Commit Graph

1247 Commits

Author SHA1 Message Date
Hitendra Prajapati db0a8862fc php: CVE-2022-4900 fix potential buffer overflow
Upstream-Status: Backport from https://github.com/php/php-src/commit/789a37f14405e2d1a05a76c9fb4ed2d49d4580d5

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:42 -05:00
Richard Purdie bc22fe3465 meta-oe: Drop broken BBCLASSEXTEND variants
The command "bitbake universe -c fetch" currently throws a ton of warnings
as there are many 'impossible' dependencies.

In some cases these variants may never have worked and were just added by copy
and paste of recipes. In some cases they once clearly did work but became
broken somewhere along the way. Users may also be carrying local bbappend files
which add further BBCLASSEXTEND.

Having universe fetch work without warnings is desireable so clean up the broken
variants. Anyone actually needing something dropped here can propose adding it
and the correct functional dependencies back quite easily. This also then
ensures we're not carrying or fixing things nobody uses.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9962d57f7c)
Backport:
* Updated paths to follow PV changes
* Adapted modified recipes to the ones generating warnings
* NB: cups-filter needs poppler-native but its not available. To fix
  this, 5fa0188b8c could be backported.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-12-17 15:36:41 -05:00
Siddharth Doshi 0f10a0d394 php: Fix CVE-2023-3824
Upstream-Status: Backport from [https://github.com/php/php-src/commit/80316123f3e9dcce8ac419bd9dd43546e2ccb5ef]
CVE: CVE-2023-3824
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-30 08:55:03 -04:00
Sourav Pramanik a84764cd13 nlohmann-json: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:52 -04:00
Sourav Pramanik 637cd4fd96 rapidjson: Avoid usage of nobranch=1
The usage of nobranch=1 in SRC_URI allows using unprotected branches.

This change updates the real branch name in place of nobranch=1.

Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 09:05:48 -04:00
Ashish Sharma 1ff41cb9c6 php: Backport fix CVE-2023-3247
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-16 08:39:45 -04:00
Martin Jansa 172fc48573 nodejs-14: add -fpermissive BUILD_CXXFLAGS to fix build with gcc-13 on host
Fixes nodejs-native build with gcc-13 on host:
http://errors.yoctoproject.org/Errors/Details/728221/

nodejs-12 doesn't need it yet and nodejs-16 doesn't need it as well

'-DV8_TYPED_ARRAY_MAX_SIZE_IN_HEAP=64' '-D__STDC_FORMAT_MACROS' '-DOPENSSL_NO_PINSHARED' '-DOPENSSL_THREADS' '-DV8_TARGET_ARCH_X64' '-DV8_EMBEDDER_STRING="-node.84"' '-DENABLE_DISASSEMBLER' '-DV8_PROMISE_INTERNAL_FIELD_COUNT=1' '-DENABLE_MINOR_MC' '-DOBJECT_PRINT' '-DV8_INTL_SUPPORT' '-DV8_CONCURRENT_MARKING' '-DV8_ARRAY_BUFFER_EXTENSION' '-DV8_ENABLE_LAZY_SOURCE_POSITIONS' '-DV8_USE_SIPHASH' '-DDISABLE_UNTRUSTED_CODE_MITIGATIONS' '-DV8_WIN64_UNWINDING_INFO' '-DV8_ENABLE_REGEXP_INTERPRETER_THREADED_DISPATCH' '-DV8_SNAPSHOT_COMPRESSION' -ITOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -I../deps/v8 -I../deps/v8/include -I.//Release/obj/gen/torque-output-root -I.//Release/obj/gen/generate-bytecode-output-root  -pthread -Wno-unused-parameter -m64 -Wno-return-type -fno-strict-aliasing -m64 -O3 -fno-omit-frame-pointer -fdata-sections -ffunction-sections -O3 -fno-rtti -fno-exceptions -std=gnu++1y -MMD -MF .//Release/.deps/Release/obj.host/v8_initializers/gen/torque-output-root/torque-generated/../../deps/v8/src/builtins/array-find-tq-csa.o.d.raw -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -isystemTOPDIR/tmp-glibc/work/x86_64-linux/nodejs-native/14.18.1-r0/recipe-sysroot-native/usr/include -O2 -pipe -c
In file included from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/move.h:37,
                 from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/bits/stl_function.h:60,
                 from /usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/functional:49,
                 from ../deps/v8/src/codegen/code-stub-assembler.h:8,
                 from ../deps/v8/src/builtins/builtins-promise-gen.h:8,
                 from ../deps/v8/src/builtins/builtins-async-gen.h:8,
                 from ../deps/v8/src/builtins/builtins-async-function-gen.cc:5:
/usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits: In instantiation of ‘struct std::is_convertible<v8::internal::Cell, v8::internal::Object>’:
../deps/v8/src/codegen/tnode.h:262:72:   required from ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’
../deps/v8/src/codegen/tnode.h:346:75:   required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’
../deps/v8/src/codegen/code-stub-assembler.h:1868:33:   required from here
/usr/lib/gcc/x86_64-pc-linux-gnu/13/include/g++-v13/type_traits:1417:30: error: invalid use of incomplete type ‘class v8::internal::Cell’ [-fpermissive]
 1417 |     : public __bool_constant<__is_convertible(_From, _To)>
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ../deps/v8/src/objects/objects.h:26,
                 from ../deps/v8/src/objects/fixed-array.h:10,
                 from ../deps/v8/src/objects/contexts.h:8,
                 from ../deps/v8/src/execution/thread-local-top.h:10,
                 from ../deps/v8/src/execution/isolate-data.h:12,
                 from ../deps/v8/src/execution/isolate.h:24,
                 from ../deps/v8/src/codegen/interface-descriptors.h:14,
                 from ../deps/v8/src/codegen/callable.h:8,
                 from ../deps/v8/src/codegen/code-factory.h:8,
                 from ../deps/v8/src/compiler/code-assembler.h:17,
                 from ../deps/v8/src/codegen/code-stub-assembler.h:15:
../deps/v8/src/objects/object-list-macros.h:19:7: note: forward declaration of ‘class v8::internal::Cell’
   19 | class Cell;
      |       ^~~~
In file included from ../deps/v8/src/codegen/interface-descriptors.h:12:
../deps/v8/src/codegen/tnode.h: In instantiation of ‘const bool v8::internal::is_subtype<v8::internal::Cell, v8::internal::Cell>::value’:
../deps/v8/src/codegen/tnode.h:346:75:   required by substitution of ‘template<class U, typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> > v8::internal::TNode<v8::internal::Cell>::TNode(const v8::internal::TNode<T>&) [with U = v8::internal::Cell; typename std::enable_if<v8::internal::is_subtype<U, v8::internal::Cell>::value, int>::type <anonymous> = <missing>]’
../deps/v8/src/codegen/code-stub-assembler.h:1868:33:   required from here
../deps/v8/src/codegen/tnode.h:262:72: error: ‘value’ is not a member of ‘std::is_convertible<v8::internal::Cell, v8::internal::Object>’
  262 |                                        std::is_convertible<T, Object>::value);
      |                                                                        ^~~~~

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:29:13 -04:00
Khem Raj 0aa6a3ddc6 nodejs: Fix build with gcc13
* MJ: remove AUTHORS modification from the original patch from
  nodejs-16, so that the same patch does apply for both 14 and 12
  versions used in dunfell

* MJ: gcc-13 isn't used for target builds in dunfell, but can be used
  on host, so this is useful backport for nodejs-native

* MJ: this fixes default nodejs-native-12, nodejs-native-14 with negative
  D_P might need additional fix on top

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:29:04 -04:00
Hitendra Prajapati 7ca27d5cf3 yajl: CVE-2023-33460 memory leak in yajl_tree_parse function
Upstream-Status: Backport from https://github.com/openEuler-BaseService/yajl/commit/23a122eddaa28165a6c219000adcc31ff9a8a698

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-14 07:08:54 -04:00
Martin Jansa d25f2f1cac nodejs: fix native node-gyp to work with python-3.11
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Narpat Mali 116bfe8d5e nodejs: make 14.18.1 available but not default
Chromium 112 needs nodejs-native version 14 or later.
Add the nodejs_14.18.1 recipe from kirkstone:
   246b20b92 nodejs: Upgrade to 14.18.1
but, use DEFAULT_PREFERENCE to make sure that the default version of nodejs
remains 12.x.

7 patches which were modified between nodejs 12 & nodejs 14 were renamed by
adding the suffix "-nodejs14". Note there are some common patches used by
nodejs 12 & 14 so, that will require attention during future maintenance.
In addition, there were 3 CVE-2022* patches which applied cleanly to nodejs
14 so, they were added to the nodejs 14 recipe. One patch, CVE-llhttp.patch
conflicted so, it has not been applied in nodejs 14 yet.

Nodejs 14 compile for qemux86-64 but, no run-time testing has been performed.

For chromium, we would either require users to modify the local.conf file or
we may create a dunfell specific branch in meta-browser.
See: https://github.com/OSSystems/meta-browser/pull/709

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Viktor Rosendahl 765cfa779d jsoncpp: Fix broken handling of escape characters
Applying this backported patch from upstream fixes the following
BAT test failure:

jsoncpp.jsoncpp_system_tests.TestJsoncpp.test_run_jsoncpp_test
(from systemtests--bmt--BAT) :
* Detail of EscapeSequenceTest/writeEscapeSequence test failure:
/usr/src/debug/jsoncpp/1.9.2-r0/git/src/test_lib_json/main.cpp(3370): expected == result
  Expected: '["\"","\\","\b","\f","\n","\r","\t","\u0278","\ud852\udf62"]
  '
  Actual  : '["\"","\\","\b","\f","\n","\r","\t","ɸ","𤭢"]

This test failure happens because aarch64 uses unsigned char as
default type for char, while x86 uses signed char. Also, there
is another bug in the code that is fixed by this upstream patch:

 "static_cast<unsigned char>(*cur) < 0x80" should be:
 "static_cast<unsigned char>(*cur) >= 0x80"

Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Poonam Jadhav 068acc4ec7 nodejs: Fix CVEs for nodejs
Add patch file CVE-llhttp.patch to fix CVE-2022-32213,
CVE-2022-32214, CVE-2022-32215, CVE-2022-35256 of nodejs.

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-llhttp.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Poonam Jadhav 9291a88738 nodejs: Fix CVE-2022-43548
Add patch to fix CVE-2022-43548

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-2022-43548.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Poonam Jadhav b691797f77 nodejs: Fix CVE-2022-35255
Add patch to fix CVE-2022-35255

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-2022-35255.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Poonam Jadhav df7fba3744 nodejs: Fix CVE-2022-32212
Add patch to fix CVE-2022-32212

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-2022-32212.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Valeria Petrov 09c3ac0da6 php: update 7.4.28 -> 7.4.33
Update php from 7.4.28 to 7.4.33

    Fixes below CVEs:
    CVE-2021-21708
    CVE-2022-31626
    CVE-2022-31625
    CVE-2022-31628
    CVE-2022-31629
    CVE-2022-31630
    CVE-2022-37454

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-19 07:49:31 -05:00
Virendra Thakur 6464eb9fc4 capnproto: Fix CVE-2022-46149
This patch contains a fix for CVE-2022-46149

Patch backported from :
https://github.com/capnproto/capnproto/commit/25d34c67863fd960af34fc4f82a7ca3362ee74b9

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-19 07:49:31 -05:00
Ivan Stepic 1e9bf08cca flatbuffers: adapt for cross-compilation environments
Flatbuffers contains a library and a schema compiler. The package
contains cmake files to discover the libraries and the compiler tool.
Currently, all of these cmake files are installed into the target
sysroot. However, the compiler utility isn't installed into the sysroot
(as it is not runnable on the build machine).

When an application that depends on flatbuffers gets built, it uses
flatbuffers' exported cmake targets to configure the project. One of the
exported targets is FlatcTarget.cmake which expects to see flatc binary
in /usr/bin of the sysroot. Since binaries for target don't end up in
target sysroot, cmake configuration fails.

This patch addresses this problem of flatbuffers' build infrastructure
in cross-compiling environments. By removing FlatcTarget.cmake for
target builds from the sysroot we essentially skip this step of
flatbuffers' configuration.

Signed-off-by: Ivan Stepic <Ivan.Stepic@bmw.de>
Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
2022-11-25 10:35:23 -05:00
Ranjitsinh Rathod a1a40c95eb nodejs: Upgrade to 12.22.12
As per the below release note, it should be a last release for 12.x
stable LTS series.
Link: https://github.com/nodejs/node/releases/tag/v12.22.12

Remove CVE-2021-44532 fix as it already available in this release
v12.22.12

License-Update: src/gtest additional file in the LICENSE

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
2022-09-11 13:49:52 -04:00
Khem Raj f22bf6efaa meta-oe: Add leading whitespace for append operator
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 92441f9d6a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 06:59:38 -07:00
Jeroen Hofstee d6795ab0ee php: move to version v7.4.28
CVE: CVE-2021-21703 CVE-2021-21706 CVE-2021-21707 CVE-2021-21708

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
[Didn't apply cleanly, corrected.]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Martin Jansa 245a1ab46b grpc: switch from master branch to main for upb
* hardknott and newer branches don't need this as upb repo was removed in:
  commit 15cff67fd6
  Author: Anatol Belski <anbelski@linux.microsoft.com>
  Date:   Fri Feb 19 12:39:55 2021 +0000

    grpc: Upgrade 1.24.3 -> 1.35.0

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Steve Sakoman abd7cf838d lua: fix CVE-2022-28805
singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup
call, leading to a heap-based buffer over-read that might affect a system that
compiles untrusted Lua code.

https://nvd.nist.gov/vuln/detail/CVE-2022-28805

(From OE-Core rev: d2ba3b8850d461bc7b773240cdf15b22b31a3f9e)

Signed-off-by: Sana Kazi <sana.kazi@kpit.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 91e14d3a8e6e67267047473f5c449f266b44f354)
Signed-off-by: Omkar Patil <omkar.patil@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25 19:34:39 -07:00
Nisha Parrakat 89d2876e2e nodejs: upgrade to 12.22.2
upgrading to next maintainence LTS version

Signed-off-by: Nisha Parrakat <nishaparrakat@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Armin Kuster bd08205d94 breakpad: Update SRC_URI for protobuf and lss
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Thomas Perrot ac85c97636 breakpad: fix branch for gtest in SRC_URI
The commit 4fe018038f87 is in the main branch, so the do_fetch task failed.

Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b8bb7dc157)
[Fix up for Dunfell context]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-04-18 07:37:42 -07:00
Ross Burton a14eb5e288 protobuf: fix patch fuzz
Applying patch CVE-2021-22570.patch
patching file src/google/protobuf/descriptor.cc
Hunk #1 succeeded at 2603 with fuzz 1 (offset -23 lines).
Hunk #2 succeeded at 2817 with fuzz 1 (offset -14 lines).
Hunk #3 succeeded at 4006 (offset -17 lines).
Hunk #4 succeeded at 4050 (offset -18 lines).
Hunk #5 succeeded at 4368 (offset -18 lines).

Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-03-27 08:18:20 -07:00
Sana Kazi 0722ff6f02 protobuf: Fix CVE-2021-22570
Fix CVE-2021-22570.
Link: https://koji.fedoraproject.org/koji/buildinfo?buildID=1916865
Link: https://src.fedoraproject.org/rpms/protobuf/blob/394beeacb500861f76473d47e10314e6a3600810/f/CVE-2021-22570.patch

Remove first and second hunk because the second argument in
InsertIfNotPresent() function is of type const char* const& but the
first and second hunk makes the type of second argument as const string
which is not compatible with the type of second argument in
InsertIfNotPresent().

Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Sana Kazi <sanakazisk19@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-23 15:48:18 -08:00
Virendra Thakur ec97823273 nodejs: Fix for CVE-2021-44532
Add patch to fix CVE-2021-44532

Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com>
Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-02-06 11:01:44 -08:00
Armin Kuster 59bff77ad0 recipes: Update SRC_URI branch and protocols
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-17 12:26:21 -08:00
Andreas Weger 46eb172b64 grpc: Define SRCREV_FORMAT
Since it uses multiple fetch URIs make it explicit to define SRCREV_FORMAT

Signed-off-by: Andreas Weger <weger@hs-mittweida.de>

Change-Id: Ib24fce16b3986a465f1c5854166b8f28446b5186
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-02 05:47:24 -07:00
Khem Raj 9298852a91 android-tools: Define SRCREV_FORMAT
Since it uses multiple fetch URIs make it explicit to define SRCREV_FORMAT

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-11-02 05:47:24 -07:00
Joe Slater e4a74a0f0f php: move to version 7.4.21
Lots of bug fixes.

CVE: CVE-2021-21704 CVE-2021-21705

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 93045c3db7)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 69dcf5bac8)
[Stable bug fix only updates]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-14 13:54:01 -07:00
Kai Kang c1a9fe8517 libdbi-perl: fix CVE-2014-10402
Backport patch to fix CVE-2014-10402.

CVE: CVE-2014-10402

Ref:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=972180#12

Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c80b3757ff)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-08-14 13:44:12 -07:00
Mingli Yu 85f8047c71 php: Upgrade to 7.4.16
License-Update: License updated (year updated)

Fix some security issues such as CVE-2021-21702 and remove two
cve patches which already included in the new version.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e418ee4657)
[Bug fix only updates plus: CVE-2020-7071 ]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-26 16:05:08 -07:00
Changqing Li 11c1cd6bf5 php: allow php as empty
Since commit c4ffcaa2[php: split out phpdbg into a separate package],
package php is empty, we might met error:
nothing provides php needed by php-cli-7.4.9-r0.corei7_64

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9be6b4f5a2)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-26 16:04:47 -07:00
Diego Santa Cruz 9982d7f277 php: split out phpdbg into a separate package
Since PHP 7.0 the phpdbg debugger is built by default and gets shipped
in the main php package, increasing its size by several MB; split it
out into a php-phpdbg package, following Debian naming.

Signed-off-by: Diego Santa Cruz <Diego.SantaCruz@spinetix.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c4ffcaa2ab)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-26 16:04:24 -07:00
Nicolas Dechesne d34d040fda python3-{pyyaml,cython,pyparsing}: move from meta-python to meta-oe
This specific statement in ostree recipe breaks the YP compatible
status (yocto-check-layer):

RDEPENDS_${PN}-ptest += " \
    ...
    ${@bb.utils.contains('BBFILE_COLLECTIONS', 'meta-python',    'python3-pyyaml', '', d)} \
    ...
"

Recently python3-pyyaml was moved to OE-core (0a8600f9cec0), and the
ostree recipe was fixed with:
b9ede0cb18 (python3-pyyaml: Do not check for meta-python)

In dunfell, moving python3-pyyaml to OE-core is not a great idea, but
moving it from meta-python to meta-oe allows us to fix ostree YP
compatible issue. Since meta-python depends on meta-oe, it should not
be a change with any visible effect.

python3-cython and python3-pyparsing are collateral damages since they are
dependency for python3-pyyaml, so needed to be moved too.

Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-07-25 13:36:16 -07:00
Clément Péron d460525cd5 nodejs: 12.20.2 -> 12.21.0
Fixes :
 - CVE-2021-22883
 - CVE-2021-22884
 - CVE-2021-23840

Signed-off-by: Clément Péron <peron.clem@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 02feb1d932)
[12.x LTS version]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-14 10:03:51 -07:00
Sean Nyekjaer 1ea5c51d98 nodejs: 12.20.1 -> 12.20.2
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 6322c63987)
[12.x is LTS version]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-05-14 10:03:51 -07:00
Peace Lee 997c27d55e Update commit for version 3.9.7
commit hash for version 3.9.7 is invalid
because previous commit hashes
chagned by git filter-branch command are restored

Signed-off-by: Peace Lee <iipeace5@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fdbfb6ce99)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-07 08:55:15 -07:00
Peace Lee 1fe81b38af guider: Upgrade to 3.9.7
Signed-off-by: Peace Lee <iipeace5@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 93c9a20bf3)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-04-07 08:55:15 -07:00
Mikko Rapeli 80c0a5fff6 giflib: apply patch for CVE-2019-15133 and set CVE_PRODUCT
Backport upstream patch for CVE-2019-15133.
Set CVE_PRODUCT to "giflib_project:giflib" which is used
in NVD. https://nvd.nist.gov/vuln/detail/CVE-2019-15133

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 17:18:02 -08:00
Leon Anavi 52967af423 sip3: Upgrade 4.19.19 -> 4.19.23
Upgrade to release 4.19.23:

- Added some missing quotes to configure.py
- Fixed a race condition when calling the PyQt5-specific meta-call
  helper.
- Fixed the wrapping of methods that return a Py_Ssize_t.
- The code generator now distinguishes between the copy/assignment
  helper and the array helper when determining which helpers can
  be generated.
- Fixed the code generation when making a copy of C++ object on
  the stack to the heap when the class has no suitable ctor.
- Check there is a public copy ctor when we can't using an
  assigment operator as a workaround.
- Preserve any current exception in the implementation of the
  wrapper dealloc functions.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 358b398258)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 17:00:42 -08:00
Leon Anavi 112b03d7a4 sip3: Consolidate in a single file
Consolidate inc and bb files into a single bb file.
Fix the broken link for HOMEPAGE.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2bc281393a)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 17:00:27 -08:00
Harpritkaur Bhandari e5499dc4bc rapidjson: Upgrade SRCREV to latest
Upgrade SRCREV to latest as it fixes the below issue:
Running UndefinedBehaviorSanitizer on projects that use
rapidjson triggers 'applying non-zero offset <NN> to null
pointer' findings in 'internal/stack.h' which are hard
to suppress by library users.
Removed "0001-CMake-remove-hardcoded-CMAKECONFIG_INSTALL_DIR-path.patch"
as the changes are already incorporated in the latest
codebase.
As per abi-compliance-checker report the source compatibility
and binary compatibility between previous SRCREV
6a905f9311f82d306da77bd963ec5aa5da07da9c and current
SRCREV 0ccdbf364c577803e2a751f5aededce935314313
is 100% and this patch is already tested on 64bit
ARM (aarch64) in a product with on target CI tests.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 04d9ea0ba7)
Signed-off-by: Harpritkaur Bhandari <Harpritkaur.Bhandari@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 16:58:53 -08:00
Mikko Rapeli 4964a5a463 flatbuffers: whitelist CVE-2020-35864
CVE-2020-35864 is for the rust crate for flatbuffers, not
flatbuffers itself.

https://security-tracker.debian.org/tracker/CVE-2020-35864

"NOT-FOR-US: flatbuffers rust crate"

Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-28 16:58:44 -08:00
Sean Nyekjaer 65d71ece83 nodejs: 12.19.1 -> 12.20.1
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit cde1019804)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit ac6bc96e7d)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:11:30 -08:00
Stacy Gaikovaia 42cb28ecd7 nodejs: 12.19.0 -> 12.19.1
Uprev nodejs in order to fix CVE-2020-8277.
This CVE allows an attacker to trigger a DNS request for a host
of their choice, which could trigger a Denial of Service in
nodejs versions < 12.19.1.

See https://nvd.nist.gov/vuln/detail/CVE-2020-8277 for details.

CVE: CVE-2020-8277
Signed-off-by: Stacy Gaikovaia <Stacy.Gaikovaia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a440154082)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 387f40ce80)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2021-01-13 08:11:18 -08:00