Mirror of git.openembedded.org/meta-openembedded https://git.enea.com/cgit/linux/meta-openembedded.git/atom?h=yoe%2Fmut 2017-11-16T00:34:05+00:00 2017-11-16T00:34:05+00:00 Paul Barker pbarker@toganlabs.com 2017-11-05T22:07:26+00:00 urn:sha1:57492d40b569f0bfbfcf351b363d76f714e41729 This update addresses the following CVEs: - CVE-2017-1000116 - CVE-2017-1000115 We can also drop the patch for CVE-2017-9462 as it's incorporated into this release. Signed-off-by: Paul Barker <pbarker@toganlabs.com> Signed-off-by: Armin Kuster <akuster808@gmail.com> 2017-06-19T17:29:37+00:00 Zhixiong Chi zhixiong.chi@windriver.com 2017-06-15T06:05:02+00:00 urn:sha1:a3bd8e6b3d664d050fe7590869d108002973ad7a Backport the CVE patch from https://www.mercurial-scm.org/repo/hg/rev/77eaf9539499 "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name. CVE: CVE-2017-9462 Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>