References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29464
The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file.
An attacker could potentially exploit the vulnerability to gain code execution, if they can
trick the victim into running Exiv2 on a crafted image file.
Upstream-Status: Accepted [f930883919]
CVE: CVE-2021-29464
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29463
The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file.
An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2,
if they can trick the victim into running Exiv2 on a crafted image file.
Upstream-Status: Accepted [783b3a6ff1]
CVE: CVE-2021-29463
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29458
The out-of-bounds read is triggered when Exiv2 is used to write metadata into a crafted image file.
An attacker could potentially exploit the vulnerability to cause a denial of service by crashing Exiv2,
if they can trick the victim into running Exiv2 on a crafted image file.
Upstream-Status: Accepted [06d2db6e5f]
CVE: CVE-2021-29458
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29457
The heap overflow is triggered when Exiv2 is used to write metadata into a crafted image file.
An attacker could potentially exploit the vulnerability to gain code execution, if they can
trick the victim into running Exiv2 on a crafted image file.
Upstream-Status: Accepted [0230620e6e]
CVE: CVE-2021-29457
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The patch recently added for CVE-2021-30004 broke compilation with
CONFIG_TLS=internal. This adds the necessary function to let it
compile again.
Signed-off-by: Alexander Vickberg <wickbergster@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
When usb_backend is configured, libxml2 is set as a RDEPEND. But, in
reality we want it to be part of the DEPENDS list.
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
NSS's build tries to be clever and passes for example -march=armv8-a+crypto
explicitly, instead of relying on the person doing the compilation to
set the right flags.
This conflicts with our compiler flags which typically pass the ideal
tune for the target, for example -mcpu=cortex-a55+crc+crypto.
When this happens GCC warns that the flags conflict (which was promoted
to an error, now fixed) and -march takes precedence over -mcpu.
As there's a huge number of potential tune flags to remove to avoid the
conflict, now that warnings are not fatal we can stop removing the flags
and let GCC warn as the generated code is the same.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
-Werror should be used by developers and not packagers, because new
compiler flags or GCC versions can use new warnings.
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Move audit to a more common layer to simplify integration.
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This requires gtk support enabled in avahi, which was
disabled on oe-core.
Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
upstream nmap is python2 compatiable now, but this recipe
supports python3.
Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- Fix an absolute path symlink issue, replace with a relative link
- Fix installed-vs-shipped QA Issue of nativesdk package
...
|ERROR: nativesdk-cdrkit-1.1.11-r0 do_package: QA Issue: nativesdk-cdrkit:
Files/directories were installed but not shipped in any package:
| /opt/windriver/wrlinux-graphics/21.18/sysroots/x86_64-wrlinuxsdk-linux/usr/sbin/netscsid
...
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Release 21.05.0
core:
* Fix crashes in malformed files
* Export SplashFont* symbols used by Scribus
* Minor code improvements
qt5/qt6:
* Make sure new signatures are always properly oriented
* Allow to pass the border width when signing
glib:
* Enhance find to support multi-line matching
utils:
* pdftoppm: Fix regression when using single scaleTo. Issue #1062
build system:
* Allow to disable building manual tests
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Drop fix-a-building-failure.patch because upstream has made is narrower
to apply to emulator builds and not just any cross compiling builds
Add missing dependency on boost
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Do not check for C++11, since it is a runtime check, wont work during
cross compile, in anycase our compilers do support C++11 and default to
c++ or newer std, so this check is redundant for OE toolchains
Add new required build time deps on fribidi and imlib2
Changes are [1]
[1] https://github.com/ice-wm/icewm/releases/tag/2.3.3
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Since tbb has a COMPATIBLE_MACHINE entry to prevent it from building
for powerpcc, let's also remove it from the meta-oe-support package
group.
Signed-off-by: Saul Wold <saul.wold@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
| [log_check] Warn: update-alternatives: sh has multiple providers with the same priority, please check /workdir/raspberrypi4_64-mortsgna-linux/allgui-dev-image/1.0-r0/rootfs/usr/lib/opkg/alternatives/sh for details
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
