From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][dunfell 00/11] Patch review
Date: Tue, 10 Oct 2023 04:14:17 -1000 [thread overview]
Message-ID: <cover.1696946306.git.steve@sakoman.com> (raw)
Please review this set of changes for dunfell and have comments back by
end of day Thursday, October 12.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6026
The following changes since commit 9a800a2e2c2b14eab8c1f83cb4ac3b94a70dd23c:
glibc: Fix CVE-2023-4911 "Looney Tunables" (2023-10-05 13:10:56 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/dunfell-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/dunfell-nut
Hitendra Prajapati (1):
xdg-utils: Fix CVE-2022-4055
Julian Haller (2):
dbus: Backport fix for CVE-2023-34969
dbus: Add missing CVE_PRODUCT
Marek Vasut (2):
busybox: Backport CVE-2022-48174 fix
cpio: Replace fix wrong CRC with ASCII CRC for large files with
upstream backport
Shinu Chandran (1):
libpcre2 : Follow up fix CVE-2022-1586
Shubham Kulkarni (1):
go: Update fix for CVE-2023-24538 & CVE-2023-39318
Sourav Pramanik (1):
openssl: Upgrade 1.1.1v -> 1.1.1w
Vijay Anusuri (3):
cups: Backport fix for CVE-2023-32360 and CVE-2023-4504
gawk: backport Debian patch to fix CVE-2023-4156
ghostscript: Backport fix CVE-2023-43115
.../{openssl_1.1.1v.bb => openssl_1.1.1w.bb} | 2 +-
.../busybox/busybox/CVE-2022-48174.patch | 82 +++
meta/recipes-core/busybox/busybox_1.31.1.bb | 1 +
meta/recipes-core/dbus/dbus.inc | 3 +
.../dbus/dbus/CVE-2023-34969.patch | 96 +++
meta/recipes-devtools/go/go-1.14.inc | 5 +-
.../go/go-1.14/CVE-2023-24538-1.patch | 4 +-
.../go/go-1.14/CVE-2023-24538-2.patch | 447 ++++++++++++-
.../go/go-1.14/CVE-2023-24538_3.patch | 393 ++++++++++++
.../go/go-1.14/CVE-2023-24538_4.patch | 497 +++++++++++++++
.../go/go-1.14/CVE-2023-24538_5.patch | 585 ++++++++++++++++++
...3-24538-3.patch => CVE-2023-24538_6.patch} | 175 +++++-
.../go/go-1.14/CVE-2023-39318.patch | 38 +-
...g-CRC-with-ASCII-CRC-for-large-files.patch | 39 --
...-calculation-of-CRC-in-copy-out-mode.patch | 58 ++
...appending-to-archives-bigger-than-2G.patch | 312 ++++++++++
meta/recipes-extended/cpio/cpio_2.13.bb | 3 +-
meta/recipes-extended/cups/cups.inc | 2 +
.../cups/cups/CVE-2023-32360.patch | 31 +
.../cups/cups/CVE-2023-4504.patch | 40 ++
.../gawk/gawk/CVE-2023-4156.patch | 28 +
meta/recipes-extended/gawk/gawk_5.0.1.bb | 1 +
.../ghostscript/CVE-2023-43115.patch | 62 ++
.../ghostscript/ghostscript_9.52.bb | 1 +
.../xdg-utils/xdg-utils/CVE-2022-4055.patch | 165 +++++
.../xdg-utils/xdg-utils_1.1.3.bb | 1 +
.../libpcre2/CVE-2022-1586-regression.patch | 30 +
.../recipes-support/libpcre/libpcre2_10.34.bb | 1 +
28 files changed, 3041 insertions(+), 61 deletions(-)
rename meta/recipes-connectivity/openssl/{openssl_1.1.1v.bb => openssl_1.1.1w.bb} (98%)
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2022-48174.patch
create mode 100644 meta/recipes-core/dbus/dbus/CVE-2023-34969.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_3.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_4.patch
create mode 100644 meta/recipes-devtools/go/go-1.14/CVE-2023-24538_5.patch
rename meta/recipes-devtools/go/go-1.14/{CVE-2023-24538-3.patch => CVE-2023-24538_6.patch} (53%)
delete mode 100644 meta/recipes-extended/cpio/cpio-2.13/0001-Wrong-CRC-with-ASCII-CRC-for-large-files.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0003-Fix-calculation-of-CRC-in-copy-out-mode.patch
create mode 100644 meta/recipes-extended/cpio/cpio-2.13/0004-Fix-appending-to-archives-bigger-than-2G.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-32360.patch
create mode 100644 meta/recipes-extended/cups/cups/CVE-2023-4504.patch
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
create mode 100644 meta/recipes-extended/ghostscript/ghostscript/CVE-2023-43115.patch
create mode 100644 meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch
create mode 100644 meta/recipes-support/libpcre/libpcre2/CVE-2022-1586-regression.patch
--
2.34.1
next reply other threads:[~2023-10-10 14:14 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-10 14:14 Steve Sakoman [this message]
2023-10-10 14:14 ` [OE-core][dunfell 01/11] cups: Backport fix for CVE-2023-32360 and CVE-2023-4504 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 02/11] gawk: backport Debian patch to fix CVE-2023-4156 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 03/11] go: Update fix for CVE-2023-24538 & CVE-2023-39318 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 04/11] dbus: Backport fix for CVE-2023-34969 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 05/11] dbus: Add missing CVE_PRODUCT Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 06/11] xdg-utils: Fix CVE-2022-4055 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 07/11] libpcre2 : Follow up fix CVE-2022-1586 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 08/11] ghostscript: Backport fix CVE-2023-43115 Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 09/11] busybox: Backport CVE-2022-48174 fix Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 10/11] openssl: Upgrade 1.1.1v -> 1.1.1w Steve Sakoman
2023-10-10 14:14 ` [OE-core][dunfell 11/11] cpio: Replace fix wrong CRC with ASCII CRC for large files with upstream backport Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2023-12-06 13:55 [OE-core][dunfell 00/11] Patch review Steve Sakoman
2023-06-08 2:35 Steve Sakoman
2023-05-20 16:04 Steve Sakoman
2022-11-12 14:09 Steve Sakoman
2022-08-18 16:56 Steve Sakoman
2022-08-10 22:31 Steve Sakoman
2022-06-02 2:30 Steve Sakoman
2022-04-16 19:14 Steve Sakoman
2022-01-20 21:23 Steve Sakoman
2022-01-13 14:37 Steve Sakoman
2021-04-08 16:31 Steve Sakoman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1696946306.git.steve@sakoman.com \
--to=steve@sakoman.com \
--cc=openembedded-core@lists.openembedded.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox