[OE-core][kirkstone][PATCH v2] ghostscript: Backport CVE-2024-29508

2024-10-18 Thread Ashish Sharma via lists.openembedded.org
/?id=ff1013a0ab485b66783b70145e342a82c670906a Signed-off-by: Ashish Sharma --- .../ghostscript/CVE-2024-29508-1.patch| 308 ++ .../ghostscript/CVE-2024-29508-2.patch| 29 ++ .../ghostscript/ghostscript_9.55.0.bb | 2 + 3 files changed, 339 insertions(+) cr

[OE-core][kirkstone][PATCH] libarchive: Fix CVE-2024-48957 & CVE-2024-48958

2024-10-12 Thread Ashish Sharma via lists.openembedded.org
Signed-off-by: Ashish Sharma --- .../libarchive/CVE-2024-48957.patch | 33 + .../libarchive/CVE-2024-48958.patch | 37 +++ .../libarchive/libarchive_3.6.2.bb| 2 + 3 files changed, 72 insertions(+) create mode 100644 meta/recipes

[OE-core][kirkstone][PATCH] ghostscript: backport fix for CVE-2024-29508

2024-10-09 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport [https://launchpad.net/ubuntu/+source/ghostscript/9.55.0~dfsg1-0ubuntu5.9] Signed-off-by: Ashish Sharma --- .../ghostscript/CVE-2024-29508-2.patch| 28 ++ .../ghostscript/CVE-2024-29508.patch | 307 ++ .../ghostscript

[OE-core][scarthgap][PATCH] ruby: Backport fix for CVE-2024-27282

2024-08-15 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport [https://github.com/ruby/ruby/commit/989a2355808a63fc45367785c82ffd46d18c900a] Signed-off-by: Ashish Sharma --- .../ruby/ruby/CVE-2024-27282.patch| 28 +++ meta/recipes-devtools/ruby/ruby_3.2.2.bb | 1 + 2 files changed, 29 insertions

[OE-core][kirkstone][PATCH] gtk+3 : backport fix for CVE-2024-6655

2024-07-30 Thread Ashish Sharma via lists.openembedded.org
stop looking for modules in cwd in gtk/gtkmodules.c. Upstream-Status: Backport [https://launchpad.net/ubuntu/+source/gtk+3.0/3.24.33-1ubuntu2.2] Signed-off-by: Ashish Sharma --- .../gtk+/gtk+3/CVE-2024-6655.patch| 39 +++ meta/recipes-gnome/gtk+/gtk+3_3.24.34.bb

[OE-core][master][PATCH] bind: Upgrade 9.18.27 -> 9.18.28

2024-07-30 Thread Ashish Sharma via lists.openembedded.org
Includes security fixes for: CVE-2024-1975 CVE-2024-1737 CVE-2024-0760 CVE-2024-4076 Changelog: = https://gitlab.isc.org/isc-projects/bind9/-/blob/v9.18.28/CHANGES Signed-off-by: Ashish Sharma

[OE-core][kirkstone][PATCH V2] bind: Upgrade 9.18.24 -> 9.18.28

2024-07-30 Thread Ashish Sharma via lists.openembedded.org
Includes security fixes for: CVE-2024-1975 CVE-2024-1737 CVE-2024-0760 CVE-2024-4076 Changelog: = https://gitlab.isc.org/isc-projects/bind9/-/blob/v9.18.28/CHANGES Signed-off-by: Ashish Sharma

[OE-core][scarthgap][PATCH] bind: Upgrade 9.18.25 -> 9.18.28

2024-07-30 Thread Ashish Sharma via lists.openembedded.org
Includes security fixes for: CVE-2024-1975 CVE-2024-1737 CVE-2024-0760 CVE-2024-4076 Changelog: = https://gitlab.isc.org/isc-projects/bind9/-/blob/v9.18.28/CHANGES Signed-off-by: Ashish Sharma

[OE-core][kirkstone][PATCH] bind: Upgrade 9.18.24 -> 9.18.28

2024-07-29 Thread Ashish Sharma via lists.openembedded.org
Includes security fixes for: CVE-2024-1975 CVE-2024-1737 CVE-2024-0760 CVE-2024-4076 Changelog: = https://gitlab.isc.org/isc-projects/bind9/-/blob/v9.18.28/CHANGES Signed-off-by: Ashish Sharma

[OE-core][scarthgap][PATCH] libarchive: backport fix for CVE-2024-26256

2024-07-24 Thread Ashish Sharma via lists.openembedded.org
This patch fixes an out-of-bound error in rar e8 filter. Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/eb7939b24a681a04648a59cdebd386b1e9dc9237] Signed-off-by: Ashish Sharma --- .../libarchive/CVE-2024-26256.patch | 27 +++ .../libarchive

[OE-core][kirkstone][PATCH] ruby: backport fix for CVE-2024-27282

2024-07-15 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport [https://github.com/ruby/ruby/commit/989a2355808a63fc45367785c82ffd46d18c900a] Signed-off-by: Ashish Sharma --- .../ruby/ruby/CVE-2024-27282.patch| 29 +++ meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 + 2 files changed, 30 insertions

[OE-core][kirkstone][PATCH] ruby: backport fix for CVE-2024-27282 Arbitrary memory address read vulnerability with Regex search

2024-07-15 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport [https://github.com/ruby/ruby/commit/989a2355808a63fc45367785c82ffd46d18c900a] Signed-off-by: Ashish Sharma --- .../ruby/ruby/CVE-2024-27282.patch| 29 +++ meta/recipes-devtools/ruby/ruby_3.1.3.bb | 1 + 2 files changed, 30 insertions

[OE-core][scarthgap][PATCH] python3: Fix CVE-2024-4032

2024-06-26 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport from [https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb] CVE: CVE-2024-4032 Signed-off-by: Ashish Sharma --- .../python/python3/CVE-2024-4032.patch| 346 ++ .../recipes-devtools/python/python3_3.12.3.bb | 1

[OE-core][kirkstone][PATCH] python3: Fix CVE-2024-4032

2024-06-26 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport from [https://github.com/python/cpython/commit/ba431579efdcbaed7a96f2ac4ea0775879a332fb] CVE: CVE-2024-4032 Signed-off-by: Ashish Sharma --- .../python/python3/CVE-2024-4032.patch| 346 ++ .../python/python3_3.10.14.bb | 1

[OE-core][dunfell][PATCH] xserver-xorg: Backport fix for CVE-2024-31080

2024-04-06 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/96798fc1967491c80a4d0c8d9e0a80586cb2152b] Signed-off-by: Ashish Sharma --- .../xserver-xorg/CVE-2024-31080.patch | 49 +++ .../xorg-xserver/xserver-xorg_1.20.14.bb | 1 + 2 files

[OE-core][dunfell][PATCH] xserver-xorg: Backport fix for CVE-2024-31081

2024-04-06 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport [https://gitlab.freedesktop.org/xorg/xserver/-/commit/3e77295f888c67fc7645db5d0c00926a29ffecee] Signed-off-by: Ashish Sharma --- .../xserver-xorg/CVE-2024-31081.patch | 47 +++ .../xorg-xserver/xserver-xorg_1.20.14.bb | 1 + 2 files

[OE-core][dunfell][PATCH] go: Backport fix for CVE-2024-24784

2024-04-06 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport [https://github.com/golang/go/commit/5330cd225ba54c7dc78c1b46dcdf61a4671a632c] Signed-off-by: Ashish Sharma --- meta/recipes-devtools/go/go-1.14.inc | 1 + .../go/go-1.14/CVE-2024-24784.patch | 205 ++ 2 files changed, 206

[OE-core][dunfell][PATCH] expat: Backport fix for CVE-2024-28757

2024-03-13 Thread Ashish Sharma via lists.openembedded.org
Upstream ref: https://github.com/libexpat/libexpat/pull/842 https://github.com/libexpat/libexpat/issues/839 Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/072eca0b72373da103ce15f8f62d1d7b52695454] Signed-off-by: Ashish Sharma --- .../expat/expat/CVE-2024-28757.patch

[OE-core][dunfell][PATCH V2] mdadm: Backport fix for CVE-2023-28938

2023-11-28 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport from [https://git.kernel.org/pub/scm/utils/mdadm/mdadm.git/patch/?id=7d374a1869d3a84971d027a7f4233878c8f25a62] CVE: CVE-2023-28938 Signed-off-by: Ashish Sharma --- .../mdadm/files/CVE-2023-28938.patch | 80 +++ meta/recipes-extended/mdadm

[OE-core][dunfell][PATCH] mdadm: Backport fix CVE-2023-28938

2023-11-27 Thread Ashish Sharma via lists.openembedded.org
Signed-off-by: Ashish Sharma --- .../mdadm/files/CVE-2023-28938.patch | 80 +++ meta/recipes-extended/mdadm/mdadm_4.1.bb | 1 + 2 files changed, 81 insertions(+) create mode 100644 meta/recipes-extended/mdadm/files/CVE-2023-28938.patch diff --git a/meta/recipes

[OE-core][dunfell][PATCH] zlib: Backport fix for CVE-2023-45853

2023-11-06 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport from [https://github.com/madler/zlib/commit/73331a6a0481067628f065ffe87bb1d8f787d10c] Signed-off-by: Ashish Sharma --- .../zlib/zlib/CVE-2023-45853.patch| 40 +++ meta/recipes-core/zlib/zlib_1.2.11.bb | 1 + 2 files changed, 41

[OE-core][kirkstone][PATCH] zlib: Backport fix CVE-2023-45853

2023-11-06 Thread Ashish Sharma via lists.openembedded.org
Signed-off-by: Ashish Sharma --- .../zlib/zlib/CVE-2023-45853.patch| 40 +++ meta/recipes-core/zlib/zlib_1.2.11.bb | 3 +- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 meta/recipes-core/zlib/zlib/CVE-2023-45853.patch diff --git a/meta

[OE-core][dunfell][PATCH] binutils: Backport fix CVE-2023-25588

2023-10-17 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport from [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=d12f8998d2d086f0a6606589e5aedb7147e6f2f1] CVE: CVE-2023-25588 Signed-off-by: Ashish Sharma --- .../binutils/binutils-2.34.inc| 1 + .../binutils/binutils/CVE-2023-25588.patch| 146

[OE-core][dunfell][PATCH] mdadm: Backport fix for CVE-2023-28736

2023-09-27 Thread Ashish Sharma via lists.openembedded.org
Signed-off-by: Ashish Sharma --- .../mdadm/files/CVE-2023-28736.patch | 77 +++ meta/recipes-extended/mdadm/mdadm_4.1.bb | 1 + 2 files changed, 78 insertions(+) create mode 100644 meta/recipes-extended/mdadm/files/CVE-2023-28736.patch diff --git a/meta/recipes

[OE-core][dunfell][PATCH] qemu: Backport fix CVE-2023-3180

2023-09-06 Thread Ashish Sharma via lists.openembedded.org
Upstream-Status: Backport from [https://gitlab.com/qemu-project/qemu/-/commit/9d38a8434721a6479fe03fb5afb150ca793d3980] CVE: CVE-2023-3180 Signed-off-by: Ashish Sharma --- meta/recipes-devtools/qemu/qemu.inc | 1 + .../qemu/qemu/CVE-2023-3180.patch | 49

[OE-core][kirkstone][PATCH] openssl: Backport fix CVE-2023-2975

2023-08-14 Thread Ashish Sharma
Signed-off-by: Ashish Sharma --- .../openssl/openssl/CVE-2023-2975.patch | 61 +++ .../openssl/openssl_3.0.9.bb | 1 + 2 files changed, 62 insertions(+) create mode 100644 meta/recipes-connectivity/openssl/openssl/CVE-2023-2975.patch diff --git a/meta

[OE-core][kirkstone][PATCH] curl: Backport fix CVE-2023-32001

2023-08-14 Thread Ashish Sharma
Signed-off-by: Ashish Sharma --- .../curl/curl/CVE-2023-32001.patch| 39 +++ meta/recipes-support/curl/curl_7.82.0.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2023-32001.patch diff --git a/meta/recipes

[OE-core][dunfell][PATCH] curl: Backport fix CVE-2023-32001

2023-08-13 Thread Ashish Sharma
Signed-off-by: Ashish Sharma --- .../curl/curl/CVE-2023-32001.patch| 38 +++ meta/recipes-support/curl/curl_7.69.1.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2023-32001.patch diff --git a/meta/recipes

[OE-core][dunfell][PATCH v2] go: Fix CVE-2023-29400

2023-07-11 Thread Ashish Sharma
emit filterFailsafe for empty unquoted attr value Signed-off-by: Ashish Sharma --- meta/recipes-devtools/go/go-1.14.inc | 1 + .../go/go-1.14/CVE-2023-29400.patch | 94 +++ 2 files changed, 95 insertions(+) create mode 100644 meta/recipes-devtools/go/go-1.14

[OE-core][dunfell][PATCH] vim: Fix CVE-2023-2609 and CVE-2023-2610

2023-07-10 Thread Ashish Sharma
untu/+source/vim/tree/debian/patches/CVE-2023-2609.patch?h=applied/ubuntu/devel&id=586a63887e677551384eea2ab03eb22bd1117338 & https://git.launchpad.net/ubuntu/+source/vim/tree/debian/patches/CVE-2023-2610.patch?h=applied/ubuntu/devel&id=586a63887e677551384eea2ab03eb22bd1117338] Signed-off-b

[OE-core][dunfell][PATCH] go: Backport fix CVE-2023-29405

2023-06-28 Thread Ashish Sharma
Upstream-Status: Backport [https://github.com/golang/go/commit/fa60c381ed06c12f9c27a7b50ca44c5f84f7f0f4 & https://github.com/golang/go/commit/1008486a9ff979dbd21c7466eeb6abf378f9c637] Signed-off-by: Ashish Sharma --- meta/recipes-devtools/go/go-1.14.inc | 2 + .../go/go-1.14/CVE-

[OE-core][dunfell][PATCH] go: Fix CVE-2023-29400

2023-06-27 Thread Ashish Sharma
emit filterFailsafe for empty unquoted attr value Signed-off-by: Ashish Sharma --- meta/recipes-devtools/go/go-1.14.inc | 1 + .../go/go-1.14/CVE-2023-29400.patch | 93 +++ 2 files changed, 94 insertions(+) create mode 100644 meta/recipes-devtools/go/go-1.14

[OE-core][dunfell][PATCH V2] golang: Fix CVE-2023-24539

2023-06-06 Thread Ashish Sharma
Improper sanitization of CSS values in html/template Signed-off-by: Ashish Sharma --- meta/recipes-devtools/go/go-1.14.inc | 1 + .../go/go-1.14/CVE-2023-24539.patch | 60 +++ 2 files changed, 61 insertions(+) create mode 100644 meta/recipes-devtools/go/go

[OE-core][dunfell][PATCH] golang: Fix CVE-2023-24539

2023-06-04 Thread Ashish Sharma
Fixing of improper sanitization of CSS values in html/template Signed-off-by: Ashish Sharma --- meta/recipes-devtools/go/go-1.14.inc | 1 + .../go/go-1.14/CVE-2023-24539.patch | 60 +++ 2 files changed, 61 insertions(+) create mode 100644 meta/recipes

[OE-core][dunfell][PATCH] connman: Fix CVE-2023-28488 DoS in client.c

2023-05-09 Thread Ashish Sharma
Avoid overwriting the read packet length after the initial test. Thus move all the length checks which depends on the total length first and do not use the total lenght from the IP packet afterwards. Fixes CVE-2023-28488 Reported by Polina Smirnova Signed-off-by: Ashish Sharma

[OE-core][dunfell-nut][PATCH v2] connman: Fix CVE-2023-28488 DoS in client.c

2023-05-08 Thread Ashish Sharma
Avoid overwriting the read packet length after the initial test. Thus move all the length checks which depends on the total length first and do not use the total lenght from the IP packet afterwards. Fixes CVE-2023-28488 Reported by Polina Smirnova Signed-off-by: Ashish Sharma

[OE-core] [--subject-prefix=OE-core][dunfell-nut][PATCH] connman: Fix CVE-2023-28488 DoS in client.c

2023-05-08 Thread Ashish Sharma
Avoid overwriting the read packet length after the initial test. Thus move all the length checks which depends on the total length first and do not use the total lenght from the IP packet afterwards. Fixes CVE-2023-28488 Reported by Polina Smirnova Signed-off-by: Ashish Sharma

[OE-core][kirkstone][PATCH] shadow:Fix CVE-2023-29383 improper input validation

2023-05-03 Thread Ashish Sharma
ChangeID: 2bfa88cb752792ddc37f700f87a896331bb12c95 CVE: CVE-2023-29383 shadow: Improper input validation in shadow-utils package utility chfn Signed-off-by: Ashish Sharma --- .../shadow/files/CVE-2023-29383.patch | 46 +++ meta/recipes-extended/shadow/shadow.inc

[OE-core][kirkstone][PATCH] vim: Backport fix for CVE-2023-0049

2023-01-10 Thread Ashish Sharma
Upstream-Status: Backport from 'https://github.com/vim/vim/commit/7b17eb4b063a234376c1ec909ee293e42cff290c' CVE: CVE-2023-0049 Signed-off-by: Ashish Sharma --- .../vim/files/CVE-2023-0049.patch | 62 +++ meta/recipes-support/vim/vim.inc | 1

[OE-core][kirkstone][PATCH] golang: Fix CVE-2022-2879\

2022-11-22 Thread Ashish Sharma
Reader.Read doesn't set a limit on the maximum size of file headers. Upstream-Status: Backport from [https://github.com/golang/go/commit/0a723816cd205576945fa57fbdde7e6532d59d08] CVE: CVE-2022-2879 Signed-off-by: Ashish Sharma --- meta/recipes-devtools/go/go-1.17.13.inc | 1 + .