linux/meta-el-common.git/recipes-devtools, branch pyro

Merge "python: Fix CVEs" into pyro

2018-10-29T11:00:47+00:00

python: Fix CVEs

2018-10-26T10:01:51+00:00

CVE: CVE-2017-1000158 CVE-2018-1060 CVE-2018-1061 CVE-2017-1000158 python in the upstream pyro is 2.7.13 CVE-2018-1060 - python in the upstream pyro is 2.7.13 CVE-2018-1061 - python in the upstream pyro is 2.7.13 Reference: CVE-2017-1000158 https://github.com/python/cpython/commit/c3c9db89273fabc62ea1b48389d9a3000c1c03ae CVE-2018-1060 https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b CVE-2018-1061 https://github.com/python/cpython/commit/937ac1fe069a4dc8471dff205f553d82e724015b Change-Id: I09dc5e7d1754c00d4bcdf57b1124370e3d790e5a Signed-off-by: Andreas Wellving Signed-off-by: Adrian Mangeac

perl: Fix CVE-2018-6913

2018-10-26T09:25:15+00:00

CVE: CVE-2018-6913 perl in the upstream pyro is 5.24.1. Reference: CVE-2018-6913 https://rt.perl.org/Public/Ticket/Attachment/1480002/799836/0001-perl-131844-fix-various-space-calculation-issues-in-.patch Change-Id: I0b728e9d8752d625d674a82cf4269f8abc880889 Signed-off-by: Andreas Wellving Signed-off-by: Adrian Mangeac

DPKG: Fix and test case for CVE-2017-8283

2017-12-14T14:31:54+00:00

Directory Traversal Vulnerability References: https://nvd.nist.gov/vuln/detail/CVE-2017-8283 http://www.securityfocus.com/bid/98064/info Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

run-postinsts: don't call update-rc.d if systemd is present

2017-12-06T10:43:12+00:00

This patch removes the call to update-rc.d in order to fix the console login issue for the Cavium board. Signed-off-by: Gabriel Ionescu Signed-off-by: Adrian Dudau

run-postinsts: Disable dpkg --configure for debs to fix boot lockup

2017-11-22T10:46:21+00:00

When a board boots for the first time, it executes run-postinsts.service and dpkg-configure.service. Since both services run dpkg --configure, it sometimes results in locking up the login service. This patch disables the execution of dpkg --configure from run-postinsts by removing the deb keyword from the list of scanned packet types. Signed-off-by: Gabriel Ionescu Signed-off-by: Adrian Dudau

qemu: CVE-2017-5931

2017-09-18T11:54:31+00:00

Fixes integer overflow in in handling virtio-crypto requests Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5931 Signed-off-by: Sona Sarmadi Signed-off-by: Martin Borg

qemu: CVE-2017-8309

2017-08-29T11:32:58+00:00

Qemu built with the Audio subsystem support is vulnerable to a host memory leakage issue. It could occur if a guest user was to repeatedly start and stop audio capture. A privileged user inside guest could use this flaw to exhaust host memory, resulting in DoS. Reference: ========== https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-8309 Upstream patch: https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05587.html Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

qemu: CVE-2017-6505

2017-08-29T11:32:30+00:00

Quick Emulator built with the USB OHCI Emulation support is vulnerable to an infinite loop issue. It could occur while processing an endpoint list descriptor in ohci_service_ed_list(). A guest user/process could use this flaw to crash Qemu process resulting in DoS. References: ========== https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-6505 Upstream patch: http://git.qemu-project.org/?p=qemu.git;a=commitdiff;h=95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

qemu: CVE-2017-7471

2017-08-29T11:31:52+00:00

Qemu built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host. References: ========== https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7471 Upstream patch: http://git.qemu-project.org/?p=qemu.git;a=commitdiff;h=96bae145e27d4df62671b4eebd6c735f412016cf Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau