CVE-2024-56827:
A flaw was found in the OpenJPEG project. A heap buffer overflow
condition may be triggered when certain options are specified while
using the opj_decompress utility. This can lead to an application crash
or other undefined behavior.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-56827]
[https://github.com/uclouvain/openjpeg/issues/1564]
Upstream patches:
[e492644fbd]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2024-56826:
A flaw was found in the OpenJPEG project. A heap buffer overflow
condition may be triggered when certain options are specified while
using the opj_decompress utility. This can lead to an application crash
or other undefined behavior.
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2024-56826]
[https://github.com/uclouvain/openjpeg/issues/1563]
Upstream patches:
[98592ee6d6]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The branch names of several upstream repos have been changed, thus we
update the recipe to avoid fetching failure.
Signed-off-by: Ramax Lo <ramaxlo@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE fixed:
- CVE-2023-40359 xterm: ReGIS reporting for character-set names containing characters other than alphanumerics or underscore
Upstream-Status: Backport from 41ba5cf31d
Note: The CVE patch is part of minor version-up and is extracted from the snapshot of xterm-379c.
Documentation of the commit shows 2 different overflows being fixed and hence the fix was extracted from the commit.
Signed-off-by: Rohini Sangam <rsangam@mvista.com>
Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Graphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file.
NOTE: exploitability may be uncommon because this file is typically owned by root.
Signed-off-by: Meenali Gupta <meenali.gupta@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
old tarballs disappear from main location, use a backup location to
fetch it in such cases.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Joao Marcos Costa <joaomarcos.costa@bootlin.com>
Backported from Nanbield
(cherry-picked from commit 8d34444c749a466f35445fd4c2212b3fbdb8d844)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The command "bitbake universe -c fetch" currently throws a ton of warnings
as there are many 'impossible' dependencies.
In some cases these variants may never have worked and were just added by copy
and paste of recipes. In some cases they once clearly did work but became
broken somewhere along the way. Users may also be carrying local bbappend files
which add further BBCLASSEXTEND.
Having universe fetch work without warnings is desireable so clean up the broken
variants. Anyone actually needing something dropped here can propose adding it
and the correct functional dependencies back quite easily. This also then
ensures we're not carrying or fixing things nobody uses.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9962d57f7c235873de0a0bb192b5f56747762fc7)
Backport:
* Updated paths to follow PV changes
* Adapted modified recipes to the ones generating warnings
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
helps it compiling on on different openGL implementations which may not
implement fulll openGL specs
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit a9212722c1b1a2ab29215651063ca94fb114c39b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The usage of nobranch=1 in SRC_URI allows using unprotected branches.
This change updates the real branch name in place of nobranch=1 for these components.
Signed-off-by: Sourav Kumar Pramanik <pramanik.souravkumar@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Add support for building native and nativesdk variants.
Signed-off-by: Bhargav Das <bhargav.das@siemens.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
* with multilib BASELIB is just "lib" while baselib is "lib64"
and libdir is "/usr/lib64".
* fixes:
ERROR: QA Issue: lvgl: Files/directories were installed but not shipped in any package:
/usr/lib
/usr/lib/liblvgl.a
Please set FILES such that these items are packaged. Alternatively if they are unneeded, avoid installing them or delete them within do_install.
lvgl: 2 installed and not shipped files. [installed-vs-shipped]
* lowercase baselib should work for ppc64 as well (I hope)
# $baselib [3 operations]
# set oe-core/meta/conf/bitbake.conf:10
# "${BASELIB}"
# set oe-core/meta/conf/bitbake.conf:11
# [vardepvalue] "${baselib}"
# set oe-core/meta/conf/multilib.conf:2
# "${@d.getVar('BASE_LIB:tune-' + (d.getVar('DEFAULTTUNE') or 'INVALID')) or d.getVar('BASELIB')}"
# pre-expansion value:
# "${@d.getVar('BASE_LIB:tune-' + (d.getVar('DEFAULTTUNE') or 'INVALID')) or d.getVar('BASELIB')}"
baselib="lib64"
* simplify destsuffix/S setting
* I was surprised that ${WORKDIR}/${PN}-${PV} works in multilib build
but then I've noticed that it's because destsuffix is set to S which
is a bit uncommon, so drop that and use default "git"
* use ${STAGING_INCDIR} instead of ${RECIPE_SYSROOT}/${includedir}
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
CVE-2019-14906 is a Red Hat vulnerability and Yocto is not applicable.
So add it to the allowlist.
Signed-off-by: Hitomi Hasegawa <hasegawa-hitomi@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8803be17aada56ec6a11fba4db9df74f16f9c58c)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This CVE is patched in our version of openjpeg. The NVD database doesn't
include a version range this is why it's still reported.
Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Some old CVEs don't have a vulnerable version range in the NVD database,
this causes come mismatch with cve-check. Ignore many CVEs that are
picked up by the class but are patched in our products.
Signed-off-by: Davide Gardenal <davide.gardenal@huawei.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit efa12676dd0676fd0aa63457d7ba360fe8a6fae2)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
There will be tofos in output pictures without any font, so make
graphviz rrecommends on liberation-fonts.
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 0e036cb1bc0c272b27cbd7e42eacbae48edc685e)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
The upstream repo location has changed, it's now
https://git.enlightenment.org/old/legacy-imlib2
It's not clear when or why it happened, but the the commit hash we use
in SRCREV exists in the 'new' location, so let's at least update the
SRC_URI for now, and fix this warning:
WARNING: imlib2-1.7.1-r0 do_fetch: Failed to fetch URL git://git.enlightenment.org/legacy/imlib2.git;protocol=https;branch=master, attempting MIRRORS if available
Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 62becef1091d21f487e826df7be7dcef3ab8f94c)
Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
This takes care of rootdir being different when using usrmerge
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 8cec1f1fd9ea585039d985943f3f20b37aff9a3b)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
License-Update: Copyright year updated to 2022
Changelog:
==========
* amend allocation/freeing of scrollback lines, eliminating an
adjustment for status-line added in patch #371
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
CVE: CVE-2022-1122
The defect is undergoing reanalysis and there may be follow-up commits.
Ref:
* https://github.com/uclouvain/openjpeg/issues/1368
Signed-off-by: Nicolas Marguet <nicolas.marguet@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog from 3.6.1 to 3.8 is included in https://feh.finalrewind.org/archive/
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
It needs to run `dot -c` first before call 'dot' command, otherwise it
fails with:
| Format: "png" not recognized. No formats found.
| Perhaps "dot -c" needs to be run (with installer's privileges) to
register the plugins?
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
xbindkeys is an application that allows you to launch shell
commands with your keyboard or your mouse under X Window. It links
commands to keys or mouse buttons, using a configuration file. It
is independant of the window manager and can capture all keyboard
keys.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Update graphviz from 2.44.1 to 2.50.0.
* update SRC_URI
* remove patches can not be applied
* mkdefs is not provided any longer, so remove installation for
graphviz-native
* rrecommends on liberation-fonts that there will be tofos in outputed
pictures without any font
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
nativesdk-librsvg is not available anymore ([2], transition to Rust).
According to [2], graphviz can be used fine (even with svg images)
without librsvg.
[1] oe-core: 67dd505c42 ("librsvg: do not enable nativesdk")
[2] https://www.linuxfromscratch.org/blfs/view/cvs/general/graphviz.html
Signed-off-by: Christian Eggers <ceggers@arri.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
