iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA
authentication, allows a timing side channel in RSA decryption operations. This
side channel could be sufficient for an attacker to recover credential plaintext.
It requires the attacker to send a large number of messages for decryption, as
described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-26306https://security-tracker.debian.org/tracker/CVE-2024-26306
Upstream patch:
299b356df6
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
A flaw was found in iperf, a utility for testing network performance using TCP, UDP,
and SCTP. A malicious or malfunctioning client can send less than the expected amount
of data to the iperf server, which can cause the server to hang indefinitely waiting
for the remainder or until the connection gets closed. This will prevent other
connections to the server, leading to a denial of service.
References:
https://nvd.nist.gov/vuln/detail/CVE-2023-7250https://security-tracker.debian.org/tracker/CVE-2023-7250
Upstream patch:
5e3704dd85
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
When creating sparse images, the RAW image is no longer needed in
some workflows such as Android and CI pipelines. These RAW images
can be multi-GB artifacts and consume significant disk space.
This change introduces a configuration option
`DELETE_RAWIMAGE_AFTER_SPARSE_CMD` which, when set to "1",
removes the RAW image after sparse image generation.
This reduces disk usage in builds where sparse images are the
final deliverables and RAW images are not required.
Default behavior is unchanged: RAW images are kept unless the
variable is explicitly enabled:
This change corresponds to upstream f5246b7df447ac76ec04c6e5add398862d1c9ccd
DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "1" # Delete RAW image
DELETE_RAWIMAGE_AFTER_SPARSE_CMD = "0" # Default behavior
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
By default, img2simg will only generate raw and fill chunks. This adds
support for "don't care" chunks, based on file holes. This is similar to
how bmaptool works. "don't care" chunks do not need to be written,
speeding up flashing time.
This change corresponds to upstream 9862a017fa7f88424f0670ba89af58e5051550b0
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
If the source image's size is not aligned to the sparse image's block
size, then conversion will fail with
img2simg: libsparse/sparse.cpp:133: int write_all_blocks(sparse_file*, output_file*): Assertion `pad >= 0' failed.
This is a bug in img2simg, but an easy way to work around it is to pad
the source image ourselves. The default block size of 4096 matches
img2simg's default block size.
This change corresponds to upstream fb331cb62eafd1e534dee292525084ccee0ef3e1
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: AshishKumar Mishra <emailaddress.ashish@gmail.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
A flaw was found in polkit. When processing an XML policy with 32 or
more nested elements in depth, an out-of-bounds write can be triggered.
This issue can lead to a crash or other unexpected behavior, and
arbitrary code execution is not discarded. To exploit this flaw, a
high-privilege account is needed as it's required to place the
malicious policy file properly.
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-7519
Upstream-patch:
107d380136
Signed-off-by: Praveen Kumar <praveen.kumar@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This ensures that host tools like 'gen' are built for build host and not
target. internal bind build supplies its own options to configuring it,
where it does not pass --host option and as a result it does not deduce
it to be a cross compile and hence these variables are not set property
inside bind build
Fixes
| ./gen: /usr/lib/libc.so.6: version `GLIBC_2.38' not found (required by ./gen)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d57c4655623a7271dc93cfb741ffdbf1b511a5c2)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Changes since 4.4.3 (Bug Fixes)
Corrected a reference count leak that occurs when the server builds
responses to leasequery packets. Thanks to VictorV of Cyber Kunlun
Lab for reporting the issue.
[Gitlab #253]
CVE: CVE-2022-2928
Corrected a memory leak that occurs when unpacking a packet that has an
FQDN option (81) that contains a label with length greater than 63
bytes.
Thanks to VictorV of Cyber Kunlun Lab for reporting the issue.
[Gitlab #254]
CVE: CVE-2022-2929
Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 354608cb88042a7255aaf5c792b7638cb37a3979)
Adapted to Kirkstone. Dropped two CVE patches, because they are included in
this patch release.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Correct "startline=" to "beginline=" in LIC_FILES_CHKSUM so that the
correct lines from autossh.c and daemon.h are used. Also remove
autossh.spec from LIC_FILES_CHKSUM as it doesn't really contain any
license information.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 506b6c94119c431edb57ccb22456837734970516)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This patch is mentioned in [1] and [2].
[1] https://nvd.nist.gov/vuln/detail/CVE-2022-47021
[2] https://github.com/xiph/opusfile/issues/36
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 95b8d055db83af01aed7f6ab98bc08cfa576f15b)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Changelog:
0.1.6
- Fixed an infinite loop when decoding some AMR-NB samples
- Fixed noise spikes when decoding non-voice frames for both AMR-NB and AMR-WB
0.1.5
- Fix an autotools issue with cross compiling from the 0.1.4 release
0.1.4
- Autotools cleanups
- Fixes for SID/DTX in the AMR-WB decoder, fixes for handling of bad
frames in both AMR-WB and AMR-NB
Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 55274f650e304074783d171a406454748b2d456e)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
The sniffer PACKAGECONFIG will make gssdp depend on gtk4 as below.
PACKAGECONFIG[sniffer] = "-Dsniffer=true,-Dsniffer=false,gtk4,"
But gtk4 needs the opengl DISTRO_FEATURES enabled, so also check
opengl in gssdp recipe to keep consistent.
Fixes:
ERROR: Nothing PROVIDES 'gtk4' (but /build/layers/meta-openembedded/meta-multimedia/recipes-connectivity/gupnp/gssdp_1.4.0.1.bb DEPENDS on or otherwise requires it)
gtk4 was skipped: missing required distro feature 'opengl' (not in DISTRO_FEATURES)
ERROR: Required build target 'meta-world-pkgdata' has no buildable providers.
Missing or unbuildable dependency chain was: ['meta-world-pkgdata', 'gssdp', 'gtk4']
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 491a703c41644b6ab4db62920774e6ea23bc8308)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
This package uses MIT license, which is very similar to X11, except that
X11 license has an advertisement clause, which is missing from the MIT.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d2b5523333b762c32e70de36237e2d8e93096189)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
In case gtk2 PACKAGECONFIG is enabled, do_package task fails
with the following error:
ERROR: ibus-1.5.26-r0 do_package: QA Issue: ibus: Files/directories were installed but not shipped in any package:
/usr/lib/gtk-2.0/2.10.0/immodules/im-ibus.so
This patch adds the missing folder to the FILES variable.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit c87c5d5614bf5d5255e031abe32ea681968a6d75)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
it encoded PYTHON variable during build which otherwise points to python
on build host which is not correct for cross compiled packages.
Add missing dependency on python3-core which is needed for ibus-setup
script to run
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit fe0e3d77eb1a992c487038e64b734b2b8b395647)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Changelog:
==========
- scale: Make OK button default (allows pressing Enter to accept selected
value)
- Fix maximum width of message dialogs to 60 characters, and make message
dialogs non-resizable (fixes regression from 3b64d05e)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit abe91b6f51cd2237e0a8243bcde3dbb7e5fd21cb)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
bpftrace need line up with kernel architecture type,
so add it to NON_MULTILIB_RECIPES.
bpftrace must be built with the same architecture (32-bit/64-bit) as the kernel
to ensure compatibility when tracing kernel functions and using eBPF features.
(cherry-picked from f8498f26991fbd8ea996dcf7c63d1c79e9c034a7 in master )
Signed-off-by: Sunil Dora <sunilkumar.dora@windriver.com>
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
0001-daemon-PATH-expand-the-sftp-backend-ssh-client.patch
included in 1.50.3
Changelog:
===========
* dav: Prevent usage of NULL when user is not specified
* ftp: Fix hangs when the connection is released
* fuse: Decrease file handle reference when open file fail
* sftp: PATH-expand the ssh client
* test: Several smaller enhancements
* backend: Add support for xx-large and x-large thumbnails
* goa: Prevent automounts when resuming from suspension
* Translation updates (GNOME Translation Project contributors)
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit d11db37985f0b28ed8a5e95cf22876a17646ca45)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
The gvfs project meson configuration attempts to locate and resolve the
path to an ssh-client on the build host, then pass that full-path to the
gvfs sftp-backend as a constant string, to be used at runtime to fork
ssh subprocesses.
As a consequence, if the build machine's ssh client path differs from
the gvfs target's path - as is common for OE/buildroot builds - gvfs can
fail at runtime. Further, build machines cannot configure gvfs without
an ssh client, even though nothing *uses* the client during the build.
The .patch in this commit has been upstreamed with gvfs, and modifies
the configuration to instead pass the string-literal `ssh` to the sftp
backend. With this change, gvfs will instead rely on PATH-expansion to
locate the user's ssh-client at runtime.
This obviates the requirement that the build machine have an ssh-client.
Signed-off-by: Alex Stewart <alex.stewart@ni.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit b3ace96246ed13320e8fc21b59ce92512aa8c843)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Use multiline styling in the gvfs DEPENDS variable assignment, so that
diffs are easier to understand.
Also alpha-sort the DEPENDS, since their order isn't meaningful.
Signed-off-by: Alex Stewart <alex.stewart@ni.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9e725dfee3a6fa6d8efef9522a787b9b4893bafc)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Changelog:
==========
* smb: Rework anonymous handling to avoid EINVAL
* http: Unescape prefix to fix handling of encoded URIs
* build: Fix build without Avahi support
* dav: Drop user from URI as a workaround for Nextcloud bug
* dav: Port DNS-SD resolver to async API to fix hangs when mounting
* smb: Ignore EINVAL for kerberos/ccache login
* dav: Rewrite to libsoup async API to fix crashes
* dav: Do not lose userinfo when copying URIs
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 92d4a5374b3100aed5606c2e759cacab9273c62e)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Changelog:
==========
• Fix a crash at shutdown after saving state. This didn't cause any data
loss, but could be annoying.
• Spellcheck underline fixes for various languages
• Various robustness fixes for GTK 4
• Fixes for inconsistent line-endings
• Translation updates
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 46fce3997be65a3895ed6619d32131c1e63aeac9)
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
