summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
* tiff: Security fix CVE-2016-5321Yi Zhao2016-09-232-0/+46
| | | | | | | | | | | | | | | | | | | | CVE-2016-5321 libtiff: a maliciously crafted TIFF file could cause the application to crash when using tiffcrop command External References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5321 http://bugzilla.maptools.org/show_bug.cgi?id=2558 Patch from: https://github.com/vadz/libtiff/commit/d9783e4a1476b6787a51c5ae9e9b3156527589f0 (From OE-Core rev: 35a7cb62be554e28f64b7583d46d693ea184491f) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 4a167cfb6ad79bbe2a2ff7f7b43c4a162ca42a4d) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: Security fix CVE-2016-3186Yi Zhao2016-09-232-0/+25
| | | | | | | | | | | | | | | | | | | | | CVE-2016-3186 libtiff: buffer overflow in the readextension function in gif2tiff.c allows remote attackers to cause a denial of service via a crafted GIF file External References: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3186 https://bugzilla.redhat.com/show_bug.cgi?id=1319503 Patch from: https://bugzilla.redhat.com/attachment.cgi?id=1144235&action=diff (From OE-Core rev: b4471e7264538b3577808fae5e78f42c0d31e195) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 3d818fc862b1d85252443fefa2222262542a10ae) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpcre: Fix CVE-2016-3191Ismo Puustinen2016-09-232-0/+175
| | | | | | | | | | | | | | | | Fix workspace overflow for (*ACCEPT) with deeply nested parentheses. The patch is from libpcre version control at http://vcs.pcre.org/pcre?view=revision&revision=1631 with the ChangeLog part removed. Original author is Philip Hazel. (From OE-Core rev: 249cc163e7a16f307e8b94a7b449cd3e93cc6b15) Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 386534f968f4da376ba7778b5d436bad4ce8355b) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Security fix CVE-2016-2178Armin Kuster2016-09-232-0/+52
| | | | | | | | | | | | | affects openssl <= 1.0.2h CVSS v2 Base Score: 2.1 LOW (From OE-Core rev: 82fe0e8c98244794531f0e24ceb93953fe68dda5) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 5b3df0c5e8885ea34f66b41fcf209a9960fbbf5e) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: Security fix CVE-2016-2177Armin Kuster2016-09-232-0/+287
| | | | | | | | | | | | | Affects openssl <= 1.0.2h CVSS v2 Base Score: 7.5 HIGH (From OE-Core rev: 5781eb9a6e6bf8984b090a488d2a326bf9fafcf8) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> (cherry picked from commit 2848c7d3e454cbc84cba9183f23ccdf3e9200ec9) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: add a patch to fix parallel buildsRoss Burton2016-09-232-0/+327
| | | | | | | | | | | | | | | Apply a patch taken from Gentoo to hopefully fix the remaining parallel make races. (From OE-Core rev: 7ab2f49107cf491d602880205a3ea1222cb5e616) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3d806d59a4c5e8ff35c7e7c5a3a6ef85e2b4b259) Minor fixup to get patch to apply to jethro Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: security fix for CVE-2016-5421Maxin B. John2016-09-022-0/+37
| | | | | | | | | Affected versions: libcurl 7.32.0 to and including 7.50.0 (From OE-Core rev: f6999fa952c7db980cfc97f6e5a971e4f34cc0a3) Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: security fix for CVE-2016-5420Maxin B. John2016-09-022-0/+32
| | | | | | | | | Affected versions: libcurl 7.1 to and including 7.50.0 (From OE-Core rev: 6b732a392289a7bb50b0e3716c066c62fa32a14d) Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: security fix for CVE-2016-5419Maxin B. John2016-09-022-0/+77
| | | | | | | | | Affected versions: libcurl 7.1 to and including 7.50.0 (From OE-Core rev: d1d6c93b491056b18b528216303047e353956e34) Signed-off-by: Maxin B. John <maxin.john@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perl-ptest.inc: fix tar call to prevent objcopy failureEnrico Jorns2016-07-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With tar version 1.29, the tar call used to copy the ptest files will not work anymore. While the call did not match the man page (but worked) before, anyway, the latest update of tar seems to have a more strict argument handling. With the current version of the tar call, the copying of files still works with latest tar version, but the excludes will not be handled properly anymore. This results in having binaries compiled with host GCC in the package. When doing the strip_and_split files in do_package() with the target objcopy, bitbake will fail with this error: ERROR: objcopy failed with exit code 256 (cmd was [...]) [...] File format not recognized Thus, the current argument issues and required changes are: * Options must be placed _before_ the pathnames. * --exclude must be followd by a '=' in order to work properly * 'f' options is for providing an archive file, which is unnecessary in this case Note that this could also be a candidate for backporting. (From OE-Core master rev: 2e498879098f7d84610aed7961d92433083d9a02) (From OE-Core rev: a27b907dd3ad20fc60b7732c19012793aaaba2df) Signed-off-by: Enrico Jorns <ejo@pengutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: make sure header path is set correctlyAnuj Mittal2016-07-271-1/+0
| | | | | | | | | | | | | | | | | | | | We're setting the native header paths in do_configure_prepend, and don't need to set them again here. This results in gcc-target not being able to locate the headers and not being able to detect glibc version, which in turn results in SSP support not getting detected even though it's available in libc. (From OE-Core master rev: 85630aa894278e7818c867179dc19ca2fbd994fc) (From OE-Core rev: f28840de3912c805acde8d11188f0c48617678ab) Signed-off-by: Anuj Mittal <anujx.mittal@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tzdata: update to 2016eArmin Kuster2016-07-271-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes affecting future time stamps Africa/Cairo observes DST in 2016 from July 7 to the end of October. Guess October 27 and 24:00 transitions. (Thanks to Steffen Thorsen.) For future years, guess April's last Thursday to October's last Thursday except for Ramadan. Changes affecting past time stamps Locations while uninhabited now use '-00', not 'zzz', as a placeholder time zone abbreviation. This is inspired by Internet RFC 3339 and is more consistent with numeric time zone abbreviations already used elsewhere. The change affects several arctic and antarctic locations, e.g., America/Cambridge_Bay before 1920 and Antarctica/Troll before 2005. Asia/Baku's 1992-09-27 transition from +04 (DST) to +04 (non-DST) was at 03:00, not 23:00 the previous day. (Thanks to Michael Deckers.) (From OE-Core master rev: ddcf128e76ed0678ce42416531f4ecb309c57439) (From OE-Core rev: 225f3b4ea4c7c7439bba2b3a85f24ea94d2f47bc) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tzcode: update to 2016eArmin Kuster2016-07-271-4/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | V2: typo in title (jet lagged) Changes to code zic now outputs a dummy transition at time 2**31 - 1 in zones whose POSIX-style TZ strings contain a '<'. This mostly works around Qt bug 53071 <https://bugreports.qt.io/browse/QTBUG-53071>. (Thanks to Zhanibek Adilbekov for reporting the Qt bug.) Changes affecting documentation and commentary tz-link.htm says why governments should give plenty of notice for time zone or DST changes, and refers to Matt Johnson's blog post. tz-link.htm mentions Tzdata for Elixir. (Thanks to Matt Johnson.) (From OE-Core master rev: 5f3340e5c966f4233e0cd4ec468b20a1fd5a7346) (From OE-Core rev: 6d9e6b6fb2c8c6c80a5981b0f91987b433b6ea24) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bluez5: move btmgmt to common READLINE sectionNicolas Dechesne2016-07-271-1/+1
| | | | | | | | | | | | | | Upstream in 5.33 btmgmt was moved from experimental to common READLINE section, in commit e4f0c5582f1fe3451d5588243adba9de1ed68b80, but this was never updated in the recipe. This is a backport from master branch, commit 28777e593d3dd3a5d0ee2effcdca6a971e2887f9. (From OE-Core rev: cbe0648e234e83b8ffc336118d3ee2967b4bb175) Signed-off-by: Nicolas Dechesne <nicolas.dechesne@linaro.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-4448Armin Kuster2016-07-273-0/+1277
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: d4343f428c89c6c238cc7cd4c4732448a00003e4) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-4447Armin Kuster2016-07-272-0/+209
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: b817c98017cb64f902cdae514fb162b3199a0a14) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-3627Armin Kuster2016-07-272-0/+65
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: ceabe39237a035efda6a74c746848a9fbab30a08) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1833Armin Kuster2016-07-272-0/+369
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: 990b5427fd3bf5c00ac7c5820d5f455378776b62) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1835Armin Kuster2016-07-272-0/+96
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: d008b7023cb703a787c8fcac5cd87628b38a9ecd) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1837Armin Kuster2016-07-272-0/+144
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: d0e3cc8c9234083a4ad6a0c1befe02b6076b084c) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-4449Armin Kuster2016-07-272-0/+48
| | | | | | | | | Affects limbxml2 < 2.9.4 (From OE-Core rev: 6f6132dc3aeb0d660c9730f6f33e9194a6098226) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1836Armin Kuster2016-07-272-0/+444
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: 9229873f278f7c24fb01673ec3d9fd404762bc25) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1839Armin Kuster2016-07-272-0/+128
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: 689145fc5ae377eab088ee524c447223be29707f) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1838Armin Kuster2016-07-272-0/+97
| | | | | | | | | Affects libxml2 < 2.9.4 (From OE-Core rev: d24b0ac044e02ec34f74e46ad599ac8bdb10432c) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1840Armin Kuster2016-07-272-0/+38
| | | | | | | | | affects libxml2 < 2.9.4 (From OE-Core rev: 9d894179128771c4a2628c103f5c39e2e6ef13c5) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-4483.patchArmin Kuster2016-07-272-0/+56
| | | | | | | | | affects libxml2 < 2.9.4 (From OE-Core rev: a28fea55f72284d3f4ed85f19f80b8475e726ee6) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1834.patchArmin Kuster2016-07-272-0/+56
| | | | | | | (From OE-Core rev: 233f3b29760c878a3acb3aa0e22b7c252f17e2b3) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-3705Armin Kuster2016-07-272-0/+72
| | | | | | | (From OE-Core rev: aa8ad693a977e104797dd623d7efad705e298eb2) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml2: Security fix for CVE-2016-1762Armin Kuster2016-07-272-0/+86
| | | | | | | (From OE-Core rev: 8a59dc853d2870bc33ef3cc5af202e33b3d7c6c2) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Security fix for CVE-2016-4429Armin Kuster2016-07-272-0/+90
| | | | | | | (From OE-Core rev: 32fd9fed93b896ee50006a95cc9d0209b85268cd) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Security Fix for CVE-2016-3706Armin Kuster2016-07-272-0/+227
| | | | | | | (From OE-Core rev: 0c82ab38064baaf25169d75ddccaa3926b62c7e3) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* toasterconf.json: exclude releases Toaster can't buildElliot Smith2016-06-031-27/+12
| | | | | | | | | | | | | | | Due to changes in master to support Python 3, Toaster is no longer able to build from master. Remove references to master and set default release to jethro. The dizzy release should also be removed, as Toaster jethro is unable to build using this release. (From OE-Core rev: 1f4bfa33073584c25396d74f3929f263f3df188b) Signed-off-by: Elliot Smith <elliot.smith@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to jethro head revisionyocto-2.0.2jethro-14.0.2Richard Purdie2016-05-231-1/+1
| | | | | | (From OE-Core rev: 8979a4546841f47677ba74989aa32f0cb3e2ff12) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* build-appliance-image: Update to jethro head revisionRichard Purdie2016-05-231-1/+1
| | | | | | (From OE-Core rev: 1ef5883b78f35679c4ff20468826d63a98be1539) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gdb: Backport patch to changes with AVX and MPXSaul Wold2016-05-222-0/+2157
| | | | | | | | | | | | | | | | | | The current MPX target descriptions assume that MPX is always combined with AVX, however that's not correct. We can have machines with MPX and without AVX; or machines with AVX and without MPX. This patch adds new target descriptions for machines that support both MPX and AVX, as duplicates of the existing MPX descriptions. The following commit will remove AVX from the MPX-only descriptions. This commit is backported from 7.12 (From OE-Core rev: 059d459d48bd42a282005698c4dc4a3ecbd2d88f) Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: Security Fix CVE-2016-4490Armin Kuster2016-05-172-0/+268
| | | | | | | (From OE-Core rev: 69b1e25a53255433262178b91ab3e328768ad725) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: Security fix CVE-2016-2226Armin Kuster2016-05-172-0/+104
| | | | | | | (From OE-Core rev: 8fc7db068cf6e2a527e10e8333585a16ce628e22) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: Security fix CVE-2016-4489Armin Kuster2016-05-172-0/+57
| | | | | | | (From OE-Core rev: 7bf396e7bdb3faaf900f99f72446f19df1cffe88) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gcc: Security fix CVE-2016-4488Armin Kuster2016-05-172-0/+71
| | | | | | | (From OE-Core rev: 07820907d25970f2c22497415aa6ff95fe43dc40) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: prevent ABI break from earlier jethro releasesJoshua Lock2016-05-141-9/+22
| | | | | | | | | | | | | | | | | | The backported upgrade to 1.0.2h included an updated GNU LD version-script which results in an ABI change. In order to try and respect ABI for existing binaries built against fido this commit partially reverts the version-script to maintain the existing ABI and instead only add the new symbols required by 1.0.2h. Suggested-by: Martin Jansa <martin.jansa@gmail.com> (From OE-Core rev: 480db6be99f9a53d8657b31b846f0079ee1a124f) (From OE-Core rev: 528541845df34843c14be5de62e9f53004d292ac) Signed-off-by: Joshua Lock <joshua.g.lock@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Security Fix CVE-2016-3115Armin Kuster2016-05-142-1/+87
| | | | | | | | | opehssh <= 7.2 (From OE-Core rev: e0df10f586361a18f2858230a5e94ccf9c3cc2f3) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: Security fix CVE-2016-2147Armin Kuster2016-05-143-0/+91
| | | | | | | | | busybox <= 1.24.2 (From OE-Core rev: 0a977091a4a5ee925b44c60bc4b13557696afadb) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* busybox: Security Fix CVE-2016-2148Armin Kuster2016-05-142-0/+75
| | | | | | | | | busybox <= 1.24.2 (From OE-Core rev: 1d7ad5f32ae39f84626bb71ded75439062dd717c) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libtiff: Security fix CVE-2015-8664 and 8683Armin Kuster2016-05-142-0/+138
| | | | | | | | | | CVE-2015-8665 CVE-2015-8683 (From OE-Core rev: 49008750ece710201701a6f413537c857190798a) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: 1.0.2d -> 1.0.2h (mainly for CVEs)Robert Yang2016-05-1115-1950/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * CVEs: - CVE-2016-0705 - CVE-2016-0798 - CVE-2016-0797 - CVE-2016-0799 - CVE-2016-0702 - CVE-2016-0703 - CVE-2016-0704 - CVE-2016-2105 - CVE-2016-2106 - CVE-2016-2109 - CVE-2016-2176 * The LICENSE's checksum is changed because of date changes (2011 -> 2016), the contents are the same. * Remove backport patches - 0001-Add-test-for-CVE-2015-3194.patch - CVE-2015-3193-bn-asm-x86_64-mont5.pl-fix-carry-propagating-bug-CVE.patch - CVE-2015-3194-1-Add-PSS-parameter-check.patch - CVE-2015-3195-Fix-leak-with-ASN.1-combine.patch - CVE-2015-3197.patch - CVE-2016-0701_1.patch - CVE-2016-0701_2.patch - CVE-2016-0800.patch - CVE-2016-0800_2.patch - CVE-2016-0800_3.patch * Update crypto_use_bigint_in_x86-64_perl.patch * Add version-script.patch and update block_diginotar.patch (From master branch) * Update openssl-avoid-NULL-pointer-dereference-in-EVP_DigestInit_ex.patch (From Armin) (From OE-Core rev: bca156013af0a98cb18d8156626b9acc8f9883e3) Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "kernel/kernel-arch: Explicitly mapping between, i386/x86_64 and x86 ↵Tom Zanussi2016-05-112-15/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | for kernel ARCH" This reverts commit a6f52930a68d8462e23486d51cdda715072dd752. In addition to also causing the problem in [YOCTO #9579], this commit was reverted in krogoth and master but wasn't reverted in jethro but should be. The original revert message was: This reverts commit 8d310b24927d0f348fb431895f0583733db2aad0. That commit completely breaks KBUILD_DEFCONFIG because it relies on $ARCH to match between the target OE arch and the kernel subdirectory containing the defconfigs. In the kernel all defconfigs for everything x86-based (including x86_64) is stored in dir arch/x86/configs/ kernel-yocto.bbclass correctly searches for all the defconfigs inside ${S}/arch/${ARCH}/configs/${KBUILD_DEFCONFIG} Commit 8d310b249 makes it search in wrong places and _only_ if you define TARGET_ARCH = "athlon" will it search x86 which is nonsensical. The commit further adds an if clause to hack the mungled kernel arches back to their original values (ugh) in do_shared_workdir which is run after do compile, but of course the build breaks before that in do_kernel_metadata because of the KBUILD_DEFCONFIG mentioned above (so that hack is useless). Please fix that corner case bug in another way which does not completely screw up the kernel arch mapping & defconfig logic. If 64bit configs are generated in the kernel for 32bit machines because the host is asked, then it it a bug in the kernel, it is of no use to hack around it in OE. (From OE-Core rev: bc02a478a5d4a5de7b3943ed809d5c22711f5b1f) (From OE-Core rev: 88e0032f13f635c868c426e963db4d8a6fc42e9d) Signed-off-by: Ioan-Adrian Ratiu <adrian.ratiu@ni.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Tom Zanussi <tom.zanussi@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glew: Correct version in autotooling patchesMartyn Welch2016-05-112-3/+3
| | | | | | | | | | | | | | | The additional autotooling patched into glew claims the version is 1.9.0 whilst we are building 1.12.0. The version in the autotooling is used to set the version number in the pkgconfig file, this results in the configuration of packages which depend on glew > 1.9.0 failing. This patch updates the version number used in the patches to match that of the version being built. (From OE-Core rev: 0ef7c0f30456cc242de331b273b92c1dfe835350) Signed-off-by: Martyn Welch <martyn.welch@collabora.co.uk> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gdb: fix QA warning (uClibc)André Draszik2016-05-111-1/+1
| | | | | | | | | | | | WARNING: QA Issue: gdb rdepends on libiconv, but it isn't a build dependency? [build-deps] We already have virtual/libiconv which is set appropriately in all environments, so let's use it to fix the issue. (From OE-Core rev: 9ae38c3b24b387b02541142d40343d1dd0411c88) Signed-off-by: André Draszik <adraszik@tycoint.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: backport bug fix to the 2.25 branch for jethroTristan Van Berkom2016-05-112-0/+167
| | | | | | | | | | | We fail to build webkit on aarch64 due to this binutils bug: https://sourceware.org/bugzilla/show_bug.cgi?id=19353 Applying patch which fixes this, stripped out changelog entry from patch to make it apply without error. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: Fix CVE-2015-8778Yuanjie Huang2016-05-112-0/+200
| | | | | | | | | | | | | | | | | | CVE: CVE-2015-8778 Improve check against integer wraparound in hcreate_r [BZ #18240] This is an integer overflow in hcreate and hcreate_r which can result in an out-of-bound memory access. This could lead to application crashes or, potentially, arbitrary code execution. Upstream-Status: Backport [2.23] (cherry-picked from commit bae7c7c7, 4bd228c8) (From OE-Core rev: 71b051f51a44dad1fdca7ca6b3552d0aebdc91d3) Signed-off-by: Yuanjie Huang <yuanjie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-16 03:45:28 +0000