nss: Add missing CVE Product #642
Closed
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Mathieu Dubois-Briand <[email protected]>
These CVEs only affect libnssdbm, compiled when --enable-legacy-db is used. https://bugzilla.mozilla.org/show_bug.cgi?id=1360782#c6 https://bugzilla.mozilla.org/show_bug.cgi?id=1360778#c8 https://bugzilla.mozilla.org/show_bug.cgi?id=1360900#c6 https://bugzilla.mozilla.org/show_bug.cgi?id=1360779#c9 Signed-off-by: Mathieu Dubois-Briand <[email protected]>
Contributor
|
applied with 8e0432f |
kraj
pushed a commit
to YoeDistro/meta-openembedded
that referenced
this pull request
May 21, 2024
WirePlumber 0.5.2
~~~~~~~~~~~~~~~~~
Highlights:
- Added support for loading configuration files other than the default
wireplumber.conf within Lua scripts (!629)
- Added support for loading single-section configuration files, without
fragments (!629)
- Updated the node.software-dsp script to be able to load filter-chain graphs
from external configuration files, which is needed for Asahi Linux audio
DSP configuration (!629)
Fixes:
- Fixed destroying camera nodes when the camera device is removed (openembedded#627, !631)
- Fixed an issue with Bluetooth BAP device set naming (!632)
- Fixed an issue caused by the pipewire event loop not being "entered" as
expected (!634, openembedded#638)
- A false positive warning about no modules being loaded is now suppressed
when using libpipewire >= 1.0.5 (openembedded#620)
- Default nodes can now be selected using priority.driver when
priority.session is not set (openembedded#642)
Changes:
- The library version is now generated following pipewire's versioning scheme:
libwireplumber-0.5.so.0.5.2 becomes libwireplumber-0.5.so.0.0502.0 (!633)
Signed-off-by: Markus Volk <[email protected]>
Signed-off-by: Khem Raj <[email protected]>
kraj
pushed a commit
to YoeDistro/meta-openembedded
that referenced
this pull request
May 21, 2024
WirePlumber 0.5.2
~~~~~~~~~~~~~~~~~
Highlights:
- Added support for loading configuration files other than the default
wireplumber.conf within Lua scripts (!629)
- Added support for loading single-section configuration files, without
fragments (!629)
- Updated the node.software-dsp script to be able to load filter-chain graphs
from external configuration files, which is needed for Asahi Linux audio
DSP configuration (!629)
Fixes:
- Fixed destroying camera nodes when the camera device is removed (openembedded#627, !631)
- Fixed an issue with Bluetooth BAP device set naming (!632)
- Fixed an issue caused by the pipewire event loop not being "entered" as
expected (!634, openembedded#638)
- A false positive warning about no modules being loaded is now suppressed
when using libpipewire >= 1.0.5 (openembedded#620)
- Default nodes can now be selected using priority.driver when
priority.session is not set (openembedded#642)
Changes:
- The library version is now generated following pipewire's versioning scheme:
libwireplumber-0.5.so.0.5.2 becomes libwireplumber-0.5.so.0.0502.0 (!633)
Signed-off-by: Markus Volk <[email protected]>
Signed-off-by: Khem Raj <[email protected]>
kraj
pushed a commit
to YoeDistro/meta-openembedded
that referenced
this pull request
Dec 16, 2024
- Refresh patches
Version 1.82.1
--------------
- Closed bugs and merge requests:
* gnome-shell crash when switching user after upgrade from Fedora 40 to Fedora
41 [openembedded#647, !955, Philip Chimento]
Version 1.82.0
--------------
- Closed bugs and merge requests:
* installed tests are failing because they can't load internal typelibs from
parent directory [openembedded#639, !953, Simon McVittie]
* GIMarshalling test has 3 failures with 1.81.90 on i686 [openembedded#642, !954, Philip
Chimento]
Version 1.81.90
---------------
- Closed bugs and merge requests:
* callbacks: fix sweeping check for incremental GC [!859, !950, Evan Welsh,
Gary Li]
* GJS doesn't handle query parameters in imports [openembedded#618, !944, Gary Li]
* Integrate gobject-introspection-tests as submodule [!946, Philip Chimento]
* module: Include full module specifier in import.meta.url [!947, Philip
Chimento]
* doap: Remove invalid maintainer entry [!948, Sophie Herold]
* installed tests have the wrong libexecdir [openembedded#636, !949, Jeremy Bicha]
* Inheriting final class crashes GJS [openembedded#640, !951, Gary Li]
* Various maintenance [!952, Philip Chimento]
Version 1.81.2
--------------
- New JavaScript features! This version of GJS is based on SpiderMonkey 128, an
upgrade from the previous ESR (Extended Support Release) of SpiderMonkey 115.
Here are the highlights of the new JavaScript features.
For more information, look them up on MDN or devdocs.io.
* New APIs
+ The new `Object.groupBy()` and `Map.groupBy()` static methods group the
elements of an iterable according to the return value of a key function.
+ The new `Promise.withResolvers()` static method returns a Promise as well
as its resolve and reject functions, shorthand for a common pattern used
when promisifying event-based APIs.
+ Strings have gained the `isWellFormed()` and `toWellFormed()` methods
which help when interoperating with strings that may have unpaired
Unicode surrogates. This usually does not come up in the GNOME platform.
+ ArrayBuffers have gained the `transfer()` and `transferToFixedLength()`
methods, which transfer ownership of a data buffer to a new ArrayBuffer
object, without copying it, and invalidating ("detaching") any existing
references to the buffer. There is also a new property, `detached`, which
allows checking whether an ArrayBuffer is in the detached state.
+ The new `Intl.Segmenter` class allows splitting a string into graphemes,
words, or sentences, in a locale-aware way.
+ `Intl.NumberFormat` has gained `formatRange()` and `formatRangeToParts()`
methods, which allow formatting number ranges, like "3–5".
+ `Intl.PluralRules` has gained a `selectRange()` method, which allows
selecting the proper plural form based on a range of numbers, like
"30–50 feral hogs".
* New behaviour
+ The `Intl.NumberFormat` and `Intl.PluralRules` constructors support new
options: `roundingIncrement`, `roundingMode`, `roundingPriority`, and
`trailingZeroDisplay`.
+ The `Intl.NumberFormat` constructor also supports the new option
`useGrouping`.
* Backwards-incompatible changes
+ The behaviour of `Date.parse()` has been changed to be more consistent
with other JavaScript engines. (But don't use `Date.parse()`.)
- Closed bugs and merge requests:
* Invalid search paths cause failed assertions when printing imports.gi
[openembedded#629, !935, Gary Li]
* SpiderMonkey 128 [openembedded#630, !936, !945, Philip Chimento]
* Pretty-printing byte array in gjs-console throws a type conversion
error [openembedded#434, !937, Gary Li]
* js: Add gjs_debug_callable() debug function [!940, Philip Chimento]
* build: Build Cairo from subproject if not found [!941, Philip
Chimento]
* Bump CI image to Fedora 40 [!942, Philip Chimento]
* CI tools updates [!943, Philip Chimento]
Version 1.81.1
--------------
- Breaking change: When creating a GObject with the `new` operator, the
constructor takes a single argument consisting of a property bag with
GObject construct properties and their values.
This was often confused with the `new` static method that may take
arguments that are not interpreted as property bags.
For example, Gio.FileIcon was one of the many affected APIs:
new Gio.FileIcon({file: myFile})
vs
Gio.FileIcon.new(myFile)
Confusion between the two often lead to bug reports when confusing
these two and calling `new Gio.FileIcon(myFile)` - the constructor
would look for a nonexistent `file` property on `myFile`, causing an
improperly initialized object.
This is now no longer allowed. The argument to `new Gio.FileIcon(...)`
must be a plain JS object, not a GObject.
It's possible that existing code legitimately used a GObject here. If
your code does this and a quick migration is impractical, please get
in touch and we will revert this change before 1.82.0 in favour of a
longer deprecation period.
- The `get_data()`, `get_qdata()`, `set_data()`, `steal_data()`,
`steal_qdata()`, `ref()`, `unref()`, `ref_sink()`, and
`force_floating()` methods of GObject now throw if called.
These methods never worked, but sometimes they would silently appear
to succeed, then cause crashes or memory leaks later.
If you were trying to use the `get_data()` family of methods, just set
a JS property instead. If you were trying to modify the refcount of a
GObject in JS, instead set the object as the value of a JS property on
some other object.
- Closed bugs and merge requests:
* doc: Document how to get a stack trace [!864, Sonny Piers]
* TextDecoder should accept GBytes [openembedded#587, !903, Sriyansh Shivam]
* Possible use-after-free with GLib.Regex.match/GLib.MatchInfo [openembedded#589,
!920, Philip Chimento]
* method `get_line` of `Pango.Layout` doesn't work. [openembedded#547, !921,
Philip Chimento]
* Block calls to g_object_get_data and friends [openembedded#423, !922, Philip
Chimento]
* Crash when calling Pango.Layout.get_pixel_size() with a badly
init:ed Pango.Layout [openembedded#580, !923, Philip Chimento]
* doc: avoid reference to Gio.UnixInputStream [!925, Andy Holmes]
* Add a CI check for config.h, and some other useful checks [openembedded#447,
!926, Philip Chimento]
* Incorrect UnixOutputStream warning [openembedded#610, !928, Philip Chimento]
* Various maintenance [!929, !931, Philip Chimento]
* Docs: Various markdown fixes [!930, Frank Dana]
* Some build fixes for the main (and gnome-46) branches for Visual
Studio [!932, Chun-wei Fan]
* GJS doesn't log undefined values [openembedded#621, !933, Gary Li]
* property objects are printed as empty js objects [openembedded#622, !934, Gary
Li]
Signed-off-by: Markus Volk <[email protected]>
Signed-off-by: Khem Raj <[email protected]>
kraj
pushed a commit
to YoeDistro/meta-openembedded
that referenced
this pull request
Jul 7, 2025
Includes fix for CVE-2025-52886 poppler 25.06.0 changelog: ========================== core: * Fix writing dates back to file * Internal code improvements * Fix crashes in malformed documents glib: * Add the ink annotation type * Add missing autopointers definitions utils: * pdfsig: Add assert-signer feature * pdfsig: Return error code on error poppler 25.05.0 changelog: ========================== core: * Fix re-fetching after xref reconstruction. Issue #1584 * Fix compilation with ENABLE_ZLIB_UNCOMPRESS=ON * Various annotation improvements. Issues openembedded#642, #1558, #1055 * CairoFontEngine: invalidate broken embedded fonts. Issue #1453 * Splash: Performance improvements * Internal code improvements glib: * Small signature improvements Signed-off-by: Yogita Urade <[email protected]> Signed-off-by: Khem Raj <[email protected]>
halstead
pushed a commit
that referenced
this pull request
Jul 27, 2025
Includes fix for CVE-2025-52886 poppler 25.06.0 changelog: ========================== core: * Fix writing dates back to file * Internal code improvements * Fix crashes in malformed documents glib: * Add the ink annotation type * Add missing autopointers definitions utils: * pdfsig: Add assert-signer feature * pdfsig: Return error code on error poppler 25.05.0 changelog: ========================== core: * Fix re-fetching after xref reconstruction. Issue #1584 * Fix compilation with ENABLE_ZLIB_UNCOMPRESS=ON * Various annotation improvements. Issues #642, #1558, #1055 * CairoFontEngine: invalidate broken embedded fonts. Issue #1453 * Splash: Performance improvements * Internal code improvements glib: * Small signature improvements Signed-off-by: Yogita Urade <[email protected]> Signed-off-by: Armin Kuster <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.