linux/meta-el-common.git/recipes-support, branch pyro

Merge "libcroco: Fix CVE-2017-7961" into pyro

2018-10-29T11:00:01+00:00

libcroco: Fix CVE-2017-7961

2018-10-26T09:22:41+00:00

libcroco in the upstream pyro is 0.6.11. CVE: CVE-2017-7961 Reference: CVE-2017-7961 https://gitlab.gnome.org/GNOME/libcroco/commit/9ad72875e9f08e4c519ef63d44cdbd94aa9504f7 Change-Id: I7769b73a81e012d52309e0f47b24d99b23eb4a05 Signed-off-by: Andreas Wellving Signed-off-by: Adrian Mangeac

curl: Fix CVEs

2018-10-25T13:26:08+00:00

CVE: CVE-2018-1000120 CVE-2018-1000121 CVE-2018-1000122 CVE-2018-1000301 Curl in the upstream pyro is 7.53.1. CVE-2018-1000120 affected versions are 7.12.3 to and including 7.58.0 CVE-2018-1000121 affected versions are 7.21.0 to and including 7.58.0 CVE-2018-1000122 affected versions are 7.20.0 to and including 7.58.0 CVE-2018-1000301 affected versions are 7.20.0 to and including 7.59.0 Reference: CVE-2018-1000120 https://curl.haxx.se/CVE-2018-1000120.patch CVE-2018-1000121 https://curl.haxx.se/CVE-2018-1000121.patch CVE-2018-1000122 https://curl.haxx.se/CVE-2018-1000122.patch CVE-2018-1000301 https://curl.haxx.se/CVE-2018-1000301.patch Change-Id: I0b7269c83e1662ed16a1b216853c3b4408889954 Signed-off-by: Andreas Wellving Signed-off-by: Adrian Mangeac

curl: fix for CVE-2018-1000005

2018-03-02T12:38:13+00:00

HTTP/2 trailer out-of-bounds read An out-of-bounds read in code handling HTTP/2 trailers was found. This could lead to a denial-of-service or an information disclosure in some circumstances. Affected versions: libcurl 7.49.0 to and including 7.57.0 Upstream patch: https://github.com/curl/curl/commit/fa3dbb9a147488a294.patch Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

curl: security fix for CVE-2017-8817

2017-12-06T10:34:56+00:00

FTP wildcard out of bounds read References: https://curl.haxx.se/docs/adv_2017-ae72.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8817 Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

curl: security fix for CVE-2017-8816

2017-12-06T10:34:56+00:00

NTLM buffer overflow via integer overflow References: https://curl.haxx.se/docs/adv_2017-12e7.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8816 Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

curl: Security fix for CVE-2017-1000257

2017-12-06T10:34:56+00:00

IMAP FETCH response out of bounds read References: https://curl.haxx.se/docs/adv_20171023.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000257 Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

curl: Security fix for CVE-2017-1000254

2017-12-06T10:34:56+00:00

FTP PWD response parser out of bounds read References: https://curl.haxx.se/docs/adv_20171004.html https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000254 Signed-off-by: Sona Sarmadi Signed-off-by: Adrian Dudau

libtasn1: Drop duplicate CVE patch

2017-11-24T14:06:10+00:00

The patch is already applied in upstream poky/pyro. Signed-off-by: Adrian Dudau

curl: Drop CVE patches

2017-11-24T14:06:10+00:00

These CVEs have been fixed in upstream poky/pyro. Signed-off-by: Adrian Dudau