Add Patch file to fix CVE-2024-20696
CVE: CVE-2024-20696
Signed-off-by: Nitin Wankhade
Signed-off-by: Nikhil R
---
.../libarchive/CVE-2024-20696.patch | 115 ++
.../libarchive/libarchive_3.7.4.bb| 3 +-
2 files changed, 117 insertions(+), 1 deletion(-)
Add Patch file to fix CVE-2024-20696
CVE: CVE-2024-20696
Signed-off-by: Nitin Wankhade
Signed-off-by: Nikhil R
---
.../libarchive/CVE-2024-20696.patch | 114 ++
.../libarchive/libarchive_3.6.2.bb| 1 +
2 files changed, 115 insertions(+)
create mode 1006
Hi Team,
Could someone review the changes and integrate them into the master branch?
Please let me know if you need any clarification from our side.
Thanks!
Zahir.
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#208148):
https://lists.openembedde
Hi Steve,
This changes are already upstreamed to master. It also got integrated to master.
https://git.yoctoproject.org/poky/commit/?id=22c08cab4db89dc3d41ab22cfe0482c1483391dd
Thanks!
Zahir
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#207511):
awmidi, control, pcm,
client_event_filter,latency,namehint,seq
Signed-off-by: aszh07
---
.../distro/include/ptest-packagelists.inc | 1 +
...001-remove-check_TESTS-from-automake.patch | 27 +++
.../alsa/alsa-lib/run-ptest | 17
.../als
ptest()
function.
Signed-off-by: aszh07
---
.../distro/include/ptest-packagelists.inc | 1 +
.../alsa/alsa-lib/run-ptest | 15 +
.../alsa/alsa-lib_1.2.11.bb | 21 ++-
3 files changed, 36 insertions(+), 1 deletion(-)
c
"libswresample libavcodec" to CVE_PRODUCT to detect
vulnerabilities
where the product is "libswresample libavcodec" as well.
Signed-off-by: aszh07
---
meta/recipes-multimedia/ffmpeg/ffmpeg_7.0.2.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-multimedia/ffmpeg
ptest()
function.
Signed-off-by: aszh07
---
.../distro/include/ptest-packagelists.inc | 1 +
.../alsa/alsa-lib_1.2.12.bb | 23 +--
meta/recipes-multimedia/alsa/files/run-ptest | 14 +++
3 files changed, 36 insertions(+), 2 deletions(-)
create mode
"libswresample libavcodec" to CVE_PRODUCT to detect
vulnerabilities
where the product is "libswresample libavcodec" as well.
Signed-off-by: aszh07
---
meta/recipes-multimedia/ffmpeg/ffmpeg_6.1.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-multimedia/ffmpeg
"libswresample libavcodec" to CVE_PRODUCT to detect
vulnerabilities
where the product is "libswresample libavcodec" as well.
Signed-off-by: aszh07
---
meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.1.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-multimedia/ffmpeg
index 00..4cefd2e522
--- /dev/null
+++
b/meta/recipes-core/glib-2.0/glib-2.0/0001-glib-2.0-Remove-gvariant-byteswap-test.patch
@@ -0,0 +1,45 @@
+From f4c529805aed5ee92b8d7d729cfa501be5835d7e Mon Sep 17 00:00:00 2001
+From: aszh07
+Date: Mon, 29 Jul 2024 16:19:10 +0530
+Subject: [PATCH] glib
libexpat through 2.5.0 allows a denial of service
(resource consumption) because many full reparsings
are required in the case of a large token for which
multiple buffer fills are needed.
References:
https://security-tracker.debian.org/tracker/CVE-2023-52425
https://ubuntu.com/security/CVE-2023-52
Update LICENSE defined for xz packages to match the license
information provided in the xz COPYING file.
The License information from PACKAGERS file of xz mentions
packages with lzma files are in public domain.They ask to
use GPLv2+, if only it's not possible to mention "PD and GPLv2+".
Include P
/72b4af6143681f528f1d237b21a9a7aee1738832]
+
+Signed-off-by: Zahir Hussain zahir.ba...@kpit.com
+Signed-off-by: aszh07
+---
+CMakeLists.txt | 4 ++
+cmakeconfig.h.in | 9 +++
+configure.ac | 21 +++
+doc/Makefile.am| 1 +
+lib/CMakeLists.txt
binaries into PTEST path using do_install_ptest()
function.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
.../distro/include/ptest-packagelists.inc | 1 +
.../alsa/alsa-lib_1.2.6.1.bb | 19 +++
2 files changed, 20 insertions(+)
diff --git a/meta/conf/distro/inc
binaries into PTEST path using do_install_ptest()
function.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
.../distro/include/ptest-packagelists.inc | 1 +
.../alsa/alsa-lib_1.2.1.2.bb | 19 +++
2 files changed, 20 insertions(+)
diff --git a/meta/conf/distro/inc
:
https://snapshot.debian.org/archive/debian-security/20231016T131513Z/pool/updates/main/n/nghttp2/nghttp2_1.36.0-2%2Bdeb10u2.debian.tar.xz
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
.../nghttp2/nghttp2/CVE-2023-44487.patch | 906 ++
.../recipes-support/nghttp2
initializes the variable from environment,
So we have to unset it in the toolchain file to avoid overwriting the
variable definition again.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake | 3 +++
1 file changed, 3 insertions(+)
diff
initializes the variable from environment,
So we have to unset it in the toolchain file to avoid overwriting the
variable definition again.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake | 3 +++
1 file changed, 3 insertions(+)
diff
initializes the variable from environment,
So we have to unset it in the toolchain file to avoid overwriting the
variable definition again.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake | 3 +++
1 file changed, 3 insertions(+)
diff --git
You are correct, of course.
But currently, we don't have any test cases for this issue.
Cheers,
Zahir.
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#191482):
https://lists.openembedded.org/g/openembedded-core/message/191482
Mute This Topic: https
initializes the variable from environment, So we
have to
unset it in the toolchain file to avoid overwriting the variable definition
again.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake | 3 +++
1 file changed, 3 insertions(+)
diff
initializes the variable from environment, So we
have to
unset it in the toolchain file to avoid overwriting the variable definition
again.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake | 3 +++
1 file changed, 3 insertions(+)
diff
initializes the variable from environment, So we
have to
unset it in the toolchain file to avoid overwriting the variable definition
again.
Signed-off-by: aszh07
Signed-off-by: Zahir Hussain
---
meta/recipes-devtools/cmake/cmake/OEToolchainConfig.cmake | 3 +++
1 file changed, 3 insertions(+)
diff
24 matches
Mail list logo
