summaryrefslogtreecommitdiffstats
path: root/meta
Commit message (Collapse)AuthorAgeFilesLines
...
* xf86-input-libinput: update to 0.28.1Armin Kuster2018-11-141-2/+2
| | | | | | | (From OE-Core rev: ec251cdc481d2e088ed817e651bacdf213fb9ded) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* xkeyboard-config: update to 2.25Armin Kuster2018-11-141-2/+2
| | | | | | | (From OE-Core rev: ff129d24dbd83768c221aa522bd32031fdbc2071) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxcb: update to 1.13.1Armin Kuster2018-11-141-2/+2
| | | | | | | (From OE-Core rev: c3ecf470b0f4d681dd11c366e3fa903c6e13717e) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libx11: update to 1.6.7 and sytle cleanupArmin Kuster2018-11-142-19/+19
| | | | | | | | | refresh Fix-hanging-issue-in-_XReply.patch (From OE-Core rev: 7edcf4f5b54ae713ede600f6c43ae955320efe69) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsm: update to 1.2.3Armin Kuster2018-11-141-4/+4
| | | | | | | | | reoder things per style (From OE-Core rev: 4e22f40647014dbd9eb05f0a9becd90fd903e7b1) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssh: Update to 7.9 primarily bug fixesArmin Kuster2018-11-141-1/+1
| | | | | | | | | see: https://lwn.net/Articles/768991/ (From OE-Core rev: d9b69aa41bc0b768698b132b9805a8abf0fac40d) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libpcre2: update to 10.32Armin Kuster2018-11-141-3/+3
| | | | | | | | | | | LIC_FILES_CHKSUM changed do to typo fixes and tidies for 10.32 see: https://www.pcre.org/changelog.txt (From OE-Core rev: e619b06dd8b66b802dd87174cfa57bd6a4a47e93) Signed-off-by: Armin Kuster <akuster808@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gnutls: update to 3.6.4Armin Kuster2018-11-141-2/+2
| | | | | | | | | | | | | | | | | Notable change: libgnutls: Added the final (RFC8446) version numbering of the TLS1.3 protocol. see: https://lists.gnupg.org/pipermail/gnutls-help/2018-September/004457.html (From OE-Core rev: 0697141e7be0b755db600aa0d5a975eac62cc7b8) Signed-off-by: Armin Kuster <akuster808@gmail.com> -- [v2] Fix typo in version in subject Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nspr: Update to 4.20Armin Kuster2018-11-144-168/+14
| | | | | | | | | | RISC-v support now included in this release so drop patch. and refresh patches (From OE-Core rev: 800f4bd6f9fa18ed68f14f5e6e12be3499fb8038) Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: actually apply latest CVE patchesRoss Burton2018-11-091-0/+3
| | | | | | | (From OE-Core rev: f0394e80a37f1da47042a1aa0487594f390603f9) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* unzip: actually apply CVE-2018-18384Ross Burton2018-11-091-0/+1
| | | | | | | (From OE-Core rev: d8e1b7afc536f989e7e6efdab0998d54f26ad1f6) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest/recipetool: Fix problems from changing upstream sourceMohamad Noor Alim Hussin2018-11-091-2/+2
| | | | | | | | | | | | The upstream source tarball checksums changed. Use the copy from our source mirror to avoid failures. [YOCTO #12979] (From OE-Core rev: e97a31e6bbaec5cb56d4750bf5171dbba510ee33) Signed-off-by: Mohamad Noor Alim Hussin <mohamad.noor.alim.hussin@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* image-buildinfo,oeqa/selftest/containerimage: Ensure image-buildinfo doesn't ↵Richard Purdie2018-11-092-0/+3
| | | | | | | | | | | | | | | | | | | break tests Having image-buildinfo enabled causes containerimage.ContainerImageTests.test_expected_files to fail due to the presence of an unexpected file: ['./', './etc/', - './etc/build', './etc/default/', './etc/default/postinst', Tweak the class to allow it to be disabled and disable it from the test just in case it was enabled. (From OE-Core rev: af67bf422a4df5b7e07894512ff73a5f493682ab) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* valgrind: drop mips n32 supportRandy MacLeod2018-11-092-0/+2
| | | | | | | | | | | | | | | | | valgrind for qemumips64 multilib builds fails to configure for libn32 with the error: configure:6190: checking for 32 bit build support ... fatal error: bits/long-double-32.h: No such file or directory It seems that the toolchain is producing: tmp-glibc/sysroots-components/mips64-n32/libn32-glibc/usr/include/bits/long-double-n32.h Until the toolchain problem is resolved, skip valgrind for libn32. (From OE-Core rev: 17d5574f05384edeb5c80ada2724fff4a1c3c94b) Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest: Standardize json logging output directoryYeoh Ee Peng2018-11-091-1/+1
| | | | | | | | | | | | Currently sdk & sdkext will output json file to LOG_DIR, while selftest will output json file to TOPDIR/log. Standardize selftest json output file to LOG_DIR. (From OE-Core rev: 2012d6b076fc833864a0254d56d78536314a6799) Signed-off-by: Yeoh Ee Peng <ee.peng.yeoh@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* glibc: make ld-2.28.so reproducible on armMartin Hundebøll2018-11-091-0/+13
| | | | | | | | | | | Play the whack-a-mole game and add the .file directive to another assembly file that otherwise shows itself in ld-2.28.so debug file, which in turns alters the build-id of ld-2.28.so on target. (From OE-Core rev: 4cbf901b3a127ed039371e614946002d26d56997) Signed-off-by: Martin Hundebøll <martin@geanix.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* base.bbclass: avoid 'find -ignore_readdir_race -delete'Matthias Schiffer2018-11-091-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | Due to a bug in find [1], -ignore_readdir_race does not work correctly with -delete. This can lead to spurious build failures when files disappear while such a command is running; specifically this was seen in the case of do_configure and do_populate_lic running concurrently for packages with ${B} == ${WORKDIR}: find: '.../sstate-build-populate_lic': No such file or directory While the issue is fixed in the findutils git master, the find command of the host system is called here, so we can't ensure that the used version contains the fix. Many common distros have not updated to a recent enough findutils version yet (Ubuntu 18.10 contains the fix, while 18.04 is still affected). Work around the issue by passing the output of find to 'rm -f' instead of using -delete. [1] https://savannah.gnu.org/bugs/?52981 (From OE-Core rev: 8079e2d62e23f7c274f46185e6dad64fa95394c1) Signed-off-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* binutils: fix four CVE issuesZhixiong Chi2018-11-095-0/+506
| | | | | | | | | Backport the CVE patches from the binutils upstream. (From OE-Core rev: 84bb9c0514ecbd7c31935c22062b18b4aaefbef1) Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perf: Disable libunwind for ARC & RISCV64Alexey Brodkin2018-11-071-0/+4
| | | | | | | | | | | | | | | | libunwind is not yet ported for ARC & RISCV64 and on attempt to build it for those arches we just get an error message. If we explicitly disable libunwind it is gracefully handled by perf build system and it just gets configured to not use it so perf is still usable even on those arches. (From OE-Core rev: bb06900a1f29fdd4066f6d7e7a961d230c2e9438) Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com> Cc: Khem Raj <raj.khem@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apt: update SRC_URIChangqing Li2018-11-071-1/+1
| | | | | | | | | | update SRC_URI since previous link is not valid now (From OE-Core rev: 0b5972c8189dade0e77df175651b8d8707647bb1) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* archiver: Drop unwanted directoriesFabien Lahoudere2018-11-071-1/+9
| | | | | | | | | | | | | In sources directory we can find patches/ and temp/. The first one is filled with symbolic link unusable on another machines. The second contains yocto logs to create this archives and are typically copied when 'S = "${WORKDIR}"' (From OE-Core rev: 3904f98851c6a63dd9377e38f1432be6b1c0a94d) Signed-off-by: Fabien Lahoudere <fabien.lahoudere@collabora.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* meta: Use double colon for chown OWNER:GROUPKosta Zertsekel2018-11-073-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | Rationale - excerp from `info chown` ==================================== OWNER‘:’GROUP If the OWNER is followed by a colon and a GROUP (a group name or numeric group ID), with no spaces between them, the group ownership of the files is changed as well (to GROUP). Some older scripts may still use ‘.’ in place of the ‘:’ separator. POSIX 1003.1-2001 (*note Standards conformance::) does not require support for that, but for backward compatibility GNU ‘chown’ supports ‘.’ so long as no ambiguity results. New scripts should avoid the use of ‘.’ because it is not portable, and because it has undesirable results if the entire OWNER‘.’GROUP happens to identify a user whose name contains ‘.’. (From OE-Core rev: 185918234a07cb506d7d7464a49ac33972c7d963) Signed-off-by: Kosta Zertsekel <zertsekel@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/selftest: Add test for Yocto source mirror functionality/completenessRichard Purdie2018-11-071-0/+23
| | | | | | | | | | | | | | We've had a number of occasions where the Yocto Project source mirrors have not been complete or functioning correctly. This adds a test so that if this happens we find out out it sooner. It also only works over http meaning we should be able to test that anyone behind an http only proxy (no git protocol) also has functional fetches for OE-Core and layers built by the core of the project. (From OE-Core rev: 9a25b2eb9cc13dd77a774dad83067ea5f9bf9716) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgpg-error: Support build for native on ppc64/ppc64le hostsSerhey Popovych2018-11-071-0/+2
| | | | | | | | | | | | | | | | | | | Both RHEL and SLES uses ppc64/ppc64le for powerpc 64 bit big/little endian targets instead of powerpc64/powerpc64le in libgpg-error. Also libgpg-error provides common target system names in form like <arch>-unknown-linux-gnu. Add mapping for ppc64/ppc64le targets to their libgpg-error equivalents to fix native builds. Cross build for arm64 tested on IBM Power 8 machine with RHEL7 for ppc64le variant only, but should work for ppc64 as well. (From OE-Core rev: f1af780769477f06eb925fd87c844baba04ada2d) Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* v86d: Make cross compilation working on more architecturesSerhey Popovych2018-11-073-20/+36
| | | | | | | | | | | | | | | | | | Since commit 709c603dec19 ("v86d: Accept aarch64 as build host") we support cross compilation on aarch64 host in addition to x86 host. However building on hosts different than two above will fail. Make cross compilation support more generic by checking for TARGET_ARCH in v86d configure script with fallback to `uname -m` when not present in environment and pass TARGET_ARCH explicitly in do_configure(). Cross build for x86 tested on IBM Power 8 machine with RHEL7. Should work on aarch64 and rest too. (From OE-Core rev: 69f7579eb36c00b557225377e1a3cc61b103be23) Signed-off-by: Serhey Popovych <serhe.popovych@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oe-init-buildenv/base: Relax python version checks in favour of HOSTTOOLS ↵Richard Purdie2018-11-072-1/+8
| | | | | | | | | | | | | | manipulation Several distros are now shipping "python" as python v3 contra to the original python guidelines. This causes users confusion/pain in trying to use our tools. We can just force "python" to "python2" within HOSTTOOLS to avoid this issue and hide the complexity from the user. (From OE-Core rev: b06a6cde5c5503f456f260c773cf126085e18c8d) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* oeqa/runtime/ptest: Inject results+logs into stored json results fileRichard Purdie2018-11-072-2/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This allows the ptest results from ptest-runner, run in an image to be transferred over to the resulting json results output. Each test is given a pass/skip/fail so individual results can be monitored and the raw log output from the ptest-runner is also dumped into the results json file as this means after the fact debugging becomes much easier. Currently the log output is not split up per test but that would make a good future enhancement. I attempted to implement this as python subTests however it failed as the output was too confusing, subTests don't support any kind of log output handling, subTest successes aren't logged and it was making things far more complex than they needed to be. We mark ptest-runner as "EXPECTEDFAILURE" since its unlikely every ptest will pass currently and we don't want that to fail the whole image test run. Its assumed there would be later analysis of the json output to determine regressions. We do have to change the test runner code so that 'unexpectedsuccess' is not a failure. Also, the test names are manipuated to remove spaces and brackets with "_" used as a replacement and any duplicate occurrences truncated. (From OE-Core rev: a13e088942e2a3c3521e98954a394e61a15234e8) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* crosssdk: Remove usage of host flags for cross-compilationRichard Purdie2018-11-071-4/+4
| | | | | | | | | | | | | | | | | | | Similarlly to OE-Core rev 4b936cde58ca0a6f34092ce82640a02859110411 for cross.sdk, BUILD_* flags can't be used as TARGET_* flags gcc-crosssdk buils leaks config.log's through "gcc-stashed-builddir" and TARGET_* flags to libgcc cross-build through "gcc/libgcc.mvars" file on "gcc-stashed-builddir". This means that if BUILD_CFLAGS contains host-specific flags like "-isystem/usr/include" libgcc build will fail "do_qa_configure" and "do_package_qa" checks. Remove host-related flags from TARGET_* flags for gcc-crosssdk builds. [YOCTO #11874] (From OE-Core rev: 6e162e619b6f5173c073cd9bedbcadf205017e30) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: Change from TARGET_ARCH to TUNE_PKGARCHRichard Purdie2018-11-074-5/+5
| | | | | | | | | | | | | | | | | Right now go-cross is changing signatures when you change TUNE for a given architecture. In particular this breaks layer tests like: yocto-check-layer ../meta-yocto-bsp/ --machines qemuarm beaglebone-yocto This changes the PN addtion to something containing the tune rather than the arch which avoids these kinds of errors. If go-cross can be tune independent that would be nice but currently that isn't the case. [YOCTO #12586] (From OE-Core rev: e3c7e1703499e6a5332d9ab8a941671ec8235c4f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go-dep: disable PTEST_ENABLED for mips and mips64Chen Qi2018-11-071-0/+5
| | | | | | | | | | | | | The current go-dep does not compile ptest successfully on mips and mips64. So as a workaround, disable PTEST_ENABLED explicitly to avoid error like below. | vet config not found (From OE-Core rev: 786322ec408e2ef5cd6fb809456e0453e5f5e162) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: add python3-venv to the python3-modules RDEPENDSRoss Burton2018-11-071-0/+1
| | | | | | | (From OE-Core rev: ed5e7541677f6a046f85389cd0c879be3db422cd) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* python3: Fix python3-pyvenv run-time dependencyHugues Kamba2018-11-072-2/+18
| | | | | | | | | | | | | | | | | | | | | | | Pyvenv is just a small script that uses venv to create virtual environments. https://www.python.org/dev/peps/pep-0405/#creating-virtual-environments This patch adds the python3-venv module as a self-contained package which python3-pyvenv must depend on at run-time. The patch also provides the package python3-pyvenv from the pyhton3-venv package.This is good for future-proofing since python3-pyvenv has been deprecated and only python3-venv is now available in Python 3.6. https://docs.python.org/3/library/venv.html. Without this patch python3-pyvenv is broken because it is missing the venv module at run-time. This patch specifies the newly created python3-venv as a run-time dependency of python3-pyvenv. (From OE-Core rev: effa141bfce55aab25142ee578c95383c755ad73) Signed-off-by: Hugues Kamba <hugues.kamba@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* gdbm: fix ptest failureChen Qi2018-11-071-1/+1
| | | | | | | | | | Some of gdbm's ptest cases require gdbmtool, which is packaged into ${PN}-bin. So extend the RDEPENDS_${PN}-ptest to include the package. (From OE-Core rev: e188a75aa882efc98b8390f43f18279c3707314a) Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* pixman: Trim license info extracted from pixman-matrix.cPeter Kjellerstedt2018-11-071-1/+1
| | | | | | | | | | | Four unrelated lines were extracted from pixman-matrix.c for the license information. License-Update: Only extract the relevant part from pixman-matrix.c (From OE-Core rev: d0a209e8cf29d982567e3978e1dcbb3871505a39) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libgpg-error: Trim license info extracted from init.c & gpg-error.h.inPeter Kjellerstedt2018-11-071-2/+2
| | | | | | | | License-Update: Only extract relevant parts from init.c & gpg-error.h.in (From OE-Core rev: a5c1ff6deb6393666745889eee8297112848ba28) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr-util: Trim license info extracted from apu_version.hPeter Kjellerstedt2018-11-071-1/+1
| | | | | | | | | | | Two unrelated lines were extracted from apu_version.h for the license information. License-Update: Only extract the relevant part from apu_version.h (From OE-Core rev: 2edb0f24a13f27b2fae94fb447221ad2ddb924a0) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* apr: Trim license info extracted from apr_lib.hPeter Kjellerstedt2018-11-071-1/+1
| | | | | | | | | | | Two unrelated lines were extracted from apr_lib.h for the license information. License-Update: Only extract the relevant part from apr_lib.h (From OE-Core rev: 90ab83ecc509c2fdc1f6083d771031decdcaad63) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* common-licenses: Correct the FreeType license textPeter Kjellerstedt2018-11-071-2/+2
| | | | | | | | | | It now matches: http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/FTL.TXT (From OE-Core rev: 9dcb393551b65c8b674f625e90171b512f5e5a60) Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* reproducible_build: update do_deploy_source_date_epoch commmentDouglas Royds2018-11-071-1/+4
| | | | | | | | | | | | Once the value of SOURCE_DATE_EPOCH is determined, it is stored in the recipe's SDE_FILE. If none of the existing mechanisms are suitable, replace the do_deploy_source_date_epoch task with recipe-specific functionality to write the appropriate SOURCE_DATE_EPOCH into the SDE_FILE. (From OE-Core rev: e7b891b76954c784f5a93bd0a1c91315673ce40d) Signed-off-by: Douglas Royds <douglas.royds@taitradio.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* curl: fix for CVE-2018-16839/CVE-2018-16840/CVE-2018-16842Changqing Li2018-11-073-0/+113
| | | | | | | (From OE-Core rev: 0f0db9fc8512a0ecd0cdba3304a195cd925a5029) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix CVE-2018-0735 for 1.1.1Kai Kang2018-11-072-0/+51
| | | | | | | | | Backport patch to fix CVE-2018-0735 for openssl 1.1.1. (From OE-Core rev: 78e751e33d3ec4394d96391e737cc39cad960ebe) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* openssl: fix CVE-2018-0734 for both 1.0.2p and 1.1.1Kai Kang2018-11-074-0/+143
| | | | | | | | | | Backport patches to fix CVE-2018-0734 for both openssl 1.0.2p and 1.1.1 versions. (From OE-Core rev: 9d5c6a87eb72a8b8b8d417126a831565982ca9a6) Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ghostscript: fix CVE-2018-18284Hongxu Jia2018-11-072-0/+246
| | | | | | | | | | | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator. (From OE-Core rev: 98ab5c5770d20b39bf3c58083f31f31838f2e940) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ghostscript: fix CVE-2018-18073Hongxu Jia2018-11-073-0/+241
| | | | | | | | | | | Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object. (From OE-Core rev: 6098c19e1f179896af7013c4b5db3081549c97bc) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ghostscript: fix CVE-2018-17961Hongxu Jia2018-11-076-0/+806
| | | | | | | | | | | | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incomplete fix for CVE-2018-17183. (From OE-Core rev: 6c32ea184941d292cd8f0eb898e6cc90120ada40) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* elfutils: fix CVE-2018-18520 & CVE-2018-18521 & CVE-2018-18310Hongxu Jia2018-11-074-0/+139
| | | | | | | | | | These CVE fixes come from upstream master branch and no new version released, so backport rather than upgrade. (From OE-Core rev: bd8d2c25f595e30a3fdcad8a2409913bb8af7c5c) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* elfutils: 0.173 -> 0.174Hongxu Jia2018-11-075-1015/+22
| | | | | | | | | | | | | | - Drop backport fixes CVE-2018-16062.patch 0001-libdw-Check-end-of-attributes-list-consistently.patch 0002-libelf-Return-error-if-elf_compress_gnu-is-used-on-S.patch - Rebase 0008-build-Provide-alternatives-for-glibc-assumptions-hel.patch (From OE-Core rev: 777c1f8b6e20643964c304400e2d746dc2926524) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* nasm: fix CVE-2018-1000667Hongxu Jia2018-11-072-0/+38
| | | | | | | | | | Since the latest nasm is 2.14rc16 (not formal release), so backport a patch to 2.13 to fix CVE-2018-1000667. (From OE-Core rev: 024b395425c95a08c881d922c310be78ffad483a) Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* unzip: fix for CVE-2018-18384Changqing Li2018-11-071-0/+39
| | | | | | | (From OE-Core rev: 2ddb3b25ed063b47d3fe2b3e9e17b7f9d0e2a7e5) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* qemu: fix for CVE-2018-10839Changqing Li2018-11-071-0/+52
| | | | | | | (From OE-Core rev: 5c2b164e1022c46f6bf541894429773c3dde7af2) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-11 16:14:21 +0000