7 files changed, 39 insertions, 73 deletions
diff --git a/meta-openembedded/meta-oe/recipes-extended/icewm/icewm_2.6.0.bb b/meta-openembedded/meta-oe/recipes-extended/icewm/icewm_2.7.0.bb
index d73655217..a16dbd414 100644
--- a/meta-openembedded/meta-oe/recipes-extended/icewm/icewm_2.6.0.bb
+++ b/meta-openembedded/meta-oe/recipes-extended/icewm/icewm_2.7.0.bb
@@ -5,7 +5,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=4a26952467ef79a7efca4a9cf52d417b"
 SRC_URI = "https://github.com/ice-wm/${BPN}/releases/download/${PV}/${BPN}-${PV}.tar.lz \
            file://0001-configure.ac-skip-running-test-program-when-cross-co.patch \
            "
-SRC_URI[sha256sum] = "33cc69ba1fb762d85cc2755a930d6cf1a7c23e33f736ef2ec01c59d612f9b2eb"
+SRC_URI[sha256sum] = "c56b1d0f5d8efa2af3e38003770eab9165289aa87bd8f1627819c7f93f9433a3"
 
 UPSTREAM_CHECK_URI = "https://github.com/ice-wm/${BPN}/releases"
 
diff --git a/meta-openembedded/meta-oe/recipes-extended/libnss-nisplus/libnss-nisplus.bb b/meta-openembedded/meta-oe/recipes-extended/libnss-nisplus/libnss-nisplus.bb
deleted file mode 100644
index 602e96375..000000000
--- a/meta-openembedded/meta-oe/recipes-extended/libnss-nisplus/libnss-nisplus.bb
+++ /dev/null
@@ -1,31 +0,0 @@
-# Copyright (C) 2019 Ruslan Bilovol <rbilovol@cisco.com>
-# Released under the MIT license (see COPYING.MIT for the terms)
-
-SUMMARY = "NSS module for glibc, to provide NIS+ support for glibc"
-
-DESCRIPTION = "This package contains the NSS NIS+ plugin for glibc.\
-This code was formerly part of glibc, but is now standalone to\
-be able to link against TI-RPC for IPv6 support."
-
-HOMEPAGE = "https://github.com/thkukuk/libnss_nisplus"
-LICENSE = "LGPL-2.1"
-LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"
-SECTION = "libs"
-DEPENDS += "libtirpc libnsl2"
-
-PV = "1.3+git${SRCPV}"
-
-SRCREV = "116219e215858f4af9370171d3ead63baca8fdb4"
-
-SRC_URI = "git://github.com/thkukuk/libnss_nisplus \
-          "
-
-S = "${WORKDIR}/git"
-
-inherit autotools pkgconfig
-
-BBCLASSEXTEND += "native nativesdk"
-#
-# We will skip parsing this packagegeoup for non-glibc systems
-#
-COMPATIBLE_HOST:libc-musl = 'null'
diff --git a/meta-openembedded/meta-oe/recipes-extended/polkit/polkit/CVE-2021-3560.patch b/meta-openembedded/meta-oe/recipes-extended/polkit/polkit/CVE-2021-3560.patch
new file mode 100644
index 000000000..daf0b1edb
--- /dev/null
+++ b/meta-openembedded/meta-oe/recipes-extended/polkit/polkit/CVE-2021-3560.patch
@@ -0,0 +1,31 @@
+From a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81 Mon Sep 17 00:00:00 2001
+From: Jan Rybar <jrybar@redhat.com>
+Date: Wed, 2 Jun 2021 15:43:38 +0200
+Subject: [PATCH] GHSL-2021-074: authentication bypass vulnerability in polkit
+
+initial values returned if error caught
+
+Upstream-Status: Backport [https://gitlab.freedesktop.org/polkit/polkit/-/commit/a04d13affe0fa53ff618e07aa8f57f4c0e3b9b81]
+
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
+---
+ src/polkit/polkitsystembusname.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/polkit/polkitsystembusname.c b/src/polkit/polkitsystembusname.c
+index 8daa12c..8ed1363 100644
+--- a/src/polkit/polkitsystembusname.c
++++ b/src/polkit/polkitsystembusname.c
+@@ -435,6 +435,9 @@ polkit_system_bus_name_get_creds_sync (PolkitSystemBusName           *system_bus
+   while (!((data.retrieved_uid && data.retrieved_pid) || data.caught_error))
+     g_main_context_iteration (tmp_context, TRUE);
+ 
++  if (data.caught_error)
++    goto out;
++
+   if (out_uid)
+     *out_uid = data.uid;
+   if (out_pid)
+-- 
+2.29.2
+
diff --git a/meta-openembedded/meta-oe/recipes-extended/polkit/polkit_0.116.bb b/meta-openembedded/meta-oe/recipes-extended/polkit/polkit_0.116.bb
index 55d11a651..6408933ea 100644
--- a/meta-openembedded/meta-oe/recipes-extended/polkit/polkit_0.116.bb
+++ b/meta-openembedded/meta-oe/recipes-extended/polkit/polkit_0.116.bb
@@ -25,6 +25,7 @@ PAM_SRC_URI = "file://polkit-1_pam.patch"
 SRC_URI = "http://www.freedesktop.org/software/polkit/releases/polkit-${PV}.tar.gz \
            ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \
            file://0003-make-netgroup-support-optional.patch \
+           file://CVE-2021-3560.patch \
            "
 SRC_URI[md5sum] = "4b37258583393e83069a0e2e89c0162a"
 SRC_URI[sha256sum] = "88170c9e711e8db305a12fdb8234fac5706c61969b94e084d0f117d8ec5d34b1"
diff --git a/meta-openembedded/meta-oe/recipes-extended/sedutil/files/0001-DtaAnnotatedDump-Add-typedef-name-to-the-union.patch b/meta-openembedded/meta-oe/recipes-extended/sedutil/files/0001-DtaAnnotatedDump-Add-typedef-name-to-the-union.patch
deleted file mode 100644
index 4be3353c6..000000000
--- a/meta-openembedded/meta-oe/recipes-extended/sedutil/files/0001-DtaAnnotatedDump-Add-typedef-name-to-the-union.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 9db49b94336f65453e06fb6a6bc4e6edf9403fea Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Mon, 17 Aug 2020 17:22:09 -0700
-Subject: [PATCH] DtaAnnotatedDump: Add typedef name to the union
-
-This is found with clang
-error: anonymous non-C-compatible type given name for linkage purposes by
-typedef declaration; add a tag name here [-Werror,-Wnon-c-typedef-for-linkage]
-| typedef union
-|              ^
-|               CAtomHeader
-
-Upstream-Status: Submitted [https://github.com/Drive-Trust-Alliance/sedutil/pull/332]
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
- Common/DtaAnnotatedDump.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Common/DtaAnnotatedDump.h b/Common/DtaAnnotatedDump.h
-index 2749365..734c8eb 100644
---- a/Common/DtaAnnotatedDump.h
-+++ b/Common/DtaAnnotatedDump.h
-@@ -20,7 +20,7 @@ along with sedutil.  If not, see <http://www.gnu.org/licenses/>.
- 
- #pragma pack(push,1)
- 
--typedef union
-+typedef union CAtomHeader_t
- {
-     // four bytes in big endian (network) byte order
-     uint8_t     all[4];
--- 
-2.28.0
-
diff --git a/meta-openembedded/meta-oe/recipes-extended/sedutil/sedutil_git.bb b/meta-openembedded/meta-oe/recipes-extended/sedutil/sedutil_git.bb
index 1e7a39319..99e358648 100644
--- a/meta-openembedded/meta-oe/recipes-extended/sedutil/sedutil_git.bb
+++ b/meta-openembedded/meta-oe/recipes-extended/sedutil/sedutil_git.bb
@@ -8,12 +8,11 @@ LICENSE = "GPLv3"
 LIC_FILES_CHKSUM = "file://Common/LICENSE.txt;md5=d32239bcb673463ab874e80d47fae504"
 
 BASEPV = "1.15.1"
-PV = "${BASEPV}+git${SRCPV}"
-SRCREV = "358cc758948be788284d5faba46ccf4cc1813796"
+PV = "1.20.0"
+SRCREV = "d3de8e45e06a21d31cca0046ceb16ced1ef3563a"
 SRC_URI = "git://github.com/Drive-Trust-Alliance/sedutil.git \
-	file://0001-Fix-build-on-big-endian-architectures.patch \
-        file://0001-DtaAnnotatedDump-Add-typedef-name-to-the-union.patch \
-"
+           file://0001-Fix-build-on-big-endian-architectures.patch \
+           "
 
 S = "${WORKDIR}/git"
 
diff --git a/meta-openembedded/meta-oe/recipes-extended/socketcan/can-utils_git.bb b/meta-openembedded/meta-oe/recipes-extended/socketcan/can-utils_git.bb
index ad7fc596e..8d63a10e5 100644
--- a/meta-openembedded/meta-oe/recipes-extended/socketcan/can-utils_git.bb
+++ b/meta-openembedded/meta-oe/recipes-extended/socketcan/can-utils_git.bb
@@ -6,9 +6,9 @@ DEPENDS = "libsocketcan"
 
 SRC_URI = "git://github.com/linux-can/${BPN}.git;protocol=git"
 
-SRCREV = "e9dd86fa5c4e6ecdfc34e487634a32f19e5c4d63"
+SRCREV = "3615bac17e539a06835dcb90855eae844ee18053"
 
-PV = "2021.06.0"
+PV = "2021.08.0"
 
 S = "${WORKDIR}/git"