Notes for BIND 9.11.33 This maintenance release of BIND 9.11 contains no significant changes, although some minor updates have been made (for example, to eliminate compiler warnings emitted by GCC

From: Ranjitsinh Rathod <ranjitsinh.rathod@...> It seems like CVE-2021-33928, CVE-2021-33929, CVE-2021-33930 and CVE-2021-33938 are pointing to same patch as CVE-2021-3200 So add CVE tag inside

From: Ranjitsinh Rathod <ranjitsinh.rathod@...> Add patch to fix CVE-2021-39537 Link:

From: Ross Burton <ross@...> Backport a fix for -3972, and whitelist -3968: it isn't valid as it fixes a bug which was introduced after 8.2. Signed-off-by: Ross Burton

From: Pavel Zhukov <pavel.zhukov@...> A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a

From: Neetika Singh <Neetika.Singh@...> Add patches for below CVE issues: CVE-2021-27218 CVE-2021-27219 CVE-2021-28153 Link:

From: Pavel Zhukov <pavel.zhukov@...> An out-of-bounds heap read in unlzma leads to information leak and denial of service when crafted LZMA-compressed input is decompressed. This can be

Since Oracle relicensed bdb, the open source community is slowly but surely replacing bdb with supported and open source friendly alternatives. As a result these CVEs are unlikely to ever be

Please review this set of patches for dunfell and have comments back by end of day Tuesday. Passed a-full on autobuilder: https://autobuilder.yoctoproject.org/typhoon/#/builders/83/builds/2988 with

<peter.kjellerstedt@...> wrote: Using = would certainly be OK and an improvement over the current mess. The reason I'd still argue that ?= is better is that it gives a clear hint that

<richard.purdie@...> wrote: What are the possible objections? I agree ??= is way overused and very often in places where ?= or a direct assignment would be better. I'm not the one

Signed-off-by: Ross Burton <ross.burton@...> --- meta/recipes-graphics/xorg-lib/libxkbcommon_1.3.1.bb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git

Enable by default, now that libraries are split into separate packages this won't cause a change to existing setups. Signed-off-by: Ross Burton <ross.burton@...> ---

The sublibraries, such as libxkbcommon-x11, have specific linkage, so to avoid link creep they can be put into separate packages. Signed-off-by: Ross Burton <ross.burton@...> ---

Not everyone wants the CLI, so put it in a separate package to reduce mandatory dependencies. Signed-off-by: Ross Burton <ross.burton@...> ---

This is a hang-over from the autotools build system. Signed-off-by: Ross Burton <ross.burton@...> --- meta/recipes-graphics/xorg-lib/libxkbcommon_1.3.1.bb | 2 +- 1 file changed, 1 insertion(+),

This patch has now been merged upstream. Signed-off-by: Ross Burton <ross.burton@...> --- .../libx11/Fix-hanging-issue-in-_XReply.patch | 13 ++----------- 1 file changed, 2 insertions(+),

Please merge these changes. Thanks, Anuj The following changes since commit e95ccf6f7fe5a42fffcfa5e43087ff964622e26c: squashfs-tools: fix CVE-2021-41072 (2021-11-22 09:45:46 +0800) are

Signed-off-by: Ross Burton <ross.burton@...> --- .../glew/glew/0001-Fix-build-race-in-Makefile.patch | 2 +- meta/recipes-graphics/glew/glew/no-strip.patch | 2 +-