 @@ xmlBufGrowInternal(xmlBufPtr buf, size_t len) {
+ CHECK_COMPAT(buf)
+
+ if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0);
+- if (buf->use + len < buf->size)
++ if (len < buf->size - buf->use)
+ return(buf->size - buf->use);
++ if (len > SIZE_MAX - buf->use)
++ return(0);
+
+- /*
+- * Windows has a BIG problem on realloc timing, so we try to double
+- * the buffer size (if that's enough) (bug 146697)
+- * Apparently BSD too, and it's probably best for linux too
+- * On an embedded system this may be something to change
+- */
+-#if 1
+- if (buf->size > (size_t) len)
+- size = buf->size * 2;
+- else
+- size = buf->use + len + 100;
+-#else
+- size = buf->use + len + 100;
+-#endif
++ if (buf->size > (size_t) len) {
++ size = buf->size > SIZE_MAX / 2 ? SIZE_MAX : buf->size * 2;
++ } else {
++ size = buf->use + len;
++ size = size > SIZE_MAX - 100 ? SIZE_MAX : size + 100;
++ }
+
+ if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+ /*
+@@ -744,7 +744,7 @@ xmlBufIsEmpty(const xmlBufPtr buf)
+ int
+ xmlBufResize(xmlBufPtr buf, size_t size)
+ {
+- unsigned int newSize;
++ size_t newSize;
+ xmlChar* rebuf = NULL;
+ size_t start_buf;
+
+@@ -772,9 +772,13 @@ xmlBufResize(xmlBufPtr buf, size_t size)
+ case XML_BUFFER_ALLOC_IO:
+ case XML_BUFFER_ALLOC_DOUBLEIT:
+ /*take care of empty case*/
+- newSize = (buf->size ? buf->size*2 : size + 10);
++ if (buf->size == 0) {
++ newSize = (size > SIZE_MAX - 10 ? SIZE_MAX : size + 10);
++ } else {
++ newSize = buf->size;
++ }
+ while (size > newSize) {
+- if (newSize > UINT_MAX / 2) {
++ if (newSize > SIZE_MAX / 2) {
+ xmlBufMemoryError(buf, "growing buffer");
+ return 0;
+ }
+@@ -782,15 +786,15 @@ xmlBufResize(xmlBufPtr buf, size_t size)
+ }
+ break;
+ case XML_BUFFER_ALLOC_EXACT:
+- newSize = size+10;
++ newSize = (size > SIZE_MAX - 10 ? SIZE_MAX : size + 10);
+ break;
+ case XML_BUFFER_ALLOC_HYBRID:
+ if (buf->use < BASE_BUFFER_SIZE)
+ newSize = size;
+ else {
+- newSize = buf->size * 2;
++ newSize = buf->size;
+ while (size > newSize) {
+- if (newSize > UINT_MAX / 2) {
++ if (newSize > SIZE_MAX / 2) {
+ xmlBufMemoryError(buf, "growing buffer");
+ return 0;
+ }
+@@ -800,7 +804,7 @@ xmlBufResize(xmlBufPtr buf, size_t size)
+ break;
+
+ default:
+- newSize = size+10;
++ newSize = (size > SIZE_MAX - 10 ? SIZE_MAX : size + 10);
+ break;
+ }
+
+@@ -866,7 +870,7 @@ xmlBufResize(xmlBufPtr buf, size_t size)
+ */
+ int
+ xmlBufAdd(xmlBufPtr buf, const xmlChar *str, int len) {
+- unsigned int needSize;
++ size_t needSize;
+
+ if ((str == NULL) || (buf == NULL) || (buf->error))
+ return -1;
+@@ -888,8 +892,10 @@ xmlBufAdd(xmlBufPtr buf, const xmlChar *str, int len) {
+ if (len < 0) return -1;
+ if (len == 0) return 0;
+
+- needSize = buf->use + len + 2;
+- if (needSize > buf->size){
++ if ((size_t) len >= buf->size - buf->use) {
++ if ((size_t) len >= SIZE_MAX - buf->use)
++ return(-1);
++ needSize = buf->use + len + 1;
+ if (buf->alloc == XML_BUFFER_ALLOC_BOUNDED) {
+ /*
+ * Used to provide parsing limits
+@@ -1025,31 +1031,7 @@ xmlBufCat(xmlBufPtr buf, const xmlChar *str) {
+ */
+ int
+ xmlBufCCat(xmlBufPtr buf, const char *str) {
+- const char *cur;
+-
+- if ((buf == NULL) || (buf->error))
+- return(-1);
+- CHECK_COMPAT(buf)
+- if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return -1;
+- if (str == NULL) {
+-#ifdef DEBUG_BUFFER
+- xmlGenericError(xmlGenericErrorContext,
+- "xmlBufCCat: str == NULL\n");
+-#endif
+- return -1;
+- }
+- for (cur = str;*cur != 0;cur++) {
+- if (buf->use + 10 >= buf->size) {
+- if (!xmlBufResize(buf, buf->use+10)){
+- xmlBufMemoryError(buf, "growing buffer");
+- return XML_ERR_NO_MEMORY;
+- }
+- }
+- buf->content[buf->use++] = *cur;
+- }
+- buf->content[buf->use] = 0;
+- UPDATE_COMPAT(buf)
+- return 0;
++ return xmlBufCat(buf, (const xmlChar *) str);
+ }
+
+ /**
+diff --git a/tree.c b/tree.c
+index 9d94aa42..86afb7d6 100644
+--- a/tree.c
++++ b/tree.c
+@@ -7104,6 +7104,8 @@ xmlBufferPtr
+ xmlBufferCreateSize(size_t size) {
+ xmlBufferPtr ret;
+
++ if (size >= UINT_MAX)
++ return(NULL);
+ ret = (xmlBufferPtr) xmlMalloc(sizeof(xmlBuffer));
+ if (ret == NULL) {
+ xmlTreeErrMemory("creating buffer");
+@@ -7111,7 +7113,7 @@ xmlBufferCreateSize(size_t size) {
+ }
+ ret->use = 0;
+ ret->alloc = xmlBufferAllocScheme;
+- ret->size = (size ? size+2 : 0); /* +1 for ending null */
++ ret->size = (size ? size + 1 : 0); /* +1 for ending null */
+ if (ret->size){
+ ret->content = (xmlChar *) xmlMallocAtomic(ret->size * sizeof(xmlChar));
+ if (ret->content == NULL) {
+@@ -7171,6 +7173,8 @@ xmlBufferCreateStatic(void *mem, size_t size) {
+
+ if ((mem == NULL) || (size == 0))
+ return(NULL);
++ if (size > UINT_MAX)
++ return(NULL);
+
+ ret = (xmlBufferPtr) xmlMalloc(sizeof(xmlBuffer));
+ if (ret == NULL) {
+@@ -7318,28 +7322,23 @@ xmlBufferShrink(xmlBufferPtr buf, unsigned int len) {
+ */
+ int
+ xmlBufferGrow(xmlBufferPtr buf, unsigned int len) {
+- int size;
++ unsigned int size;
+ xmlChar *newbuf;
+
+ if (buf == NULL) return(-1);
+
+ if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return(0);
+- if (len + buf->use < buf->size) return(0);
++ if (len < buf->size - buf->use)
++ return(0);
++ if (len > UINT_MAX - buf->use)
++ return(-1);
+
+- /*
+- * Windows has a BIG problem on realloc timing, so we try to double
+- * the buffer size (if that's enough) (bug 146697)
+- * Apparently BSD too, and it's probably best for linux too
+- * On an embedded system this may be something to change
+- */
+-#if 1
+- if (buf->size > len)
+- size = buf->size * 2;
+- else
+- size = buf->use + len + 100;
+-#else
+- size = buf->use + len + 100;
+-#endif
++ if (buf->size > (size_t) len) {
++ size = buf->size > UINT_MAX / 2 ? UINT_MAX : buf->size * 2;
++ } else {
++ size = buf->use + len;
++ size = size > UINT_MAX - 100 ? UINT_MAX : size + 100;
++ }
+
+ if ((buf->alloc == XML_BUFFER_ALLOC_IO) && (buf->contentIO != NULL)) {
+ size_t start_buf = buf->content - buf->contentIO;
+@@ -7466,7 +7465,10 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+ case XML_BUFFER_ALLOC_IO:
+ case XML_BUFFER_ALLOC_DOUBLEIT:
+ /*take care of empty case*/
+- newSize = (buf->size ? buf->size : size + 10);
++ if (buf->size == 0)
++ newSize = (size > UINT_MAX - 10 ? UINT_MAX : size + 10);
++ else
++ newSize = buf->size;
+ while (size > newSize) {
+ if (newSize > UINT_MAX / 2) {
+ xmlTreeErrMemory("growing buffer");
+@@ -7476,7 +7478,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+ }
+ break;
+ case XML_BUFFER_ALLOC_EXACT:
+- newSize = size+10;
++ newSize = (size > UINT_MAX - 10 ? UINT_MAX : size + 10);;
+ break;
+ case XML_BUFFER_ALLOC_HYBRID:
+ if (buf->use < BASE_BUFFER_SIZE)
+@@ -7494,7 +7496,7 @@ xmlBufferResize(xmlBufferPtr buf, unsigned int size)
+ break;
+
+ default:
+- newSize = size+10;
++ newSize = (size > UINT_MAX - 10 ? UINT_MAX : size + 10);;
+ break;
+ }
+
+@@ -7580,8 +7582,10 @@ xmlBufferAdd(xmlBufferPtr buf, const xmlChar *str, int len) {
+ if (len < 0) return -1;
+ if (len == 0) return 0;
+
+- needSize = buf->use + len + 2;
+- if (needSize > buf->size){
++ if ((unsigned) len >= buf->size - buf->use) {
++ if ((unsigned) len >= UINT_MAX - buf->use)
++ return XML_ERR_NO_MEMORY;
++ needSize = buf->use + len + 1;
+ if (!xmlBufferResize(buf, needSize)){
+ xmlTreeErrMemory("growing buffer");
+ return XML_ERR_NO_MEMORY;
+@@ -7694,29 +7698,7 @@ xmlBufferCat(xmlBufferPtr buf, const xmlChar *str) {
+ */
+ int
+ xmlBufferCCat(xmlBufferPtr buf, const char *str) {
+- const char *cur;
+-
+- if (buf == NULL)
+- return(-1);
+- if (buf->alloc == XML_BUFFER_ALLOC_IMMUTABLE) return -1;
+- if (str == NULL) {
+-#ifdef DEBUG_BUFFER
+- xmlGenericError(xmlGenericErrorContext,
+- "xmlBufferCCat: str == NULL\n");
+-#endif
+- return -1;
+- }
+- for (cur = str;*cur != 0;cur++) {
+- if (buf->use + 10 >= buf->size) {
+- if (!xmlBufferResize(buf, buf->use+10)){
+- xmlTreeErrMemory("growing buffer");
+- return XML_ERR_NO_MEMORY;
+- }
+- }
+- buf->content[buf->use++] = *cur;
+- }
+- buf->content[buf->use] = 0;
+- return 0;
++ return xmlBufferCat(buf, (const xmlChar *) str);
+ }
+
+ /**
+--
+GitLab
+
diff --git a/meta/recipes-core/libxml/libxml2_2.9.10.bb b/meta/recipes-core/libxml/libxml2_2.9.10.bb
index c4bb8f29e0..b3ebf15751 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.10.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.10.bb
@@ -30,6 +30,8 @@ SRC_URI += "http://www.w3.org/XML/Test/xmlts20080827.tar.gz;subdir=${BP};name=te
file://CVE-2021-3541.patch \
file://CVE-2022-23308.patch \
file://CVE-2022-23308-fix-regression.patch \
+ file://CVE-2022-29824-dependent.patch \
+ file://CVE-2022-29824.patch \
"
SRC_URI[archive.sha256sum] = "593b7b751dd18c2d6abcd0c4bcb29efc203d0b4373a6df98e3a455ea74ae2813"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 07/11] vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (5 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 06/11] libxml2: Fix CVE-2022-29824 for libxml2 Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 08/11] cve-check.bbclass: Added do_populate_sdk[recrdeptask] Steve Sakoman
` (3 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
Address CVE-2022-1621, CVE-2022-1629, CVE-2022-1674, CVE-2022-1733, CVE-2022-1735
CVE-2022-1769, CVE-2022-1771, CVE-2022-1785, CVE-2022-1796
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fafce97bd440150ac5c586b53b887ee70a5b66bd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/vim/vim.inc | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 4b8f4d1dfb..9d918379b4 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -21,8 +21,8 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https \
file://racefix.patch \
"
-PV .= ".4912"
-SRCREV = "a7583c42cd6b64fd276a5d7bb0db5ce7bfafa730"
+PV .= ".5034"
+SRCREV = "5a6ec10cc80ab02eeff644ab19b82312630ea855"
# Remove when 8.3 is out
UPSTREAM_VERSION_UNKNOWN = "1"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 08/11] cve-check.bbclass: Added do_populate_sdk[recrdeptask].
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (6 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 07/11] vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 09/11] cve-check: Add helper for symlink handling Steve Sakoman
` (2 subsequent siblings)
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: leimaohui <leimaohui@fujitsu.com>
As product, sdk should do cve check as well as rootfs.
Signed-off-by: Lei Maohui <leimaohui@fujitsu.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
(cherry picked from commit cc17753935c5f9e08aaa6c5886f059303147c07b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/cve-check.bbclass | 1 +
1 file changed, 1 insertion(+)
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 34c38bdf2d..f7ed2a6ae9 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -213,6 +213,7 @@ python cve_check_write_rootfs_manifest () {
ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}"
do_rootfs[recrdeptask] += "${@'do_cve_check' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}"
+do_populate_sdk[recrdeptask] += "${@'do_cve_check' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}"
def get_patches_cves(d):
"""
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 09/11] cve-check: Add helper for symlink handling
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (7 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 08/11] cve-check.bbclass: Added do_populate_sdk[recrdeptask] Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 10/11] cve-check: Only include installed packages for rootfs manifest Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 11/11] cve-check: Allow warnings to be disabled Steve Sakoman
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5046d54df2c3057be2afa4143a2833183fca0d67)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/cve-check.bbclass | 34 +++++++++++++---------------------
1 file changed, 13 insertions(+), 21 deletions(-)
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index f7ed2a6ae9..3cae0e8eb2 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -75,6 +75,12 @@ CVE_CHECK_LAYER_INCLUDELIST ??= ""
# set to "alphabetical" for version using single alphabetical character as increment release
CVE_VERSION_SUFFIX ??= ""
+def update_symlinks(target_path, link_path):
+ if link_path != target_path and os.path.exists(target_path):
+ if os.path.exists(os.path.realpath(link_path)):
+ os.remove(link_path)
+ os.symlink(os.path.basename(target_path), link_path)
+
def generate_json_report(d, out_path, link_path):
if os.path.exists(d.getVar("CVE_CHECK_SUMMARY_INDEX_PATH")):
import json
@@ -94,10 +100,7 @@ def generate_json_report(d, out_path, link_path):
with open(out_path, "w") as f:
json.dump(summary, f, indent=2)
- if link_path != out_path:
- if os.path.exists(os.path.realpath(link_path)):
- os.remove(link_path)
- os.symlink(os.path.basename(out_path), link_path)
+ update_symlinks(out_path, link_path)
python cve_save_summary_handler () {
import shutil
@@ -114,14 +117,9 @@ python cve_save_summary_handler () {
if os.path.exists(cve_tmp_file):
shutil.copyfile(cve_tmp_file, cve_summary_file)
-
- if cve_summary_file and os.path.exists(cve_summary_file):
- cvefile_link = os.path.join(cvelogpath, cve_summary_name)
- # if the paths are the same don't create the link
- if cvefile_link != cve_summary_file:
- if os.path.exists(os.path.realpath(cvefile_link)):
- os.remove(cvefile_link)
- os.symlink(os.path.basename(cve_summary_file), cvefile_link)
+ cvefile_link = os.path.join(cvelogpath, cve_summary_name)
+ update_symlinks(cve_summary_file, cvefile_link)
+ bb.plain("Complete CVE report summary created at: %s" % cvefile_link)
if d.getVar("CVE_CHECK_FORMAT_JSON") == "1":
json_summary_link_name = os.path.join(cvelogpath, d.getVar("CVE_CHECK_SUMMARY_FILE_NAME_JSON"))
@@ -193,15 +191,9 @@ python cve_check_write_rootfs_manifest () {
bb.utils.mkdirhier(os.path.dirname(manifest_name))
shutil.copyfile(cve_tmp_file, manifest_name)
- if manifest_name and os.path.exists(manifest_name):
- manifest_link = os.path.join(deploy_dir, "%s.cve" % link_name)
- # if they are the same don't create the link
- if manifest_link != manifest_name:
- # If we already have another manifest, update symlinks
- if os.path.exists(os.path.realpath(manifest_link)):
- os.remove(manifest_link)
- os.symlink(os.path.basename(manifest_name), manifest_link)
- bb.plain("Image CVE report stored in: %s" % manifest_name)
+ manifest_link = os.path.join(deploy_dir, "%s.cve" % link_name)
+ update_symlinks(manifest_name, manifest_link)
+ bb.plain("Image CVE report stored in: %s" % manifest_name)
if d.getVar("CVE_CHECK_FORMAT_JSON") == "1":
link_path = os.path.join(deploy_dir, "%s.json" % link_name)
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 10/11] cve-check: Only include installed packages for rootfs manifest
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (8 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 09/11] cve-check: Add helper for symlink handling Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 11/11] cve-check: Allow warnings to be disabled Steve Sakoman
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Ernst Sjöstrand <ernstp@gmail.com>
Before this the rootfs manifest and the summary were identical.
We should separate the summary and rootfs manifest more clearly,
now the summary is for all CVEs and the rootfs manifest is only for
things in that image. This is even more useful if you build multiple
images.
Signed-off-by: Ernst Sjöstrand <ernstp@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3b8cc6fc45f0ea5677729ee2b1819bdc7a441ab1)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 65498411d73e8008d5550c2d0a1148f990717587)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/cve-check.bbclass | 69 ++++++++++++++++++++++++++--------
1 file changed, 54 insertions(+), 15 deletions(-)
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 3cae0e8eb2..29b276e491 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -171,6 +171,8 @@ python cve_check_write_rootfs_manifest () {
"""
import shutil
+ import json
+ from oe.rootfs import image_list_installed_packages
from oe.cve_check import cve_check_merge_jsons
if d.getVar("CVE_CHECK_COPY_FILES") == "1":
@@ -181,26 +183,63 @@ python cve_check_write_rootfs_manifest () {
if os.path.exists(deploy_file_json):
bb.utils.remove(deploy_file_json)
- if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")):
- bb.note("Writing rootfs CVE manifest")
- deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
- link_name = d.getVar("IMAGE_LINK_NAME")
+ # Create a list of relevant recipies
+ recipies = set()
+ for pkg in list(image_list_installed_packages(d)):
+ pkg_info = os.path.join(d.getVar('PKGDATA_DIR'),
+ 'runtime-reverse', pkg)
+ pkg_data = oe.packagedata.read_pkgdatafile(pkg_info)
+ recipies.add(pkg_data["PN"])
+
+ bb.note("Writing rootfs CVE manifest")
+ deploy_dir = d.getVar("DEPLOY_DIR_IMAGE")
+ link_name = d.getVar("IMAGE_LINK_NAME")
+
+ json_data = {"version":"1", "package": []}
+ text_data = ""
+ enable_json = d.getVar("CVE_CHECK_FORMAT_JSON") == "1"
+ enable_text = d.getVar("CVE_CHECK_FORMAT_TEXT") == "1"
+
+ save_pn = d.getVar("PN")
+
+ for pkg in recipies:
+ # To be able to use the CVE_CHECK_RECIPE_FILE variable we have to evaluate
+ # it with the different PN names set each time.
+ d.setVar("PN", pkg)
+ if enable_text:
+ pkgfilepath = d.getVar("CVE_CHECK_RECIPE_FILE")
+ if os.path.exists(pkgfilepath):
+ with open(pkgfilepath) as pfile:
+ text_data += pfile.read()
+
+ if enable_json:
+ pkgfilepath = d.getVar("CVE_CHECK_RECIPE_FILE_JSON")
+ if os.path.exists(pkgfilepath):
+ with open(pkgfilepath) as j:
+ data = json.load(j)
+ cve_check_merge_jsons(json_data, data)
+
+ d.setVar("PN", save_pn)
+
+ if enable_text:
+ link_path = os.path.join(deploy_dir, "%s.cve" % link_name)
manifest_name = d.getVar("CVE_CHECK_MANIFEST")
- cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE")
- bb.utils.mkdirhier(os.path.dirname(manifest_name))
- shutil.copyfile(cve_tmp_file, manifest_name)
+ with open(manifest_name, "w") as f:
+ f.write(text_data)
- manifest_link = os.path.join(deploy_dir, "%s.cve" % link_name)
- update_symlinks(manifest_name, manifest_link)
+ update_symlinks(manifest_name, link_path)
bb.plain("Image CVE report stored in: %s" % manifest_name)
- if d.getVar("CVE_CHECK_FORMAT_JSON") == "1":
- link_path = os.path.join(deploy_dir, "%s.json" % link_name)
- manifest_path = d.getVar("CVE_CHECK_MANIFEST_JSON")
- bb.note("Generating JSON CVE manifest")
- generate_json_report(d, manifest_path, link_path)
- bb.plain("Image CVE JSON report stored in: %s" % link_path)
+ if enable_json:
+ link_path = os.path.join(deploy_dir, "%s.json" % link_name)
+ manifest_name = d.getVar("CVE_CHECK_MANIFEST_JSON")
+
+ with open(manifest_name, "w") as f:
+ json.dump(json_data, f, indent=2)
+
+ update_symlinks(manifest_name, link_path)
+ bb.plain("Image CVE JSON report stored in: %s" % manifest_name)
}
ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}"
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 11/11] cve-check: Allow warnings to be disabled
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
` (9 preceding siblings ...)
2022-06-02 2:30 ` [OE-core][dunfell 10/11] cve-check: Only include installed packages for rootfs manifest Steve Sakoman
@ 2022-06-02 2:30 ` Steve Sakoman
10 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-06-02 2:30 UTC (permalink / raw)
To: openembedded-core
From: Richard Purdie <richard.purdie@linuxfoundation.org>
When running CVE checks in CI we're usually not interested in warnings on the
console for any CVEs present. Add a configuration option CVE_CHECK_SHOW_WARNINGS
to allow this to be disabled (it is left enabled by default).
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1054d3366ba528f2ad52585cf951e508958c5c68)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 8fd6a9f521ea6b1e10c80fe33968943db30991ba)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/cve-check.bbclass | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/meta/classes/cve-check.bbclass b/meta/classes/cve-check.bbclass
index 29b276e491..0111ec6ba8 100644
--- a/meta/classes/cve-check.bbclass
+++ b/meta/classes/cve-check.bbclass
@@ -48,6 +48,7 @@ CVE_CHECK_COPY_FILES ??= "1"
CVE_CHECK_CREATE_MANIFEST ??= "1"
CVE_CHECK_REPORT_PATCHED ??= "1"
+CVE_CHECK_SHOW_WARNINGS ??= "1"
# Provide text output
CVE_CHECK_FORMAT_TEXT ??= "1"
@@ -472,7 +473,7 @@ def cve_write_data_text(d, patched, unpatched, whitelisted, cve_data):
write_string += "VECTOR: %s\n" % cve_data[cve]["vector"]
write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve)
- if unpatched_cves:
+ if unpatched_cves and d.getVar("CVE_CHECK_SHOW_WARNINGS") == "1":
bb.warn("Found unpatched CVE (%s), for more information check %s" % (" ".join(unpatched_cves),cve_file))
if write_string:
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2022-08-10 22:31 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-08-10 22:31 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4058
The following changes since commit 73d2b640ad665f6ff3c4fbe8f5da4ef0dbb175f2:
libtirpc: CVE-2021-46828 DoS vulnerability with lots of connections (2022-07-28 06:26:48 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alex Kiernan (1):
openssh: Add openssh-sftp-server to openssh RDEPENDS
Bruce Ashfield (2):
linux-yocto/5.4: update to v5.4.208
linux-yocto/5.4: update to v5.4.209
Hitendra Prajapati (2):
grub2: Fix several security issue of integer underflow
gdk-pixbuf: CVE-2021-46829 a heap-based buffer overflow
Jose Quaresma (1):
gstreamer1.0: use the correct meson option for the capabilities
Khem Raj (1):
libmodule-build-perl: Use env utility to find perl interpreter
Martin Jansa (1):
libxml2: Port gentest.py to Python-3
Richard Purdie (1):
insane: Fix buildpaths test to work with special devices
Ross Burton (1):
cve_check: skip remote patches that haven't been fetched when
searching for CVE tags
Steve Sakoman (1):
selftest: skip virgl test on fedora 36
meta/classes/insane.bbclass | 6 +-
meta/lib/oe/cve_check.py | 5 +-
meta/lib/oeqa/selftest/cases/runtime_test.py | 2 +
.../grub/files/CVE-2022-28733.patch | 60 ++
.../grub/files/CVE-2022-28734.patch | 67 ++
.../grub/files/CVE-2022-28736.patch | 275 ++++++
meta/recipes-bsp/grub/grub2.inc | 3 +
.../openssh/openssh_8.2p1.bb | 2 +-
.../0001-Port-gentest.py-to-Python-3.patch | 813 ++++++++++++++++++
meta/recipes-core/libxml/libxml2_2.9.10.bb | 11 +
.../perl/libmodule-build-perl_0.4231.bb | 1 +
.../gdk-pixbuf/CVE-2021-46829.patch | 61 ++
.../gdk-pixbuf/gdk-pixbuf_2.40.0.bb | 1 +
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +-
.../gstreamer/gstreamer1.0_1.16.3.bb | 2 +-
17 files changed, 1321 insertions(+), 24 deletions(-)
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28733.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28734.patch
create mode 100644 meta/recipes-bsp/grub/files/CVE-2022-28736.patch
create mode 100644 meta/recipes-core/libxml/libxml2/0001-Port-gentest.py-to-Python-3.patch
create mode 100644 meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2021-46829.patch
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2022-08-18 16:56 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-08-18 16:56 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by end
of day Sunday.
This is the final patch set for the 3.1.19 release.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4098
The following changes since commit ac6ea1a96645d2a4dd54660256603f0b191bb4d3:
gstreamer1.0: use the correct meson option for the capabilities (2022-08-10 05:04:10 -1000)
are available in the Git repository at:
git://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alexander Kanavin (1):
linux-firmware: update 20220610 -> 20220708
Dmitry Baryshkov (1):
linux-firwmare: restore WHENCE_CHKSUM variable
Hitendra Prajapati (3):
qemu: CVE-2020-27821 heap buffer overflow in msix_table_mmio_write
gnutls: CVE-2022-2509 Double free during gnutls_pkcs7_verify
zlib: CVE-2022-37434 a heap-based buffer over-read
Ming Liu (1):
rootfs-postcommands.bbclass: move host-user-contaminated.txt to ${S}
Pascal Bach (1):
bin_package: install into base_prefix
Randy MacLeod (1):
vim: update from 9.0.0063 to 9.0.0115
Richard Purdie (2):
vim: Upgrade 9.0.0021 -> 9.0.0063
kernel-arch: Fix buildpaths leaking into external module compiles
Shruthi Ravichandran (1):
initscripts: run umountnfs as a KILL script
meta/classes/bin_package.bbclass | 3 +-
meta/classes/kernel-arch.bbclass | 2 +-
meta/classes/rootfs-postcommands.bbclass | 2 +-
.../initscripts/initscripts_1.0.bb | 2 +-
.../zlib/zlib/CVE-2022-37434.patch | 44 +++
meta/recipes-core/zlib/zlib_1.2.11.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2020-27821.patch | 73 +++++
...20220610.bb => linux-firmware_20220708.bb} | 14 +-
.../gnutls/gnutls/CVE-2022-2509.patch | 282 ++++++++++++++++++
meta/recipes-support/gnutls/gnutls_3.6.14.bb | 1 +
meta/recipes-support/vim/files/racefix.patch | 33 --
meta/recipes-support/vim/vim.inc | 10 +-
13 files changed, 418 insertions(+), 50 deletions(-)
create mode 100644 meta/recipes-core/zlib/zlib/CVE-2022-37434.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2020-27821.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20220610.bb => linux-firmware_20220708.bb} (98%)
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2022-2509.patch
delete mode 100644 meta/recipes-support/vim/files/racefix.patch
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2022-11-12 14:09 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2022-11-12 14:09 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/4469
The following changes since commit babcb7cd3bbefe9c0ea28e960e4fd6cefbc03cae:
bluez5: add dbus to RDEPENDS (2022-11-04 07:52:01 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alex Kiernan (1):
openssl: upgrade 1.1.1q to 1.1.1s
Hitendra Prajapati (1):
bluez: CVE-2022-3637 A DoS exists in monitor/jlink.c
Martin Jansa (1):
externalsrc.bbclass: fix git repo detection
Peter Kjellerstedt (1):
externalsrc.bbclass: Remove a trailing slash from ${B}
Ross Burton (1):
sanity: check for GNU tar specifically
Sundeep KOKKONDA (2):
binutils: stable 2.34 branch updates
glibc : stable 2.31 branch updates.
Sunil Kumar (1):
go: Security Fix for CVE-2022-2879
Vivek Kumbhar (2):
curl: fix CVE-2022-32221 POST following PUT
qemu: fix CVE-2021-3638 ati-vga: inconsistent check in ati_2d_blt()
may lead to out-of-bounds write
ciarancourtney (1):
wic: swap partitions are not added to fstab
meta/classes/externalsrc.bbclass | 6 +-
meta/classes/sanity.bbclass | 8 ++
meta/recipes-connectivity/bluez5/bluez5.inc | 1 +
.../bluez5/bluez5/CVE-2022-3637.patch | 39 ++++++
.../{openssl_1.1.1q.bb => openssl_1.1.1s.bb} | 2 +-
meta/recipes-core/glibc/glibc-version.inc | 2 +-
.../glibc/glibc/CVE-2021-33574_1.patch | 26 ++--
.../binutils/binutils-2.34.inc | 2 +-
.../binutils/binutils/CVE-2020-16593.patch | 4 +-
.../binutils/binutils/CVE-2021-3549.patch | 80 ++++++-------
meta/recipes-devtools/go/go-1.14.inc | 1 +
.../go/go-1.14/CVE-2022-2879.patch | 111 ++++++++++++++++++
meta/recipes-devtools/qemu/qemu.inc | 1 +
.../qemu/qemu/CVE-2021-3638.patch | 80 +++++++++++++
.../curl/curl/CVE-2022-32221.patch | 29 +++++
meta/recipes-support/curl/curl_7.69.1.bb | 1 +
scripts/lib/wic/plugins/imager/direct.py | 2 +-
17 files changed, 329 insertions(+), 66 deletions(-)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2022-3637.patch
rename meta/recipes-connectivity/openssl/{openssl_1.1.1q.bb => openssl_1.1.1s.bb} (98%)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2022-2879.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2021-3638.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2022-32221.patch
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2023-05-20 16:04 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2023-05-20 16:04 UTC (permalink / raw)
To: openembedded-core
Please review this set of patches for dunfell and have comments back by
end of day Tuesday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5324
The following changes since commit 1bc254e7969f3d5470bacf9ad9f065d38b7b7fde:
run-postinsts: Set dependency for ldconfig to avoid boot issues (2023-05-11 07:47:14 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alex Kiernan (1):
pypi.bbclass: Set CVE_PRODUCT to PYPI_PACKAGE
Dmitry Baryshkov (1):
linux-firmware: upgrade 20230210 -> 20230404
Hitendra Prajapati (2):
git: fix CVE-2023-29007
git: fix CVE-2023-25652
Khem Raj (1):
perf: Depend on native setuptools3
Marek Vasut (1):
cpio: Fix wrong CRC with ASCII CRC for large files
Martin Jansa (1):
populate_sdk_ext.bbclass: set METADATA_REVISION with an DISTRO
override
Randolph Sapp (1):
wic/bootimg-efi: if fixed-size is set then use that for mkdosfs
Siddharth (1):
curl: ammend fix for CVE-2023-27534 to fix error when ssh is enabled
Steve Sakoman (1):
selftest: skip virgl test on ubuntu 22.10, fedora 37, and all rocky
Thomas Roos (1):
oeqa/utils/metadata.py: Fix running oe-selftest running with no distro
set
meta/classes/populate_sdk_ext.bbclass | 3 +-
meta/classes/pypi.bbclass | 2 +
meta/lib/oeqa/selftest/cases/runtime_test.py | 6 +
meta/lib/oeqa/utils/metadata.py | 6 +-
.../git/files/CVE-2023-25652.patch | 94 +++++++++++
.../git/files/CVE-2023-29007.patch | 159 ++++++++++++++++++
meta/recipes-devtools/git/git.inc | 2 +
...g-CRC-with-ASCII-CRC-for-large-files.patch | 39 +++++
meta/recipes-extended/cpio/cpio_2.13.bb | 1 +
...20230210.bb => linux-firmware_20230404.bb} | 6 +-
meta/recipes-kernel/perf/perf.bb | 2 +-
.../curl/curl/CVE-2023-27534-pre1.patch | 51 ++++++
.../curl/curl/CVE-2023-27534.patch | 122 ++------------
meta/recipes-support/curl/curl_7.69.1.bb | 1 +
scripts/lib/wic/plugins/source/bootimg-efi.py | 7 +
15 files changed, 387 insertions(+), 114 deletions(-)
create mode 100644 meta/recipes-devtools/git/files/CVE-2023-25652.patch
create mode 100644 meta/recipes-devtools/git/files/CVE-2023-29007.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0001-Wrong-CRC-with-ASCII-CRC-for-large-files.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20230210.bb => linux-firmware_20230404.bb} (99%)
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-27534-pre1.patch
--
2.34.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2023-06-08 2:35 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2023-06-08 2:35 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Friday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5422
The following changes since commit e4b98a42970574296e0da06842691b9fc1ffc9a1:
selftest: skip virgl test on ubuntu 22.10, fedora 37, and all rocky (2023-05-20 06:02:24 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Alex Kiernan (1):
openssh: Move sshdgenkeys.service to sshd.socket
Ashish Sharma (1):
golang: Fix CVE-2023-24539
Bruce Ashfield (5):
linux-yocto/5.4: update to v5.4.238
linux-yocto/5.4: update to v5.4.240
linux-yocto/5.4: update to v5.4.241
linux-yocto/5.4: update to v5.4.242
linux-yocto/5.4: update to v5.4.243
Nikhil R (1):
ffmpeg: Fix CVE-2022-48434
Vijay Anusuri (3):
ghostscript: Fix CVE-2023-28879
xserver-xorg: Security fix CVE-2023-0494 and CVE-2023-1393
go: Security fix CVE-2023-24540
.../openssh/openssh/sshd.socket | 1 +
.../openssh/openssh/sshd@.service | 2 -
meta/recipes-devtools/go/go-1.14.inc | 2 +
.../go/go-1.14/CVE-2023-24539.patch | 60 ++++++++
.../go/go-1.14/CVE-2023-24540.patch | 90 ++++++++++++
.../ghostscript/CVE-2023-28879.patch | 54 +++++++
.../ghostscript/ghostscript_9.52.bb | 1 +
.../xserver-xorg/CVE-2023-0494.patch | 38 +++++
.../xserver-xorg/CVE-2023-1393.patch | 46 ++++++
.../xorg-xserver/xserver-xorg_1.20.14.bb | 2 +
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 +--
.../ffmpeg/ffmpeg/CVE-2022-48434.patch | 136 ++++++++++++++++++
.../recipes-multimedia/ffmpeg/ffmpeg_4.2.2.bb | 1 +
15 files changed, 449 insertions(+), 20 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24539.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24540.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-28879.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-0494.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-1393.patch
create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2022-48434.patch
--
2.34.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2023-10-10 14:14 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2023-10-10 14:14 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Thursday, October 12.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6026
The following changes since commit 9a800a2e2c2b14eab8c1f83cb4ac3b94a70dd23c:
glibc: Fix CVE-2023-4911 "Looney Tunables" (2023-10-05 13:10:56 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Hitendra Prajapati (1):
xdg-utils: Fix CVE-2022-4055
Julian Haller (2):
dbus: Backport fix for CVE-2023-34969
dbus: Add missing CVE_PRODUCT
Marek Vasut (2):
busybox: Backport CVE-2022-48174 fix
cpio: Replace fix wrong CRC with ASCII CRC for large files with
upstream backport
Shinu Chandran (1):
libpcre2 : Follow up fix CVE-2022-1586
Shubham Kulkarni (1):
go: Update fix for CVE-2023-24538 & CVE-2023-39318
Sourav Pramanik (1):
openssl: Upgrade 1.1.1v -> 1.1.1w
Vijay Anusuri (3):
cups: Backport fix for CVE-2023-32360 and CVE-2023-4504
gawk: backport Debian patch to fix CVE-2023-4156
ghostscript: Backport fix CVE-2023-43115
.../{openssl_1.1.1v.bb => openssl_1.1.1w.bb} | 2 +-
.../busybox/busybox/CVE-2022-48174.patch | 82 +++
meta/recipes-core/busybox/busybox_1.31.1.bb | 1 +
meta/recipes-core/dbus/dbus.inc | 3 +
.../dbus/dbus/CVE-2023-34969.patch | 96 +++
meta/recipes-devtools/go/go-1.14.inc | 5 +-
.../go/go-1.14/CVE-2023-24538-1.patch | 4 +-
.../go/go-1.14/CVE-2023-24538-2.patch | 447 ++++++++++++-
.../go/go-1.14/CVE-2023-24538_3.patch | 393 ++++++++++++
.../go/go-1.14/CVE-2023-24538_4.patch | 497 +++++++++++++++
.../go/go-1.14/CVE-2023-24538_5.patch | 585 ++++++++++++++++++
...3-24538-3.patch => CVE-2023-24538_6.patch} | 175 +++++-
.../go/go-1.14/CVE-2023-39318.patch | 38 +-
...g-CRC-with-ASCII-CRC-for-large-files.patch | 39 --
...-calculation-of-CRC-in-copy-out-mode.patch | 58 ++
...appending-to-archives-bigger-than-2G.patch | 312 ++++++++++
meta/recipes-extended/cpio/cpio_2.13.bb | 3 +-
meta/recipes-extended/cups/cups.inc | 2 +
.../cups/cups/CVE-2023-32360.patch | 31 +
.../cups/cups/CVE-2023-4504.patch | 40 ++
.../gawk/gawk/CVE-2023-4156.patch | 28 +
meta/recipes-extended/gawk/gawk_5.0.1.bb | 1 +
.../ghostscript/CVE-2023-43115.patch | 62 ++
.../ghostscript/ghostscript_9.52.bb | 1 +
.../xdg-utils/xdg-utils/CVE-2022-4055.patch | 165 +++++
.../xdg-utils/xdg-utils_1.1.3.bb | 1 +
.../libpcre2/CVE-2022-1586-regression.patch | 30 +
.../recipes-support/libpcre/libpcre2_10.34.bb | 1 +
28 files changed, 3041 insertions(+), 61 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl_1.1.1v.bb => openssl_1.1.1w.bb} (98%)
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2022-48174.patch
create mode 100644 meta/recipes-core/dbus/dbus/CVE-2023-34969.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_3.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_4.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_5.patch
rename meta/recipes-devtools/go/go-1.14/{CVE-2023-24538-3.patch => CVE-2023-24538_6.patch} (53%)
delete mode 100644 meta/recipes-extended/cpio/cpio-2.13/0001-Wrong-CRC-with-ASCII-CRC-for-large-files.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0003-Fix-calculation-of-CRC-in-copy-out-mode.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0004-Fix-appending-to-archives-bigger-than-2G.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-32360.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-4504.patch
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-43115.patch
create mode 100644 meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch
create mode 100644 meta/recipes-support/libpcre/libpcre2/CVE-2022-1586-regression.patch
--
2.34.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [OE-core][dunfell 00/11] Patch review
@ 2023-12-06 13:55 Steve Sakoman
0 siblings, 0 replies; 23+ messages in thread
From: Steve Sakoman @ 2023-12-06 13:55 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for dunfell and have comments back by
end of day Friday, December 8
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6293
The following changes since commit 0764da7e3f1d71eb390e5eb8a9aa1323c24d1c19:
vim: use upstream generated .po files (2023-11-28 12:31:43 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Ashish Sharma (1):
mdadm: Backport fix for CVE-2023-28938
Bruce Ashfield (3):
linux-yocto/5.4: update to v5.4.258
linux-yocto/5.4: update to v5.4.260
linux-yocto/5.4: update to v5.4.262
Lee Chee Yang (2):
epiphany: fix CVE-2022-29536
qemu: ignore CVE-2021-20295 CVE-2023-2680
Steve Sakoman (1):
cve-exclusion_5.4.inc: update for 5.4.262
Tim Orling (1):
vim: upgrade 9.0.2068 -> 9.0.2130
Vivek Kumbhar (1):
libsndfile: fix CVE-2022-33065 Signed integer overflow in src/mat4.c
poojitha adireddy (2):
binutils 2.34: Fix CVE-2021-46174
binutils: Mark CVE-2022-47696 as patched
.../binutils/binutils-2.34.inc | 1 +
.../binutils/binutils/CVE-2021-46174.patch | 35 ++++++++
.../binutils/binutils/CVE-2023-25588.patch | 3 +
meta/recipes-devtools/qemu/qemu.inc | 7 ++
.../mdadm/files/CVE-2023-28938.patch | 80 +++++++++++++++++++
meta/recipes-extended/mdadm/mdadm_4.1.bb | 1 +
.../recipes-gnome/epiphany/epiphany_3.34.4.bb | 1 +
.../epiphany/files/CVE-2022-29536.patch | 46 +++++++++++
.../linux/cve-exclusion_5.4.inc | 79 ++++++++++++++----
.../linux/linux-yocto-rt_5.4.bb | 6 +-
.../linux/linux-yocto-tiny_5.4.bb | 8 +-
meta/recipes-kernel/linux/linux-yocto_5.4.bb | 22 ++---
.../libsndfile1/CVE-2022-33065.patch | 46 +++++++++++
.../libsndfile/libsndfile1_1.0.28.bb | 3 +-
meta/recipes-support/vim/vim.inc | 4 +-
15 files changed, 306 insertions(+), 36 deletions(-)
create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2021-46174.patch
create mode 100644 meta/recipes-extended/mdadm/files/CVE-2023-28938.patch
create mode 100644 meta/recipes-gnome/epiphany/files/CVE-2022-29536.patch
create mode 100644 meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2022-33065.patch
--
2.34.1
^ permalink raw reply [flat|nested] 23+ messages in thread
end of thread, other threads:[~2023-12-06 13:56 UTC | newest]
Thread overview: 23+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-06-02 2:30 [OE-core][dunfell 00/11] Patch review Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 01/11] ruby: Upgrade ruby to 2.7.6 for security fix Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 02/11] ruby: Whitelist CVE-2021-28966 as this affects Windows OS only Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 03/11] libsdl2: Add fix for CVE-2021-33657 Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 04/11] ffmpeg: Fix for CVE-2022-1475 Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 05/11] ncurses: Fix CVE-2022-29458 Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 06/11] libxml2: Fix CVE-2022-29824 for libxml2 Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 07/11] vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 08/11] cve-check.bbclass: Added do_populate_sdk[recrdeptask] Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 09/11] cve-check: Add helper for symlink handling Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 10/11] cve-check: Only include installed packages for rootfs manifest Steve Sakoman
2022-06-02 2:30 ` [OE-core][dunfell 11/11] cve-check: Allow warnings to be disabled Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-12-06 13:55 [OE-core][dunfell 00/11] Patch review Steve Sakoman
2023-10-10 14:14 Steve Sakoman
2023-06-08 2:35 Steve Sakoman
2023-05-20 16:04 Steve Sakoman
2022-11-12 14:09 Steve Sakoman
2022-08-18 16:56 Steve Sakoman
2022-08-10 22:31 Steve Sakoman
2022-04-16 19:14 Steve Sakoman
2022-01-20 21:23 Steve Sakoman
2022-01-13 14:37 Steve Sakoman
2021-04-08 16:31 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox