Divya Chellam 138ab1c7df ruby: fix CVE-2024-41946 ...

REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS
vulnerability when it parses an XML that has many entity expansions
with SAX2 or pull parser API. The REXML gem 3.3.3 or later include
the patch to fix the vulnerability.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-41946

Upstream-patch:
https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368

(From OE-Core rev: b0e74fd8922bba8e954a223ec46de5c33d2ff743)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>

2025-02-24 07:00:53 -08:00

..

apt

apt: add missing <cstdint> for uint16_t

2023-10-18 05:13:24 -10:00

autoconf

autoconf: Update K & R stype functions

2022-09-16 17:53:22 +01:00

autoconf-archive

…

automake

automake: fix buildtest patch

2023-08-26 04:24:02 -10:00

binutils

binutils: internal gdb: Fix CVE-2024-53589

2025-02-05 06:54:35 -08:00

bison

…

bootchart2

bootchart2: Fix usrmerge support

2023-02-15 21:46:56 +00:00

btrfs-tools

…

cargo

rust-common: Drop LLVM_TARGET and simplify

2022-06-07 11:53:26 +01:00

ccache

ccache: fix build with gcc-13

2023-10-05 15:48:49 -10:00

cdrtools

cdrtools-native: fix build with gcc-14

2024-10-12 05:17:58 -07:00

chrpath

…

cmake

cmake: Fix sporadic issues when determining compiler internals

2024-11-15 06:05:32 -08:00

createrepo-c

…

dejagnu

dejagnu: Fix LICENSE

2024-09-16 06:09:56 -07:00

desktop-file-utils

…

devel-config

…

diffstat

…

distcc

…

dmidecode

dmidecode: fixup for CVE-2023-30630

2023-08-19 05:56:58 -10:00

dnf

…

docbook-xml

…

dosfstools

…

dpkg

dpkg: fix CVE-2022-1664

2022-08-01 16:27:29 +01:00

dwarfsrcfiles

…

e2fsprogs

e2fsprogs: fix ptest bug for second running

2023-06-21 04:00:58 -10:00

elfutils

elfutils: Disable stringop-overflow warning for build host

2024-01-04 05:00:13 -10:00

erofs-utils

…

expect

…

fdisk

…

file

file: fix CVE-2022-48554

2023-09-08 16:09:41 -10:00

flex

…

gcc

classes/qemu: use tune to select QEMU_EXTRAOPTIONS, not package architecture

2025-01-24 07:49:28 -08:00

gdb

gdb: Fix CVE-2024-53589

2025-02-05 06:54:35 -08:00

git

git: Fix multiple CVEs

2024-06-01 19:07:52 -07:00

glide

…

gnu-config

…

go

go: Fix CVE-2024-45336

2025-02-15 06:04:43 -08:00

help2man

…

i2c-tools

…

icecc-create-env

…

icecc-toolchain

…

intltool

…

jquery

…

json-c

json-c: define CVE_VERSION

2023-10-05 15:48:49 -10:00

libcomps

…

libdnf

libdnf: resolve cstdint inclusion for newer gcc versions

2023-09-08 16:09:42 -10:00

libedit

libedit: Make docs generation deterministic

2024-09-16 06:09:56 -07:00

libmodulemd

…

librepo

…

libtool

…

llvm

llvm: reduce size of -dbg package

2024-11-27 06:27:26 -08:00

log4cplus

log4cplus: upgrade 2.0.7 -> 2.0.8

2022-08-04 16:29:15 +01:00

lua

lua: Fix install conflict when enable multilib.

2023-03-20 17:20:44 +00:00

m4

…

make

…

makedevs

makedevs: Don't use COPYING.patch just to add license file into ${S}

2022-06-11 10:06:13 +01:00

meson

meson: Fix wrapper handling of implicit setup command

2023-03-20 17:20:44 +00:00

mmc

…

mtd

mtd-utils: upgrade 2.1.4 -> 2.1.5

2022-12-01 19:35:05 +00:00

mtools

…

nasm

nasm: fix CVE-2020-21528

2023-09-08 16:09:41 -10:00

ninja

ninja: fix build with python 3.13

2024-12-02 06:23:20 -08:00

opkg

opkg: Set correct info_dir and status_file in opkg.conf

2022-12-13 15:23:34 +00:00

opkg-utils

opkg-utils: use a git clone, not a dynamic snapshot

2022-11-09 17:42:08 +00:00

orc

orc: upgrade 0.4.39 -> 0.4.40

2024-11-02 06:32:36 -07:00

patch

…

patchelf

patchelf: replace a rejected patch with an equivalent uninative.bbclass tweak

2023-04-11 11:31:52 +01:00

perl

perl: ignore CVE-2023-47100

2024-04-19 04:50:38 -07:00

perl-cross

perl: update 5.34.1 -> 5.34.3

2023-12-22 16:36:55 -10:00

pkgconf

pkgconf: fix CVE-2023-24056

2023-03-23 22:45:33 +00:00

pkgconfig

…

pseudo

pseudo: Fix envp bug and add posix_spawn wrapper

2024-11-15 06:05:32 -08:00

python

python3: Treat UID/GID overflow as failure

2025-02-15 06:04:44 -08:00

qemu

qemu: fix CVE-2024-3447

2024-12-09 07:54:03 -08:00

quilt

quilt: Fix merge.test race condition

2023-05-30 04:11:15 -10:00

repo

…

rpm

rpm: Remove -Wimplicit-function-declaration warnings

2022-10-11 21:56:13 +01:00

rsync

rsync: fix CVE-2024-12747

2025-01-24 07:49:28 -08:00

ruby

ruby: fix CVE-2024-41946

2025-02-24 07:00:53 -08:00

run-postinsts

run-postinsts: Set dependency for ldconfig to avoid boot issues

2023-05-10 04:19:57 -10:00

rust

rust: ignore CVE-2024-43402

2024-10-12 05:17:57 -07:00

squashfs-tools

…

strace

strace: Update patches/tests with upstream fixes

2023-07-12 05:11:38 -10:00

subversion

subversion: ignore CVE-2024-45720

2025-02-24 07:00:53 -08:00

swig

…

syslinux

syslinux: Disable error on implicit-function-declaration

2024-10-24 06:31:58 -07:00

systemd-bootchart

…

tcf-agent

…

tcltk

tcl: skip async and event tests in run-ptest

2024-04-19 04:50:39 -07:00

unfs3

…

unifdef

…

vala

vala: add -Wno-error=incompatible-pointer-types work around

2024-11-02 06:32:36 -07:00

valgrind

valgrind: disable avx_estimate_insn.vgtest

2024-10-12 05:17:58 -07:00

xmlto

xmlto: backport a patch to fix build with gcc-14 on host

2024-11-11 06:19:18 -08:00