Security Survey 20221017

[CamberLoid]

Topic Description

The topic includes a series of security updates. See issues mentioned below to see details.

As the PR is created, the version of packages will be frozen unless major vulnerabilities were disclosed.

Package(s) Affected

Core

• zlib: Apply patch
• aosc-aaa: Bump version

Non-core

Priority

• openssl{,+32}: 1.1.1q
• python-{2,3}: Patch + Update 3.10.8
• git
• curl
• libxml2{,+32}: 2.9.12 -> 2.10.3
• bind: 9.16.21 -> 9.16.33
• dhcp: 4.4.1 -> 4.4.3.P1

Non-priority

• cups: 2.4.0 -> 2.4.2
• squid: 5.5 -> 5.7
• kitty: 0.24.2 -> 0.26.4
• openjpeg: 2.3.1 -> 2.5.0
• chromium
• google-chrome
• poppler : REL Bump
• xz: 5.2.5 -> 5.2.7
• expat: 2.4.6 -> 2.5.0
• vim:
• unzip (Downgrade)
• xterm: 351 -> 375
• (New) libilbc
• (New) bcg729
• wireshark -> 4.0.0
• ntfs-3g: 2022.5.17 -> 2022.10.3
• rpm: 4.17.0 -> 4.18.0
• libksba: 1.3.5 -> 1.6.2
• open-vm-tools: 11.3.0 -> 12.1.0
• libtiff: 4.0.10 -> 4.4.0
• freerdp: 2.7.0 -> 2.8.1
• lighttpd: Patch to fix cve
• nokogiri: 1.13.3 -> 1.13.9
• opensc: 0.20.0 -> 0.22.0
• libgcrypt: 1.9.1 -> 1.9.4
• mariadb: 10.9.4
• virglrenderer: 0.10.3
• sqlite: 3.39.4
• xmlsec (as the update of libxml2): 1.2.36
• fcgi: as dependency of lighttpd

Not an upgrade, but need to rebuild

• cryptography: new for riscv64
• gettext: Build for arm64 and loongson3. dependency of po4a, which is in xz's dependency graph.

Security Update?

Yes. TBA

Build Order

• Core: zlib aosc-aaa
• Priority: openssl python-{2,3} git curl libxml2 bind dhcp autobuild3
• Others
  • common: cups squid kitty openjpeg poppler xz expat vim unzip xterm libilbc bcg729 ntfs-3g rpm libksba libtiff freerdp fcgi lighttpd nokogiri opensc libgcrypt mariadb virglrenderer sqlite xmlsec
  • AMD64: $common open-vm-tools google-chrome chromium
  • ARM64: gettext $common chromium
  • RISCV64: cryptography $common
  • LOONGSON3: gettext $common

Test Build(s) Done

Primary Architectures

• AMD64 amd64
• AArch64 arm64
• 32-bit Optional Environment optenv32

Secondary Architectures

Architectural progress for "secondary," or experimental ports does not impede on merging of this topic.

• Loongson 3 loongson3
• RISC-V 64-bit riscv64

Update(s) Uploaded to Stable

Primary Architectures

• AMD64 amd64
• AArch64 arm64
• 32-bit Optional Environment optenv32

Secondary Architectures

Architectural progress for "secondary," or experimental ports does not impede on merging of this topic.

• Loongson 3 loongson3
• RISC-V 64-bit riscv64