Commit Graph

3003 Commits

Author SHA1 Message Date
Richard Purdie
f160f3e7f3 vim: Upgrade 9.0.453 -> 9.0.541
Includes a fix for CVE-2022-3234.

(From OE-Core rev: 650ae29fc567e033205558fa85cc1c156d9f72a7)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d6b54f37aa4db1457296b8981b630a49d251ceb5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-28 08:02:10 +01:00
Richard Purdie
d64bef1c7d vim: Upgrade 9.0.0341 -> 9.0.0453
Includes fixes for CVE-2022-3099 and CVE-2022-3134.

(From OE-Core rev: bc2e5e961e88eb9f4d8cd1f2ee0ed56ab00774a9)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d042923262130b6b96f703b5cd4184f659caeb92)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-17 19:12:55 +01:00
Khem Raj
2723b8dae8 apr: Cache configure tests which use AC_TRY_RUN
AC_TRY_RUN macro means the test needs to run to find the result and we
are cross compiling so this will always get wrong results, this results
in miscompiling apache2 on musl because it disables rlimit
(ac_cv_struct_rlimit) wrongly.

All these variables are determined with AC_TRY_RUN checks

(From OE-Core rev: 8784e3712add2fbdf684d442a14fb94e5a7fc61f)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
(cherry picked from commit 504eb0ff1cae200ee85ec18ebae564cae9bf9c8c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
2d582eaef4 lz4: upgrade 1.9.3 -> 1.9.4
CVE-2021-3520.patch
removed since it's included in 1.9.4

License-Update:
  Copyright year updated to 2020
  description of 3rd party applications changed

(From OE-Core rev: 8883d3992078ae24c2601ebf844223fa6e056ded)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit f95c66050bc69af7769d1868b0118cefb24e5b0d)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
634e86bc24 libatomic-ops: upgrade 7.6.12 -> 7.6.14
License-Update:  Adjust/reformat content of LICENSING.txt
=========================================================
 "libatomic_ops_gpl.a" changed to "libatomic_ops_gpl.a file"
 "sysdeps" changed to "atomic_ops/sysdeps"
 "This applies only to test code, sample applications," changed to
 "This applies only to the test code"

Changelog:
==========
 Add note to README that AO malloc code has same license as AO stack
 Adjust/reformat content of LICENSING.txt
 Avoid AO_stack_t to cross CPU cache line boundary
 Do not assume 'ordered except earlier write' for UWP/arm64
 Do not name GCC intrinsics as C11 ones in ChangeLog and configure
 Eliminate '-pedantic is not option that controls warnings' GCC-6.3 message
 Ensure result of AO_test_and_set is always AO_TS_CLEAR or AO_TS_SET
 Fix 'AO_malloc redefinition' MS VC warning caused by attributes mismatch
 Fix 'use of undeclared SIG_BLOCK' Clang error if -std=c89 on Cygwin
 Fix AO_compare_and_swap_full asm code for clang on sparc
 Fix a typo in comment of AO_stack_push_explicit_aux_release
 Fix code indentation in main() of test_stack.c
 Refine AO_UNIPROCESSOR macro description in configure
 Remove outdated comment about unsupported Win64 in atomic_ops_stack.h
 Repeat black list check on CAS fail in stack_push_explicit_aux_release

(From OE-Core rev: 8bcf5d5885abbc405f17a56027aa19f826dcdb71)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit a0f177ef7f52bab06d8fff752ba8390defd71ed5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
46a7341426 liburcu: upgrade 0.13.1 -> 0.13.2
2022-08-18 Userspace RCU 0.13.2
	* Revert "Fix: remove type constness in URCU_FORCE_CAST's C++ version"
	* Fix: futex.h: include headers outside extern C
	* Fix: add missing unused attribute to _rcu_dereference
	* Fix: change method used by _rcu_dereference to strip type constness
	* Fix: remove type constness in URCU_FORCE_CAST's C++ version
	* Move extern "C" down in include/urcu/urcu-bp.h
	* fix: ifdef linux specific cpu count compat
	* Set git-review branch to stable-0.13
	* fix: sysconf(_SC_NPROCESSORS_CONF) can be less than max cpu id
	* Fix: revise obsolete command in README.md
	* Fix: workqueue: remove unused variable "ret"
	* Fix: urcu-qsbr: futex wait: handle spurious futex wakeups
	* Fix: urcu: futex wait: handle spurious futex wakeups
	* Fix: urcu-wait: futex wait: handle spurious futex wakeups
	* Fix: defer_rcu: futex wait: handle spurious futex wakeups
	* Fix: call_rcu: futex wait: handle spurious futex wakeups
	* Fix: workqueue: futex wait: handle spurious futex wakeups
	* Fix: Use %lu rather than %ld to print count

(From OE-Core rev: 2852ebcba6c718640b306adfd33907411ac02d21)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b9ce9d9ab53baab7ba84187d17b34e48ff9eb16e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
wangmy
fdee7be50f libtasn1: upgrade 4.18.0 -> 4.19.0
Changelog:
===========
- Clarify libtasn1.map license.  Closes: #38.
- Fix ETYPE_OK out of bounds read.  Closes: #32.
- Update gnulib files and various maintenance fixes.

(From OE-Core rev: 005bfa0639724248f2a257cae0108ecd16e7314b)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit b8f2c6ec61ffcc607a35bd5c11f5020c9b676226)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Richard Purdie
df6c07aa0e vim: Upgrade 9.0.0242 -> 9.0.0341
Addresses CVE-2022-2980, CVE-2022-2946 and CVE-2022-2982.

(From OE-Core rev: b6eb009351d2bb04ae7ea828800e0e1b6934213e)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 01c08d47ecfcc7aefacc8280e0055c75b13795b2)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Robert Joslyn
68dfce5f52 curl: Backport patch for CVE-2022-35252
https://curl.se/docs/CVE-2022-35252.html

(From OE-Core rev: 40bbdb43b247ffc5dd1990f51fb824a089c0987f)

Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Chee Yang Lee
2c42fa484a sqlite: add CVE-2022-35737 patch to SRC_URI
SRC_URI include patch introduced in oe-core commit
fdc82b2314b580c0135c16b7278ebf8786311dec

(From OE-Core rev: f28dc527d4a3e3aa6ef2b446e863264c0e874fa1)

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-12 08:41:47 +01:00
Khem Raj
93a0fcc7c9 apr: Use correct strerror_r implementation based on libc type
musl does not implement GNU extention of strerror_r but XSI compliant
version, therefore add it via a packageconfig to set right variables
during configure to cache the value.

configure detection logic depends on runtime test which will always be
wrong on cross compiles therefore backport a patch to make it possible
to cache the needed configure variable.

(From OE-Core rev: b59027f32e4b2896dccced6d9cb75fbb41651abe)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit ded3d76a844dd1aef9ac610fbe506bf76285369b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-03 13:09:49 +01:00
Khem Raj
7b0a2f46f7 pinentry: enable _XOPEN_SOURCE on musl for wchar usage in curses
This is defined for glibc automatically with _GNU_SOURCE but not for
musl

(From OE-Core rev: 9c9dd76aee4f9d9e25e8e46bd84fe802007e9c0c)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 84375186570af548b49e44e884925f4feaddcc7a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-03 13:09:49 +01:00
ghassaneben
51fa770857 sqlite: fix CVE-2022-35737
Increase the size of loop variables in the printf() implementation to avoid integer overflow on multi-gigabyte string arguments. CVE-2022-35737.

This bug fix refers to: CVE-2022-35737 and it's a backport of a fix added in sqlite 3.39.2 (2022-07-21).

(From OE-Core rev: fdc82b2314b580c0135c16b7278ebf8786311dec)

Signed-off-by: Ghassane Ben El Aattar <ghassaneb.aattar@huawei.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-03 13:09:49 +01:00
Richard Purdie
2140cd390f vim: Upgrade 9.0.0115 -> 9.0.0242
Includes fixes for:

CVE-2022-2816
CVE-2022-2817
CVE-2022-2819
CVE-2022-2845
CVE-2022-2849
CVE-2022-2862
CVE-2022-2874
CVE-2022-2889

(From OE-Core rev: 54ee67b1a805a07288925d56e9956aabc23b6ab2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ec2d27d09444213ec1c9b91c6f8c4363f297294)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:52:28 +01:00
Alexander Kanavin
7f288475f5 libcap: upgrade 2.64 -> 2.65
CHanges from 2.64:

- Fix syntax error in DEBUG build of protected code in setcap.c. (Bug reported by yixiangzhike.)
- Prevent bash from reading the wrong startup files when the capsh --user=xxx argument is used to invoke a shell as the user xxx. (Bug: 215926)
- Man page info for cap_get_pid() and cap_reset_ambient(). (Bug reports from nomonemo and Tinkerer One.)
- Improve documentation and help for the captree program.
- Updated go/Makefile comment about an unfixed Go runtime bug in go1.16 and go1.17 (resolved in go1.18+), and the deadlock behavior of the psx-fd test.
- Refresh the signatures on the two GPG keys morgan@ uses. The 4096 bit one is preferred, but the older one is also used for continuity reasons. This set of signatures should also be available from the various key servers out there.

(From OE-Core rev: 70cd3c073512084fccb85b311911794ea895d3f2)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c3b16a6d0d0d4246b44dec3b1818f435d32d04e5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:51:29 +01:00
wangmy
407bb73387 libcap: upgrade 2.63 -> 2.64
Changes from 2.63:

- Fix memory leak in libpsx at program exit. (Bug: 215551 reported by Kalen Hall)
- Be more resilient to CGo configuration with Go compiler when building tests. (Bug: 215603)
- Fix cap_*prctl() return code/errno handling.  (Bug: 215772 reported by Anderson Toshiyuki Sasaki)
- Minor clarification to cap_get_pid() man page concerning pid value within namespaces. (Bug: 215812)

(From OE-Core rev: b23e43ea7c677b5450969d3586d1f68cc278fc73)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bfbf8f05d1789b8a8a6826b83a21fd09b8e903ad)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:51:29 +01:00
Alexander Kanavin
a3e099e8a0 iso-codes: upgrade 4.10.0 -> 4.11.0
Changes from 4.10.0:

- Update ISO 639-3 codes from SIL website. Fixes #40
- Translation updates for ISO 3166-1
- Translation updates for ISO 3166-2
- Translation updates for ISO 3166-3
- Translation updates for ISO 639-2
- Translation updates for ISO 639-3
- Translation updates for ISO 639-5
- Translation updates for ISO 4217
- Translation updates for ISO 15924

(From OE-Core rev: 2d0254acde343c2d9cdcb94b488dc1308bae319f)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit a269e59a960a56ac038f4e96c199a7577202b186)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-28 07:51:29 +01:00
Mikko Rapeli
d4dc48175a boost: fix install of fiber shared libraries
For fiber, only CMake modules were installed in boost 1.78.0.
In 1.79.0 and versions before 1.78.0 also the shared libraries
are installed. This upstream patch fixes the issue in 1.78.0.

Note that boost git repo does not show changes in tools/build
directory between 1.78.0 and 1.79.0 tags but the release tar balls
contain a large update of which this one is needed to fix the missing
shared libraries.

Only kirkstone is affected.

buildhistory shows the difference in metadata boost-fiber binary package
without and with this patch:

 --- a/packages/core2-64-poky-linux/boost/boost-fiber/latest
 +++ b/packages/core2-64-poky-linux/boost/boost-fiber/latest
@@ -1,8 +1,9 @@
 PV = 1.78.0
 PR = r0
-RPROVIDES =
-RDEPENDS =
+PKG = libboost-fiber1.78.0
+RPROVIDES = boost-fiber (=1.78.0)
+RDEPENDS = boost-context (>= 1.78.0) glibc (>= 2.35) libgcc (>= 11.3.0) libstdc++ (>= 11.3.0)
 RRECOMMENDS =
-PKGSIZE = 0
+PKGSIZE = 80032
 FILES = /usr/lib/libboost_fiber*.so.*
-FILELIST =
+FILELIST = /usr/lib/libboost_fiber.so.1.78.0

(From OE-Core rev: f5952401a89a84b40f98c1c946daba2d83a2b18a)

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-23 15:22:52 +01:00
Randy MacLeod
73618dee22 vim: update from 9.0.0063 to 9.0.0115
Drop crosscompile.patch which was merged as part of:
   509695c1c (tag: v9.0.0065) patch 9.0.0065: \
      cross-compiling doesn't work because of timer_create check

Also drop: racefix.patch which may have been fixed upstream
and is being tracked by:
   https://github.com/vim/vim/pull/10776
where upstream is asking if the different approach resolves the
race condition. Let's see what's out there!

(From OE-Core rev: 27e4c6f98be296fb5f67ac7775461854d48f6c9a)

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
(cherry picked from commit 6996472cd33d2d4b91821f2dfe24a27a697e4afe)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-23 15:22:52 +01:00
Hitendra Prajapati
33e296554e gnutls: CVE-2022-2509 Double free during gnutls_pkcs7_verify
Source: https://gitlab.com/gnutls/gnutls
MR: 120416
Type: Security Fix
Disposition: Backport from ce37f9eb26
ChangeID: 703e01956915cf9543fdc47cfd5edb87403294f9
Description:
          CVE-2022-2509 gnutls: Double free during gnutls_pkcs7_verify.

(From OE-Core rev: 49781a79fd7764ef2e0d61ffa793acd59f210ecf)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-23 15:22:52 +01:00
Richard Purdie
6a0d24ba1c vim: Upgrade 9.0.0021 -> 9.0.0063
Pulls in several CVE fixes.
Added a patch to avoid timer_create cross compile issue (and submitted upstream).
Also submit the race fix upstream.
We disable timer_create in the native case since some systems have it
and some don't so this makes us consistent.

(From OE-Core rev: 8b42e405fc630537398116a1429a9bc7cb2152ab)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit d0c1de084c7ce030d47a428e4bbfbc4ce2996057)
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-01 16:27:29 +01:00
Yue Tao
1630dbb40b gnupg: upgrade to 2.3.7 to fix CVE-2022-34903
(From OE-Core rev: c0c7214f8bdc1942a53f9a86b937eb4977e09452)

Signed-off-by: Yue Tao <yue.tao@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-01 16:27:29 +01:00
Alexander Kanavin
4f2f861895 gnupg: update 2.3.4 -> 2.3.6
Remove 0003-dirmngr-uses-libgpg-error.patch
(upstream addressed the issue).

(From OE-Core rev: 4e9c180baf5fea79a2ca472651b782038051b837)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Yue Tao <yue.tao@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-01 16:27:29 +01:00
Robert Joslyn
702cf1e964 curl: Fix multiple CVEs
Backport fixes for:
 * CVE-2022-32205 - https://curl.se/docs/CVE-2022-32205.html
 * CVE-2022-32206 - https://curl.se/docs/CVE-2022-32206.html
 * CVE-2022-32207 - https://curl.se/docs/CVE-2022-32207.html
 * CVE-2022-32208 - https://curl.se/docs/CVE-2022-32208.html

(From OE-Core rev: 2749916ff534aecfd2a7871268b1166e5bb5bca4)

Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-25 15:11:46 +01:00
Alexander Kanavin
e8af53db95 libsoup: upgrade 3.0.6 -> 3.0.7
Changes in libsoup from 3.0.6 to 3.0.7:

* Fix leak in SoupAuthNTLM [Milan Crha]
* Fix constructing SoupAuthNTLM objects [Milan Crha]
* Disable mutual negotiation in SoupAuthNegotiate [Michael Catanzaro]
* http2: Do not advertise the `h2` protocool for proxy connections [Carlos Garcia Campos]
* http2: Remove left-over headers when HTTP/1 redirects to HTTP/2 [Carlos Garcia Campos]
* http2: Handle HTTP_1_1_REQUIRED error [Carlos Garcia Campos]
* http2: Read request bodies synchronously for sync requests [Carlos Garcia Campos]
* http2: Properly handle server sending shut down GOAWAY [Carlos Garcia Campos]
* tests: Remove dependency on Apache's PHP module [Carlos Garcia Campos]
* tests: Depend upon Apache's http2 module [Carlos Garcia Campos]

(From OE-Core rev: a4bfb5ceb5cf8c0c6d27225b27ef10c0b9dceccb)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 800e0d32db86dccfe1b54111d01034e4a315cce9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-16 06:52:45 +01:00
Ross Burton
97e48b17b9 vim: upgrade to 9.0.0021
This fixes the following CVEs:
- CVE-2022-2257
- CVE-2022-2264
- CVE-2022-2284
- CVE-2022-2285
- CVE-2022-2286
- CVE-2022-2287

(From OE-Core rev: 640ccea3110408985ef5cf76fbe8dc9f4c3fd22c)

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 03c044a81a76b7505b9d5bf0d936dde75b51905e)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-16 06:52:45 +01:00
Jose Quaresma
91df5c1c7b curl: backport openssl fix CN check error code
Fix out of memory [1]

OpenSSL host verification + hostname in certificate CN only seems broken in 7.82.0

[1] https://github.com/curl/curl/issues/8559

(From OE-Core rev: 7a8d374a3d4bbef336be2b273afc00c93c637ae6)

Signed-off-by: Jose Quaresma <jose.quaresma@foundries.io>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-08 08:27:16 +01:00
Maxime Roussin-Bélanger
cc75d77bc9 libffi: fix native build being not portable
Without `--with-gcc-arch=generic` libffi looks up the cpuid to automatically determine
which mtune/march to use. This makes the native sstate-cache unuseable since it's
possible to have a newer cpu building the recipe and the library being pulled from
another older cpu which doesn't have the instruction.

(From OE-Core rev: 58804e0051e3b77e0378aa4accbd26b2588b68e7)

Signed-off-by: Maxime Roussin-Bélanger <maxime.roussinbelanger@gmail.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit cddaecac1fdd4d033c2ff8ccaf1d60e1c598d5b7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-08 08:27:16 +01:00
Richard Purdie
ac087037fe vim: 8.2.5083 -> 9.0.0005
The license checksum changed due to a major version change in the referenced file.

(From OE-Core rev: a290032fe88b6bac5e789da20f88fd72febe1780)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 89f34d8aa4f4572d048dbb732ca4c83d443157fb)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-08 08:27:16 +01:00
Yi Zhao
d37d6ad960 popt: fix override syntax in RDEPENDS
RDEPENDS_${PN}-ptest -> RDEPENDS:${PN}-ptest

(From OE-Core rev: 6168dbc9b27da1ed88c277bab6f024e6e068e685)

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 37a47bfced900c2f1e239b216d8614eb290f2f0c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-22 23:46:29 +01:00
Kai Kang
62fdfa45ab xxhash: fix build with gcc 12
It fails to compile xxhash when '-Og' is set in CFLAGS via such as set
DEBUG_BUILD = '1' in local.conf. Check and disable inline when '-Og'
exists.

(From OE-Core rev: d8e454b370089e4a33c8373742178ef4d540e848)

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3464c67cd34acbb1a6705369e34dee8af7e348ac)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-22 23:46:29 +01:00
Richard Purdie
a6344dc61a vim: Upgrade 8.2.5034 -> 8.2.5083
Includes fixes for CVE-2022-1927, CVE-2022-1942.

(From OE-Core rev: b85e29de4bca17834b003d499db5129fc5dee75e)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1e740b5c2227c0040621ae63436d06db4873670f)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-22 23:46:28 +01:00
wangmy
cf73ba2e31 iso-codes: upgrade 4.9.0 -> 4.10.0
Changelog:
==========
Added
--------
Update ISO 639-2 codes to include Montenegrin (cnr) added in 2017.
Update ISO 4217. Fixes #24
ISO 639-3: New translation for Friulian
ISO 639-5: New translations for Esperanto, Hindi, Russian
ISO 4217: New translation for Esperanto

Changed
--------
Translation updates for ISO 3166-1
Translation updates for ISO 3166-2
Translation updates for ISO 3166-3
Translation updates for ISO 639-2
Translation updates for ISO 639-3
Translation updates for ISO 639-5
Translation updates for ISO 4217
Translation updates for ISO 15924

Fixed
--------
ISO 3166-2: Add parent codes for GB. Fixes #36
ISO 3166-2: Fix subdivision names for Finland. Fixes #37

(From OE-Core rev: c4114d9bfbdb3be7815d15b98edd666e62056ddc)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit eb771fa7740f9749d26a4d3f74a926eb1e564ee5)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-18 16:34:40 +01:00
Peter Kjellerstedt
5c04e06d76 libseccomp: Correct LIC_FILES_CHKSUM
Previously, only the first line of the LICENSE file was included,
which only covered the license name and thus would not detect a change
to the version (or anything else for that matter).

(From OE-Core rev: f9f1e7fa6b895cf810887b6c5ddb07b521371f20)

Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 3ac45755dffc611fb46f5cd1c07f4876d3094893)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11 10:06:13 +01:00
Richard Purdie
2d031b7e2a lzo: Add further info to a patch and mark as Inactive-Upstream
Add some further info to the patch based on upstream changes. Given the last release
in 2017 and glaring issues on at least armv5, it does raise the question on whether
we should drop this. There are probably better compression tools now.

(From OE-Core rev: 27815774c983f7c2c849513efe087a6d77eaf443)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 241309c6dec364445093fa5973cc8998431cbed9)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-11 10:06:13 +01:00
Joerg Vehlow
9437dc2783 libseccomp: Add missing files for ptests
pfc files are used e.g. in 38-basic-pfc_coverage.sh
valgrind_test.supp is required, when valgrind is installed, otherwise
all valgrind tests fail

(From OE-Core rev: b34aaa9acbe865f61be0a598b8df2735b1bc76cd)

Signed-off-by: Joerg Vehlow <joerg.vehlow@aox.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 32ba67bc37b5ca73f7d29cb6c7de281ab8f824bd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-07 11:53:26 +01:00
Davide Gardenal
8de0650a97 libpcre2: upgrade 10.39 -> 10.40
Security fixes and update to Unicode property handling.

Upstream release notes:
https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.40

CVE: CVE-2022-1587

(From OE-Core rev: 9cf49b4f07afcf48a5e6d1ed12d0959d5d040e00)

Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-07 11:53:26 +01:00
Richard Purdie
01e54e3b62 libxslt: Mark CVE-2022-29824 as not applying
We have libxml2 2.9.14 and we don't link statically against libxml2 anyway
so the CVE doesn't apply to libxslt.

(From OE-Core rev: 82f4186ec0b16d4c1d9a8612fc3b6c6701fee8ea)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit c6315d8a2a1429a0fb7563b1d6352ceee7bc222c)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-07 11:53:26 +01:00
Richard Purdie
fd6b78f90c vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs
Address CVE-2022-1621, CVE-2022-1629, CVE-2022-1674, CVE-2022-1733, CVE-2022-1735
CVE-2022-1769, CVE-2022-1771, CVE-2022-1785, CVE-2022-1796

(From OE-Core rev: c703b970f614ede46f9d3e24bb33cb4eb77d38a2)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit fafce97bd440150ac5c586b53b887ee70a5b66bd)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-07 11:53:25 +01:00
Alexander Kanavin
354e778709 sqlite3: upgrade 3.38.3 -> 3.38.5
Additional changes in version 3.38.4 (2022-05-04):

Fix a byte-code problem in the Bloom filter pull-down optimization added by release 3.38.0 in which an error in the byte code causes the byte code engine to enter an infinite loop when the pull-down optimization encounters a NULL key. Forum thread 2482b32700384a0f.
Other minor patches. See the timeline for details.

Additional changes in version 3.38.5 (2022-05-06):

Fix a blunder in the CLI of the 3.38.4 release.

(From OE-Core rev: c762a5c97b61b4d560cda33ba4a7c329df0fc9f8)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit e1bd414792ae2576685b2a352a5cc93343f06985)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-28 10:38:17 +01:00
Hitendra Prajapati
ce9e354ebd pcre2: CVE-2022-1586 Out-of-bounds read
Backport from 50a51cb7e6
CVE-2022-1586: pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c.

(From OE-Core rev: fb6c980105ffd0262517299ab366218c61cc0665)

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
(cherry picked from commit 7519eb1cb624bb576cfe60f7470d40c566818ac3)
Signed-off-by: Jeremy A. Puhlman <jpuhlman@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-28 10:38:17 +01:00
Robert Joslyn
ee8d859d05 curl: Backport CVE fixes
Backport patches to address the following CVEs:
 * https://curl.se/docs/CVE-2022-22576.html
 * https://curl.se/docs/CVE-2022-27775.html
 * https://curl.se/docs/CVE-2022-27776.html
 * https://curl.se/docs/CVE-2022-27774.html
 * https://curl.se/docs/CVE-2022-30115.html
 * https://curl.se/docs/CVE-2022-27780.html
 * https://curl.se/docs/CVE-2022-27781.html
 * https://curl.se/docs/CVE-2022-27779.html
 * https://curl.se/docs/CVE-2022-27782.html

(From OE-Core rev: b83c7ae43c372c1870d13ae25ebfad9c68a0928d)

Signed-off-by: Robert Joslyn <robert.joslyn@redrectangle.org>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-25 22:45:50 +01:00
Richard Purdie
0070210dee vim: Upgrade 8.2.4681 -> 8.2.4912
Includes fixes for CVE-2022-1381, CVE-2022-1420.

(From OE-Core rev: d1c0db32383812531b857729c585b3305e781cd9)

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 77d745bd49c979de987c75fd7a3af116e99db82b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20 10:08:06 +01:00
Alexander Kanavin
2b7d34e5ec sqlite3: upgrade 3.38.2 -> 3.38.3
2022-04-27 - Version 3.38.3
Version 3.38.3 fixes a bug in the automatic-index and Bloom filter construction
logic that might cause SQLite to be overly aggressive in the use of ON clause
constraints, resulting in a incorret automatic-index or Bloom filter that excludes
some valid rows from output. The bug was introduced in version 3.38.0.
Other minor changes were tossed in to complete the patch.

(From OE-Core rev: c78ac7ef2d14a8b6167922a12e8c7f35c4b11bfb)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 1efd89a4572bb2f39728fd53a1d4db944b06ff38)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20 10:08:06 +01:00
Alexander Kanavin
713dea485f fribidi: upgrade 1.0.11 -> 1.0.12
Overview of changes between 1.0.11 and 1.0.12

- Various fuzzing fixes.

(From OE-Core rev: e42ff3c56228359f4dfa1de2303dfa64fd29f311)

Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 5396115fc726f0a9f8a76d1b3ec27ea73062367b)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-20 10:08:06 +01:00
wangmy
1d045cfddf libgit2: upgrade 1.4.2 -> 1.4.3
Changelog:
=========
Validate repository directory ownership (v1.4)
midx: Fix an undefined behavior (left-shift signed overflow)
fetch: support OID refspec without dst
Fix crash when regenerating a patch with unquoted spaces in filename

(From OE-Core rev: e6541bd09289abc87b7e81716bea774c80285bc0)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit bef09c61ee32df214fb8cf6000e0314ff3a38156)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-28 17:07:18 +01:00
wangmy
d1804e004e libusb1: upgrade 1.0.25 -> 1.0.26
Changelog:
==========
* Fix regression with transfer free's after closing device
* Fix regression with destroyed context if API is misused
* Workaround for applications using missing default context
* Fix hotplog enumeration regression
* Fix Windows isochronous transfer regression since 1.0.24
* Fix macOS exit crash in some multi-context cases
* Build fixes for various platforms and configurations
* Fix Windows HID multi-interface product string retrieval
* Update isochronous OUT packet actual lengths on Windows
* Add interface bound checking for broken devices
* Add umockdev tests on Linux

(From OE-Core rev: 0c5828713ad1716d2032986f4156cfbc83a53674)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 7353489980600af07d0771654da6a8a3b0df7572)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-28 17:07:18 +01:00
wangmy
7eada90a66 libsoup: upgrade 3.0.5 -> 3.0.6
Changelog:
=========
* Misc HTTP/2 fixes
* Add PUT/POST support to examples/get
* Add `--user-agent` option to examples/get
* Misc meson improvements
* Fix build with Visual Studio

(From OE-Core rev: 11beef012a0c7605b5ede04b9135692a993e0038)

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 0ee1c748af7520f50275b8dfb32f41de7f5e14c7)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-28 17:07:18 +01:00
Khem Raj
d94222a7a9 gnupg: Disable FORTIFY_SOURCES on mips
This is a workaround for issue reported with gcc12 [1]

[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105234

(From OE-Core rev: 21f2723c84c37a0aaa1a27bc4b738f82507321e8)

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 8b8259e070c582d0c566535a3559aa712148efc0)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-28 17:07:18 +01:00
Konrad Weihmann
2e3513e7cc libcap: add pam_cap license
If libcap is compiled with pam in PACKAGECONFIG
one additional license text becomes effective,
add that as a conditional

(From OE-Core rev: 1ea595d5fe24f4ba5e648b5591d5e2a442f57ca4)

Signed-off-by: Konrad Weihmann <kweihmann@outlook.com>
Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-14 09:47:00 +01:00