Commit Graph

3021 Commits

Author SHA1 Message Date
Wang Mingyu
531d6fe602 mpfr: upgrade 4.1.0 -> 4.1.1
Changelog:
=========
- Bug fixes (see <https://www.mpfr.org/mpfr-4.1.0/#fixed> and/or the
  ChangeLog file), in particular for macros implementing functions.
- Improved manual formatting.

(From OE-Core rev: 9977278a12d6bc0b811077fa19c64b80e793a33d)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f733eddc428cf9537f97cb91025b73dd1fdea932)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-23 23:05:50 +00:00
Qiu, Zheng
d513c3043b vim: upgrade 9.0.0820 -> 9.0.0947
Includes fixes for CVE-2022-4141
https://nvd.nist.gov/vuln/detail/CVE-2022-4141

For a short list of important changes, see:
https://www.arp242.net/vimlog/

(From OE-Core rev: a7abc8754ab5fbefa23fc17571d272a77dcd2421)

Signed-off-by: Zheng Qiu <zheng.qiu@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 160f459febc7fb36cc0fe85c63eb26780ace3bfd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-13 15:23:34 +00:00
Bhabu Bindu
bfec99ed33 curl: Fix CVE-2022-42915
HTTP proxy double-free

Link: https://security-tracker.debian.org/tracker/CVE-2022-42915

(From OE-Core rev: 4754f33d7ec96f72351853463540c8b1a3f4bc0c)

Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Bhabu Bindu
b1ea1218bd curl: Fix CVE-2022-42916
HSTS bypass via IDN

Link: https://security-tracker.debian.org/tracker/CVE-2022-42916

(From OE-Core rev: e6796b426503477620e0e5c5c9da50352269a593)

Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Bhabu Bindu
17c2b23373 curl: Fix CVE-2022-32221
POST following PUT confusion

Link: https://ubuntu.com/security/CVE-2022-32221

(From OE-Core rev: 518bea85c9496d77c70d703b818e442eda841554)

Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-07 15:02:45 +00:00
Wang Mingyu
0a1f9f4d2c iso-codes: upgrade 4.11.0 -> 4.12.0
Changelog:
=========
- ISO 3166-1: Update name for TR. Fixes #38
- Translation updates for ISO 3166-1
- Translation updates for ISO 3166-2. Closes: #1020633
- Translation updates for ISO 3166-3
- Translation updates for ISO 639-2
- Translation updates for ISO 639-3
- Translation updates for ISO 639-5
- Translation updates for ISO 4217
- Translation updates for ISO 15924

(From OE-Core rev: 017abb138460978e87c84c509f9af7524a053e1b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 99917b4b7d5642b292cb95c770871b95e411dfc5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-01 19:35:05 +00:00
Alexander Kanavin
54fc3e7d5d libical: upgrade 3.0.15 -> 3.0.16
Version 3.0.16 is a patch release.

- Fix regressions in 3.0.15 due to improperly tested fuzz fixes
- Fix argument guards in icaltime_as_timet to match documentation and tests.

(From OE-Core rev: 6d68985f1a7a55cda92c177c739e51cac3faf653)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 77d4557d6f6a1405d03bb5dc7ca23d7ee78c2037)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-01 19:35:04 +00:00
Alexander Kanavin
844f11d08d libffi: upgrade 3.4.2 -> 3.4.4
3.4.4 Oct-23-2022
    Important aarch64 fixes, including support for linux builds
      with Link Time Optimization (-flto).
    Fix x86 stdcall stack alignment.
    Fix x86 Windows msvc assembler compatibility.
    Fix moxie and or1k small structure args.

3.4.3 Sep-19-22
    All struct args are passed by value, regardless of size, as per ABIs.
    Enable static trampolines for Cygwin.
    Add support for Loongson's LoongArch64 architecture.
    Fix x32 static trampolines.
    Fix 32-bit x86 stdcall stack corruption.
    Fix ILP32 aarch64 support.

License-Update: copyright years

(From OE-Core rev: 6ad074b1caff63e90805aac25cca8a831b57273d)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 5b42ba98ef26a52bad8de1790b402938fec4a160)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-12-01 19:35:04 +00:00
Alexander Kanavin
b4f8b1b31c libffi: submit patch upstream
(From OE-Core rev: c8c8945ded40a36b42da4e95974cf76796c15cfb)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9555a7dc768c32a009333232e25cef041054b7f7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-24 15:30:01 +00:00
wangmy
85cb720810 libksba: upgrade 1.6.0 -> 1.6.2
New upstream release fixing CVE-2022-3515

(From OE-Core rev: b58fa75b4cb0cc75034be5f952224d4bcee9aff6)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 4bef6fc673de958dfbab80bcbc2e0159803b97ee)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
(cherry picked from commit 8e453d64255ce6a01b193c3735bb0aefbaa6fb38)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-10 14:39:24 +00:00
wangmy
2a041adc8d numactl: upgrade 2.0.15 -> 2.0.16
(From OE-Core rev: 5a51b44967fff256ec298f7c3cfae1c084bf1b32)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 6d9ed8d4b13c2d87dae482bbadef039de050bc9d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-10 14:39:24 +00:00
Richard Purdie
7444db04e6 numactl: upgrade 2.0.14 -> 2.0.15
v2.0.15 changes

Various bug fixes and cleanups
Supported multiple preferred nodes
This release didn't include a release tarball. Furthermore, it had issues such as #135, #136 and #138 that got fixed in the follow up release. Please try to use v2.0.16 instead.
License checksum change from a typo fix.

(From OE-Core rev: c275a87794027b03fde68ee11fa2f5eddbf3c344)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8829fe6ee093acc6fb990f9ca6cad67c2c7549d5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-10 14:39:24 +00:00
wangmy
0f6128e969 libical: upgrade 3.0.14 -> 3.0.15
Changelog:
=========
 Add missing property parameters into libical-glib
 Fix CMake option USE_32BIT_TIME_T actually uses a 32-bit time_t value
 Fix icaltime_as_timet, which returned incorrect results for years >= 2100, to work properly between years 1902 and 10k.
 Fix x-property comma handling and escaping
 Built-in timezones updated to tzdata2022d (now with a VTIMEZONE for each time zone alias)
 Fix fuzzer issues
 Handle unreachable-code compile warnings with clang
 Ensure all vanew_foo() calls finish with (void*)0 (not 0)

(From OE-Core rev: d0882397cb37ab19543733535c3d01d09c3845a4)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 6092ae3cbe0eaf006db615c6cc3f1692e1cc1df8)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-10 14:39:24 +00:00
wangmy
69664b0ca9 libcap: upgrade 2.65 -> 2.66
RELEASE NOTES FOR 2.66

Fix documentation typos in cap_from_text.3 (Bug: 216514 reported by Paulo Andrade.)

Some getpcaps code clean up and a fix for PID argument parsing from Jakub Wilk.

Slightly more robust Makefiles to address an error with make -j48 test observed by Tomasz Kłoczko.

Include a simple Go program, captrace, to trace kernel capability validation checks

This program can be used to figure out what capabilities a program needs to operate.

captrace (a wrapper for bpftrace) uses BPF kprobes to monitor the kernel for capability checks and whether or not they succeed for the system, a specific PID or a program's direct execution.

Trim down the default file capabilities for contrib/sucap/su to those actually needed and set USER and HOME environment variables so bash doesn't complain about a sourcing error.

(From OE-Core rev: 003a81171366956c899305ca9adc352d3c99c964)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 9040e612084a561b1766bb86c9c002b811eea4c9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-10 14:39:23 +00:00
Keiya Nobuta
2d4e9d0d5b gnutls: Unified package names to lower-case
create-spdx can't detect the license properly if the case doesn't
match, so fix it.

(From OE-Core rev: a96cd0df052af00215796add25373daf12a0e5ed)

Signed-off-by: Keiya Nobuta <nobuta.keiya@fujitsu.com>
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 9c87828493784d996910d742006268a626ef0130)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-09 17:42:08 +00:00
Tim Orling
94d9172199 vim: upgrade 9.0.0614 -> 9.0.0820
Includes fixes for CVE-2022-3705
https://nvd.nist.gov/vuln/detail/CVE-2022-3705

For a short list of important changes, see:
https://www.arp242.net/vimlog/

(From OE-Core rev: 555fd2848b970fd38c20651b5e98cabb7f31287c)

Signed-off-by: Tim Orling <tim.orling@konsulko.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit f6d917bd0f8810b5ed8d403ad25d59cda2fc9574)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-04 13:13:31 +00:00
Teoh Jay Shen
c0a61b5e5d vim: Upgrade 9.0.0598 -> 9.0.0614
Include fixes for CVE-2022-3352.

(From OE-Core rev: 1104d02f9bac2fdd540da5ccb5dd6690e025ef33)

Signed-off-by: Teoh Jay Shen <jay.shen.teoh@intel.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
(cherry picked from commit 8aa707f80ae1cfe89d5e20ec1f1632a65149aed4)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-11-04 13:13:31 +00:00
Richard Purdie
8b6a66b029 vim: Upgrade 9.0.0541 -> 9.0.0598
Includes a fix for CVE-2022-3278.

(From OE-Core rev: 9837a62cc42de4120794d4ae8d0264109b8308dc)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 98c40271692147873a622e168e8b2e90a9fcc54c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-11 21:56:13 +01:00
Richard Purdie
f160f3e7f3 vim: Upgrade 9.0.453 -> 9.0.541
Includes a fix for CVE-2022-3234.

(From OE-Core rev: 650ae29fc567e033205558fa85cc1c156d9f72a7)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d6b54f37aa4db1457296b8981b630a49d251ceb5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-28 08:02:10 +01:00
Richard Purdie
d64bef1c7d vim: Upgrade 9.0.0341 -> 9.0.0453
Includes fixes for CVE-2022-3099 and CVE-2022-3134.

(From OE-Core rev: bc2e5e961e88eb9f4d8cd1f2ee0ed56ab00774a9)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d042923262130b6b96f703b5cd4184f659caeb92)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-17 19:12:55 +01:00
Khem Raj
2723b8dae8 apr: Cache configure tests which use AC_TRY_RUN
AC_TRY_RUN macro means the test needs to run to find the result and we
are cross compiling so this will always get wrong results, this results
in miscompiling apache2 on musl because it disables rlimit
(ac_cv_struct_rlimit) wrongly.

All these variables are determined with AC_TRY_RUN checks

(From OE-Core rev: 8784e3712add2fbdf684d442a14fb94e5a7fc61f)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
(cherry picked from commit 504eb0ff1cae200ee85ec18ebae564cae9bf9c8c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
2d582eaef4 lz4: upgrade 1.9.3 -> 1.9.4
CVE-2021-3520.patch
removed since it's included in 1.9.4

License-Update:
  Copyright year updated to 2020
  description of 3rd party applications changed

(From OE-Core rev: 8883d3992078ae24c2601ebf844223fa6e056ded)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f95c66050bc69af7769d1868b0118cefb24e5b0d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
634e86bc24 libatomic-ops: upgrade 7.6.12 -> 7.6.14
License-Update:  Adjust/reformat content of LICENSING.txt
=========================================================
 "libatomic_ops_gpl.a" changed to "libatomic_ops_gpl.a file"
 "sysdeps" changed to "atomic_ops/sysdeps"
 "This applies only to test code, sample applications," changed to
 "This applies only to the test code"

Changelog:
==========
 Add note to README that AO malloc code has same license as AO stack
 Adjust/reformat content of LICENSING.txt
 Avoid AO_stack_t to cross CPU cache line boundary
 Do not assume 'ordered except earlier write' for UWP/arm64
 Do not name GCC intrinsics as C11 ones in ChangeLog and configure
 Eliminate '-pedantic is not option that controls warnings' GCC-6.3 message
 Ensure result of AO_test_and_set is always AO_TS_CLEAR or AO_TS_SET
 Fix 'AO_malloc redefinition' MS VC warning caused by attributes mismatch
 Fix 'use of undeclared SIG_BLOCK' Clang error if -std=c89 on Cygwin
 Fix AO_compare_and_swap_full asm code for clang on sparc
 Fix a typo in comment of AO_stack_push_explicit_aux_release
 Fix code indentation in main() of test_stack.c
 Refine AO_UNIPROCESSOR macro description in configure
 Remove outdated comment about unsupported Win64 in atomic_ops_stack.h
 Repeat black list check on CAS fail in stack_push_explicit_aux_release

(From OE-Core rev: 8bcf5d5885abbc405f17a56027aa19f826dcdb71)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit a0f177ef7f52bab06d8fff752ba8390defd71ed5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
46a7341426 liburcu: upgrade 0.13.1 -> 0.13.2
2022-08-18 Userspace RCU 0.13.2
	* Revert "Fix: remove type constness in URCU_FORCE_CAST's C++ version"
	* Fix: futex.h: include headers outside extern C
	* Fix: add missing unused attribute to _rcu_dereference
	* Fix: change method used by _rcu_dereference to strip type constness
	* Fix: remove type constness in URCU_FORCE_CAST's C++ version
	* Move extern "C" down in include/urcu/urcu-bp.h
	* fix: ifdef linux specific cpu count compat
	* Set git-review branch to stable-0.13
	* fix: sysconf(_SC_NPROCESSORS_CONF) can be less than max cpu id
	* Fix: revise obsolete command in README.md
	* Fix: workqueue: remove unused variable "ret"
	* Fix: urcu-qsbr: futex wait: handle spurious futex wakeups
	* Fix: urcu: futex wait: handle spurious futex wakeups
	* Fix: urcu-wait: futex wait: handle spurious futex wakeups
	* Fix: defer_rcu: futex wait: handle spurious futex wakeups
	* Fix: call_rcu: futex wait: handle spurious futex wakeups
	* Fix: workqueue: futex wait: handle spurious futex wakeups
	* Fix: Use %lu rather than %ld to print count

(From OE-Core rev: 2852ebcba6c718640b306adfd33907411ac02d21)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b9ce9d9ab53baab7ba84187d17b34e48ff9eb16e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
fdee7be50f libtasn1: upgrade 4.18.0 -> 4.19.0
Changelog:
===========
- Clarify libtasn1.map license.  Closes: #38.
- Fix ETYPE_OK out of bounds read.  Closes: #32.
- Update gnulib files and various maintenance fixes.

(From OE-Core rev: 005bfa0639724248f2a257cae0108ecd16e7314b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b8f2c6ec61ffcc607a35bd5c11f5020c9b676226)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Richard Purdie
df6c07aa0e vim: Upgrade 9.0.0242 -> 9.0.0341
Addresses CVE-2022-2980, CVE-2022-2946 and CVE-2022-2982.

(From OE-Core rev: b6eb009351d2bb04ae7ea828800e0e1b6934213e)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 01c08d47ecfcc7aefacc8280e0055c75b13795b2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Robert Joslyn
68dfce5f52 curl: Backport patch for CVE-2022-35252
https://curl.se/docs/CVE-2022-35252.html

(From OE-Core rev: 40bbdb43b247ffc5dd1990f51fb824a089c0987f)

Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Chee Yang Lee
2c42fa484a sqlite: add CVE-2022-35737 patch to SRC_URI
SRC_URI include patch introduced in oe-core commit
fdc82b2314b580c0135c16b7278ebf8786311dec

(From OE-Core rev: f28dc527d4a3e3aa6ef2b446e863264c0e874fa1)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Khem Raj
93a0fcc7c9 apr: Use correct strerror_r implementation based on libc type
musl does not implement GNU extention of strerror_r but XSI compliant
version, therefore add it via a packageconfig to set right variables
during configure to cache the value.

configure detection logic depends on runtime test which will always be
wrong on cross compiles therefore backport a patch to make it possible
to cache the needed configure variable.

(From OE-Core rev: b59027f32e4b2896dccced6d9cb75fbb41651abe)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ded3d76a844dd1aef9ac610fbe506bf76285369b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-03 13:09:49 +01:00
Khem Raj
7b0a2f46f7 pinentry: enable _XOPEN_SOURCE on musl for wchar usage in curses
This is defined for glibc automatically with _GNU_SOURCE but not for
musl

(From OE-Core rev: 9c9dd76aee4f9d9e25e8e46bd84fe802007e9c0c)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 84375186570af548b49e44e884925f4feaddcc7a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-03 13:09:49 +01:00
ghassaneben
51fa770857 sqlite: fix CVE-2022-35737
Increase the size of loop variables in the printf() implementation to avoid integer overflow on multi-gigabyte string arguments. CVE-2022-35737.

This bug fix refers to: CVE-2022-35737 and it's a backport of a fix added in sqlite 3.39.2 (2022-07-21).

(From OE-Core rev: fdc82b2314b580c0135c16b7278ebf8786311dec)

Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-03 13:09:49 +01:00
Richard Purdie
2140cd390f vim: Upgrade 9.0.0115 -> 9.0.0242
Includes fixes for:

CVE-2022-2816
CVE-2022-2817
CVE-2022-2819
CVE-2022-2845
CVE-2022-2849
CVE-2022-2862
CVE-2022-2874
CVE-2022-2889

(From OE-Core rev: 54ee67b1a805a07288925d56e9956aabc23b6ab2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ec2d27d09444213ec1c9b91c6f8c4363f297294)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:52:28 +01:00
Alexander Kanavin
7f288475f5 libcap: upgrade 2.64 -> 2.65
CHanges from 2.64:

- Fix syntax error in DEBUG build of protected code in setcap.c. (Bug reported by yixiangzhike.)
- Prevent bash from reading the wrong startup files when the capsh --user=xxx argument is used to invoke a shell as the user xxx. (Bug: 215926)
- Man page info for cap_get_pid() and cap_reset_ambient(). (Bug reports from nomonemo and Tinkerer One.)
- Improve documentation and help for the captree program.
- Updated go/Makefile comment about an unfixed Go runtime bug in go1.16 and go1.17 (resolved in go1.18+), and the deadlock behavior of the psx-fd test.
- Refresh the signatures on the two GPG keys morgan@ uses. The 4096 bit one is preferred, but the older one is also used for continuity reasons. This set of signatures should also be available from the various key servers out there.

(From OE-Core rev: 70cd3c073512084fccb85b311911794ea895d3f2)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c3b16a6d0d0d4246b44dec3b1818f435d32d04e5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:51:29 +01:00
wangmy
407bb73387 libcap: upgrade 2.63 -> 2.64
Changes from 2.63:

- Fix memory leak in libpsx at program exit. (Bug: 215551 reported by Kalen Hall)
- Be more resilient to CGo configuration with Go compiler when building tests. (Bug: 215603)
- Fix cap_*prctl() return code/errno handling.  (Bug: 215772 reported by Anderson Toshiyuki Sasaki)
- Minor clarification to cap_get_pid() man page concerning pid value within namespaces. (Bug: 215812)

(From OE-Core rev: b23e43ea7c677b5450969d3586d1f68cc278fc73)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bfbf8f05d1789b8a8a6826b83a21fd09b8e903ad)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:51:29 +01:00
Alexander Kanavin
a3e099e8a0 iso-codes: upgrade 4.10.0 -> 4.11.0
Changes from 4.10.0:

- Update ISO 639-3 codes from SIL website. Fixes #40
- Translation updates for ISO 3166-1
- Translation updates for ISO 3166-2
- Translation updates for ISO 3166-3
- Translation updates for ISO 639-2
- Translation updates for ISO 639-3
- Translation updates for ISO 639-5
- Translation updates for ISO 4217
- Translation updates for ISO 15924

(From OE-Core rev: 2d0254acde343c2d9cdcb94b488dc1308bae319f)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a269e59a960a56ac038f4e96c199a7577202b186)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:51:29 +01:00
Mikko Rapeli
d4dc48175a boost: fix install of fiber shared libraries
For fiber, only CMake modules were installed in boost 1.78.0.
In 1.79.0 and versions before 1.78.0 also the shared libraries
are installed. This upstream patch fixes the issue in 1.78.0.

Note that boost git repo does not show changes in tools/build
directory between 1.78.0 and 1.79.0 tags but the release tar balls
contain a large update of which this one is needed to fix the missing
shared libraries.

Only kirkstone is affected.

buildhistory shows the difference in metadata boost-fiber binary package
without and with this patch:

 --- a/packages/core2-64-poky-linux/boost/boost-fiber/latest
 +++ b/packages/core2-64-poky-linux/boost/boost-fiber/latest
@@ -1,8 +1,9 @@
 PV = 1.78.0
 PR = r0
-RPROVIDES =
-RDEPENDS =
+PKG = libboost-fiber1.78.0
+RPROVIDES = boost-fiber (=1.78.0)
+RDEPENDS = boost-context (>= 1.78.0) glibc (>= 2.35) libgcc (>= 11.3.0) libstdc++ (>= 11.3.0)
 RRECOMMENDS =
-PKGSIZE = 0
+PKGSIZE = 80032
 FILES = /usr/lib/libboost_fiber*.so.*
-FILELIST =
+FILELIST = /usr/lib/libboost_fiber.so.1.78.0

(From OE-Core rev: f5952401a89a84b40f98c1c946daba2d83a2b18a)

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-23 15:22:52 +01:00
Randy MacLeod
73618dee22 vim: update from 9.0.0063 to 9.0.0115
Drop crosscompile.patch which was merged as part of:
   509695c1c (tag: v9.0.0065) patch 9.0.0065: \
      cross-compiling doesn't work because of timer_create check

Also drop: racefix.patch which may have been fixed upstream
and is being tracked by:
   https://github.com/vim/vim/pull/10776
where upstream is asking if the different approach resolves the
race condition. Let's see what's out there!

(From OE-Core rev: 27e4c6f98be296fb5f67ac7775461854d48f6c9a)

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
(cherry picked from commit 6996472cd33d2d4b91821f2dfe24a27a697e4afe)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-23 15:22:52 +01:00
Hitendra Prajapati
33e296554e gnutls: CVE-2022-2509 Double free during gnutls_pkcs7_verify
Source: https://gitlab.com/gnutls/gnutls
MR: 120416
Type: Security Fix
Disposition: Backport from ce37f9eb26
ChangeID: 703e01956915cf9543fdc47cfd5edb87403294f9
Description:
          CVE-2022-2509 gnutls: Double free during gnutls_pkcs7_verify.

(From OE-Core rev: 49781a79fd7764ef2e0d61ffa793acd59f210ecf)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-23 15:22:52 +01:00
Richard Purdie
6a0d24ba1c vim: Upgrade 9.0.0021 -> 9.0.0063
Pulls in several CVE fixes.
Added a patch to avoid timer_create cross compile issue (and submitted upstream).
Also submit the race fix upstream.
We disable timer_create in the native case since some systems have it
and some don't so this makes us consistent.

(From OE-Core rev: 8b42e405fc630537398116a1429a9bc7cb2152ab)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d0c1de084c7ce030d47a428e4bbfbc4ce2996057)
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-01 16:27:29 +01:00
Yue Tao
1630dbb40b gnupg: upgrade to 2.3.7 to fix CVE-2022-34903
(From OE-Core rev: c0c7214f8bdc1942a53f9a86b937eb4977e09452)

Signed-off-by: Yue Tao <yue.tao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-01 16:27:29 +01:00
Alexander Kanavin
4f2f861895 gnupg: update 2.3.4 -> 2.3.6
Remove 0003-dirmngr-uses-libgpg-error.patch
(upstream addressed the issue).

(From OE-Core rev: 4e9c180baf5fea79a2ca472651b782038051b837)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yue Tao <yue.tao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-01 16:27:29 +01:00
Robert Joslyn
702cf1e964 curl: Fix multiple CVEs
Backport fixes for:
 * CVE-2022-32205 - https://curl.se/docs/CVE-2022-32205.html
 * CVE-2022-32206 - https://curl.se/docs/CVE-2022-32206.html
 * CVE-2022-32207 - https://curl.se/docs/CVE-2022-32207.html
 * CVE-2022-32208 - https://curl.se/docs/CVE-2022-32208.html

(From OE-Core rev: 2749916ff534aecfd2a7871268b1166e5bb5bca4)

Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-25 15:11:46 +01:00
Alexander Kanavin
e8af53db95 libsoup: upgrade 3.0.6 -> 3.0.7
Changes in libsoup from 3.0.6 to 3.0.7:

* Fix leak in SoupAuthNTLM [Milan Crha]
* Fix constructing SoupAuthNTLM objects [Milan Crha]
* Disable mutual negotiation in SoupAuthNegotiate [Michael Catanzaro]
* http2: Do not advertise the `h2` protocool for proxy connections [Carlos Garcia Campos]
* http2: Remove left-over headers when HTTP/1 redirects to HTTP/2 [Carlos Garcia Campos]
* http2: Handle HTTP_1_1_REQUIRED error [Carlos Garcia Campos]
* http2: Read request bodies synchronously for sync requests [Carlos Garcia Campos]
* http2: Properly handle server sending shut down GOAWAY [Carlos Garcia Campos]
* tests: Remove dependency on Apache's PHP module [Carlos Garcia Campos]
* tests: Depend upon Apache's http2 module [Carlos Garcia Campos]

(From OE-Core rev: a4bfb5ceb5cf8c0c6d27225b27ef10c0b9dceccb)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 800e0d32db86dccfe1b54111d01034e4a315cce9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-16 06:52:45 +01:00
Ross Burton
97e48b17b9 vim: upgrade to 9.0.0021
This fixes the following CVEs:
- CVE-2022-2257
- CVE-2022-2264
- CVE-2022-2284
- CVE-2022-2285
- CVE-2022-2286
- CVE-2022-2287

(From OE-Core rev: 640ccea3110408985ef5cf76fbe8dc9f4c3fd22c)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 03c044a81a76b7505b9d5bf0d936dde75b51905e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-16 06:52:45 +01:00
Jose Quaresma
91df5c1c7b curl: backport openssl fix CN check error code
Fix out of memory [1]

OpenSSL host verification + hostname in certificate CN only seems broken in 7.82.0

[1] https://github.com/curl/curl/issues/8559

(From OE-Core rev: 7a8d374a3d4bbef336be2b273afc00c93c637ae6)

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-08 08:27:16 +01:00
Maxime Roussin-Bélanger
cc75d77bc9 libffi: fix native build being not portable
Without `--with-gcc-arch=generic` libffi looks up the cpuid to automatically determine
which mtune/march to use. This makes the native sstate-cache unuseable since it's
possible to have a newer cpu building the recipe and the library being pulled from
another older cpu which doesn't have the instruction.

(From OE-Core rev: 58804e0051e3b77e0378aa4accbd26b2588b68e7)

Signed-off-by: Maxime Roussin-Bélanger <maxime.roussinbelanger@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cddaecac1fdd4d033c2ff8ccaf1d60e1c598d5b7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-08 08:27:16 +01:00
Richard Purdie
ac087037fe vim: 8.2.5083 -> 9.0.0005
The license checksum changed due to a major version change in the referenced file.

(From OE-Core rev: a290032fe88b6bac5e789da20f88fd72febe1780)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 89f34d8aa4f4572d048dbb732ca4c83d443157fb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-08 08:27:16 +01:00
Yi Zhao
d37d6ad960 popt: fix override syntax in RDEPENDS
RDEPENDS_${PN}-ptest -> RDEPENDS:${PN}-ptest

(From OE-Core rev: 6168dbc9b27da1ed88c277bab6f024e6e068e685)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 37a47bfced900c2f1e239b216d8614eb290f2f0c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-22 23:46:29 +01:00
Kai Kang
62fdfa45ab xxhash: fix build with gcc 12
It fails to compile xxhash when '-Og' is set in CFLAGS via such as set
DEBUG_BUILD = '1' in local.conf. Check and disable inline when '-Og'
exists.

(From OE-Core rev: d8e454b370089e4a33c8373742178ef4d540e848)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3464c67cd34acbb1a6705369e34dee8af7e348ac)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-22 23:46:29 +01:00
Richard Purdie
a6344dc61a vim: Upgrade 8.2.5034 -> 8.2.5083
Includes fixes for CVE-2022-1927, CVE-2022-1942.

(From OE-Core rev: b85e29de4bca17834b003d499db5129fc5dee75e)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1e740b5c2227c0040621ae63436d06db4873670f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-22 23:46:28 +01:00