Commit Graph

8346 Commits

Author SHA1 Message Date
Martin Jansa d25f2f1cac nodejs: fix native node-gyp to work with python-3.11
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-06-23 06:58:18 -04:00
Narpat Mali 116bfe8d5e nodejs: make 14.18.1 available but not default
Chromium 112 needs nodejs-native version 14 or later.
Add the nodejs_14.18.1 recipe from kirkstone:
   246b20b92 nodejs: Upgrade to 14.18.1
but, use DEFAULT_PREFERENCE to make sure that the default version of nodejs
remains 12.x.

7 patches which were modified between nodejs 12 & nodejs 14 were renamed by
adding the suffix "-nodejs14". Note there are some common patches used by
nodejs 12 & 14 so, that will require attention during future maintenance.
In addition, there were 3 CVE-2022* patches which applied cleanly to nodejs
14 so, they were added to the nodejs 14 recipe. One patch, CVE-llhttp.patch
conflicted so, it has not been applied in nodejs 14 yet.

Nodejs 14 compile for qemux86-64 but, no run-time testing has been performed.

For chromium, we would either require users to modify the local.conf file or
we may create a dunfell specific branch in meta-browser.
See: https://github.com/OSSystems/meta-browser/pull/709

Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Narpat Mali <narpat.mali@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Jack Mitchell 4c533a5f90 nss: backport fix for native build failure due to dangling pointer with gcc13
Upstream-Status: Backport
Link: https://github.com/nss-dev/nss/commit/cbf5a2bce75ca2c2fd3e247796b9892f5298584e

Signed-off-by: Jack Mitchell <ml@embed.me.uk>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Jack Mitchell c69846bfc6 nss: backport fix for native build failure due to implicit casting with gcc13
Upstream-Status: Backport
Link: https://github.com/nss-dev/nss/commit/4e7e332b25a2794f381323518e52d8d95273b69e

Signed-off-by: Jack Mitchell <ml@embed.me.uk>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-16 07:09:25 -04:00
Hitendra Prajapati e39b002df9 multipath-tools: CVE-2022-41973 Symlink attack multipathd operates insecurely
Upstream-Status: Backport from https://github.com/opensvc/multipath-tools/commit/cb57b930fa690ab79b3904846634681685e3470f

dev/shm may have unsafe permissions. Use /run instead.
Use systemd's tmpfiles.d mechanism to create /run/multipath
early during boot.

For backward compatibilty, make the runtime directory configurable
via the "runtimedir" make variable.

QA Issue: non -dev/-dbg/nativesdk- package multipath-tools-libs
  contains symlink .so '/usr/lib/libdmmp.so'
  ...

Fix this by making the new pattern for multipath-tools-libs package
more specific.

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Alex Yao eca75eba7d lcov: Fix Perl Path
Fixes an issue where lcov is using the system Perl rather than the yocto
provided Perl. This causes packages to not be found during runtime such
as PerlIO::gzip.

Signed-off-by: Alex Yao <alexyao1@meraki.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Viktor Rosendahl 765cfa779d jsoncpp: Fix broken handling of escape characters
Applying this backported patch from upstream fixes the following
BAT test failure:

jsoncpp.jsoncpp_system_tests.TestJsoncpp.test_run_jsoncpp_test
(from systemtests--bmt--BAT) :
* Detail of EscapeSequenceTest/writeEscapeSequence test failure:
/usr/src/debug/jsoncpp/1.9.2-r0/git/src/test_lib_json/main.cpp(3370): expected == result
  Expected: '["\"","\\","\b","\f","\n","\r","\t","\u0278","\ud852\udf62"]
  '
  Actual  : '["\"","\\","\b","\f","\n","\r","\t","ɸ","𤭢"]

This test failure happens because aarch64 uses unsigned char as
default type for char, while x86 uses signed char. Also, there
is another bug in the code that is fixed by this upstream patch:

 "static_cast<unsigned char>(*cur) < 0x80" should be:
 "static_cast<unsigned char>(*cur) >= 0x80"

Signed-off-by: Ranjitsinh Rathod <ranjitsinhrathod1991@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-05 07:20:59 -04:00
Hugo SIMELIERE 34f5646bba libmodbus: Fix CVE-2022-0367
Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-05-03 11:16:53 -04:00
Armin Kuster 7007d14c25 mariadb: Update to latest lts 10.4.28
Source: Mariadb.org
MR: 119595, 119604, 119613, 119622, 119631, 119640, 119649, 119658, 119573
Type: Security Fix
Disposition: Backport from mariadb.org
ChangeID: 2aacce87739247d98ee5b61d1b714930da961a30
Description:

This is a bug fix only update. Includes these CVES:
CVE-2022-32081
CVE-2022-32083
CVE-2022-32084
CVE-2022-32085
CVE-2022-32086
CVE-2022-32087
CVE-2022-32088
CVE-2022-32089
CVE-2022-32091

Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>

--
V2]
Missed on CVE reference.
2023-04-06 07:32:45 -04:00
Hitendra Prajapati 94b30b7d85 syslog-ng: CVE-2022-38725 An integer overflow in the RFC3164 parser
Upstream-Status: Backport from https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8 && https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a && https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d && https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37 && https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321 && https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4 && https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396 && https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
vkumbhar f1d4acc09d mariadb: fix CVE-2022-47015 NULL pointer dereference in spider_db_mbase::print_warnings()
The function spider_db_mbase::print_warnings() can potentially result
in a null pointer dereference.

Remove the null pointer dereference by cleaning up the function.

Signed-off-by: Vivek Kumbhar <vkumbhar@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
Hitendra Prajapati 4f78732be2 postgresql: CVE-2022-41862 Client memory disclosure when connecting with Kerberos to modified server
Upstream-Status: Backport from https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=3f7342671341a7a137f2d8b06ab3461cdb0e1d88

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
Virendra Thakur 7b7913fd47 nss: Fix CVE CVE-2023-0767
Add CVE-2023-0767.patch to fix CVE-2023-0767

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
Signed-off-by: Bhabu Bindu <bindudaniel1996@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-04-06 07:32:11 -04:00
Chris Rogers 7ae42df58f xterm: Remove undeclared variables introduced by backport
CVE-2022-45063 ported onto the dunfell baseline introduces two
variables that cause xterm to fail compilation with the error

./fontutils.c:4143:13: error: 'added' undeclared (first use in this function)

These two variables don't appear to be defined at all in findXftGlyph for
xterm_353, so they should be removed.

Fixes: 10148c538ebc("xterm : Fix CVE-2022-45063 code execution via OSC 50 input sequences] CVE-2022-45063")
Signed-off-by: Chris Rogers <crogers122@gmail.com>
Tested-by: Jason Andryuk <jandryuk@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Poonam Jadhav 068acc4ec7 nodejs: Fix CVEs for nodejs
Add patch file CVE-llhttp.patch to fix CVE-2022-32213,
CVE-2022-32214, CVE-2022-32215, CVE-2022-35256 of nodejs.

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-llhttp.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Poonam Jadhav 9291a88738 nodejs: Fix CVE-2022-43548
Add patch to fix CVE-2022-43548

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-2022-43548.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Poonam Jadhav b691797f77 nodejs: Fix CVE-2022-35255
Add patch to fix CVE-2022-35255

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-2022-35255.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Poonam Jadhav df7fba3744 nodejs: Fix CVE-2022-32212
Add patch to fix CVE-2022-32212

Link: https://sources.debian.org/src/nodejs/12.22.12~dfsg-1~deb11u3/debian/patches/cve-2022-32212.patch

Signed-off-by: Poonam Jadhav <Poonam.Jadhav@kpit.com>
Signed-off-by: Omkar Patil <omkarpatil10.93@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Priyal Doshi 0a7d275985 open-vm-tools: Security fix for CVE-2022-31676
Backport from https://github.com/vmware/open-vm-tools/commit/70a74758bfe0042c27f15ce590fb21a2bc54d745

Signed-off-by: Priyal Doshi <pdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-03-18 16:16:42 -04:00
Roger Knecht 8757134505 zeromq: 4.3.2 -> 4.3.4
Fixes:
- CVE-2021-20236

Patch changes:
- Refreshed 0001-CMakeLists-txt-Avoid-host-specific-path-to-libsodium.patch

Signed-off-by: Roger Knecht <roger@norberthealth.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
Hitendra Prajapati 1172ebfa20 krb5: CVE-2022-42898 integer overflow vulnerabilities in PAC parsing
Upstream-Status: Backport from https://github.com/krb5/krb5/commit/4e661f0085ec5f969c76c0896a34322c6c432de4

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
Mathieu Dubois-Briand 56403db5e3 nss: Fix CVE-2020-25648
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
Mathieu Dubois-Briand 50b6fb7d62 nss: Whitelist CVEs related to libnssdbm
These CVEs only affect libnssdbm, compiled when --enable-legacy-db is
used.

https://bugzilla.mozilla.org/show_bug.cgi?id=1360782#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360778#c8
https://bugzilla.mozilla.org/show_bug.cgi?id=1360900#c6
https://bugzilla.mozilla.org/show_bug.cgi?id=1360779#c9
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
Mathieu Dubois-Briand f0f9398891 nss: Add missing CVE product
Signed-off-by: Mathieu Dubois-Briand <mbriand@witekio.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-02-22 11:24:23 -05:00
Valeria Petrov 09c3ac0da6 php: update 7.4.28 -> 7.4.33
Update php from 7.4.28 to 7.4.33

    Fixes below CVEs:
    CVE-2021-21708
    CVE-2022-31626
    CVE-2022-31625
    CVE-2022-31628
    CVE-2022-31629
    CVE-2022-31630
    CVE-2022-37454

Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-19 07:49:31 -05:00
Siddharth Doshi 10148c538e xterm : Fix CVE-2022-45063 code execution via OSC 50 input sequences] CVE-2022-45063
Upstream-Status: Backport [https://github.com/ThomasDickey/xterm-snapshots/commit/787636674918873a091e7a4ef5977263ba982322]
CVE: CVE-2022-45063

Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-19 07:49:31 -05:00
Virendra Thakur 6464eb9fc4 capnproto: Fix CVE-2022-46149
This patch contains a fix for CVE-2022-46149

Patch backported from :
https://github.com/capnproto/capnproto/commit/25d34c67863fd960af34fc4f82a7ca3362ee74b9

Signed-off-by: Virendra Thakur <virendrak@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2023-01-19 07:49:31 -05:00
Hitendra Prajapati 7952135f65 postgresql: Fix CVE-2022-2625
Upstream-Status: Backport from https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=5579726bd60a6e7afb04a3548bced348cd5ffd89
Description:
	CVE-2022-2625 postgresql: Extension scripts replace objects not belonging to the extension.

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-12-11 16:01:15 -05:00
Ivan Stepic 1e9bf08cca flatbuffers: adapt for cross-compilation environments
Flatbuffers contains a library and a schema compiler. The package
contains cmake files to discover the libraries and the compiler tool.
Currently, all of these cmake files are installed into the target
sysroot. However, the compiler utility isn't installed into the sysroot
(as it is not runnable on the build machine).

When an application that depends on flatbuffers gets built, it uses
flatbuffers' exported cmake targets to configure the project. One of the
exported targets is FlatcTarget.cmake which expects to see flatc binary
in /usr/bin of the sysroot. Since binaries for target don't end up in
target sysroot, cmake configuration fails.

This patch addresses this problem of flatbuffers' build infrastructure
in cross-compiling environments. By removing FlatcTarget.cmake for
target builds from the sysroot we essentially skip this step of
flatbuffers' configuration.

Signed-off-by: Ivan Stepic <Ivan.Stepic@bmw.de>
Signed-off-by: Bhabu Bindu <bhabu.bindu@kpit.com>
2022-11-25 10:35:23 -05:00
Hitendra Prajapati 62842aac98 postgresql: CVE-2022-1552 Autovacuum, REINDEX, and others omit "security restricted operation" sandbox
Source: https://git.postgresql.org/gitweb/?p=postgresql.git;
MR: 121822
Type: Security Fix
Disposition: Backport from https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=ab49ce7c3414ac19e4afb386d7843ce2d2fb8bda && https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=677a494789062ca88e0142a17bedd5415f6ab0aa
ChangeID: 5011e2e09f30f76fc27dc4cb5fa98a504d1aaec9
Description:
	 CVE-2022-1552 postgresql: Autovacuum, REINDEX, and others omit "security restricted operation" sandbox.

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
2022-10-30 14:47:35 -04:00
wangmy 6792ebdd96 c-ares: upgrade 1.17.2 -> 1.18.1
c-ares version 1.18.1 - Oct 27 2021
Bug fixes:

ares_getaddrinfo() would return ai_addrlen of 16 for ipv6 adddresses
rather than the sizeof(struct sockaddr_in6)

Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.18.1.bb

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit e251d7b827)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Sinan Kaya ad1dcf68b6 c-ares: remove custom patches
Current patch is breaking the library dependencies added by cmake
especially when you are static linking.

Applications need the ws2_32 library to be linked for mingw32
and with the existing patch this is not getting passed to the users.

Current patch seems to address this issue:
https://github.com/c-ares/c-ares/issues/373

Both issues are resolved in 1.17.2:

1.17.2-r0/git $ find . | grep c-ares-config.cmake.in
./c-ares-config.cmake.in
1.17.2-r0/git $ find . | grep libcares.pc.cmake
./libcares.pc.cmake

Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.17.2.bb

Signed-off-by: Sinan Kaya <okaya@kernel.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 621bdc1993)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
wangmy cd8d2f689f c-ares: upgrade 1.17.1 -> 1.17.2
Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.17.2.bb

Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c49173b09c)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Khem Raj de05a500b9 c-ares: Upgrade to 1.17.1 release
Forward port cmake-install-libcares.pc.patch, drop the need to install
pkgconfig files as its already being done by main Makefile

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Forward port cmake-install-libcares.pc.patch, drop the need to install
pkgconfig files as its already being done by main Makefile

Conflicts:
meta-oe/recipes-support/c-ares/c-ares_1.17.1.bb

Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b65f290419)
Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Armin Kuster 87841f0c18 Revert "c-ares: Add fix for CVE-2021-3672"
This reverts commit b06724bc27.
Revert this CVE fix as we upgrade c-ares to 1.18.1

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Armin Kuster <akuster808@gmail.vom>
2022-09-11 13:49:52 -04:00
Yi Zhao a33dca5297 cryptsetup: upgrade 2.3.2 -> 2.3.7
Stable security bug-fix release that fixes CVE-2021-4122.

ReleaseNotes:
https://kernel.org/pub/linux/utils/cryptsetup/v2.3/v2.3.7-ReleaseNotes

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
(cherry picked from commit 5dca16b451)
This is just the rename and SRC_URI hash updates made to apply
to dunfell.
Signed-off-by: Jason Andryuk <jandryuk@gmail.com>
2022-09-11 13:49:52 -04:00
Ranjitsinh Rathod a1a40c95eb nodejs: Upgrade to 12.22.12
As per the below release note, it should be a last release for 12.x
stable LTS series.
Link: https://github.com/nodejs/node/releases/tag/v12.22.12

Remove CVE-2021-44532 fix as it already available in this release
v12.22.12

License-Update: src/gtest additional file in the LICENSE

Signed-off-by: Ranjitsinh Rathod <ranjitsinh.rathod@kpit.com>
Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
2022-09-11 13:49:52 -04:00
Khem Raj f22bf6efaa meta-oe: Add leading whitespace for append operator
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 92441f9d6a)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-08-02 06:59:38 -07:00
Hitendra Prajapati b406297d3b xterm: CVE-2022-24130 Buffer overflow in set_sixel in graphics_sixel.c
Source: https://github.com/ThomasDickey/xterm-snapshots/
MR: 115675
Type: Security Fix
Disposition: Backport from https://github.com/ThomasDickey/xterm-snapshots/commit/1584fc227673264661250d3a8d673c168ac9512d
ChangeID: 6ad000b744527ae863187b570714792fc29467d9
Description:
         CVE-2022-24130 xterm: Buffer overflow in set_sixel in graphics_sixel.c.

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-16 12:56:17 -07:00
Hitendra Prajapati a24773d39e openldap: CVE-2022-29155 OpenLDAP SQL injection
Source: https://git.openldap.org/openldap/openldap
MR: 117821
Type: Security Fix
Disposition: Backport from https://git.openldap.org/openldap/openldap/-/commit/87df6c19915042430540931d199a39105544a134
ChangeID: d534808c796600ca5994bcda28938d45405bc7b4
Description:
	CVE-2022-29155 openldap: OpenLDAP SQL injection

Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-07-16 12:56:17 -07:00
Jeroen Hofstee d6795ab0ee php: move to version v7.4.28
CVE: CVE-2021-21703 CVE-2021-21706 CVE-2021-21707 CVE-2021-21708

Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
[Didn't apply cleanly, corrected.]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Akash Hadke 512a3caee4 iperf: Set CVE_PRODUCT to "iperf_project:iperf"
Set CVE_PRODUCT as 'iperf_project:iperf' for iperf2 and iperf3
recipes, cve-check class is setting default CVE_PRODUCT to
'iperf2' and 'iperf3' respectively which ignores the iperf
CVEs from NVD Database.

Reference:
CVE-2016-4303
Link: https://nvd.nist.gov/vuln/detail/CVE-2016-4303

Signed-off-by: Akash Hadke <akash.hadke@kpit.com>
Signed-off-by: Akash Hadke <hadkeakash4@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Martin Jansa 245a1ab46b grpc: switch from master branch to main for upb
* hardknott and newer branches don't need this as upb repo was removed in:
  commit 15cff67fd6
  Author: Anatol Belski <anbelski@linux.microsoft.com>
  Date:   Fri Feb 19 12:39:55 2021 +0000

    grpc: Upgrade 1.24.3 -> 1.35.0

Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Martin Jansa 96e9636f7d leveldb: switch from master branch to main
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Martin Jansa 2526b14d39 tesseract-lang: switch from master branch to main
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-06-15 06:45:03 -07:00
Armin Kuster 04212afa12 mariadb: update to 10.4.25
Source: mariadb.org
MR: 117530, 117522, 117514, 117506, 117497, 117489, 117481, 117473, 117465, 117457, 117449, 117380, 117364, 117356, 117336, 117212, 117204, 117196, 117180, 117188, 117169, 117161, 117441, 117372
Type: Security Fix
Disposition: Backport from mariagdb.org
ChangeID: 8bf787570ebe8503d2974af92e17b505e70440e5
Description:

LTS version, bug fix only.

Include these CVES:
CVE-2022-27458
CVE-2022-27457
CVE-2022-27456
CVE-2022-27455
CVE-2022-27452
CVE-2022-27451
CVE-2022-27449
CVE-2022-27448
CVE-2022-27447
CVE-2022-27446
CVE-2022-27445
CVE-2022-27444
CVE-2022-27387
CVE-2022-27386
CVE-2022-27385
CVE-2022-27384
CVE-2022-27383
CVE-2022-27382
CVE-2022-27381
CVE-2022-27380
CVE-2022-27379
CVE-2022-27378
CVE-2022-27377
CVE-2022-27376

Signed-off-by: Armin Kuster <akuster@mvista.com>
2022-06-05 06:53:33 -07:00
Julien STEPHAN 9f361cff9c opencl-headers: switch to main branch
master branch was renamed main on upstream project, so update the URI

Signed-off-by: Julien STEPHAN <jstephan@baylibre.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25 19:34:39 -07:00
Julien STEPHAN c9e034fbaa opencl-icd-loader: switch to main branch
master branch was renamed main, so update the URI

Signed-off-by: Julien STEPHAN <jstephan@baylibre.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25 19:34:39 -07:00
Sana Kazi a38c92d8e9 openjpeg: Whitelist CVE-2020-27844 and CVE-2015-1239
Whitelist CVE-2020-27844 as it is introduced by
https://github.com/uclouvain/openjpeg/commit/4edb8c83374f52cd6a8f2c7c875e8ffacccb5fa5
but the contents of this patch is not present in openjpeg_2.3.1

Link: https://security-tracker.debian.org/tracker/CVE-2020-27844

Whitelist CVE-2015-1239 as the CVE description clearly states that
j2k_read_ppm_v3 function in openjpeg is affected due to CVE-2015-1239
but in openjpeg_2.3.1 this function is not present.
Hence, CVE-2015-1239 does not affect openjpeg_2.3.1.

Signed-off-by: Sana.Kazi <Sana.Kazi@kpit.com>
Signed-off-by: Sana Kazi <sanakazisk19@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25 19:34:39 -07:00
Martin Jansa de4b76934c ostree: prevent ostree-native depending on target virtual/kernel to provide kernel-module-overlay
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
2022-05-25 19:34:39 -07:00