diff --git a/poky/meta/recipes-extended/acpica/acpica_20190509.bb b/poky/meta/recipes-extended/acpica/acpica_20190816.bb
similarity index 90%
rename from poky/meta/recipes-extended/acpica/acpica_20190509.bb
rename to poky/meta/recipes-extended/acpica/acpica_20190816.bb
index cf6db33..8f79974 100644
--- a/poky/meta/recipes-extended/acpica/acpica_20190509.bb
+++ b/poky/meta/recipes-extended/acpica/acpica_20190816.bb
@@ -17,8 +17,8 @@
 DEPENDS = "bison flex bison-native"
 
 SRC_URI = "https://acpica.org/sites/acpica/files/acpica-unix2-${PV}.tar.gz"
-SRC_URI[md5sum] = "dd1f8240f924b12b0a0de0c31ab26ab1"
-SRC_URI[sha256sum] = "860b5f94a0590b278592acf16a4556b05ff0309c08e8c48aa29827cfa02c8e9d"
+SRC_URI[md5sum] = "6a73b1e34715916fa31132dbe11008b0"
+SRC_URI[sha256sum] = "888e80f3bb77381620a5ead208e1a1be06f3ea66ddc8cfdfa62811cae5f03752"
 UPSTREAM_CHECK_URI = "https://acpica.org/downloads"
 
 S = "${WORKDIR}/acpica-unix2-${PV}"
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch
new file mode 100644
index 0000000..3f28555
--- /dev/null
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14811-0001.patch
@@ -0,0 +1,68 @@
+From 885444fcbe10dc42787ecb76686c8ee4dd33bf33 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Tue, 20 Aug 2019 10:10:28 +0100
+Subject: [PATCH] make .forceput inaccessible
+
+Bug #701343, #701344, #701345
+
+More defensive programming. We don't want people to access .forecput
+even though it is no longer sufficient to bypass SAFER. The exploit
+in #701343 didn't work anyway because of earlier work to stop the error
+handler being used, but nevertheless, prevent access to .forceput from
+.setuserparams2.
+
+CVE: CVE-2019-14811
+Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
+
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ Resource/Init/gs_lev2.ps  | 6 +++---
+ Resource/Init/gs_pdfwr.ps | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/Resource/Init/gs_lev2.ps b/Resource/Init/gs_lev2.ps
+index 98d55fe..f1b771f 100644
+--- a/Resource/Init/gs_lev2.ps
++++ b/Resource/Init/gs_lev2.ps
+@@ -158,7 +158,7 @@ end
+     {
+       pop pop
+     } ifelse
+-  } forall
++  } executeonly forall
+         % A context switch might have occurred during the above loop,
+         % causing the interpreter-level parameters to be reset.
+         % Set them again to the new values.  From here on, we are safe,
+@@ -229,9 +229,9 @@ end
+        { pop pop
+        }
+       ifelse
+-    }
++    } executeonly
+    forall pop
+-} .bind odef
++} .bind executeonly odef
+ 
+ % Initialize the passwords.
+ % NOTE: the names StartJobPassword and SystemParamsPassword are known to
+diff --git a/Resource/Init/gs_pdfwr.ps b/Resource/Init/gs_pdfwr.ps
+index 00c19fa..dfe504d 100644
+--- a/Resource/Init/gs_pdfwr.ps
++++ b/Resource/Init/gs_pdfwr.ps
+@@ -652,11 +652,11 @@ currentdict /.pdfmarkparams .undef
+           systemdict /.pdf_hooked_DSC_Creator //true .forceput
+         } executeonly if
+         pop
+-      } if
++      } executeonly if
+     } {
+       pop
+     } ifelse
+-  }
++  } executeonly
+   {
+     pop
+   } ifelse
+-- 
+2.20.1
+
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0001.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0001.patch
new file mode 100644
index 0000000..c76e21c
--- /dev/null
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0001.patch
@@ -0,0 +1,270 @@
+From 0bafbd9c1273fab0dc79fd20db0ffc4443683f96 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Mon, 29 Apr 2019 11:14:06 +0100
+Subject: [PATCH 1/2] PDF interpreter - Decode ToUnicode entries of the form
+ /Identity-H/V
+
+Bug #701003 "Text searchability broken due to omission of /ToUnicode /Identity-H"
+
+The PDF references from 1.2 too 2.0 all state that the value associated
+with a ToUnicode key in a FontDescriptor must be a stream object. However
+this file (and one case seen previously, bug 687351) have FontDescriptor
+dictionaries where the value associated with a /ToUnicode key is a
+name object, in both cases /Identity-H.
+
+Although this is clearly not legal, Acrobat not only tolerates it, it
+actually uses it for search/copy/paste (see bug 701003 for details).
+Without the key Acrobat is unable to successfully search the output file.
+
+We can't simply preserve the name object as a ToUnicode value; when
+handling ToUnicode we actually decode the CMap and build a
+GlyphNames2Unicode map (an internal representation of the G2U data
+produced by the Microsoft PostScript printer driver). When writing the
+output file we use that information to get a Unicode value for each
+character we write, and build a new ToUnicode CMap using that.
+
+This commit tackles the problem by pre-scanning for a name object and
+then checking to see if its Identity-H or Identity-V (although we have
+not seen an Identity-V, there seems no reason why it wouldn't be
+equally valid). If we find either of these then we construct a
+GlyphNames2Unicode table for all possible values (0 - 65535) and store
+that with the font as normal. When we write the output file we only
+write the required entries for the subset font, so we write a now
+completely legal ToUnicode CMap, and Acrobat is equally happy with that
+as the original name.
+
+If the ToUnicode value isn't a name object, or isn't one of the
+identities then we proceed as before. This means we will print a
+warning for non conforming ToUnicode entries and ignore them.
+
+CVE: CVE-2019-14817
+Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
+
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ Resource/Init/pdf_font.ps | 200 ++++++++++++++++++++++++--------------
+ 1 file changed, 129 insertions(+), 71 deletions(-)
+
+diff --git a/Resource/Init/pdf_font.ps b/Resource/Init/pdf_font.ps
+index 9fb85f6..2df3303 100644
+--- a/Resource/Init/pdf_font.ps
++++ b/Resource/Init/pdf_font.ps
+@@ -621,86 +621,144 @@ currentdict end readonly def
+         PDFDEBUG {
+           (.processToUnicode beg) =
+         } if
+-        2 index /ToUnicode knownoget {
+-          dup type /dicttype eq { dup /File known not } { //true } ifelse {
+-            % We undefine wrong /Length and define /File in stream dictionaries.
+-            % Bug687351.pdf defines /ToUnicode /Identity-H, what is incorrect.
+-            (   **** Warning: Ignoring bad ToUnicode CMap.\n)  pdfformatwarning
+-            pop
++
++        2 index /ToUnicode knownoget
++        {
++            dup type /nametype eq {
++              % This is contrary to the specification but it seems that Acrobat at least will accept
++              % a ToUnicode with a value of Identity-H *and* will use that for search, copy/paste.
++              % We can't pass through a name, so the best we can do is build a GlyphNames2Unicode
++              % map matching that which would have been generated by a full 16-bit Identity CMap
++              %
++              % See bug numbers 701003 and 687351
++              %
++              dup /Identity-H eq 1 index /Identity-V eq or{
++                pop
++                1 index /FontInfo .knownget not {
++                  currentglobal 2 index dup gcheck setglobal
++                  /FontInfo 5 dict dup 5 1 roll .forceput
++                  setglobal
++                } if
++                dup /GlyphNames2Unicode .knownget not {
++                  //true                        % No existing G2U, make one
++                } {
++                  dup wcheck {
++                    //false                     % Existing, writeable G2U, don't make new one
++                  } {
++                    pop //true                          % Existing read only G2U, make new one
++                  } ifelse
++                } ifelse
++                {
++                  currentglobal exch dup gcheck setglobal
++                  dup /GlyphNames2Unicode 100 dict dup 4 1 roll .forceput
++                  3 2 roll setglobal
++                } if                                 % font-res font-dict encoding|null font-info g2u
++
++                0 1 65535{
++                                                        % g2u index
++                  dup dup 256 mod exch 256 idiv         % g2u index lo-byte hi-byte
++                  2 string dup 0 4 -1 roll              % g2u index lo-byte () () 0 hi-byte
++                  put                                   % g2u index lo-byte (x)
++                  dup 1                                 % g2u index lo-byte (x) (x) 1
++                  4 -1 roll put                         % g2u index (x) (x) 1 lo-byte -> dict index (xx)
++                  2 index                               % g2u index (xx) dict
++                  3 1 roll                              % g2u g2u index (xx)
++                  put                                   % g2u
++                } for
++                pop                                     % font-res font-dict encoding|null font-info
++                pop                                     % font-res font-dict encoding|null
++                //false                                 % We built a GlyphNames2Unicode table, don't need to process further
++              }{
++                //true                                  % name is not Identity-V or H, fail by falling through
++              }ifelse
+           } {
+-            /PDFScanRules .getuserparam dup //null eq {
+-              pop //PDFScanRules_null
+-            } {
+-              1 dict dup /PDFScanRules 4 -1 roll put
+-            } ifelse
+-            //PDFScanRules_true setuserparams
+-            PDFfile fileposition
+-            3 -1 roll
+-            count 1 sub
+-            countdictstack
+-            { //false resolvestream
+-              % Following Acrobat we ignore everything outside
+-              %   begincodespacerange .. endcmap.
+-              dup 0 (begincodespacerange) /SubFileDecode filter flushfile
+-              /CIDInit /ProcSet findresource begin
+-              //ToUnicodeCMapReader begin
+-              12 dict begin
+-              /CMapType 2 def
+-              mark exch % emulate 'begincodespacerange'
+-              0 (endcmap) /SubFileDecode filter cvx /begincmap cvx exch 2 .execn
+-              endcmap
+-              userdict /.lastToUnicode currentdict put
+-              end end end
+-            }
++            //true
++          } ifelse                                      % not a name, try as a dictionary (as specified)
+ 
+-            PDFSTOPONERROR {
+-              { exec } 0 get
+-              //false
+-              5 -2 roll
+-              5
++          % If the ToUnicode isn't a name, or the name isn't Identity-V or -H then follow the specification
++          % If its not a dictionary type throw an error, otherwise decode it and build a GlyphNames2Unicode
++          %
++          {
++            dup type /dicttype eq { dup /File known not } { //true } ifelse {
++              % We undefine wrong /Length and define /File in stream dictionaries.
++              % Bug687351.pdf defines /ToUnicode /Identity-H, what is incorrect.
++              (   **** Warning: Ignoring bad ToUnicode CMap.\n)  pdfformatwarning
++              pop
+             } {
+-              { stopped } 0 get
+-              4 2 roll
+-              4
+-            } ifelse
+-            array astore cvx exec
++              /PDFScanRules .getuserparam dup //null eq {
++                pop //PDFScanRules_null
++              } {
++                1 dict dup /PDFScanRules 4 -1 roll put
++              } ifelse
++              //PDFScanRules_true setuserparams
++              PDFfile fileposition
++              3 -1 roll
++              count 1 sub
++              countdictstack
++              { //false resolvestream
++                % Following Acrobat we ignore everything outside
++                %   begincodespacerange .. endcmap.
++                dup 0 (begincodespacerange) /SubFileDecode filter flushfile
++                /CIDInit /ProcSet findresource begin
++                //ToUnicodeCMapReader begin
++                12 dict begin
++                /CMapType 2 def
++                mark exch % emulate 'begincodespacerange'
++                0 (endcmap) /SubFileDecode filter cvx /begincmap cvx exch 2 .execn
++                endcmap
++                userdict /.lastToUnicode currentdict put
++                end end end
++              }
+ 
+-            countdictstack exch sub 0 .max { end } repeat
+-            count exch sub 2 sub 0 .max { exch pop } repeat
+-            3 1 roll                     % Stach the stop flag.
+-            PDFfile exch setfileposition
+-            setuserparams
+-            {
+-              (   **** Warning: Failed to read ToUnicode CMap.\n)  pdfformatwarning
+-            } {
+-              1 index /FontInfo .knownget not {
+-                currentglobal 2 index dup gcheck setglobal
+-                /FontInfo 5 dict dup 5 1 roll .forceput
+-                setglobal
+-              } if
+-              dup /GlyphNames2Unicode .knownget not {
+-                //true                        % No existing G2U, make one
++              PDFSTOPONERROR {
++                { exec } 0 get
++                //false
++                5 -2 roll
++                5
++              } {
++                { stopped } 0 get
++                4 2 roll
++                4
++              } ifelse
++              array astore cvx exec
++
++              countdictstack exch sub 0 .max { end } repeat
++              count exch sub 2 sub 0 .max { exch pop } repeat
++              3 1 roll                     % Stach the stop flag.
++              PDFfile exch setfileposition
++              setuserparams
++              {
++                (   **** Warning: Failed to read ToUnicode CMap.\n)  pdfformatwarning
+               } {
+-                dup wcheck {
+-                  //false                     % Existing, writeable G2U, don't make new one
++                1 index /FontInfo .knownget not {
++                  currentglobal 2 index dup gcheck setglobal
++                  /FontInfo 5 dict dup 5 1 roll .forceput
++                  setglobal
++                } if
++                dup /GlyphNames2Unicode .knownget not {
++                  //true                        % No existing G2U, make one
+                 } {
+-                  pop //true                          % Existing read only G2U, make new one
++                  dup wcheck {
++                    //false                     % Existing, writeable G2U, don't make new one
++                  } {
++                    pop //true                          % Existing read only G2U, make new one
++                  } ifelse
+                 } ifelse
++                {
++                  currentglobal exch dup gcheck setglobal
++                  dup /GlyphNames2Unicode 100 dict dup 4 1 roll .forceput
++                  3 2 roll setglobal
++                } if                                 % font-res font-dict encoding|null font-info g2u
++                exch pop exch                        % font-res font-dict g2u encoding|null
++                userdict /.lastToUnicode get         % font-res font-dict g2u Encoding|null CMap
++                .convert_ToUnicode-into-g2u          % font-res font-dict
++                //null                               % font-res font-dict //null
+               } ifelse
+-              {
+-                currentglobal exch dup gcheck setglobal
+-                dup /GlyphNames2Unicode 100 dict dup 4 1 roll .forceput
+-                3 2 roll setglobal
+-              } if                                 % font-res font-dict encoding|null font-info g2u
+-              exch pop exch                        % font-res font-dict g2u encoding|null
+-              userdict /.lastToUnicode get         % font-res font-dict g2u Encoding|null CMap
+-              .convert_ToUnicode-into-g2u          % font-res font-dict
+-              //null                               % font-res font-dict //null
+             } ifelse
+-          } ifelse
+-        } if
+-        PDFDEBUG {
+-          (.processToUnicode end) =
++          } if
++          PDFDEBUG {
++            (.processToUnicode end) =
++          } if
+         } if
+       } if
+     } stopped
+-- 
+2.20.1
+
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0002.patch b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0002.patch
new file mode 100644
index 0000000..6348fff
--- /dev/null
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript/CVE-2019-14817-0002.patch
@@ -0,0 +1,236 @@
+From cd1b1cacadac2479e291efe611979bdc1b3bdb19 Mon Sep 17 00:00:00 2001
+From: Ken Sharp <ken.sharp@artifex.com>
+Date: Wed, 21 Aug 2019 10:10:51 +0100
+Subject: [PATCH 2/2] PDF interpreter - review .forceput security
+
+Bug #701450 "Safer Mode Bypass by .forceput Exposure in .pdfexectoken"
+
+By abusing the error handler it was possible to get the PDFDEBUG portion
+of .pdfexectoken, which uses .forceput left readable.
+
+Add an executeonly appropriately to make sure that clause isn't readable
+no mstter what.
+
+Review all the uses of .forceput searching for similar cases, add
+executeonly as required to secure those. All cases in the PostScript
+support files seem to be covered already.
+
+CVE: CVE-2019-14817
+Upstream-Status: Backport [git://git.ghostscript.com/ghostpdl.git]
+
+Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
+---
+ Resource/Init/pdf_base.ps |  2 +-
+ Resource/Init/pdf_draw.ps | 14 +++++++-------
+ Resource/Init/pdf_font.ps | 29 ++++++++++++++++-------------
+ Resource/Init/pdf_main.ps |  6 +++---
+ Resource/Init/pdf_ops.ps  | 11 ++++++-----
+ 5 files changed, 33 insertions(+), 29 deletions(-)
+
+diff --git a/Resource/Init/pdf_base.ps b/Resource/Init/pdf_base.ps
+index 1a218f4..cffde5c 100644
+--- a/Resource/Init/pdf_base.ps
++++ b/Resource/Init/pdf_base.ps
+@@ -157,7 +157,7 @@ currentdict /num-chars-dict .undef
+     {
+       dup ==only () = flush
+     } ifelse % PDFSTEP
+-  } if % PDFDEBUG
++  } executeonly if % PDFDEBUG
+   2 copy .knownget {
+     exch pop exch pop exch pop exec
+   } {
+diff --git a/Resource/Init/pdf_draw.ps b/Resource/Init/pdf_draw.ps
+index e18a7c2..0a3924c 100644
+--- a/Resource/Init/pdf_draw.ps
++++ b/Resource/Init/pdf_draw.ps
+@@ -501,8 +501,8 @@ end
+       (        Output may be incorrect.\n) pdfformaterror
+       //pdfdict /.gs_warning_issued //true .forceput
+       PDFSTOPONERROR { /gs /undefined signalerror } if
+-    } if
+-  }
++    } executeonly if
++  } executeonly
+   ifelse
+ } bind executeonly def
+ 
+@@ -1142,7 +1142,7 @@ currentdict end readonly def
+           .setglobal
+           pdfformaterror
+         } executeonly ifelse
+-      }
++      } executeonly
+       {
+         currentglobal //pdfdict gcheck .setglobal
+         //pdfdict /.Qqwarning_issued //true .forceput
+@@ -1150,8 +1150,8 @@ currentdict end readonly def
+         pdfformaterror
+       } executeonly ifelse
+       end
+-    } ifelse
+-  } loop
++    } executeonly ifelse
++  } executeonly loop
+   {
+     (\n   **** Error: File has unbalanced q/Q operators \(too many q's\)\n               Output may be incorrect.\n)
+     //pdfdict /.Qqwarning_issued .knownget
+@@ -1165,14 +1165,14 @@ currentdict end readonly def
+         .setglobal
+         pdfformaterror
+       } executeonly ifelse
+-    }
++    } executeonly
+     {
+       currentglobal //pdfdict gcheck .setglobal
+       //pdfdict /.Qqwarning_issued //true .forceput
+       .setglobal
+       pdfformaterror
+     } executeonly ifelse
+-  } if
++  } executeonly if
+   pop
+ 
+   % restore pdfemptycount
+diff --git a/Resource/Init/pdf_font.ps b/Resource/Init/pdf_font.ps
+index 2df3303..6a6a5fe 100644
+--- a/Resource/Init/pdf_font.ps
++++ b/Resource/Init/pdf_font.ps
+@@ -638,7 +638,7 @@ currentdict end readonly def
+                   currentglobal 2 index dup gcheck setglobal
+                   /FontInfo 5 dict dup 5 1 roll .forceput
+                   setglobal
+-                } if
++                } executeonly if
+                 dup /GlyphNames2Unicode .knownget not {
+                   //true                        % No existing G2U, make one
+                 } {
+@@ -668,10 +668,12 @@ currentdict end readonly def
+                 pop                                     % font-res font-dict encoding|null font-info
+                 pop                                     % font-res font-dict encoding|null
+                 //false                                 % We built a GlyphNames2Unicode table, don't need to process further
+-              }{
++              } executeonly
++              {
+                 //true                                  % name is not Identity-V or H, fail by falling through
+               }ifelse
+-          } {
++          } executeonly
++          {
+             //true
+           } ifelse                                      % not a name, try as a dictionary (as specified)
+ 
+@@ -759,9 +761,9 @@ currentdict end readonly def
+           PDFDEBUG {
+             (.processToUnicode end) =
+           } if
+-        } if
+-      } if
+-    } stopped
++        } executeonly if
++      } executeonly if
++    } executeonly stopped
+     {
+       .dstackdepth 1 countdictstack 1 sub
+       {pop end} for
+@@ -1291,19 +1293,20 @@ currentdict /eexec_pdf_param_dict .undef
+                 //pdfdict /.Qqwarning_issued //true .forceput
+               } executeonly if
+               Q
+-            } repeat
++            } executeonly repeat
+             Q
+-          } PDFfile fileposition 2 .execn % Keep pdfcount valid.
++          } executeonly PDFfile fileposition 2 .execn % Keep pdfcount valid.
+           PDFfile exch setfileposition
+-        } ifelse
+-      } {
++        } executeonly ifelse
++      } executeonly
++      {
+         % PDF Type 3 fonts don't use .notdef
+         % d1 implementation adjusts the width as needed
+         0 0 0 0 0 0
+         pdfopdict /d1 get exec
+       } ifelse
+       end end
+-    } bdef
++    } executeonly bdef
+     dup currentdict Encoding .processToUnicode
+     currentdict end .completefont exch pop
+ } bind executeonly odef
+@@ -2103,9 +2106,9 @@ currentdict /CMap_read_dict undef
+           (Will continue, but content may be missing.) = flush
+         } ifelse
+       } if
+-    } if
++    } executeonly if
+     /findresource cvx /undefined signalerror
+-  } loop
++  } executeonly loop
+ } bind executeonly odef
+ 
+ /buildCIDType0 {	% <CIDFontType0-font-resource> buildCIDType0 <font>
+diff --git a/Resource/Init/pdf_main.ps b/Resource/Init/pdf_main.ps
+index 5305ea6..a59e63c 100644
+--- a/Resource/Init/pdf_main.ps
++++ b/Resource/Init/pdf_main.ps
+@@ -2749,15 +2749,15 @@ currentdict /PDF2PS_matrix_key undef
+           .setglobal
+           pdfformaterror
+         } executeonly ifelse
+-      }
++      } executeonly
+       {
+         currentglobal //pdfdict gcheck .setglobal
+         //pdfdict /.Qqwarning_issued //true .forceput
+         .setglobal
+         pdfformaterror
+       } executeonly ifelse
+-    } if
+-  } if
++    } executeonly if
++  } executeonly if
+   pop
+   count PDFexecstackcount sub { pop } repeat
+   (after exec) VMDEBUG
+diff --git a/Resource/Init/pdf_ops.ps b/Resource/Init/pdf_ops.ps
+index 285e582..6c1f100 100644
+--- a/Resource/Init/pdf_ops.ps
++++ b/Resource/Init/pdf_ops.ps
+@@ -186,14 +186,14 @@ currentdict /gput_always_allow .undef
+         .setglobal
+         pdfformaterror
+       } executeonly ifelse
+-    }
++    } executeonly
+     {
+       currentglobal //pdfdict gcheck .setglobal
+       //pdfdict /.Qqwarning_issued //true .forceput
+       .setglobal
+       pdfformaterror
+     } executeonly ifelse
+-  } if
++  } executeonly if
+ } bind executeonly odef
+ 
+ % Save PDF gstate
+@@ -440,11 +440,12 @@ currentdict /gput_always_allow .undef
+   dup type /booleantype eq {
+     .currentSMask type /dicttype eq {
+       .currentSMask /Processed 2 index .forceput
++    } executeonly
++    {
++      .setSMask
++    }ifelse
+   } executeonly
+   {
+-      .setSMask
+-  }ifelse
+-  }{
+   .setSMask
+   }ifelse
+ 
+-- 
+2.20.1
+
diff --git a/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb b/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
index fcc9e00..349c0c2 100644
--- a/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
+++ b/poky/meta/recipes-extended/ghostscript/ghostscript_9.27.bb
@@ -25,6 +25,9 @@
                 file://do-not-check-local-libpng-source.patch \
                 file://avoid-host-contamination.patch \
                 file://mkdir-p.patch \
+                file://CVE-2019-14811-0001.patch \
+                file://CVE-2019-14817-0001.patch \
+                file://CVE-2019-14817-0002.patch \
 "
 
 SRC_URI = "${SRC_URI_BASE} \
diff --git a/poky/meta/recipes-extended/iptables/iptables/iptables.rules b/poky/meta/recipes-extended/iptables/iptables/iptables.rules
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/poky/meta/recipes-extended/iptables/iptables/iptables.rules
diff --git a/poky/meta/recipes-extended/iptables/iptables/iptables.service b/poky/meta/recipes-extended/iptables/iptables/iptables.service
new file mode 100644
index 0000000..041316e
--- /dev/null
+++ b/poky/meta/recipes-extended/iptables/iptables/iptables.service
@@ -0,0 +1,13 @@
+[Unit]
+Description=Packet Filtering Framework
+Before=network-pre.target
+Wants=network-pre.target
+
+[Service]
+Type=oneshot
+ExecStart=@SBINDIR@/iptables-restore /etc/iptables/iptables.rules
+ExecReload=@SBINDIR@/iptables-restore /etc/iptables/iptables.rules
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb b/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb
index 6ac3fc6..ff9fcb1 100644
--- a/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb
+++ b/poky/meta/recipes-extended/iptables/iptables_1.8.3.bb
@@ -10,12 +10,14 @@
 SRC_URI = "http://netfilter.org/projects/iptables/files/iptables-${PV}.tar.bz2 \
            file://0001-configure-Add-option-to-enable-disable-libnfnetlink.patch \
            file://0002-configure.ac-only-check-conntrack-when-libnfnetlink-enabled.patch \
+           file://iptables.service \
+           file://iptables.rules \
 "
 
 SRC_URI[md5sum] = "29de711d15c040c402cf3038c69ff513"
 SRC_URI[sha256sum] = "a23cac034181206b4545f4e7e730e76e08b5f3dd78771ba9645a6756de9cdd80"
 
-inherit autotools pkgconfig
+inherit autotools pkgconfig systemd
 
 EXTRA_OECONF = "--with-kernel=${STAGING_INCDIR}"
 
@@ -56,6 +58,19 @@
 
 ALLOW_EMPTY_${PN}-modules = "1"
 
+do_install_append() {
+
+        install -d ${D}${sysconfdir}/iptables
+        install -m 0644 ${WORKDIR}/iptables.rules ${D}${sysconfdir}/iptables
+
+        install -d ${D}${systemd_system_unitdir}
+        install -m 0644 ${WORKDIR}/iptables.service ${D}${systemd_system_unitdir}
+
+	sed -i -e 's,@SBINDIR@,${sbindir},g' ${D}${systemd_system_unitdir}/iptables.service
+}
+
+SYSTEMD_SERVICE_${PN} = "iptables.service"
+
 RDEPENDS_${PN} = "${PN}-module-xt-standard"
 RRECOMMENDS_${PN} = " \
     ${PN}-modules \
diff --git a/poky/meta/recipes-extended/screen/screen_4.6.2.bb b/poky/meta/recipes-extended/screen/screen_4.6.2.bb
index 24ec751..21b476d 100644
--- a/poky/meta/recipes-extended/screen/screen_4.6.2.bb
+++ b/poky/meta/recipes-extended/screen/screen_4.6.2.bb
@@ -35,10 +35,11 @@
 PACKAGECONFIG ??= ""
 PACKAGECONFIG[utempter] = "ac_cv_header_utempter_h=yes,ac_cv_header_utempter_h=no,libutempter,"
 
-EXTRA_OECONF = "--with-pty-mode=0620 --with-pty-group=5 \
+EXTRA_OECONF = "--with-pty-mode=0620 --with-pty-group=5 --with-sys-screenrc=${sysconfdir}/screenrc \
                ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--enable-pam', '--disable-pam', d)}"
 
 do_install_append () {
+	install -D -m 644 ${S}/etc/etcscreenrc ${D}/${sysconfdir}/screenrc
 	if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then
 		install -D -m 644 ${WORKDIR}/screen.pam ${D}/${sysconfdir}/pam.d/screen
 	fi
diff --git a/poky/meta/recipes-extended/timezone/timezone.inc b/poky/meta/recipes-extended/timezone/timezone.inc
index ce16524..f6bab1a 100644
--- a/poky/meta/recipes-extended/timezone/timezone.inc
+++ b/poky/meta/recipes-extended/timezone/timezone.inc
@@ -4,7 +4,7 @@
 LICENSE = "PD & BSD & BSD-3-Clause"
 LIC_FILES_CHKSUM = "file://LICENSE;md5=c679c9d6b02bc2757b3eaf8f53c43fba"
 
-PV = "2019b"
+PV = "2019c"
 
 SRC_URI =" http://www.iana.org/time-zones/repository/releases/tzcode${PV}.tar.gz;name=tzcode \
            http://www.iana.org/time-zones/repository/releases/tzdata${PV}.tar.gz;name=tzdata \
@@ -12,7 +12,7 @@
 
 UPSTREAM_CHECK_URI = "http://www.iana.org/time-zones"
 
-SRC_URI[tzcode.md5sum] = "91e0978d947496fd6aaf46d351f9c41d"
-SRC_URI[tzcode.sha256sum] = "2e479d409337da41408629ce6c3b4d8410b10ba6d4431d862e22d2b137d7756d"
-SRC_URI[tzdata.md5sum] = "b26b5d7d844cb96c73ed2fb6d588daaf"
-SRC_URI[tzdata.sha256sum] = "05d9092c90dcf9ec4f3ccfdea80c7dcea5e882b3b105c3422da172aaa9a50c64"
+SRC_URI[tzcode.md5sum] = "195a17454c5db05cab96595380650391"
+SRC_URI[tzcode.sha256sum] = "f6ebd3668e02d5ed223d3b7b1947561bf2d2da2f4bd1db61efefd9e06c167ed4"
+SRC_URI[tzdata.md5sum] = "f6987e6dfdb2eb83a1b5076a50b80894"
+SRC_URI[tzdata.sha256sum] = "79c7806dab09072308da0e3d22c37d3b245015a591891ea147d3b133b60ffc7c"
diff --git a/poky/meta/recipes-extended/timezone/tzdata.bb b/poky/meta/recipes-extended/timezone/tzdata.bb
index 82fe369..1e2d9bd 100644
--- a/poky/meta/recipes-extended/timezone/tzdata.bb
+++ b/poky/meta/recipes-extended/timezone/tzdata.bb
@@ -147,6 +147,8 @@
 RPROVIDES_tzdata-misc = "tzdata-misc"
 
 FILES_tzdata-core += " \
+                ${sysconfdir}/localtime                  \
+                ${sysconfdir}/timezone                   \
                 ${datadir}/zoneinfo/Pacific/Honolulu     \
                 ${datadir}/zoneinfo/America/Anchorage    \
                 ${datadir}/zoneinfo/America/Los_Angeles  \
@@ -202,8 +204,7 @@
                 ${datadir}/zoneinfo/iso3166.tab          \
                 ${datadir}/zoneinfo/Etc/*"
 
-CONFFILES_tzdata-core += "${@ "${sysconfdir}/timezone" if bb.utils.to_boolean(d.getVar('INSTALL_TIMEZONE_FILE')) else "" }"
-CONFFILES_tzdata-core += "${sysconfdir}/localtime"
+CONFFILES_tzdata-core = "${sysconfdir}/localtime ${sysconfdir}/timezone"
 
 ALLOW_EMPTY_${PN} = "1"
 RDEPENDS_${PN} = "${TZ_PACKAGES}"