* [OE-core][kirkstone 0/6] Patch review
@ 2023-04-05 2:29 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-04-05 2:29 UTC (permalink / raw)
To: openembedded-core
Please review this final set of patches for the kirkstone 4.0.9 release and
have comments back by end of day Thursday.
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/5147
The following changes since commit 3eeab90fd45a1e8de6d9d16dfdec79c72639614b:
rsync: Turn on -pedantic-errors at the end of 'configure' (2023-03-30 08:29:50 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
http://cgit.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alexander Kanavin (1):
patchelf: replace a rejected patch with an equivalent
uninative.bbclass tweak
Michael Halstead (2):
uninative: Upgrade to 3.8.1 to include libgcc
uninative: Upgrade to 3.9 to include glibc 2.37
Shubham Kulkarni (1):
go-runtime: Security fix for CVE-2022-41723
Simone Weiss (1):
json-c: Add ptest for json-c
pawan (1):
curl: Add fix for CVE-2023-23916
meta/classes/uninative.bbclass | 2 +
.../distro/include/ptest-packagelists.inc | 1 +
meta/conf/distro/include/yocto-uninative.inc | 10 +-
meta/recipes-devtools/go/go-1.17.13.inc | 1 +
.../go/go-1.18/CVE-2022-41723.patch | 156 +++++++++++++
meta/recipes-devtools/json-c/json-c/run-ptest | 20 ++
meta/recipes-devtools/json-c/json-c_0.15.bb | 16 +-
.../patchelf/handle-read-only-files.patch | 65 ------
.../patchelf/patchelf_0.14.5.bb | 1 -
.../curl/curl/CVE-2023-23916.patch | 219 ++++++++++++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 1 +
11 files changed, 419 insertions(+), 73 deletions(-)
create mode 100644 meta/recipes-devtools/go/go-1.18/CVE-2022-41723.patch
create mode 100644 meta/recipes-devtools/json-c/json-c/run-ptest
delete mode 100644 meta/recipes-devtools/patchelf/patchelf/handle-read-only-files.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2023-23916.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2023-10-21 15:28 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2023-10-21 15:28 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, October 24
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6084
The following changes since commit 5570e49791b770271f176a4deeb5f6f1a028cb4a:
uboot-extlinux-config.bbclass: fix missed override syntax migration (2023-10-17 12:19:37 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Lee Chee Yang (1):
qemu: ignore RHEL specific CVE-2023-2680
Meenali Gupta (1):
linux-firmware: upgrade 20230625 -> 20230804
Peter Marko (1):
zlib: patch CVE-2023-45853
Siddharth Doshi (2):
libx11: Security Fix for CVE-2023-43785, CVE-2023-43786 and
CVE-2023-43787
vim: Upgrade 9.0.2009 -> 9.0.2048
Vijay Anusuri (1):
gawk: backport Debian patch to fix CVE-2023-4156
.../zlib/zlib/CVE-2023-45853.patch | 42 +++++++++++++
meta/recipes-core/zlib/zlib_1.2.11.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 4 ++
.../gawk/gawk/CVE-2023-4156.patch | 28 +++++++++
meta/recipes-extended/gawk/gawk_5.1.1.bb | 1 +
.../xorg-lib/libx11/CVE-2023-43785.patch | 62 ++++++++++++++++++
.../xorg-lib/libx11/CVE-2023-43786-0001.patch | 41 ++++++++++++
.../xorg-lib/libx11/CVE-2023-43786-0002.patch | 45 +++++++++++++
.../xorg-lib/libx11/CVE-2023-43786-0003.patch | 51 +++++++++++++++
.../xorg-lib/libx11/CVE-2023-43787.patch | 63 +++++++++++++++++++
.../xorg-lib/libx11_1.7.3.1.bb | 5 ++
...20230625.bb => linux-firmware_20230804.bb} | 4 +-
meta/recipes-support/vim/vim.inc | 4 +-
13 files changed, 347 insertions(+), 4 deletions(-)
create mode 100644 meta/recipes-core/zlib/zlib/CVE-2023-45853.patch
create mode 100644 meta/recipes-extended/gawk/gawk/CVE-2023-4156.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43785.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0001.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0002.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43786-0003.patch
create mode 100644 meta/recipes-graphics/xorg-lib/libx11/CVE-2023-43787.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20230625.bb => linux-firmware_20230804.bb} (99%)
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-01-08 16:14 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-01-08 16:14 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, January 10
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6425
The following changes since commit 227b3d4edad31b0d0045f41133271693265240b0:
tzdata: Upgrade to 2023d (2024-01-02 03:46:18 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Dhairya Nagodra (2):
cve-update-nvd2-native: faster requests with API keys
cve-update-nvd2-native: increase the delay between subsequent request
failures
Dmitry Baryshkov (1):
linux-firmware: upgrade 20230804 -> 20231030
Peter Marko (2):
cve-update-nvd2-native: remove unused variable CVE_SOCKET_TIMEOUT
cve-update-nvd2-native: make number of fetch attemtps configurable
Vijay Anusuri (1):
xserver-xorg: Fix for CVE-2023-6377 and CVE-2023-6478
.../meta/cve-update-nvd2-native.bb | 27 +++++--
.../xserver-xorg/CVE-2023-6377.patch | 79 +++++++++++++++++++
.../xserver-xorg/CVE-2023-6478.patch | 63 +++++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 2 +
...20230804.bb => linux-firmware_20231030.bb} | 4 +-
5 files changed, 165 insertions(+), 10 deletions(-)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6377.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6478.patch
rename meta/recipes-kernel/linux-firmware/{linux-firmware_20230804.bb => linux-firmware_20231030.bb} (99%)
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-01-21 18:57 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-01-21 18:57 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, January 23
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6471
The following changes since commit ebd61290a644a6d9f2b3701e0e7ea050636da76c:
pybootchartgui: fix 2 SyntaxWarnings (2024-01-16 04:10:03 -1000)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (2):
openssl: fix CVE-2023-6237 Excessive time spent checking invalid RSA
public keys
pam: fix CVE-2024-22365 pam_namespace misses
Peter Marko (1):
dropbear: backport patch for CVE-2023-48795
Vijay Anusuri (2):
gnutls: Fix for CVE-2024-0553 and CVE-2024-0567
xserver-xorg: Multiple CVE fixes
Yogita Urade (1):
tiff: fix CVE-2023-6228
.../openssl/openssl/CVE-2023-6237.patch | 127 ++++++++++
.../openssl/openssl_3.0.12.bb | 1 +
meta/recipes-core/dropbear/dropbear.inc | 1 +
.../dropbear/dropbear/CVE-2023-48795.patch | 234 ++++++++++++++++++
.../pam/libpam/CVE-2024-22365.patch | 62 +++++
meta/recipes-extended/pam/libpam_1.5.2.bb | 1 +
.../xserver-xorg/CVE-2023-6816.patch | 55 ++++
.../xserver-xorg/CVE-2024-0229-1.patch | 87 +++++++
.../xserver-xorg/CVE-2024-0229-2.patch | 221 +++++++++++++++++
.../xserver-xorg/CVE-2024-0229-3.patch | 41 +++
.../xserver-xorg/CVE-2024-0229-4.patch | 45 ++++
.../xserver-xorg/CVE-2024-0408.patch | 64 +++++
.../xserver-xorg/CVE-2024-0409.patch | 46 ++++
.../xserver-xorg/CVE-2024-21885.patch | 113 +++++++++
.../xserver-xorg/CVE-2024-21886-1.patch | 74 ++++++
.../xserver-xorg/CVE-2024-21886-2.patch | 57 +++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 10 +
.../libtiff/tiff/CVE-2023-6228.patch | 31 +++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
.../gnutls/gnutls/CVE-2024-0553.patch | 125 ++++++++++
.../gnutls/gnutls/CVE-2024-0567.patch | 184 ++++++++++++++
meta/recipes-support/gnutls/gnutls_3.7.4.bb | 2 +
22 files changed, 1582 insertions(+)
create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-6237.patch
create mode 100644 meta/recipes-core/dropbear/dropbear/CVE-2023-48795.patch
create mode 100644 meta/recipes-extended/pam/libpam/CVE-2024-22365.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2023-6816.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-1.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-2.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-3.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0229-4.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0408.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-0409.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21885.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-1.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-21886-2.patch
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2023-6228.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2024-0553.patch
create mode 100644 meta/recipes-support/gnutls/gnutls/CVE-2024-0567.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-05-13 12:18 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-05-13 12:18 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, May 17
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6895
The following changes since commit 24fd9b6756728a0337100f53a1c6e92aba092f9d:
ppp: Add RSA-MD in LICENSE (2024-05-08 05:19:26 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Archana Polampalli (2):
xserver-xorg: fix CVE-2024-31082
xserver-xorg: fix CVE-2024-31083
Bhabu Bindu (1):
libpciaccess: Remove duplicated license entry
Peter Marko (1):
glibc: Update to latest on stable 2.35 branch
Vijay Anusuri (2):
bluez5: Fix CVE-2023-27349 CVE-2023-50229 & CVE-2023-50230
gstreamer1.0-plugins-bad: fix CVE-2023-50186
meta/recipes-connectivity/bluez5/bluez5.inc | 2 +
.../bluez5/bluez5/CVE-2023-27349.patch | 48 +++++++
.../CVE-2023-50229_CVE-2023-50230.patch | 67 ++++++++++
meta/recipes-core/glibc/glibc-version.inc | 2 +-
...y-the-header-between-arm-and-aarch64.patch | 64 +++++-----
meta/recipes-core/glibc/glibc_2.35.bb | 5 +-
.../xorg-lib/libpciaccess_0.16.bb | 2 +-
.../xserver-xorg/CVE-2024-31082.patch | 52 ++++++++
.../xserver-xorg/CVE-2024-31083-0001.patch | 117 ++++++++++++++++++
.../xserver-xorg/CVE-2024-31083-0002.patch | 76 ++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 3 +
.../CVE-2023-50186.patch | 70 +++++++++++
.../gstreamer1.0-plugins-bad_1.20.7.bb | 1 +
13 files changed, 478 insertions(+), 31 deletions(-)
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2023-27349.patch
create mode 100644 meta/recipes-connectivity/bluez5/bluez5/CVE-2023-50229_CVE-2023-50230.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31082.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31083-0001.patch
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2024-31083-0002.patch
create mode 100644 meta/recipes-multimedia/gstreamer/gstreamer1.0-plugins-bad/CVE-2023-50186.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-07-20 12:42 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-07-20 12:42 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, July 23
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7158
The following changes since commit 5d97b0576e98a2cf402abab1a1edcab223545d87:
build-appliance-image: Update to kirkstone head revision (2024-07-15 10:31:11 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Ashish Sharma (1):
ruby: backport fix for CVE-2024-27282
Florian Amstutz (1):
uboot-sign: Fix index error in concat_dtb_helper() with multiple
configs
Hitendra Prajapati (1):
busybox: Fix CVE-2023-42363
Peter Marko (2):
busybox: Patch CVE-2021-42380
libarchive: ignore CVE-2024-37407
Vijay Anusuri (1):
python3-jinja2: Upgrade 3.1.3 -> 3.1.4
meta/classes/uboot-sign.bbclass | 6 +-
.../busybox/busybox/CVE-2021-42380.patch | 151 ++++++++++++++++++
.../busybox/busybox/CVE-2023-42363.patch | 68 ++++++++
meta/recipes-core/busybox/busybox_1.35.0.bb | 2 +
...inja2_3.1.3.bb => python3-jinja2_3.1.4.bb} | 8 +-
.../ruby/ruby/CVE-2024-27282.patch | 29 ++++
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 +
.../libarchive/libarchive_3.6.2.bb | 2 +
8 files changed, 261 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2021-42380.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-42363.patch
rename meta/recipes-devtools/python/{python3-jinja2_3.1.3.bb => python3-jinja2_3.1.4.bb} (82%)
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2024-27282.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-08-25 18:49 Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 1/6] libyaml: ignore CVE-2024-35326 Steve Sakoman
` (5 more replies)
0 siblings, 6 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, August 27
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7272
The following changes since commit 6c1000a2bbfe5e618e42bc5be2058332337d4177:
python3-pycryptodome(x): use python_setuptools_build_meta build class (2024-08-15 05:58:11 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Guocai He (1):
libsoup: fix compile error on centos7
Leon Anavi (1):
python3: add PACKAGECONFIG[editline]
Niko Mauno (1):
image_types.bbclass: Use --force also with lz4,lzop
Peter Marko (1):
libyaml: ignore CVE-2024-35326
Siddharth Doshi (2):
Tiff: Security fix for CVE-2024-7006
curl: Security fix for CVE-2024-7264
meta/classes/image_types.bbclass | 4 +-
.../python/python3_3.10.14.bb | 5 +-
.../libtiff/tiff/CVE-2024-7006.patch | 64 ++++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
.../curl/curl/CVE-2024-7264_1.patch | 66 ++++
.../curl/curl/CVE-2024-7264_2.patch | 320 ++++++++++++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 2 +
.../0001-meson.build-set-c_std-to-gnu99.patch | 44 +++
.../libsoup/libsoup-2.4_2.74.2.bb | 4 +-
meta/recipes-support/libyaml/libyaml_0.2.5.bb | 2 +-
10 files changed, 506 insertions(+), 6 deletions(-)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2024-7006.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-7264_1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-7264_2.patch
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/0001-meson.build-set-c_std-to-gnu99.patch
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 1/6] libyaml: ignore CVE-2024-35326
2024-08-25 18:49 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
@ 2024-08-25 18:49 ` Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 2/6] Tiff: Security fix for CVE-2024-7006 Steve Sakoman
` (4 subsequent siblings)
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
From: Peter Marko <peter.marko@siemens.com>
This is the same problem as already ignored CVE-2024-35328.
See laso this comment in addition:
https://github.com/yaml/libyaml/issues/298#issuecomment-2167684233
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-support/libyaml/libyaml_0.2.5.bb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/meta/recipes-support/libyaml/libyaml_0.2.5.bb b/meta/recipes-support/libyaml/libyaml_0.2.5.bb
index f7c29e7e0f..e30dc5a43f 100644
--- a/meta/recipes-support/libyaml/libyaml_0.2.5.bb
+++ b/meta/recipes-support/libyaml/libyaml_0.2.5.bb
@@ -19,6 +19,6 @@ DISABLE_STATIC:class-nativesdk = ""
DISABLE_STATIC:class-native = ""
# upstream-wontfix: Upstream thinks there is no working code that is exploitable - https://github.com/yaml/libyaml/issues/302
-CVE_CHECK_IGNORE += "CVE-2024-35328"
+CVE_CHECK_IGNORE += "CVE-2024-35326 CVE-2024-35328"
BBCLASSEXTEND = "native nativesdk"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 2/6] Tiff: Security fix for CVE-2024-7006
2024-08-25 18:49 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 1/6] libyaml: ignore CVE-2024-35326 Steve Sakoman
@ 2024-08-25 18:49 ` Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 3/6] curl: Security fix for CVE-2024-7264 Steve Sakoman
` (3 subsequent siblings)
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Upstream-Status: Backport from [https://gitlab.com/libtiff/libtiff/-/commit/818fb8ce881cf839fbc710f6690aadb992aa0f9e]
CVE's Fixed:
CVE-2024-7006 libtiff: NULL pointer dereference in tif_dirinfo.c
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../libtiff/tiff/CVE-2024-7006.patch | 64 +++++++++++++++++++
meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 +
2 files changed, 65 insertions(+)
create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2024-7006.patch
diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2024-7006.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2024-7006.patch
new file mode 100644
index 0000000000..217de0ea92
--- /dev/null
+++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2024-7006.patch
@@ -0,0 +1,64 @@
+From 818fb8ce881cf839fbc710f6690aadb992aa0f9e Mon Sep 17 00:00:00 2001
+From: Su_Laus <sulau@freenet.de>
+Date: Fri, 1 Dec 2023 20:12:25 +0100
+Subject: [PATCH] Check return value of _TIFFCreateAnonField().
+
+Fixes #624
+
+Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/818fb8ce881cf839fbc710f6690aadb992aa0f9e]
+CVE: CVE-2024-7006
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ libtiff/tif_dirinfo.c | 2 +-
+ libtiff/tif_dirread.c | 15 ++++++---------
+ 2 files changed, 7 insertions(+), 10 deletions(-)
+
+diff --git a/libtiff/tif_dirinfo.c b/libtiff/tif_dirinfo.c
+index a212d01..95226a8 100644
+--- a/libtiff/tif_dirinfo.c
++++ b/libtiff/tif_dirinfo.c
+@@ -797,7 +797,7 @@ _TIFFFindOrRegisterField(TIFF *tif, uint32_t tag, TIFFDataType dt)
+ fld = TIFFFindField(tif, tag, dt);
+ if (fld == NULL) {
+ fld = _TIFFCreateAnonField(tif, tag, dt);
+- if (!_TIFFMergeFields(tif, fld, 1))
++ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1))
+ return NULL;
+ }
+
+diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
+index 0e283fc..1781166 100644
+--- a/libtiff/tif_dirread.c
++++ b/libtiff/tif_dirread.c
+@@ -3735,11 +3735,9 @@ TIFFReadDirectory(TIFF* tif)
+ dp->tdir_tag,dp->tdir_tag);
+ /* the following knowingly leaks the
+ anonymous field structure */
+- if (!_TIFFMergeFields(tif,
+- _TIFFCreateAnonField(tif,
+- dp->tdir_tag,
+- (TIFFDataType) dp->tdir_type),
+- 1)) {
++ const TIFFField *fld = _TIFFCreateAnonField(
++ tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
++ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1)) {
+ TIFFWarningExt(tif->tif_clientdata,
+ module,
+ "Registering anonymous field with tag %"PRIu16" (0x%"PRIx16") failed",
+@@ -4502,10 +4500,9 @@ TIFFReadCustomDirectory(TIFF* tif, toff_t diroff,
+ TIFFWarningExt(tif->tif_clientdata, module,
+ "Unknown field with tag %"PRIu16" (0x%"PRIx16") encountered",
+ dp->tdir_tag, dp->tdir_tag);
+- if (!_TIFFMergeFields(tif, _TIFFCreateAnonField(tif,
+- dp->tdir_tag,
+- (TIFFDataType) dp->tdir_type),
+- 1)) {
++ const TIFFField *fld = _TIFFCreateAnonField(
++ tif, dp->tdir_tag, (TIFFDataType)dp->tdir_type);
++ if (fld == NULL || !_TIFFMergeFields(tif, fld, 1)) {
+ TIFFWarningExt(tif->tif_clientdata, module,
+ "Registering anonymous field with tag %"PRIu16" (0x%"PRIx16") failed",
+ dp->tdir_tag, dp->tdir_tag);
+--
+2.35.7
+
diff --git a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
index b4af179e76..209b38b8f2 100644
--- a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
+++ b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb
@@ -53,6 +53,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \
file://CVE-2023-6277-2.patch \
file://CVE-2023-6277-3.patch \
file://CVE-2023-6277-4.patch \
+ file://CVE-2024-7006.patch \
"
SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 3/6] curl: Security fix for CVE-2024-7264
2024-08-25 18:49 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 1/6] libyaml: ignore CVE-2024-35326 Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 2/6] Tiff: Security fix for CVE-2024-7006 Steve Sakoman
@ 2024-08-25 18:49 ` Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 4/6] python3: add PACKAGECONFIG[editline] Steve Sakoman
` (2 subsequent siblings)
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
From: Siddharth Doshi <sdoshi@mvista.com>
Upstream-Status: Backport from [https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519]
CVE's Fixed:
============
CVE-2024-7264 libcurl: ASN.1 date parser overread
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../curl/curl/CVE-2024-7264_1.patch | 66 ++++
.../curl/curl/CVE-2024-7264_2.patch | 320 ++++++++++++++++++
meta/recipes-support/curl/curl_7.82.0.bb | 2 +
3 files changed, 388 insertions(+)
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-7264_1.patch
create mode 100644 meta/recipes-support/curl/curl/CVE-2024-7264_2.patch
diff --git a/meta/recipes-support/curl/curl/CVE-2024-7264_1.patch b/meta/recipes-support/curl/curl/CVE-2024-7264_1.patch
new file mode 100644
index 0000000000..2e1d8eeaaa
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2024-7264_1.patch
@@ -0,0 +1,66 @@
+From 3c914bc680155b32178f1f15ca8d47c7f4640afe Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 30 Jul 2024 10:05:17 +0200
+Subject: [PATCH] x509asn1: clean up GTime2str
+
+Co-authored-by: Stefan Eissing
+Reported-by: Dov Murik
+
+Closes #14307
+
+Note: This patch is needed by the main patch to be backported.
+
+Upstream-Status: Backport from [https://github.com/curl/curl/commit/3c914bc680155b32178f1f15ca8d47c7f4640afe]
+CVE: CVE-2024-7264
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ lib/vtls/x509asn1.c | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/lib/vtls/x509asn1.c b/lib/vtls/x509asn1.c
+index f64acb8..b538bd9 100644
+--- a/lib/vtls/x509asn1.c
++++ b/lib/vtls/x509asn1.c
+@@ -539,7 +539,7 @@ static const char *GTime2str(const char *beg, const char *end)
+ /* Convert an ASN.1 Generalized time to a printable string.
+ Return the dynamically allocated string, or NULL if an error occurs. */
+
+- for(fracp = beg; fracp < end && *fracp >= '0' && *fracp <= '9'; fracp++)
++ for(fracp = beg; fracp < end && ISDIGIT(*fracp); fracp++)
+ ;
+
+ /* Get seconds digits. */
+@@ -558,17 +558,22 @@ static const char *GTime2str(const char *beg, const char *end)
+ return NULL;
+ }
+
+- /* Scan for timezone, measure fractional seconds. */
++ /* timezone follows optional fractional seconds. */
+ tzp = fracp;
+- fracl = 0;
++ fracl = 0; /* no fractional seconds detected so far */
+ if(fracp < end && (*fracp == '.' || *fracp == ',')) {
+- fracp++;
+- do
++ /* Have fractional seconds, e.g. "[.,]\d+". How many? */
++ tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
++ while(tzp < end && ISDIGIT(*tzp))
+ tzp++;
+- while(tzp < end && *tzp >= '0' && *tzp <= '9');
+- /* Strip leading zeroes in fractional seconds. */
+- for(fracl = tzp - fracp - 1; fracl && fracp[fracl - 1] == '0'; fracl--)
+- ;
++ if(tzp == fracp) /* never looped, no digit after [.,] */
++ return CURLE_BAD_FUNCTION_ARGUMENT;
++ fracl = tzp - fracp - 1; /* number of fractional sec digits */
++ DEBUGASSERT(fracl > 0);
++ /* Strip trailing zeroes in fractional seconds.
++ * May reduce fracl to 0 if only '0's are present. */
++ while(fracl && fracp[fracl - 1] == '0')
++ fracl--;
+ }
+
+ /* Process timezone. */
+--
+2.35.7
+
diff --git a/meta/recipes-support/curl/curl/CVE-2024-7264_2.patch b/meta/recipes-support/curl/curl/CVE-2024-7264_2.patch
new file mode 100644
index 0000000000..e8853c1e0c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2024-7264_2.patch
@@ -0,0 +1,320 @@
+From 27959ecce75cdb2809c0bdb3286e60e08fadb519 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Tue, 30 Jul 2024 16:40:48 +0200
+Subject: [PATCH] x509asn1: unittests and fixes for gtime2str
+
+Fix issues in GTime2str() and add unit test cases to verify correct
+behaviour.
+
+Follow-up to 3c914bc6801
+
+Closes #14316
+
+Upstream-Status: Backport from [https://github.com/curl/curl/commit/27959ecce75cdb2809c0bdb3286e60e08fadb519]
+CVE: CVE-2024-7264
+Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
+---
+ lib/vtls/x509asn1.c | 32 +++++++---
+ lib/vtls/x509asn1.h | 11 ++++
+ tests/data/Makefile.inc | 2 +-
+ tests/data/test1656 | 22 +++++++
+ tests/unit/Makefile.inc | 4 +-
+ tests/unit/unit1656.c | 133 ++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 194 insertions(+), 10 deletions(-)
+ create mode 100644 tests/data/test1656
+ create mode 100644 tests/unit/unit1656.c
+
+diff --git a/lib/vtls/x509asn1.c b/lib/vtls/x509asn1.c
+index b538bd9..a25a6e6 100644
+--- a/lib/vtls/x509asn1.c
++++ b/lib/vtls/x509asn1.c
+@@ -563,12 +563,13 @@ static const char *GTime2str(const char *beg, const char *end)
+ fracl = 0; /* no fractional seconds detected so far */
+ if(fracp < end && (*fracp == '.' || *fracp == ',')) {
+ /* Have fractional seconds, e.g. "[.,]\d+". How many? */
+- tzp = fracp++; /* should be a digit char or BAD ARGUMENT */
++ fracp++; /* should be a digit char or BAD ARGUMENT */
++ tzp = fracp;
+ while(tzp < end && ISDIGIT(*tzp))
+ tzp++;
+ if(tzp == fracp) /* never looped, no digit after [.,] */
+ return CURLE_BAD_FUNCTION_ARGUMENT;
+- fracl = tzp - fracp - 1; /* number of fractional sec digits */
++ fracl = tzp - fracp; /* number of fractional sec digits */
+ DEBUGASSERT(fracl > 0);
+ /* Strip trailing zeroes in fractional seconds.
+ * May reduce fracl to 0 if only '0's are present. */
+@@ -577,18 +578,24 @@ static const char *GTime2str(const char *beg, const char *end)
+ }
+
+ /* Process timezone. */
+- if(tzp >= end)
+- ; /* Nothing to do. */
++ if(tzp >= end) {
++ tzp = "";
++ tzl = 0;
++ }
+ else if(*tzp == 'Z') {
+- tzp = " GMT";
+- end = tzp + 4;
++ sep = " ";
++ tzp = "GMT";
++ tzl = 3;
++ }
++ else if((*tzp == '+') || (*tzp == '-')) {
++ sep = " UTC";
++ tzl = end - tzp;
+ }
+ else {
+ sep = " ";
+- tzp++;
++ tzl = end - tzp;
+ }
+
+- tzl = end - tzp;
+ return curl_maprintf("%.4s-%.2s-%.2s %.2s:%.2s:%c%c%s%.*s%s%.*s",
+ beg, beg + 4, beg + 6,
+ beg + 8, beg + 10, sec1, sec2,
+@@ -596,6 +603,15 @@ static const char *GTime2str(const char *beg, const char *end)
+ sep, (int)tzl, tzp);
+ }
+
++#ifdef UNITTESTS
++/* used by unit1656.c */
++CURLcode Curl_x509_GTime2str(struct dynbuf *store,
++ const char *beg, const char *end)
++{
++ return GTime2str(store, beg, end);
++}
++#endif
++
+ /*
+ * Convert an ASN.1 UTC time to a printable string.
+ * Return the dynamically allocated string, or NULL if an error occurs.
+diff --git a/lib/vtls/x509asn1.h b/lib/vtls/x509asn1.h
+index db7df0e..515cb7e 100644
+--- a/lib/vtls/x509asn1.h
++++ b/lib/vtls/x509asn1.h
+@@ -73,6 +73,17 @@ CURLcode Curl_extract_certinfo(struct Curl_easy *data, int certnum,
+ const char *beg, const char *end);
+ CURLcode Curl_verifyhost(struct Curl_easy *data, struct connectdata *conn,
+ const char *beg, const char *end);
++
++#ifdef UNITTESTS
++#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
++ defined(USE_MBEDTLS)
++
++/* used by unit1656.c */
++CURLcode Curl_x509_GTime2str(struct dynbuf *store,
++ const char *beg, const char *end);
++#endif
++#endif
++
+ #endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL
+ * or USE_SECTRANSP */
+ #endif /* HEADER_CURL_X509ASN1_H */
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 47117b6..5415f37 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -208,7 +208,7 @@ test1620 test1621 \
+ \
+ test1630 test1631 test1632 test1633 test1634 \
+ \
+-test1650 test1651 test1652 test1653 test1654 test1655 \
++test1650 test1651 test1652 test1653 test1654 test1655 test1656 \
+ test1660 test1661 \
+ \
+ test1700 test1701 test1702 test1703 \
+diff --git a/tests/data/test1656 b/tests/data/test1656
+new file mode 100644
+index 0000000..2fab21b
+--- /dev/null
++++ b/tests/data/test1656
+@@ -0,0 +1,22 @@
++<testcase>
++<info>
++<keywords>
++unittest
++Curl_x509_GTime2str
++</keywords>
++</info>
++
++#
++# Client-side
++<client>
++<server>
++none
++</server>
++<features>
++unittest
++</features>
++<name>
++Curl_x509_GTime2str unit tests
++</name>
++</client>
++</testcase>
+diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc
+index 7e7844e..b5650b2 100644
+--- a/tests/unit/Makefile.inc
++++ b/tests/unit/Makefile.inc
+@@ -34,7 +34,7 @@ UNITPROGS = unit1300 unit1301 unit1302 unit1303 unit1304 unit1305 unit1307 \
+ unit1600 unit1601 unit1602 unit1603 unit1604 unit1605 unit1606 unit1607 \
+ unit1608 unit1609 unit1610 unit1611 unit1612 \
+ unit1620 unit1621 \
+- unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 \
++ unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 unit1656 \
+ unit1660 unit1661
+
+ unit1300_SOURCES = unit1300.c $(UNITFILES)
+@@ -155,6 +155,8 @@ unit1654_CPPFLAGS = $(AM_CPPFLAGS)
+ unit1655_SOURCES = unit1655.c $(UNITFILES)
+ unit1655_CPPFLAGS = $(AM_CPPFLAGS)
+
++unit1656_SOURCES = unit1656.c $(UNITFILES)
++
+ unit1660_SOURCES = unit1660.c $(UNITFILES)
+ unit1660_CPPFLAGS = $(AM_CPPFLAGS)
+
+diff --git a/tests/unit/unit1656.c b/tests/unit/unit1656.c
+new file mode 100644
+index 0000000..644e72f
+--- /dev/null
++++ b/tests/unit/unit1656.c
+@@ -0,0 +1,133 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "curlcheck.h"
++
++#include "vtls/x509asn1.h"
++
++static CURLcode unit_setup(void)
++{
++ return CURLE_OK;
++}
++
++static void unit_stop(void)
++{
++
++}
++
++#if defined(USE_GNUTLS) || defined(USE_SCHANNEL) || defined(USE_SECTRANSP) || \
++ defined(USE_MBEDTLS)
++
++#ifndef ARRAYSIZE
++#define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
++#endif
++
++struct test_spec {
++ const char *input;
++ const char *exp_output;
++ CURLcode exp_result;
++};
++
++static struct test_spec test_specs[] = {
++ { "190321134340", "1903-21-13 43:40:00", CURLE_OK },
++ { "", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
++ { "WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
++ { "0WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
++ { "19032113434", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
++ { "19032113434WTF", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
++ { "190321134340.", NULL, CURLE_BAD_FUNCTION_ARGUMENT },
++ { "190321134340.1", "1903-21-13 43:40:00.1", CURLE_OK },
++ { "19032113434017.0", "1903-21-13 43:40:17", CURLE_OK },
++ { "19032113434017.01", "1903-21-13 43:40:17.01", CURLE_OK },
++ { "19032113434003.001", "1903-21-13 43:40:03.001", CURLE_OK },
++ { "19032113434003.090", "1903-21-13 43:40:03.09", CURLE_OK },
++ { "190321134340Z", "1903-21-13 43:40:00 GMT", CURLE_OK },
++ { "19032113434017.0Z", "1903-21-13 43:40:17 GMT", CURLE_OK },
++ { "19032113434017.01Z", "1903-21-13 43:40:17.01 GMT", CURLE_OK },
++ { "19032113434003.001Z", "1903-21-13 43:40:03.001 GMT", CURLE_OK },
++ { "19032113434003.090Z", "1903-21-13 43:40:03.09 GMT", CURLE_OK },
++ { "190321134340CET", "1903-21-13 43:40:00 CET", CURLE_OK },
++ { "19032113434017.0CET", "1903-21-13 43:40:17 CET", CURLE_OK },
++ { "19032113434017.01CET", "1903-21-13 43:40:17.01 CET", CURLE_OK },
++ { "190321134340+02:30", "1903-21-13 43:40:00 UTC+02:30", CURLE_OK },
++ { "19032113434017.0+02:30", "1903-21-13 43:40:17 UTC+02:30", CURLE_OK },
++ { "19032113434017.01+02:30", "1903-21-13 43:40:17.01 UTC+02:30", CURLE_OK },
++ { "190321134340-3", "1903-21-13 43:40:00 UTC-3", CURLE_OK },
++ { "19032113434017.0-04", "1903-21-13 43:40:17 UTC-04", CURLE_OK },
++ { "19032113434017.01-01:10", "1903-21-13 43:40:17.01 UTC-01:10", CURLE_OK },
++};
++
++static bool do_test(struct test_spec *spec, size_t i, struct dynbuf *dbuf)
++{
++ CURLcode result;
++ const char *in = spec->input;
++
++ Curl_dyn_reset(dbuf);
++ result = Curl_x509_GTime2str(dbuf, in, in + strlen(in));
++ if(result != spec->exp_result) {
++ fprintf(stderr, "test %zu: expect result %d, got %d\n",
++ i, spec->exp_result, result);
++ return FALSE;
++ }
++ else if(!result && strcmp(spec->exp_output, Curl_dyn_ptr(dbuf))) {
++ fprintf(stderr, "test %zu: input '%s', expected output '%s', got '%s'\n",
++ i, in, spec->exp_output, Curl_dyn_ptr(dbuf));
++ return FALSE;
++ }
++
++ return TRUE;
++}
++
++UNITTEST_START
++{
++ size_t i;
++ struct dynbuf dbuf;
++ bool all_ok = TRUE;
++
++ Curl_dyn_init(&dbuf, 32*1024);
++
++ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
++ fprintf(stderr, "curl_global_init() failed\n");
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ for(i = 0; i < ARRAYSIZE(test_specs); ++i) {
++ if(!do_test(&test_specs[i], i, &dbuf))
++ all_ok = FALSE;
++ }
++ fail_unless(all_ok, "some tests of Curl_x509_GTime2str() fails");
++
++ Curl_dyn_free(&dbuf);
++ curl_global_cleanup();
++}
++UNITTEST_STOP
++
++#else
++
++UNITTEST_START
++{
++ puts("not tested since Curl_x509_GTime2str() is not built-in");
++}
++UNITTEST_STOP
++
++#endif
+--
+2.35.7
+
diff --git a/meta/recipes-support/curl/curl_7.82.0.bb b/meta/recipes-support/curl/curl_7.82.0.bb
index 72d8544e08..81a653b583 100644
--- a/meta/recipes-support/curl/curl_7.82.0.bb
+++ b/meta/recipes-support/curl/curl_7.82.0.bb
@@ -58,6 +58,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2023-46219-0002.patch \
file://CVE-2023-46219-0003.patch \
file://CVE-2024-2398.patch \
+ file://CVE-2024-7264_1.patch \
+ file://CVE-2024-7264_2.patch \
"
SRC_URI[sha256sum] = "0aaa12d7bd04b0966254f2703ce80dd5c38dbbd76af0297d3d690cdce58a583c"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 4/6] python3: add PACKAGECONFIG[editline]
2024-08-25 18:49 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
` (2 preceding siblings ...)
2024-08-25 18:49 ` [OE-core][kirkstone 3/6] curl: Security fix for CVE-2024-7264 Steve Sakoman
@ 2024-08-25 18:49 ` Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 5/6] image_types.bbclass: Use --force also with lz4,lzop Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 6/6] libsoup: fix compile error on centos7 Steve Sakoman
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
From: Leon Anavi <leon.anavi@konsulko.com>
Backport PACKAGECONFIG[editline] from Scarthgap to Kirkstone
because libedit has feature parity with readline but is more
permissively licensed (BSD verses GPLv3). This patch provides
means of enabling editline in a distribution without GPLv3 and
in this case improves Python REPL keyboard support.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/recipes-devtools/python/python3_3.10.14.bb | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-devtools/python/python3_3.10.14.bb b/meta/recipes-devtools/python/python3_3.10.14.bb
index 31c458c09a..b5bc80ab88 100644
--- a/meta/recipes-devtools/python/python3_3.10.14.bb
+++ b/meta/recipes-devtools/python/python3_3.10.14.bb
@@ -106,7 +106,8 @@ CACHED_CONFIGUREVARS = " \
PACKAGECONFIG:class-target ??= "readline gdbm ${@bb.utils.filter('DISTRO_FEATURES', 'lto', d)}"
PACKAGECONFIG:class-native ??= "readline gdbm"
PACKAGECONFIG:class-nativesdk ??= "readline gdbm"
-PACKAGECONFIG[readline] = ",,readline"
+PACKAGECONFIG[readline] = "--with-readline=readline,,readline,,,editline"
+PACKAGECONFIG[editline] = "--with-readline=editline,,libedit,,,readline"
# Use profile guided optimisation by running PyBench inside qemu-user
PACKAGECONFIG[pgo] = "--enable-optimizations,,qemu-native"
PACKAGECONFIG[tk] = ",,tk"
@@ -118,7 +119,7 @@ do_configure:prepend () {
cat > ${B}/Modules/Setup.local << EOF
*disabled*
${@bb.utils.contains('PACKAGECONFIG', 'gdbm', '', '_gdbm _dbm', d)}
-${@bb.utils.contains('PACKAGECONFIG', 'readline', '', 'readline', d)}
+${@bb.utils.contains_any('PACKAGECONFIG', 'readline editline', '', 'readline', d)}
EOF
}
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 5/6] image_types.bbclass: Use --force also with lz4,lzop
2024-08-25 18:49 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
` (3 preceding siblings ...)
2024-08-25 18:49 ` [OE-core][kirkstone 4/6] python3: add PACKAGECONFIG[editline] Steve Sakoman
@ 2024-08-25 18:49 ` Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 6/6] libsoup: fix compile error on centos7 Steve Sakoman
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
From: Niko Mauno <niko.mauno@vaisala.com>
Several conversion commands already make use of 'force' option in the
compression, which enables overwriting existing files without
prompting.
Since occasionally an existing residual destination file from a
previously aborted or failed task can prevent the re-execution of the
conversion command task, by enabling the 'force' option also for lz4
and lzop compression commands we can avoid following kind of BitBake
failures with these compressors:
| DEBUG: Executing shell function do_image_cpio
| 117685 blocks
| 2 blocks
| example-image.cpio.lz4 already exists; do you want to overwrite (y/N) ? not overwritten
| Error 20 : example-image.cpio : open file error
| WARNING: exit code 20 from a shell command.
ERROR: Task (.../recipes-core/images/example-image.bb:do_image_cpio) failed with exit code '1'
(From OE-Core rev: 623ab22434909f10aaf613cd3032cc2a2c6e3ff9)
Signed-off-by: Niko Mauno <niko.mauno@vaisala.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
meta/classes/image_types.bbclass | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/meta/classes/image_types.bbclass b/meta/classes/image_types.bbclass
index 9d5f8c68a4..72245019f4 100644
--- a/meta/classes/image_types.bbclass
+++ b/meta/classes/image_types.bbclass
@@ -292,8 +292,8 @@ CONVERSION_CMD:lzma = "lzma -k -f -7 ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}"
CONVERSION_CMD:gz = "gzip -f -9 -n -c --rsyncable ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type} > ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}.gz"
CONVERSION_CMD:bz2 = "pbzip2 -f -k ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}"
CONVERSION_CMD:xz = "xz -f -k -c ${XZ_COMPRESSION_LEVEL} ${XZ_DEFAULTS} --check=${XZ_INTEGRITY_CHECK} ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type} > ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}.xz"
-CONVERSION_CMD:lz4 = "lz4 -9 -z -l ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type} ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}.lz4"
-CONVERSION_CMD:lzo = "lzop -9 ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}"
+CONVERSION_CMD:lz4 = "lz4 -f -9 -z -l ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type} ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}.lz4"
+CONVERSION_CMD:lzo = "lzop -f -9 ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}"
CONVERSION_CMD:zip = "zip ${ZIP_COMPRESSION_LEVEL} ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}.zip ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}"
CONVERSION_CMD:zst = "zstd -f -k -T0 -c ${ZSTD_COMPRESSION_LEVEL} ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type} > ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}.zst"
CONVERSION_CMD:sum = "sumtool -i ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type} -o ${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.${type}.sum ${JFFS2_SUM_EXTRA_ARGS}"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 6/6] libsoup: fix compile error on centos7
2024-08-25 18:49 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
` (4 preceding siblings ...)
2024-08-25 18:49 ` [OE-core][kirkstone 5/6] image_types.bbclass: Use --force also with lz4,lzop Steve Sakoman
@ 2024-08-25 18:49 ` Steve Sakoman
5 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-08-25 18:49 UTC (permalink / raw)
To: openembedded-core
From: Guocai He <guocai.he.cn@windriver.com>
Backport a patch [1] to fix the below build failure.
FAILED: libsoup/libsoup-2.4.so.1.11.0.p/soup-address.c.o
In file included from /usr/include/glib-2.0/gio/gnetworking.h:40,
from ../libsoup-2.72.0/libsoup/soup-address.c:14:
/usr/include/resolv.h:75:15: error: unknown type name ‘u_char’
const u_char **__query,
^~~~~~
[1] https://gitlab.gnome.org/GNOME/libsoup/-/commit/5c3d431bdb094c59997f2a23e31e83f815ab667c
Signed-off-by: Guocai He <guocai.he.cn@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
.../0001-meson.build-set-c_std-to-gnu99.patch | 44 +++++++++++++++++++
.../libsoup/libsoup-2.4_2.74.2.bb | 4 +-
2 files changed, 47 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/0001-meson.build-set-c_std-to-gnu99.patch
diff --git a/meta/recipes-support/libsoup/libsoup-2.4/0001-meson.build-set-c_std-to-gnu99.patch b/meta/recipes-support/libsoup/libsoup-2.4/0001-meson.build-set-c_std-to-gnu99.patch
new file mode 100644
index 0000000000..4a7d189515
--- /dev/null
+++ b/meta/recipes-support/libsoup/libsoup-2.4/0001-meson.build-set-c_std-to-gnu99.patch
@@ -0,0 +1,44 @@
+From c41784deb1d4a923007ffe14cfa676f785808f45 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Wed, 21 Aug 2024 06:48:32 +0000
+Subject: [PATCH] meson.build: set c_std to gnu99
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Set c_std to gnu99 to avoid the following build failure with gcc 4.8:
+
+In file included from /tmp/instance-0/output-1/host/arm-buildroot-linux-gnueabi/sysroot/usr/include/resolv.h:65:0,
+ from /tmp/instance-0/output-1/host/arm-buildroot-linux-gnueabi/sysroot/usr/include/glib-2.0/gio/gnetworking.h:40,
+ from ../libsoup/soup-address.c:14:
+/tmp/instance-0/output-1/host/arm-buildroot-linux-gnueabi/sysroot/usr/include/arpa/nameser.h:115:2: error: unknown type name 'u_char'
+ const u_char *_msg, *_eom;
+ ^
+
+Fixes:
+ - http://autobuild.buildroot.org/results/56b9cb987e25b99d6fed16c537552f47c3376f21
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/5c3d431bdb094c59997f2a23e31e83f815ab667c]
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Signed-off-by: guocai <guocai.he.cn@windriver.com>
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 3cc56fb..506c5a4 100644
+--- a/meson.build
++++ b/meson.build
+@@ -2,7 +2,7 @@ project('libsoup', 'c',
+ version: '2.74.2',
+ meson_version : '>=0.50',
+ license : 'LGPL2',
+- default_options : 'c_std=c99')
++ default_options : 'c_std=gnu99')
+
+ gnome = import('gnome')
+
+--
+2.35.5
+
diff --git a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
index 6ff393c9a3..be286e1849 100644
--- a/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
+++ b/meta/recipes-support/libsoup/libsoup-2.4_2.74.2.bb
@@ -11,7 +11,9 @@ DEPENDS = "glib-2.0 glib-2.0-native libxml2 sqlite3 libpsl"
SHRT_VER = "${@d.getVar('PV').split('.')[0]}.${@d.getVar('PV').split('.')[1]}"
-SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz"
+SRC_URI = "${GNOME_MIRROR}/libsoup/${SHRT_VER}/libsoup-${PV}.tar.xz \
+ file://0001-meson.build-set-c_std-to-gnu99.patch \
+ "
SRC_URI[sha256sum] = "f0a427656e5fe19e1df71c107e88dfa1b2e673c25c547b7823b6018b40d01159"
CVE_PRODUCT = "libsoup"
--
2.34.1
^ permalink raw reply related [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2024-09-05 12:40 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2024-09-05 12:40 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Friday, September 6
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/7310
The following changes since commit 6992437d725f9cc88da4261814b69aaadc5ef0f2:
grub: fs/fat: Don't error when mtime is 0 (2024-08-29 06:13:56 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Hitendra Prajapati (1):
qemu: fix CVE-2024-7409
Rohini Sangam (1):
python3: Security fix for CVE-2024-8088
Vijay Anusuri (1):
apr: upgrade 1.7.2 -> 1.7.5
Vrushti Dabhi (2):
sqlite3: CVE-ID correction for CVE-2023-7104
sqlite3: Rename patch for CVE-2022-35737
Wang Mingyu (1):
wireless-regdb: upgrade 2024.05.08 -> 2024.07.04
.../python/python3/CVE-2024-8088.patch | 124 +++++++++++++
.../python/python3_3.10.14.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 4 +
.../qemu/qemu/CVE-2024-7409-0001.patch | 162 ++++++++++++++++
.../qemu/qemu/CVE-2024-7409-0002.patch | 174 ++++++++++++++++++
.../qemu/qemu/CVE-2024-7409-0003.patch | 122 ++++++++++++
.../qemu/qemu/CVE-2024-7409-0004.patch | 163 ++++++++++++++++
....05.08.bb => wireless-regdb_2024.07.04.bb} | 2 +-
...-runtime-test-for-mmap-that-can-map-.patch | 2 +-
.../apr/{apr_1.7.2.bb => apr_1.7.5.bb} | 2 +-
...lementation.patch => CVE-2022-35737.patch} | 0
.../sqlite/files/CVE-2023-7104.patch | 10 +-
meta/recipes-support/sqlite/sqlite3_3.38.5.bb | 4 +-
13 files changed, 761 insertions(+), 9 deletions(-)
create mode 100644 meta/recipes-devtools/python/python3/CVE-2024-8088.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0001.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0002.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0003.patch
create mode 100644 meta/recipes-devtools/qemu/qemu/CVE-2024-7409-0004.patch
rename meta/recipes-kernel/wireless-regdb/{wireless-regdb_2024.05.08.bb => wireless-regdb_2024.07.04.bb} (94%)
rename meta/recipes-support/apr/{apr_1.7.2.bb => apr_1.7.5.bb} (98%)
rename meta/recipes-support/sqlite/files/{0001-sqlite-Increased-the-size-of-loop-variables-in-the-printf-implementation.patch => CVE-2022-35737.patch} (100%)
--
2.34.1
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2025-03-10 13:36 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-10 13:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, March 12
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1152
The following changes since commit 0d9f2fcc2058407eb138297d9f8f12595851b963:
mesa: Fix missing GLES3 headers in SDK sysroot (2025-03-04 08:43:39 -0800)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Alessio Cascone (1):
tzcode-native: Fix compiler setting from 2023d version
Deepesh Varatharajan (1):
binutils: Fix CVE-2025-0840
Hitendra Prajapati (1):
ruby: Fix CVE-2025-27220
Priyal Doshi (1):
tzdata/tzcode-native: upgrade 2024b -> 2025a
Vijay Anusuri (2):
openssh: Fix CVE-2025-26465
libtasn1: upgrade 4.19.0 -> 4.20.0
.../openssh/openssh/CVE-2025-26465.patch | 140 ++++++++++++++++++
.../openssh/openssh_8.9p1.bb | 1 +
.../binutils/binutils-2.38.inc | 1 +
.../binutils/0038-CVE-2025-0840.patch | 53 +++++++
.../ruby/ruby/CVE-2025-27220.patch | 76 ++++++++++
meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 +
meta/recipes-extended/timezone/timezone.inc | 6 +-
.../timezone/tzcode-native.bb | 2 +-
...{libtasn1_4.19.0.bb => libtasn1_4.20.0.bb} | 7 +-
9 files changed, 279 insertions(+), 8 deletions(-)
create mode 100644 meta/recipes-connectivity/openssh/openssh/CVE-2025-26465.patch
create mode 100644 meta/recipes-devtools/binutils/binutils/0038-CVE-2025-0840.patch
create mode 100644 meta/recipes-devtools/ruby/ruby/CVE-2025-27220.patch
rename meta/recipes-support/gnutls/{libtasn1_4.19.0.bb => libtasn1_4.20.0.bb} (63%)
--
2.43.0
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2025-03-24 19:36 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-03-24 19:36 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Wednesday, March 26
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1242
The following changes since commit acb88b244e89bc1300a24f60d0a44c21e0ab1af6:
vim: Upgrade 9.1.1043 -> 9.1.1115 (2025-03-13 09:19:58 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Peter Marko (1):
tiff: mark CVE-2023-30774 as patched
Robert Yang (1):
libxcrypt-compat: Remove libcrypt.so to fix conflict with libcrypt
Vijay Anusuri (2):
libxslt: Fix for CVE-2024-55549
libxslt: Fix for CVE-2025-24855
Yogita Urade (2):
xserver-xorg: fix CVE-2022-49737
xwayland: fix CVE-2022-49737
.../libxcrypt/libxcrypt-compat_4.4.33.bb | 2 +-
.../xserver-xorg/CVE-2022-49737.patch | 90 ++++++++++++
.../xorg-xserver/xserver-xorg_21.1.8.bb | 1 +
.../xwayland/xwayland/CVE-2022-49737.patch | 90 ++++++++++++
.../xwayland/xwayland_22.1.8.bb | 1 +
...-of-TIFFTAG_INKNAMES-and-related-TIF.patch | 4 +-
.../libxslt/libxslt/CVE-2024-55549.patch | 49 +++++++
.../libxslt/libxslt/CVE-2025-24855.patch | 134 ++++++++++++++++++
.../recipes-support/libxslt/libxslt_1.1.35.bb | 5 +-
9 files changed, 373 insertions(+), 3 deletions(-)
create mode 100644 meta/recipes-graphics/xorg-xserver/xserver-xorg/CVE-2022-49737.patch
create mode 100644 meta/recipes-graphics/xwayland/xwayland/CVE-2022-49737.patch
create mode 100644 meta/recipes-support/libxslt/libxslt/CVE-2024-55549.patch
create mode 100644 meta/recipes-support/libxslt/libxslt/CVE-2025-24855.patch
--
2.43.0
^ permalink raw reply [flat|nested] 17+ messages in thread
* [OE-core][kirkstone 0/6] Patch review
@ 2025-05-09 16:16 Steve Sakoman
0 siblings, 0 replies; 17+ messages in thread
From: Steve Sakoman @ 2025-05-09 16:16 UTC (permalink / raw)
To: openembedded-core
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, May 13
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/#/builders/29/builds/1554
The following changes since commit 25ba9895b98715adb66a06e50f644aea2e2c9eb6:
Revert "cve-update-nvd2-native: Tweak to work better with NFS DL_DIR" (2025-04-29 07:45:33 -0700)
are available in the Git repository at:
https://git.openembedded.org/openembedded-core-contrib stable/kirkstone-nut
https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/kirkstone-nut
Haixiao Yan (1):
glibc: Add single-threaded fast path to rand()
Hitendra Prajapati (1):
busybox: fix CVE-2023-39810
Peter Marko (3):
ghostscript: ignore CVE-2025-27837
ghostscript: ignore CVE-2024-29507
qemu: ignore CVE-2023-1386
Praveen Kumar (1):
connman :fix CVE-2025-32743
.../connman/connman/CVE-2025-32743.patch | 43 ++++++
.../connman/connman_1.41.bb | 1 +
.../busybox/busybox/CVE-2023-39810.patch | 131 ++++++++++++++++++
meta/recipes-core/busybox/busybox_1.35.0.bb | 1 +
...dd-single-threaded-fast-path-to-rand.patch | 47 +++++++
meta/recipes-core/glibc/glibc_2.35.bb | 1 +
meta/recipes-devtools/qemu/qemu.inc | 3 +
.../ghostscript/ghostscript_9.55.0.bb | 4 +-
8 files changed, 230 insertions(+), 1 deletion(-)
create mode 100644 meta/recipes-connectivity/connman/connman/CVE-2025-32743.patch
create mode 100644 meta/recipes-core/busybox/busybox/CVE-2023-39810.patch
create mode 100644 meta/recipes-core/glibc/glibc/0001-stdlib-Add-single-threaded-fast-path-to-rand.patch
--
2.43.0
^ permalink raw reply [flat|nested] 17+ messages in thread
end of thread, other threads:[~2025-05-09 16:17 UTC | newest]
Thread overview: 17+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-25 18:49 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 1/6] libyaml: ignore CVE-2024-35326 Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 2/6] Tiff: Security fix for CVE-2024-7006 Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 3/6] curl: Security fix for CVE-2024-7264 Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 4/6] python3: add PACKAGECONFIG[editline] Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 5/6] image_types.bbclass: Use --force also with lz4,lzop Steve Sakoman
2024-08-25 18:49 ` [OE-core][kirkstone 6/6] libsoup: fix compile error on centos7 Steve Sakoman
-- strict thread matches above, loose matches on Subject: below --
2025-05-09 16:16 [OE-core][kirkstone 0/6] Patch review Steve Sakoman
2025-03-24 19:36 Steve Sakoman
2025-03-10 13:36 Steve Sakoman
2024-09-05 12:40 Steve Sakoman
2024-07-20 12:42 Steve Sakoman
2024-05-13 12:18 Steve Sakoman
2024-01-21 18:57 Steve Sakoman
2024-01-08 16:14 Steve Sakoman
2023-10-21 15:28 Steve Sakoman
2023-04-05 2:29 Steve Sakoman
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox