Commit Graph

26110 Commits

Author SHA1 Message Date
Joe Slater
d09595e7ac python3-inotify: fix tests
Some tests in test-inotify.py assume values for watch
descriptors.  This is not safe, so we retrieve the
assigned values to compare with event information generated.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0efa5c872f)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-15 19:09:42 -04:00
Yi Zhao
513d4afd25 frr: Security fix CVE-2023-38802
CVE-2023-38802:
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote
attacker to cause a denial of service via a crafted BGP update with a
corrupted attribute 23 (Tunnel Encapsulation).

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-38802

Patch from:
46817adab0

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-15 19:09:42 -04:00
Robert Yang
332fce9304 frr: Fix CVE-2023-41358 and CVE-2023-41360
Backport patches to fix CVE-2023-41358 and CVE-2023-41360.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-41358
https://nvd.nist.gov/vuln/detail/CVE-2023-41360

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-15 19:09:42 -04:00
Meenali Gupta
f77bc7fda8 lldpd: upgrade 1.0.16 -> 1.0.17
This release only contains bugfixes and security fixes.

Highlighted bugfixes in 1.0.17:
      Read overflow when parsing CDP addresses. Thanks to Matteo Memelli.
      Don't output empty lines on configure commands.
Changelog:
      https://github.com/lldpd/lldpd/releases/tag/1.0.17

References: 
     https://nvd.nist.gov/vuln/detail/CVE-2023-41910

Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-15 19:09:42 -04:00
Khem Raj
5cdad4e343 kernel-selftest: Build headers before compiling tests
This fixes build failure with kernel 6.5

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-15 19:09:42 -04:00
Changqing Li
8df57cbec4 redis: upgrade 7.0.12 -> 7.0.13
Refer [1], include an urgency SECURITY fix and some bug fixes

[1] https://github.com/redis/redis/releases/tag/7.0.13

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-10-15 19:09:42 -04:00
Lee Chee Yang
922f41b39f x11vnc: Fix CVE-2020-29074
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit dbdea59838)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27 07:40:56 -04:00
Lee Chee Yang
7fff53bcbd opensc: fix CVE-2023-2977
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 44b0037309)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27 07:40:56 -04:00
Sanjay Chitroda
d4277b4734 netkit-telnet: Fix CVE-2022-39028
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-39028
https://security-tracker.debian.org/tracker/CVE-2022-39028

Upstream Patch:
https://cgit.freebsd.org/src/commit/?id=6914ffef4e23

- Patch is adopted from FreeBSD, as same vulnerability of
  telnetd is applicable to FreeBSD and netkit-telnet packages.

Signed-off-by: Sanjay Chitroda <sanjay.chitroda@einfochips.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d629fe71e4)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-27 07:40:56 -04:00
Armin Kuster
255184c655 openldap: update to 2.5.16.
2.5.x is an LTS version per the project.
Drop patch now included.

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 7a423279cf)
Signed-off-by: Armin Kuster <akuster@mvista.com>
2023-09-27 07:40:47 -04:00
Yogita Urade
32c529d435 poppler: fix CVE-2023-34872
A vulnerability in Outline.cc for Poppler prior to 23.06.0
allows a remote attacker to cause a Denial of Service (DoS)
(crash) via a crafted PDF file in OutlineItem::open.

Reference:
https://gitlab.freedesktop.org/poppler/poppler/-/issues/1399

Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:22:00 -04:00
Chen Qi
5862e1090d grpc: fix CVE-2023-33953
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:22:00 -04:00
Chen Qi
105cf62313 grpc: fix CVE-2023-32732
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:22:00 -04:00
Polampalli, Archana
8379041d98 python3-appdirs: print ptest results in unified format
Update run-ptest script to print the output of python3-appdirs ptest results in
unified format

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:22:00 -04:00
Chris Dimich
c0e8ce2623 image_types_sparse: Fix syntax error
When using the image type:

	IMAGE_FSTYPES += " wic.sparse"
	IMAGE_CLASSES += " image_types_sparse"

The following error arises:

	Syntax error: Bad function name

So need to remove function in favor of variable.

Signed-off-by: Chris Dimich <chris.dimich@boundarydevices.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Bastian Krause <bst@pengutronix.de>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-19 07:22:00 -04:00
Martin Jansa
056148368b tcpreplay: fix pcap detection with /usr/lib32 multilib
* use BPN, BP where useful
* use prefix instead of hardcoding /usr
* add patch to search also in lib32 subdir of --with-libpcap value
  to fix:
  checking for libpcap... configure: error: "Unable to find matching library for header file in TOPDIR/BUILD/work/raspberrypi4_64-oemllib32-linux-gnueabi/lib32-tcpreplay/4.4.4-r0/lib32-recipe-sysroot/usr"

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-06 08:16:19 -04:00
Martin Jansa
2091b63c9d libcyusbserial: fix installed-vs-shipped QA issue with multilib
* testing ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR} existence
  doesn't really work in cross compilation and on some hosts was causing:

  ERROR: QA Issue: libcyusbserial: Files/directories were installed but not shipped in any package:
    /usr/lib/libcyusbserial.so.1
    /usr/lib/libcyusbserial.so
  Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
  libcyusbserial: 2 installed and not shipped files. [installed-vs-shipped]

  with multilib using /usr/lib32 or /usr/lib64 when the same didn't
  exist on host.

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-06 08:16:15 -04:00
Martin Jansa
1d67c934ee khronos-cts.inc: respect MLPREFIX when appending DEPENDS with anonymous python
* this causes 2 issues:
  lib32-opengl-es-cts depending on 64bit wayland and wayland-protocols:

  $ bitbake-getvar -r lib32-opengl-es-cts DEPENDS
  #
  # $DEPENDS [14 operations]
  #   set /OE/build/oe-core/openembedded-core/meta/conf/bitbake.conf:309
  #     ""
  #   set /OE/build/oe-core/openembedded-core/meta/conf/documentation.conf:137
  #     [doc] "Lists a recipe's build-time dependencies (i.e. other recipe files)."
  #   :prepend /OE/build/oe-core/openembedded-core/meta/classes-global/base.bbclass:57
  #     "${BASEDEPENDS} "
  #   :prepend /OE/build/oe-core/openembedded-core/meta/classes-recipe/pkgconfig.bbclass:7
  #     "pkgconfig-native "
  #   :prepend /OE/build/oe-core/openembedded-core/meta/classes-recipe/cmake.bbclass:10
  #     "cmake-native "
  #   :append /OE/build/oe-core/openembedded-core/meta/classes-recipe/python3native.bbclass:11
  #     " python3-native "
  #   append /OE/build/oe-core/meta-openembedded/meta-oe/recipes-graphics/vk-gl-cts/khronos-cts.inc:28
  #     "python3-lxml-native libpng zlib virtual/libgles2 qemu-native"
  #   :append[libc-musl] /OE/build/oe-core/meta-openembedded/meta-oe/recipes-graphics/vk-gl-cts/khronos-cts.inc:38
  #     " libexecinfo"
  #   rename (to) classextend.py:108 [map_depends_variable]
  #     "DEPENDS_NONML"
  #   set classextend.py:109 [map_depends_variable]
  #     "${@oe.classextend.get_depends('DEPENDS', d)}"
  #   append classextend.py:110 [map_depends_variable]
  #     [vardeps] " DEPENDS_NONML"
  #   append cmake.bbclass:25 [__anon_30__OE_build_oe_core_openembedded_core_meta_classes_recipe_cmake_bbclass]
  #     " ninja-native"
  #   append khronos-cts.inc:77 [__anon_80__OE_build_oe_core_meta_openembedded_meta_oe_recipes_graphics_vk_gl_cts_khronos_cts_inc]
  #     " wayland-native wayland wayland-protocols"
  #   append khronos-cts.inc:79 [__anon_80__OE_build_oe_core_meta_openembedded_meta_oe_recipes_graphics_vk_gl_cts_khronos_cts_inc]
  #     " virtual/libx11 virtual/egl "
  # pre-expansion value:
  #   "${@oe.classextend.get_depends('DEPENDS', d)} ninja-native wayland-native wayland wayland-protocols virtual/libx11 virtual/egl "
  DEPENDS="cmake-native lib32-libpng pkgconfig-native python3-lxml-native python3-native qemu-native virtual/lib32-arm-oemllib32-linux-gnueabi-compilerlibs virtual/arm-oemllib32-linux-gnueabi-gcc virtual/lib32-libc virtual/lib32-libgles2 lib32-zlib ninja-native wayland-native wayland wayland-protocols virtual/libx11 virtual/egl "

* lib32-opengl-es-cts-dev runtime depending on 64bit wayland-dev wayland-protocols-dev
  as caught by multilib QA check:

  ERROR: QA Issue: lib32-opengl-es-cts package lib32-opengl-es-cts-dev - suspicious values 'wayland-dev wayland-protocols-dev' in RRECOMMENDS [multilib]

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-06 08:16:12 -04:00
Martin Jansa
60ef815604 mongodb: enable hardware crc32 only with crc in TUNE_FEATURES
* see https://jira.mongodb.org/browse/SERVER-30893

* fixes:
  aarch64-oe-linux-gcc -fstack-protector-strong -O2 -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security -Werror=format-security -Werror=return-type --sysroot=TOPDIR/BUILD/work/mach-oe-linux/mongodb/4.4.13-r0/recipe-sysroot -o build/opt/third_party/wiredtiger/src/checksum/arm64/crc32-arm64.o -c -std=c11 -fno-omit-frame-pointer -fno-strict-aliasing -fasynchronous-unwind-tables -ggdb -pthread -Wall -Wsign-compare -Wno-unknown-pragmas -Winvalid-pch -O2 -Wno-unused-local-typedefs -Wno-unused-function -Wno-deprecated-declarations -Wno-unused-const-variable -Wno-unused-but-set-variable -Wno-missing-braces -Wno-exceptions -fstack-protector-strong -fPIE -DNDEBUG -D_XOPEN_SOURCE=700 -D_GNU_SOURCE -D_FORTIFY_SOURCE=2 -DBOOST_THREAD_VERSION=5 -DBOOST_THREAD_USES_DATETIME -DBOOST_SYSTEM_NO_DEPRECATED -DBOOST_MATH_NO_LONG_DOUBLE_MATH_FUNCTIONS -DBOOST_ENABLE_ASSERT_DEBUG_HANDLER -DBOOST_LOG_NO_SHORTHAND_NAMES -DBOOST_LOG_USE_NATIVE_SYSLOG -DBOOST_LOG_WITHOUT_THREAD_ATTR -DABSL_FORCE_ALIGNED_ACCESS -DHAVE_VERBOSE -DHAVE_FALLOCATE -DHAVE_SYNC_FILE_RANGE -DHAVE_ARM_NEON_INTRIN_H -D_GNU_SOURCE -DHAVE_BUILTIN_EXTENSION_ZLIB -DHAVE_BUILTIN_EXTENSION_SNAPPY -DHAVE_BUILTIN_EXTENSION_ZSTD -Isrc/third_party/zstandard-1.4.3/zstd/lib -Isrc/third_party/snappy-1.1.7 -Ibuild/opt/third_party/wiredtiger -Isrc/third_party/wiredtiger -Ibuild/opt/third_party/wiredtiger/src/include -Isrc/third_party/wiredtiger/src/include -Ibuild/opt/third_party/wiredtiger/build_linux -Isrc/third_party/wiredtiger/build_linux src/third_party/wiredtiger/src/checksum/arm64/crc32-arm64.c
  cc1: warning: command-line option '-Wno-exceptions' is valid for C++/ObjC++ but not for C
  /tmp/ccGvwFgu.s: Assembler messages:
  /tmp/ccGvwFgu.s:45: Error: selected processor does not support `crc32cb w2,w2,w3'
  /tmp/ccGvwFgu.s:77: Error: selected processor does not support `crc32cx w2,w2,x4'
  /tmp/ccGvwFgu.s:103: Error: selected processor does not support `crc32cb w2,w2,w0'

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-06 08:16:08 -04:00
Wang Mingyu
57c5169739 tcpdump: upgrade 4.99.3 -> 4.99.4
Changelog:
==========
Source code:
----------------
  Fix spaces before tabs in indentation.
Updated printers:
-----------------
  LSP ping: Fix "Unused value" warnings from Coverity.
  CVE-2023-1801: Fix an out-of-bounds write in the SMB printer.
  DNS: sync resource types with IANA.
  ICMPv6: Update the output to show a RPL DAO field name.
  Geneve: Fix the Geneve UDP port test.
Building and testing:
----------------------
  Require at least autoconf 2.69.
  Don't check for strftime(), as it's in C90 and beyond.
  Update config.{guess,sub}, timestamps 2023-01-01,2023-01-21.
Documentation:
-------------
  man: Document TCP flag names better.

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 2e782260d0)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-05 13:40:23 -04:00
Martin Jansa
facddc3141 libiio: use main branch instead of master
* the branch was renamed upstream

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 11:55:25 -04:00
Soumya Sambu
86124cc625 krb5: Fix CVE-2023-36054
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2
and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote
authenticated user can trigger a kadmind crash. This occurs because
_xdr_kadm5_principal_ent_rec does not validate the relationship
between n_key_data and the key_data array count.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-36054

Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-04 11:55:22 -04:00
Soumya
41fffef6b0 yasm: fix CVE-2023-37732
Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c
and /elf/elf.c, which allows the attacker to cause a denial of service via a
crafted file.

References:
https://github.com/yasm/yasm/issues/233
https://nvd.nist.gov/vuln/detail/CVE-2023-37732

Signed-off-by: Soumya <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-09-03 10:43:56 -04:00
Polampalli, Archana
c5a65353e1 hwloc: fix CVE-2022-47022
An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause
a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c.

References:
https://nvd.nist.gov/vuln/detail/CVE-2022-47022
https://github.com/open-mpi/hwloc/issues/544

Upstream patches:
ac1f8db9a0

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-31 09:10:29 -04:00
Wang Mingyu
3862ca8fe1 iperf3: upgrade 3.13 -> 3.14
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-31 09:09:56 -04:00
Polampalli, Archana
a01d5db9c3 nodejs: upgrade 18.16.1 -> 18.17.1
Update to latest release of latest LTS 18 release

License-Update: [1] [2] [3]

The following CVEs are fixed in this release:
    CVE-2023-32002
    CVE-2023-32006
    CVE-2023-32559

[1] 0cfdb3affa
[2] 2ea6e03003
[3] 261e1d23d1

https://github.com/nodejs/node/releases/tag/v18.17.1

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-31 09:09:24 -04:00
Yi Zhao
32e47b26e9 frr: Security fix CVE-2023-3748
CVE-2023-3748:
A flaw was found in FRRouting when parsing certain babeld unicast hello
messages that are intended to be ignored. This issue may allow an
attacker to send specially crafted hello messages with the unicast flag
set, the interval field set to 0, or any TLV that contains a sub-TLV
with the Mandatory flag set to enter an infinite loop and cause a denial
of service.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-3748

Patch from:
ae1e0e1fed

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit ee1026ab77)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-31 08:49:13 -04:00
Mingli Yu
b0ba472191 mcelog: Drop unneeded autotools-brokensep
Drop unneeded autotools-brokensep class inherit, this package has
traditional makefile build.

This change also fixes the below buildpaths issue altogether.
WARNING: mcelog-191-r0 do_package_qa: QA Issue: File /usr/sbin/.debug/mcelog in package mcelog-dbg contains reference to TMPDIR [buildpaths]

(cherry picked from commit 29e6c4928c)

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-16 08:33:38 -04:00
Linus Jacobson
c89bb116aa khronos-cts: Replace wayland feature dependancy with vulkan
Khronos-cts.inc is used for building vulkan-cts or opengl-es-cts. Even
though vulkan-cts depends on vulkan-loader, which automatically
requires vulkan distro feature, it is more explicitly stated if written
here next to opengl.

Some systems do not support a windowing service (like wayland) but still
might use standard khronos GPU libraries. For these cases, wayland
dependancy is invalid.

Patch replaces the invalid wayland distro feature dependancy with
vulkan for clarity.

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-16 08:33:34 -04:00
Mingli Yu
ed9dde1850 php: Upgrade to 8.2.8
php 8.2.7 is a security release and the php 8.2.8 is a bug fix release
and more details at [1].

[1] https://www.php.net/ChangeLog-8.php#8.2.7

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-11 10:36:04 -04:00
Mingli Yu
495d1ff414 iniparser: Fix CVE-2023-33461
Handle null return from iniparser_getstring to fix CVE-2023-33461.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-11 10:36:00 -04:00
Mingli Yu
52ca385fc1 yajl: Fix CVE-2023-33460
Backport 2 patches [1] [2] to fix CVE-2023-33460.

[1] 3d65cb0c6d
[2] 23a122edda

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-11 10:35:57 -04:00
Changqing Li
9fca75d8b2 redis: upgrade 7.0.11 -> 7.0.12
Refer:
https://github.com/redis/redis/releases/tag/7.0.12

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-10 10:19:26 -04:00
Changqing Li
a24260ebfc redis: upgrade 6.2.12 -> 6.2.13
Refer:
https://github.com/redis/redis/releases/tag/6.2.13

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-10 10:19:23 -04:00
Beniamin Sandu
75cf318cef lmsensors: do not pull in unneeded perl modules for run-time dependencies
Signed-off-by: Beniamin Sandu <beniaminsandu@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-08-03 16:46:11 -04:00
Polampalli, Archana
03fd1d368a yasm: fix CVE-2023-31975
yasm v1.3.0 was discovered to contain a memory leak via the function
yasm_intnum_copy at /libyasm/intnum.c.

References:
https://nvd.nist.gov/vuln/detail/CVE-2023-31975
https://github.com/yasm/yasm/issues/210

Upstream patches:
b2cc5a1693

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:15:34 -04:00
Jasper Orschulko
40bcb0e09f yaml-cpp: Fix cmake export
Signed-off-by: Jasper Orschulko <jasper@fancydomain.eu>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:14:34 -04:00
Mingli Yu
9c62a90f3f gnulib: Update SRC_URI
Update the SRC_URI to fix the do_fetch warning.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:13:43 -04:00
Mingli Yu
cb365a5378 dialog: Update the SRC_URI
Update the SRC_URI to fix the do_fetch error.

Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:13:33 -04:00
Polampalli, Archana
d9bd685f6e nodejs: upgrade 18.14.2 -> 18.16.1
Refresh 0001-Disable-running-gyp-files-for-bundled-deps.patch against 18.16.1

License-Update: Add missing licenses for Ada [1] BSD, Simduf [2] BSD, posteject
[3] MIT

[1] 0bc4c17e57
[2] c9845fc334
[3] 4aaec07266

The list of the CVEs are fixed in this relase:

    CVE-2023-30581
    CVE-2023-30585
    CVE-2023-30588
    CVE-2023-30589
    CVE-2023-30590

https://github.com/nodejs/node/releases/tag/v18.16.1
https://github.com/nodejs/node/releases/tag/v18.16.0
https://github.com/nodejs/node/releases/tag/v18.15.0

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:13:21 -04:00
Joe Slater
b5f5c8859c libgpiod: modify RDEPENDS for ptest
The current use of RDEPENDS to add a dependency on bats results
in the QA warning/error

 lib32-libgpiod package lib32-libgpiod-ptest-dev - suspicious values
  'bats-dev' in RRECOMMENDS [multilib]

when building lib32-libgpiod with ptest not enabled.  We add the
dependency only if ptest is enabled.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9904bd6a24)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-25 07:12:13 -04:00
Chee Yang Lee
7d4883e0a0 c-ares: upgrade 1.19.0 -> 1.19.1
https://c-ares.org/changelog.html

c-ares version 1.19.1 - May 22 2023

Security:
CVE-2023-32067. High. 0-byte UDP payload causes Denial of Service
CVE-2023-31147 Moderate. Insufficient randomness in generation of DNS
query IDs
CVE-2023-31130. Moderate. Buffer Underwrite in ares_inet_net_pton()
CVE-2023-31124. Low. AutoTools does not set CARES_RANDOM_FILE during
cross compilation

Bug fixes:
Fix uninitialized memory warning in test
Turn off IPV6_V6ONLY on Windows to allow IPv4-mapped IPv6 addresses
ares_getaddrinfo() should allow a port of 0
Fix memory leak in ares_send() on error
Fix comment style in ares_data.h
Remove unneeded ifdef for Windows
Fix typo in ares_init_options.3
Re-add support for Watcom compiler
Sync ax_pthread.m4 with upstream
Windows: Invalid stack variable used out of scope for HOSTS path
Sync ax_cxx_compile_stdcxx_11.m4 with upstream to fix uclibc support

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-16 15:15:41 -04:00
Chee Yang Lee
6c46f263d5 rabbitmq-c: Fix CVE-2023-35789
affects <= 0.13.0

Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-16 15:15:37 -04:00
Yi Zhao
76305fc4c3 open-vm-tools: Security fix CVE-2023-20867
CVE-2023-20867:
A fully compromised ESXi host can force VMware Tools to fail to
authenticate host-to-guest operations, impacting the confidentiality and
integrity of the guest virtual machine.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2023-20867

Patch from:
https://github.com/vmware/open-vm-tools/blob/CVE-2023-20867.patch/2023-20867-Remove-some-dead-code.patch

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-07-02 11:24:51 -04:00
Yi Zhao
d71a08b3d8 mbedtls: upgrade 2.28.2 -> 2.28.3
Mbed TLS 2.28 is a long-time support branch. It will be supported with
bug-fixes and security fixes until end of 2024.

ChangeLog:
https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.3

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-28 16:28:35 -04:00
Yi Zhao
c403568572 frr: upgrade 8.4.2 -> 8.4.4
ChangeLog:
https://github.com/FRRouting/frr/releases/tag/frr-8.4.4
45e36c0c00

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-28 16:28:27 -04:00
Polampalli, Archana
473261544c tcpreplay: upgrade 4.4.3 -> 4.4.4
This release contains bug fixes only.
The following CVEs have been addressed:

CVE-2023-27783
CVE-2023-27784
CVE-2023-27785
CVE-2023-27786
CVE-2023-27787
CVE-2023-27788
CVE-2023-27789

Changelog:
=========
dlt_jnpr_ether_cleanup: check subctx before cleanup by @Marsman1996 in #781
Bug #780 assert tcpedit dlt cleanup by @fklassen in #800
Fix bugs caused by strtok_r by @Marsman1996 in #783
Bug #782 #784 #785 #786 #787 #788 strtok r isuses by @fklassen in #801
Update en10mb.c by @david-guti in #793
PR #793 ip6 unicast flood by @fklassen in #802
Bug #719 fix overflow check for parse_mpls() by @fklassen in #804
PR #793 - update tests for corrected IPv6 MAC by @fklassen in #805
PR #793 - update tests for vlandel by @fklassen in #806
Feature #773 gh actions ci by @fklassen in #807

Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-28 16:28:13 -04:00
Hitendra Prajapati
b3acca0eb1 wireshark: Fix Multiple CVEs
Backport fixes for:
* CVE-2023-0666 - Upstream-Status: Backport from 265cbf15a4
* CVE-2023-0667 - Upstream-Status: Backport from 85fbca8adb
* CVE-2023-0668 - Upstream-Status: Backport from c4f37d77b2

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-27 07:05:40 -04:00
Wang Mingyu
30b2c1c064 python3-django: upgrade 4.1.7 -> 4.2.1
Changelog:
https://docs.djangoproject.com/en/4.2/releases/4.2.1/

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 08:02:41 -04:00
Joe Slater
3b31f80da3 python3-sqlparse: fix CVE-2023-30608
Backport from commit c457abd5f... upstream.

Signed-off-by: Joe Slater <joe.slater@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f8df473476)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 08:02:41 -04:00