[kirkstone,02/28] libxml2: Ignore CVE-2016-3709

Message ID	a2806f24b95dd8cb1e687655e202bd7e053d0ac7.1661293746.git.steve@sakoman.com
State	Accepted, archived
Commit	a2806f24b95dd8cb1e687655e202bd7e053d0ac7
Headers	show Return-Path: <steve@sakoman.com> ip: 209.85.210.172, mailfrom: steve@sakoman.com) From: Steve Sakoman <steve@sakoman.com> To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 02/28] libxml2: Ignore CVE-2016-3709 Date: Tue, 23 Aug 2022 12:35:14 -1000 Message-Id: <a2806f24b95dd8cb1e687655e202bd7e053d0ac7.1661293746.git.steve@sakoman.com> In-Reply-To: <cover.1661293745.git.steve@sakoman.com> References: <cover.1661293745.git.steve@sakoman.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[kirkstone,01/28] libtiff: CVE-2022-34526 A stack overflow was discovered \| expand [kirkstone,01/28] libtiff: CVE-2022-34526 A stack overflow was discovered [kirkstone,02/28] libxml2: Ignore CVE-2016-3709 [kirkstone,03/28] connman: Backports for security fixes [kirkstone,04/28] u-boot: fix CVE-2022-30552 [kirkstone,05/28] u-boot: fix CVE-2022-33967 [kirkstone,06/28] grub2: fix several CVEs [kirkstone,07/28] cve-check: Don't use f-strings [kirkstone,08/28] go: update v1.17.12 -> v1.17.13 [kirkstone,09/28] bluez5: update 5.64 -> 5.65 [kirkstone,10/28] libwpe: upgrade 1.12.0 -> 1.12.2 [kirkstone,11/28] ell: upgrade 0.49 -> 0.50 [kirkstone,12/28] iso-codes: upgrade 4.10.0 -> 4.11.0 [kirkstone,13/28] libcap: upgrade 2.63 -> 2.64 [kirkstone,14/28] libcap: upgrade 2.64 -> 2.65 [kirkstone,15/28] libwebp: upgrade 1.2.2 -> 1.2.3 [kirkstone,16/28] mobile-broadband-provider-info: upgrade 20220511 -> 20220725 [kirkstone,17/28] webkitgtk: upgrade 2.36.4 -> 2.36.5 [kirkstone,18/28] weston: upgrade 10.0.1 -> 10.0.2 [kirkstone,19/28] python3-pip: Fix RDEPENDS after the update [kirkstone,20/28] cracklib: Drop using register keyword [kirkstone,21/28] tcp-wrappers: Fix implicit-function-declaration warnings [kirkstone,22/28] libpam: use /run instead of /var/run in systemd tmpfiles [kirkstone,23/28] perf: Fix reproducibility issues with 5.19 onwards [kirkstone,24/28] archiver.bbclass: some recipes that uses the kernelsrc bbclass uses the shared so… [kirkstone,25/28] apt: fix nativesdk-apt build failure during the second time build [kirkstone,26/28] linux-yocto: prepend the the value with a space when append to KERNEL_EXTRA_ARGS [kirkstone,27/28] create-spdx: handle links to inaccessible locations [kirkstone,28/28] packagegroup-self-hosted: update for strace

Message ID

a2806f24b95dd8cb1e687655e202bd7e053d0ac7.1661293746.git.steve@sakoman.com

State

Accepted, archived

Commit

a2806f24b95dd8cb1e687655e202bd7e053d0ac7

Headers

From: Steve Sakoman <steve@sakoman.com>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][kirkstone 02/28] libxml2: Ignore CVE-2016-3709
Date: Tue, 23 Aug 2022 12:35:14 -1000
Message-Id: 
 <a2806f24b95dd8cb1e687655e202bd7e053d0ac7.1661293746.git.steve@sakoman.com>
In-Reply-To: <cover.1661293745.git.steve@sakoman.com>
References: <cover.1661293745.git.steve@sakoman.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[kirkstone,01/28] libtiff: CVE-2022-34526 A stack overflow was discovered | expand

Commit Message

Steve Sakoman Aug. 23, 2022, 10:35 p.m. UTC

From: Khem Raj <raj.khem@gmail.com>

This is fixed via a revert in 2.9.11 [1]

[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f

Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 131b7010ae45b0c4e1c6a29dfc56b225d2ad2a69)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-core/libxml/libxml2_2.9.14.bb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/meta/recipes-core/libxml/libxml2_2.9.14.bb b/meta/recipes-core/libxml/libxml2_2.9.14.bb
index 3081ebf92f..e58298d3b0 100644
--- a/meta/recipes-core/libxml/libxml2_2.9.14.bb
+++ b/meta/recipes-core/libxml/libxml2_2.9.14.bb
@@ -29,6 +29,10 @@  SRC_URI[testtar.sha256sum] = "96151685cec997e1f9f3387e3626d61e6284d4d6e66e0e440c
 
 BINCONFIG = "${bindir}/xml2-config"
 
+# Fixed since 2.9.11 via
+# https://gitlab.gnome.org/GNOME/libxml2/-/commit/c1ba6f54d32b707ca6d91cb3257ce9de82876b6f
+CVE_CHECK_IGNORE += "CVE-2016-3709"
+
 PACKAGECONFIG ??= "python \
     ${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)} \
 "

[kirkstone,02/28] libxml2: Ignore CVE-2016-3709

Commit Message

Patch