From: "Khem Raj" <raj.khem@gmail.com>
To: milunj@yahoo.com, yocto@lists.yoctoproject.org
Subject: Re: [yocto] Fixing vulnerabilities in glibc #yocto
Date: Mon, 09 Dec 2019 11:46:38 -0800 [thread overview]
Message-ID: <616242a482e6237b9fc15ce7b308a9bf4e4a22b9.camel@gmail.com> (raw)
In-Reply-To: <R19L.1575899282432368398.77t7@lists.yoctoproject.org>
[-- Attachment #1: Type: text/plain, Size: 1923 bytes --]
On Mon, 2019-12-09 at 05:48 -0800, milunj via Lists.Yoctoproject.Org
wrote:
> My greeting to all
> I am new on yocto project and yocto build environment is also new to
> me ...
> My working task is removing vulnerabilities from libc library...
> The processor is based on arm5 while newer yoctos 2.7.x and 3.x. do
> not provide environment support for arm5 based processors.
>
> The glibc vulnerabilities are fixed in the latest glibc 2.30
> released. package while yocto 2.6.x includes 2.28 package.
> Also some of glibc vulnerabilities are patched in 2.6.4 (\oecore-
> thud-20.0.4.tar\oecore-thud-20.0.4\meta\recipes-core\glibc\glibc):
>
> CVE-2016-10739
> CVE-2018-19591
> CVE-2019-6488
> CVE-2019-7309
> CVE-2019-9169
> while there are some others those have not been patched:
>
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-3590
>
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-7254
>
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-20796
>
> https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9192
>
> Does anyone know whether new vulnerability patches will be applied
> for yocto 2.6.5 and when will be released yocto 2.6.5 ?
it depends on contribution, if you can contribute the fixes thats best
for predictability, secondly, you can also open tickets in yocto bug
tracking system.
> Thank you in advance
> Milun
>
>
>
>
>
>
> -=-=-=-=-=-=-=-=-=-=-=-Links: You receive all messages sent to this
> group.
> View/Reply Online (#47603):
> https://lists.yoctoproject.org/g/yocto/message/47603
> Mute This Topic: https://lists.yoctoproject.org/mt/67793912/1997914
> Mute #yocto:
> https://lists.yoctoproject.org/mk?hashtag=yocto&subid=6692173
> Group Owner: yocto+owner@lists.yoctoproject.org
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [raj.khem@
> gmail.com]-=-=-=-=-=-=-=-=-=-=-=-
[-- Attachment #2: Type: text/html, Size: 4675 bytes --]
prev parent reply other threads:[~2019-12-09 19:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-09 13:48 Fixing vulnerabilities in glibc #yocto milunj
2019-12-09 17:24 ` [yocto] " Randy MacLeod
2019-12-09 19:46 ` Khem Raj [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=616242a482e6237b9fc15ce7b308a9bf4e4a22b9.camel@gmail.com \
--to=raj.khem@gmail.com \
--cc=milunj@yahoo.com \
--cc=yocto@lists.yoctoproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox