summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
...
* python: force off_t size to 8 to enable large file supportPaul Eggleton2014-11-061-0/+3
| | | | | | | | | | | | | | | | | If DISTRO_FEATURES contains "largefile", force the size of off_t to 8 as a workaround for having ac_cv_sizeof_off_t=4 on 32-bit systems. In future we will likely drop the value from the site file, but for now this is a slightly safer fix. Fixes [YOCTO #6813]. (From OE-Core master rev: a8216030ee6c65531de8fbf3eed878a345a94edc) (From OE-Core rev: 94483eff5d0858ef1b5a8850268aa6a7bc6e6463) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: avoid screen sessions being killed on disconnect with systemdPaul Eggleton2014-11-061-0/+1
| | | | | | | | | | | | | | | | | Tell systemd just to kill the sshd process when the ssh connection drops instead of the entire cgroup for sshd, so that any screen sessions (and more to the point, processes within them) do not get killed. (This is what the Fedora sshd service file does, and what we're already doing in the dropbear service file). (From OE-Core master rev: 3c238dff41fbd3687457989c7b17d22b2cc844be) (From OE-Core rev: 6e6aeb7cca52b92a0c8013473e2b8bb18738a119) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to daisy head revisionRichard Purdie2014-11-051-1/+1
| | | | | | (From OE-Core rev: d1729495a19bda411fa84310ecf6c0ac3073ce36) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Security Advisory - curl - CVE-2014-3620Chong Lu2014-11-052-0/+70
| | | | | | | | | | | | | | libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain. (From OE-Core rev: ddbaade8afbc9767583728bfdc220639203d6853) (From OE-Core rev: 13bb2ee98cfd159455e459501dda280a78cb5a3b) Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: Security Advisory - curl - CVE-2014-3613Chong Lu2014-11-052-0/+270
| | | | | | | | | | | | | | | | | By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. (From OE-Core rev: 985ef933208da1dd1f17645613ce08e6ad27e2c1) (From OE-Core rev: dbbda31ca0a29c930f3078635ae7c5a41d933b58) Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Conflicts: meta/recipes-support/curl/curl_7.35.0.bb
* pseudo.inc: Clean up backport of version update to 1.6.2Saul Wold2014-11-051-5/+1
| | | | | | | | | | | | | | | | | This uprevs pseudo to 1.6. This merges in all of the existing fixes, and also adds partial support for extended attributes, including storing arbitrary extended attributes in the database, and also interpreting the posix permissions ACLs as chmod requests. The extended attribute support means we need xattr.h, the simplest way to be sure of this is to build attr before pseudo, which doesn't take long. (From OE-Core rev: 606793e7b5c129654f317e5bec9ed7f083d3383d) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ltp: Added zip-native as a DEPENDSAlejandro Hernandez2014-11-041-1/+1
| | | | | | | | | | | | | | | | The Makefile checks for zip during installation [YOCTO #6699] (From OE-Core rev: a6e8ced3fa8e8e2aa3df0798b80eb26e5ebc4b15) (From OE-Core rev: 00dc2ac9e0a7d4cec2d94f4d934dc1ab42d5b20b) Signed-off-by: Alejandro Hernandez <alejandro.hernandez@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Conflicts: meta/recipes-extended/ltp/ltp_20140115.bb
* pseudo*.bb: update to pseudo 1.6.2Peter Seebach2014-11-043-17/+12
| | | | | | | | | | | | | | | | | pseudo 1.6.2 fixes problems with 64-bit inodes and some underlying issues involving file renames that could occasionally cause very strange behaviors files being deleted, linked, or renamed, mostly observed as strange recovery if an inode got reused. (From OE-Core rev: b2c6a032d6e5deb07e76ed75fcd0931fad6a748c) (From OE-Core rev: c2e56d7da8c7df330869babac198678b33eb3802) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Conflicts: meta/recipes-devtools/pseudo/pseudo_1.6.2.bb meta/recipes-devtools/pseudo/pseudo_git.bb
* gnupg: CVE-2013-4242Kai Kang2014-10-232-0/+63
| | | | | | | | | | | | | | | | GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x and possibly other products, allows local users to obtain private RSA keys via a cache side-channel attack involving the L3 cache, aka Flush+Reload. Patch from commit e2202ff2b704623efc6277fb5256e4e15bac5676 in git://git.gnupg.org/libgcrypt.git (From OE-Core rev: 0692743b51f7daa0154fd4d8982236b4702ea2da) Signed-off-by: Yong Zhang <yong.zhang@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Upgrade to 1.0.1jSaul Wold2014-10-2312-688/+145
| | | | | | | | | This address the latest set of CVE issues (From OE-Core rev: 461e598815f8749bb26e97369e3b877f7ce749cf) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0869Yue Tao2014-10-232-0/+34
| | | | | | | | | | | | | | | | | | The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0869 (From OE-Core rev: 9d0fe8f47e360ad09d4a20144da96576dd4bf82f) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Conflicts: meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-4358Yue Tao2014-10-232-0/+146
| | | | | | | | | | | | | | | | | libavcodec/h264.c in FFmpeg before 0.11.4 allows remote attackers to cause a denial of service (crash) via vectors related to alternating bit depths in H.264 data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4358 (From OE-Core rev: 187470bf4e1d0d87d84aae251e663c3eb490ff9c) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Conflicts: meta/recipes-multimedia/gstreamer/gst-ffmpeg_0.10.13.bb Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* readline: Security Advisory - readline - CVE-2014-2524Kai Kang2014-10-232-0/+45
| | | | | | | | | | | | | | The _rl_tropen function in util.c in GNU readline before 6.3 patch 3 allows local users to create or overwrite arbitrary files via a symlink attack on a /var/tmp/rltrace.[PID] file. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2524 (From OE-Core rev: a4fa519de008ccd5b9411fcb1880e0a64383ce9c) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: upgrade to 1.0.1jRoss Burton2014-10-231-9/+5
| | | | | | | | | | | | (From OE-Core rev: 5163eb2c3c492d3640aa0628c29f6b8d446a8261) Signed-off-by: Ross Burton <ross.burton@intel.com> Conflicts: meta/recipes-connectivity/openssl/openssl_1.0.1g.bb meta/recipes-connectivity/openssl/openssl_1.0.1i.bb meta/recipes-connectivity/openssl/openssl_1.0.1j.bb Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* lttng-modules: Update to version 2.4.2Chang Rebecca Swee Fun2014-10-231-3/+3
| | | | | | | | | | | | | | lttng-modules breaks when building with kernel 3.10.43. This updates lttng-modules for 2.4.2 and it will also fixes the build failure with kernel 3.10.43. Fixes for [YOCTO #6788] (From OE-Core rev: 29ef1c738050e536d7824bdca6f7a0b8b1528011) Signed-off-by: Chang Rebecca Swee Fun <rebecca.swee.fun.chang@intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bash: Fix-for-CVE-2014-6278Catalin Popeanga2014-10-104-0/+1292
| | | | | | | | | | | This vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277 See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278 (From OE-Core rev: de596b5f31e837dcd2ce991245eb5548f12d72ae) Signed-off-by: Catalin Popeanga <Catalin.Popeanga@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bash: Fix for CVE-2014-6277Catalin Popeanga2014-10-104-0/+90
| | | | | | | | | | | Follow up bash43-026 to parse properly function definitions in the values of environment variables, to not allow remote attackers to execute arbitrary code or to cause a denial of service. See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6277 (From OE-Core rev: 85961bcf81650992259cebb0ef1f1c6cdef3fefa) Signed-off-by: Catalin Popeanga <Catalin.Popeanga@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bash: Fix for CVE-2014-7186 and CVE-2014-7187Catalin Popeanga2014-10-104-0/+1416
| | | | | | | | | | | | | This is a followup patch to incomplete CVE-2014-6271 fix code execution via specially-crafted environment https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7186 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7187 (From OE-Core rev: 153d1125659df9e5c09e35a58bd51be184cb13c1) Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bash: Fix for exported function namespace changeCatalin Popeanga2014-10-104-0/+335
| | | | | | | | | | | | | | | This is a followup patch to incomplete CVE-2014-6271 fix code execution via specially-crafted environment This patch changes the encoding bash uses for exported functions to avoid clashes with shell variables and to avoid depending only on an environment variable's contents to determine whether or not to interpret it as a shell function. (From OE-Core rev: 6c51cc96d03df26d1c10867633e7a10dfbec7c45) Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl: fix for CVE-2010-4777yanjun.zhu2014-10-103-2/+49
| | | | | | | | | | | | | | | | | | | | The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-4777 (From OE-Core rev: 368df9f13ddf124e6aaaec06c02ab698c9e0b6c3) (From OE-Core rev: 73aff6efb3374427234a3615ffca07874f22f3fa) Signed-off-by: yanjun.zhu <yanjun.zhu@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpam: Security Advisory - CVE-2014-2583Yue Tao2014-10-102-0/+64
| | | | | | | | | | | | | | | | | | | | | | | v2 changes: * update format for commit log * add Upstream-Status for patch Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create aribitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty funtion, which is used by the format_timestamp_name function. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-2583 (From OE-Core rev: 69255c84ebd99629da8174e1e73fd8c715e49b52) (From OE-Core rev: 8b9164029153fa06520bd5b6349245c2ac1f605f) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtiff: Security Advisory - CVE-2012-4564Yue Tao2014-10-102-1/+101
| | | | | | | | | | | | | | | | | | | | | | v2 changes: * update format for commit log * add Upstream-Status for patch ppm2tiff does not check the return value of the TIFFScanlineSize function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PPM image that triggers an integer overflow, a zero-memory allocation, and a heap-based buffer overflow. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4564 (From OE-Core rev: 9f02922d44de483ef4d02ce95b55efe79a8b09a2) (From OE-Core rev: ff60c490c4fdb9f89d2b8e8fe7f2e7c4f2ff631f) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dpkg: Security Advisory - CVE-2014-3127Guillem Jover2014-10-102-0/+69
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | v2 changes: * update format for commit log * add Upstream-Status for patch commit a12eb58959d0a10584a428f4a3103a49204c410f upstream Dpkg::Source::Patch: Outright reject C-style filenames in patches Because patch only started recognizing C-style filenames in diffs in version 2.7, it's not safe to assume one behaviour or the other, as the system might or might not have a recent enough version, or a GNU patch program at all. There's also no reason we should be supporting this kind of strange encoded filenames in patches, when we have not done so up to now. Let's just ban these types of diffs and be done with it. Fixes: CVE-2014-0471, CVE-2014-3127 Closes: #746306 [drop the text for debian/changelog,because it's not suitable for the veriosn] (From OE-Core rev: 2c3838443eacd3a86ea8917ea53a20248e7bdf03) (From OE-Core rev: 14273b42542151357e3299736f2b730ca3257fc0) Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* dpkg: Security Advisory - CVE-2014-0471Guillem Jover2014-10-102-0/+98
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | v2 changes: * update format for commit log * add Upstream-Status for patch commit a82651188476841d190c58693f95827d61959b51 upstream Dkpkg::Source::Patch: Correctly parse C-style diff filenames We need to strip the surrounding quotes, and unescape any escape sequence, so that we check the same files that the patch program will be using, otherwise a malicious package could overpass those checks, and perform directory traversal attacks on source package unpacking. Fixes: CVE-2014-0471 Reported-by: Jakub Wilk <jwilk@debian.org> [drop the text for debian/changelog,because it's not suitable for the veriosn] (From OE-Core rev: 81880b34a8261e824c5acafaa4cb321908e554a0) (From OE-Core rev: c75316fc256d229cfad45cd57328920993d93d8d) Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gst-ffmpeg: Add CVE patchesYue Tao2014-10-1018-0/+917
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Security Advisory - ffmpeg - CVE-2013-0866 The aac_decode_init function in libavcodec/aacdec.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large number of channels in an AAC file, which triggers an out-of-bounds array access. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0866 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0875 The ff_add_png_paeth_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via a crafted PNG image, related to an out-of-bounds array access. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0875 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0860 The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0860 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2011-3934 Double free vulnerability in the vp3_update_thread_context function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted vp3 data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3934 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2011-3946 The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Supplemental enhancement information (SEI) data, which triggers an infinite loop. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3946 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-7023 The ff_combine_frame function in libavcodec/parser.c in FFmpeg before 2.1 does not properly handle certain memory-allocation errors, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7023 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-7009 The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7009 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0855 Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec (ALAC) data, which triggers an out-of-bounds array access. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0855 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2011-4351 Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4351 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0848 The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0848 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2011-3944 The smacker_decode_header_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Smacker data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3944 file://0001-huffyuvdec-check-width-more-completely-avoid-out-of-.patch \ gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-7010 Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7010 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2011-3941 The decode_mb function in libavcodec/error_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block index, which triggers an out-of-bound write. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3941 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2013-0846 Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0846 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2012-6618 The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service (crash) via a crafted MP3 file, possibly related to frame size or lack of sufficient frames to estimate rate. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6618 gst-ffmpeg: Security Advisory - ffmpeg - CVE-2012-6617 The prepare_sdp_description function in ffserver.c in FFmpeg before 1.0.2 allows remote attackers to cause a denial of service (crash) via vectors related to the rtp format. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6617 (From OE-Core rev: 58f08a96764094189b5aaf3cc8b4cc0c95e23409) (From OE-Core rev: 9b3a2d0716540dae72376a8c2e418b244a85c0cb) Signed-off-by: Yue Tao <Yue.Tao@windriver.com> Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nspr: Fix for CVE-2014-1545Xufeng Zhang2014-10-102-0/+68
| | | | | | | | | | | | | | | | Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.Per: http://cwe.mitre.org/data/definitions/787.html (From OE-Core rev: 191cab2f679491c2b6ddba49c5cf4886dcd22f57) (From OE-Core rev: bebfeb6d4deac18601edda8dcac0f32c3382cb06) Signed-off-by: Xufeng Zhang <xufeng.zhang@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pulseaudio: fix CVE-2014-3970Shan Hai2014-10-102-1/+55
| | | | | | | | | | | | | | | | | The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet. Fix it by picking a patch from pulseaudio upstream code. (From OE-Core rev: f9d7407e54f1fa3d3a316a5bbb8b80665e6f03fd) (From OE-Core rev: cf008bce23e897d1c3a51805af839af9241271df) Signed-off-by: Shan Hai <shan.hai@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nss: CVE-2014-1544Li Wang2014-10-102-0/+42
| | | | | | | | | | | | | | | | | | | the patch comes from: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-1544 https://hg.mozilla.org/projects/nss/rev/204f22c527f8 author Robert Relyea <rrelyea@redhat.com> https://bugzilla.mozilla.org/show_bug.cgi?id=963150 Bug 963150: Add nssCertificate_AddRef and nssCertificate_Destroy calls to PK11_ImportCert to prevent nssTrustDomain_AddCertsToCache from freeing the CERTCertificate associated with the NSSCertificate. r=wtc. (From OE-Core rev: 7ef613c7f4b9e4ff153766f31dae81fc4810c0df) (From OE-Core rev: 7e4f3f167c40c09bf2c32f5e366a8fad3c66b74b) Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtiff: fix CVE-2013-1961Muzaffar Mahmood2014-10-102-0/+787
| | | | | | | | | | | | | | | | | | | Integrate community fix for the issue CVE-2013-1961 and migrated to version 4.0.3. Stack-based buffer overflow in the t2p_write_pdf_page function in tiff2pdf in libtiff before 4.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted image length and resolution in a TIFF image file. (From OE-Core rev: f24e3456c60951d2985d7c23bdcc1f8c15d6c167) (From OE-Core rev: 9b8ca9d9b0b12dff8a3908da00020d253685958f) Signed-off-by: Priyanka Shobhan <priyanka_shobhan@mentor.com> Signed-off-by: Christopher Larson <chris_larson@mentor.com> Signed-off-by: Muzaffar Mahmood <muzaffar_mahmood@mentor.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* adt-installer: fix sed input file errorChong Lu2014-10-101-0/+1
| | | | | | | | | | | | | | When use default install directory, we can't get the environment setup script path. The reason is that opkg-cl list incorrect files paths. This patch sets env_script variable to make us get correct environment setup script path. [YOCTO #6443] (From OE-Core rev: b0ac1ea1f7eaca92b613f874ee2cbf6830743a71) Signed-off-by: Chong Lu <Chong.Lu@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: Add fix for recent patch on older gccRichard Purdie2014-10-102-0/+51
| | | | | | | | | The recent bintuils patch update breaks on older gccs such as CentOS 6. Backport a patch to address this. (From OE-Core rev: 947c1bab91993be149fba1d09aedbe8509902fbe) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: fix python packaging for nativesdkPaul Eggleton2014-10-092-1/+31
| | | | | | | | | | | | | | | We enable the python module in nativesdk-libxml2, but the python binary used is in the native sysroot and thus you get the module installed in the wrong path. Even with that fixed the python files are still unpackaged, so create an ${PN}-python package and add them to it. (This does not affect the libxml target build at all since python is disabled for that.) (From OE-Core rev: 360fc811ff843c63f796e958517a5152f07e851d) Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* layer.conf: Mark opkg-utils as ABISAFE for update-alternatives usageSteffen Sledz2014-09-291-0/+2
| | | | | | | | | | | | | Currently linux-firmware rebuilds for each machine due to its usage of update-alternatives which in turn means a dependency on opkg-utils. Marking opkg-utils as ABISAFE is the only option we have right now to avoid this. (From OE-Core rev: e4c4ca3101062ecc956294ac968dc488321eb33b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steffen Sledz <sledz@dresearch-fe.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* update-rc.d/systemd: Remove OVERRIDES dependencySteffen Sledz2014-09-292-0/+2
| | | | | | | | | | | | | | | Taking run-postinsts and building for two machines which have different OVERRIDES leads to two different sets of stamps for an allarch package. We don't need to depend on OVERRIDES in these classes, the end resulting variables are good enough. We can therefore exclude the dependency and allow a single package to be generated for run-postinsts. (From OE-Core rev: 6e875148f79a6877653a5bf95879b8cda1cacbc6) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steffen Sledz <sledz@dresearch-fe.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* layer.conf: Add in useradd dependencies as ABISAFE dependenciesSteffen Sledz2014-09-291-0/+4
| | | | | | | | | | | | Currently allarch recipes using useradd rebuild each time MACHINE changes which is not desireable. Adding the useradd dependencies to this list ensures they do not change under these circumstances. (From OE-Core rev: 0306b6122a34579673ab89fa4869d577995af960) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steffen Sledz <sledz@dresearch-fe.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bash: Fix CVE-2014-7169Khem Raj2014-09-294-0/+34
| | | | | | | | | | | This is a followup patch to incomplete CVE-2014-6271 fix code execution via specially-crafted environment Change-Id: Ibb0a587ee6e09b8174e92d005356e822ad40d4ed (From OE-Core rev: e358d20e8ccf1299e8a046e743a31e92546cd239) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bash: fix CVE-2014-6271Ross Burton2014-09-294-0/+193
| | | | | | | | | | | | | CVE-2014-6271 aka ShellShock. "GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment." (From OE-Core rev: eb41d5d4eaee1c810f8e418704c110c2005d0197) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* eglibc: CVE-2014-5119 fixArmin Kuster2014-09-292-0/+241
| | | | | | | | | | | | | __gconv_translit_find: Disable function [BZ #17187] This functionality has never worked correctly, and the implementation contained a security vulnerability (CVE-2014-5119). (From OE-Core rev: 3f0a4551969798803e019435f1f4b5e8f88bea1a) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nss-3.15.1: fix CVE-2013-1739yzhu12014-09-291-0/+81
| | | | | | | | | | | | | | | | | | | | Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1739 (From OE-Core rev: 9b43af77d112e75fa9827a9080b7e94f41f9a116) (From OE-Core rev: 4ce30ef254511ce39dd576b80134b9316f9fa06c) Signed-off-by: yzhu1 <yanjun.zhu@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Conflicts: meta/recipes-support/nss/nss.inc
* nss: CVE-2013-5606Li Wang2014-09-292-0/+50
| | | | | | | | | | | | | | | | | | | | | | | | | the patch comes from: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5606 https://bugzilla.mozilla.org/show_bug.cgi?id=910438 http://hg.mozilla.org/projects/nss/rev/d29898e0981c The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate. (From OE-Core rev: 1e153b1b21276d56144add464d592cd7b96a4ede) (From OE-Core rev: e2c81356f68eb0b77408e73f01df5bc5c9f2adb3) Signed-off-by: Li Wang <li.wang@windriver.com> Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Conflicts: meta/recipes-support/nss/nss.inc
* useradd-staticids.bbclass: Fix for Bug 6633Fabrice Coulon2014-09-231-2/+6
| | | | | | | | | | | | | | | | | When using the useradd-staticids.bbclass under meta/classes, this error occurs: "<username> - <username>: Username does not have a static uid defined." There was a problem with the regular expression for parsing parameters, it was sometimes returning an empty string. I have fixed this by skipping empty strings. (From OE-Core rev: f249ef32709069a2680b92dc5a5b4f6545d014b7) (From OE-Core rev: 592f0dccaf1985194f40fc019a9d33b9623df37f) Signed-off-by: Fabrice Coulon <fabrice@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* crosssdk: Clear MACHINEOVERRIDESRichard Purdie2014-09-201-0/+1
| | | | | | | | | | | | | | | | | Without this, things like arm* can make it into OVERRIDES when we're building a compiler to build binaries for another architecture like x86. This can can lead to build failures dependning on the exact configuration and overrides. For example: MACHINE=imx53qsb bitbake gcc-crosssdk-initial-x86_64 -e | grep EXTRA_OECONF was showing an armv7 configuration option to gcc. (From OE-Core rev: d02cdf3ee88c7bbb93cecf094008858782deec3f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* native/nativesdk: Clear MACHINEOVERRIDESKhem Raj2014-09-202-0/+2
| | | | | | | | | | | | | | | | | | | | | In cases where we override variables e.g PACKAGE_ARCH conditionally and use a MACHINEOVERRIDE to qualify the override like PACKAGE_ARCH_<MACHINE> = "some target PACKAGE_ARCH" This would also be effective if this recipe is BBEXTENDED to native or nativesdk which is undesired This particular issue will cause wrong sysroot to be used for nativesdk case since PACKAGE_ARCH would have been modified and eventually changing value of STAGING_DIR_TARGET which we use as --sysroot option to cross and cross-canadian built SDK gcc (From OE-Core rev: 474234a362b4cda5f2f1afab369c98d4e0ca1b11) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: Explicitly disable libiscsi, its not in DEPENDSJonathan Liu2014-09-201-1/+1
| | | | | | | (From OE-Core rev: 8f67830e41e435a142d0b905a1b9f706a1cf1175) Signed-off-by: Jonathan Liu <net147@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* populate_sdk_base: Fix grep command usage on old hostsRichard Purdie2014-08-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "man grep" on centos: -R, -r, --recursive Read all files under each directory, recursively; this is equivalent to the -d recurse option. "man grep" on a more recent ubuntu system: -r, --recursive Read all files under each directory, recursively, following symbolic links only if they are on the command line. This is equivalent to the -d recurse option. So we have an issue when the SDK installer (even with buildtools-tarball) is used on old hosts since it may try and dereference paths which it should not. This is caused by differences in the behaviour of grep -r on older systems. The fix is to wrap this in find so that only real files are found (as elsewhere in the script. [YOCTO #6577] (From OE-Core rev: 7986adeac16550b33f65fded39a55f668e0e543f) (From OE-Core rev: 11e83000b164340b7e261a62f074a0e0cb6d6282) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qt4: Fix Qt 4.8.5 source to new locationDiego Sueiro2014-08-111-1/+1
| | | | | | | | | | | | Qt 4.8.5 was moved from http://download.qt-project.org/official_releases/qt/4.8/ to http://download.qt-project.org/archive/qt/4.8/ Thi fix must be applied for dora and daisy branches. (From OE-Core rev: 975f5865bbfd417840be745d09a68dc064ea8d1d) Signed-off-by: Diego Sueiro <diego.sueiro@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cairo: explicitly disable LTO support by backporting patch which removes itMartin Jansa2014-08-112-1/+63
| | | | | | | | | | | * cairo-native was failing to build in gentoo with gcc-4.9 and LTO enabled, more details in upstream bug https://bugs.freedesktop.org/show_bug.cgi?id=77060 (From OE-Core rev: a7b5605fc8ac5b56f7a9d1587efc5c50d98378b8) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* kernel: don't copy .so.dbg files into kernel source installBruce Ashfield2014-08-111-1/+1
| | | | | | | | | | | | | | | In 3.16+ x86-64 kernel builds produce a vdso64.so.dbg file. If this file is copied into the kernel source install multiple QA failures are triggered. Specifically, this file triggers a debug package split that results in files installed but not shipped, and invalid .debug file errors. By ensuring that .so files are not copied, we avoid this incorrect split with no impact on future build phases. (From OE-Core rev: 649eb801b13e73b532688ede2d966e196d2cb314) Signed-off-by: Bruce Ashfield <bruce.ashfield@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perf: explicitly disable libunwindMartin Jansa2014-08-111-1/+1
| | | | | | | | | * it's not included in DEPENDS and it's detected from sysroot (From OE-Core rev: e426f6c6711ecc752d0fef67005fb769fd74b5f1) Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* populate_sdk_deb: Fix non x86_64 SDK buildsRichard Purdie2014-07-271-5/+10
| | | | | | | | | | | | | | If building with SDKMACHINE=i686 and using the deb backend, populate_sdk would fail. Its clear when looking at the options that the 32 bit values were overwritten. Replace this code with code similar to that used in package_deb itself. [YOCTO #6458] (From OE-Core rev: 9c45575a9df01f0d36fb03120ec86d55b15819f3) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-05-25 20:58:14 +0000