Closes: CVE-2023-25584
Upstream-Status: Backport
[https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=77c225bdeb410cf60da804879ad41622f5f1aa44]
Signed-off-by: Ashish Kumar Mishra
---
.../binutils/binutils-2.39.inc| 1 +
.../binutils/0016-CVE-2023-25584.patch|
Commit f673d3d239799fb1ab50f4aa5d44187666aa0cd7 introduced a warning for
virtual/ being used in RPROVIDES and RDEPENDS. Make it possible to
disable the warning by removing "virtual-slash from WARN_QA.
Signed-off-by: Peter Kjellerstedt
---
meta/classes-global/insane.bbclass | 13 +++--
1
On 1/22/24 13:00, Chen Qi via lists.openembedded.org wrote:
On 1/20/24 01:19, Richard Purdie wrote:
On Tue, 2023-12-26 at 12:44 +0800, Chen Qi via lists.openembedded.org
wrote:
From: Chen Qi
The initial_revs["."] does not have an initial value, resulting
in the following error:
KeyError:
From: Chen Qi
Add a test case to ensure the following error does not happen again for
'devtool modify -n'.
Traceback (most recent call last):
File "/buildarea2/chenqi/poky/scripts/devtool", line 349, in
ret = main()
File "/buildarea2/chenqi/poky/scripts/devtool", line 336, in main
Thanks Richard and Ross's comments!
I will try to send the patch to the upstream.
Thanks,
On 1/20/24 01:41, Ross Burton wrote:
CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know
the content is safe.
On 1/20/24 01:19, Richard Purdie wrote:
On Tue, 2023-12-26 at 12:44 +0800, Chen Qi via lists.openembedded.org
wrote:
From: Chen Qi
The initial_revs["."] does not have an initial value, resulting
in the following error:
KeyError: '.'
The problem could be reproduced by running:
devtool
On 1/20/24 02:14, Alexandre Belloni wrote:
On 19/01/2024 19:13:25+0100, Alexandre Belloni wrote:
On 19/01/2024 11:09:20+0800, Chen Qi via lists.openembedded.org wrote:
What's the status of this patch series?
Is there any issue or concern that I missed?
I'm glad you asked, I got this today:
From: Kai Kang
It fails occasionally with missing generated header files:
| ../git/common/asn1.c:42:10: fatal error: openssl.asn.h: No such file or
directory
|42 | #include "openssl.asn.h"
| | ^~~
| compilation terminated.
According to meson manual page:
From: Vijay Anusuri
Upstream-Status: Backport [import from ubuntu
https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/gnutls28/3.6.13-2ubuntu1.9/gnutls28_3.6.13-2ubuntu1.9.debian.tar.xz
Upstream-Commit:
https://gitlab.com/gnutls/gnutls/-/commit/29d6298d0b04cfff970b993915db71ba3f580b6d]
Hi all,
Intel and WR YP QA is planning for QA execution for YP build yocto-5.0_M2.rc1.
We are planning to execute following tests for this cycle:
OEQA-manual tests for following module:
1. OE-Core
2. BSP-hw
Runtime auto test for following platforms:
1. MinnowBoard Turbot - 32bit
Yes
On 1/19/24 19:57, Martin Jansa wrote:
**
*CAUTION: This email comes from a non Wind River email account!*
Do not click links or open attachments unless you recognize the sender
and know the content is safe.
Do you need to override the PREFERRED_VERSION_? instead of overriding
On 1/19/24 17:29, Richard Purdie wrote:
CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know
the content is safe.
On Fri, 2024-01-19 at 15:35 +0800, Changqing Li wrote:
From: Changqing Li
use ?= to set
On Sun, Jan 21, 2024 at 8:43 AM Ashishx88 wrote:
>
> Hi Members ,
>
> I am trying to submit an CVE patch CVE-2023-25584 for binutils
> This is my first patch in community so apologies if any basic info is missed
>
> Can members please help me for
>
> 1) Do i need to share only specific CVE patch
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch
/home/patchtest/share/mboxes/kirkstone-6-6-xserver-xorg-Multiple-CVE-fixes.patch
FAIL: test CVE check ignore: CVE_CHECK_IGNORE is deprecated
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch
/home/patchtest/share/mboxes/kirkstone-2-6-openssl-fix-CVE-2023-6237-Excessive-time-spent-checking-invalid-RSA-public-keys.patch
FAIL: test CVE
Thank you for your submission. Patchtest identified one
or more issues with the patch. Please see the log below for
more information:
---
Testing patch
/home/patchtest/share/mboxes/kirkstone-3-6-tiff-fix-CVE-2023-6228.patch
FAIL: test CVE check ignore: CVE_CHECK_IGNORE is deprecated and should
From: Simone Weiß
This is fixed via a patch added in gcc-13.2.inc already.
Signed-off-by: Simone Weiß
---
meta/recipes-devtools/gcc/libgcc-initial_13.2.bb | 2 ++
1 file changed, 2 insertions(+)
diff --git a/meta/recipes-devtools/gcc/libgcc-initial_13.2.bb
From: Vijay Anusuri
Fix below CVE's
CVE-2023-6816
CVE-2024-0229
CVE-2024-21885
CVE-2024-21886
CVE-2024-0408
CVE-2024-0409
Signed-off-by: Vijay Anusuri
Signed-off-by: Steve Sakoman
---
.../xserver-xorg/CVE-2023-6816.patch | 55 +
.../xserver-xorg/CVE-2024-0229-1.patch|
From: Hitendra Prajapati
Upstream-Status: Backport from
https://github.com/linux-pam/linux-pam/commit/031bb5a5d0d950253b68138b498dc93be69a64cb
Signed-off-by: Hitendra Prajapati
Signed-off-by: Steve Sakoman
---
.../pam/libpam/CVE-2024-22365.patch | 62 +++
From: Peter Marko
Documentation for this patch is under
https://github.com/mkj/dropbear/commit/66bc1fcdee594c6cb1139df0ef8a6c9c5fc3fde3
Signed-off-by: Peter Marko
Signed-off-by: Steve Sakoman
---
meta/recipes-core/dropbear/dropbear.inc | 1 +
From: Vijay Anusuri
CVE-2024-0553
A vulnerability was found in GnuTLS. The response times to malformed
ciphertexts in RSA-PSK ClientKeyExchange differ from response times of
ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote
attacker to perform a timing side-channel
From: Yogita Urade
CVE-2023-6228:
An issue was found in the tiffcp utility distributed by the
libtiff package where a crafted TIFF file on processing may
cause a heap-based buffer overflow leads to an application
crash.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-6228
From: Hitendra Prajapati
Upstream-Status: Backport from
https://github.com/openssl/openssl/commit/e09fc1d746a4fd15bb5c3d7bbbab950aadd005db
Signed-off-by: Hitendra Prajapati
Signed-off-by: Steve Sakoman
---
.../openssl/openssl/CVE-2023-6237.patch | 127 ++
Please review this set of changes for kirkstone and have comments back by
end of day Tuesday, January 23
Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/6471
The following changes since commit ebd61290a644a6d9f2b3701e0e7ea050636da76c:
Hi Members ,
I am trying to submit an CVE patch CVE-2023-25584 for binutils
*This is my first patch in community so apologies if any basic info is missed*
Can members please help me for
1) Do i need to share only specific CVE patch with community
or
Patch with updates
Branch: nanbield
New this week: 4 CVEs
CVE-2023-51780 (CVSS3: 8.1 HIGH): linux-yocto
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51780 *
CVE-2023-51781 (CVSS3: 7.0 HIGH): linux-yocto
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51781 *
CVE-2023-51782 (CVSS3: 7.0
Branch: kirkstone
New this week: 1 CVEs
CVE-2024-22195 (CVSS3: 6.1 MEDIUM): python3-jinja2:python3-jinja2-native
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22195 *
Removed this week: 0 CVEs
Full list: Found 40 unpatched CVEs
CVE-2021-35937 (CVSS3: 6.4 MEDIUM): rpm:rpm-native
Branch: dunfell
New this week: 1 CVEs
CVE-2024-22195 (CVSS3: 6.1 MEDIUM): python3-jinja2
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-22195 *
Removed this week: 0 CVEs
Full list: Found 111 unpatched CVEs
CVE-2020-15705 (CVSS3: 6.4 MEDIUM): grub:grub-efi:grub-efi-native
Branch: master
New this week: 0 CVEs
Removed this week: 2 CVEs
CVE-2023-6377 (CVSS3: 7.8 HIGH): xserver-xorg
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6377 *
CVE-2023-6478 (CVSS3: 7.5 HIGH): xserver-xorg
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-6478 *
Full
29 matches
Mail list logo
