linux/poky.git, branch yocto-3.0.4

build-appliance-image: Update to zeus head revision

2020-08-14T16:56:00+00:00

(From OE-Core rev: 9cad716656b427e625a470a820b8b29b1ec9f976) Signed-off-by: Richard Purdie

poky.conf: Bump version for 3.0.4 zeus release

2020-08-14T16:55:48+00:00

(From meta-yocto rev: 6cd2fc85bd6a40474b21b83408c0a57bb819649f) Signed-off-by: Richard Purdie

libpcre: Add fix for CVE-2020-14155

2020-08-12T09:53:51+00:00

Added below patch in libpcre CVE-2020-14155.patch This patch fixes below error: PCRE could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in libpcre via a large number after (?C substring. By sending a request with a large number, an attacker can execute arbitrary code on the system or cause the application to crash. Tested-by: Rahul Taya (From OE-Core rev: 3f536edfa56ce3f93223c23ed48427a0c24ede1a) Signed-off-by: Saloni Jain Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

go: Security Advisory - go - CVE-2020-15586

2020-08-12T09:53:51+00:00

Backport patch from to solve CVE-2020-15586. (From OE-Core rev: 0e8526ce8694ebd6988c3804e4d2ccf39cda90c7) Signed-off-by: Li Zhou Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

pypi.bbclass: use new pypi UPSTREAM_CHECK_URI

2020-08-12T09:53:51+00:00

Upstream https://pypi.python.org/pypi/${PYPI_PACKAGE}/ redirects to https://pypi.org/project/${PYPI_PACKAGE}/ (From OE-Core rev: b535360f0bd2fb6a057b678f35da1803a31eeba6) Signed-off-by: Tim Orling Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman (cherry picked from commit e5f3f961242d888f3f786af8f793bf1d247fdff0) [Yocto # 13990] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

pypi.bbclass: mind package suffix on version check

2020-08-12T09:53:51+00:00

Some pypi packages do have suffixes like dev, or a0 or b1. When doing a version check on these, the version will get falsely identified as major release versions. Add a terminating slash to rule out those false positives (From OE-Core rev: 13b145b9551884534f1dd2446eccfc55abc25f38) Signed-off-by: Konrad Weihmann Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman (cherry picked from commit 0603f6d9f2abfa67b99b1bc39228f6aa16a0370d) [Yocto bug #13990] Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

gstreamer1.0: fix builds with make 4.3

2020-08-04T22:17:38+00:00

Depend on make-native instead of using host make to avoid errors like: | controller-enumtypes.c:10:1: error: stray '\' in program | 10 | \#include "gstinterpolationcontrolsource.h" | | ^ | controller-enumtypes.c:10:2: error: stray '#' in program | 10 | \#include "gstinterpolationcontrolsource.h" | | ^ | controller-enumtypes.c:10:11: error: expected '=', ',', ';', 'asm' or '__attribute__' before string constant | 10 | \#include "gstinterpolationcontrolsource.h" | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | controller-enumtypes.c:11:1: error: stray '\' in program | 11 | \#include "gstlfocontrolsource.h" | | ^ | controller-enumtypes.c:11:2: error: stray '#' in program | 11 | \#include "gstlfocontrolsource.h" This helps building on autobuilder where some workers have buildtools with make 4.3 installed. Building using meson works fine so later branches are not affected and upstream has rejected patches to fix this: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/515 (From OE-Core rev: 74e22d0d2b61d0014f408972725469bb7a024622) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

core: glib-2.0: fix requested libmount/mkostemp/selinux not being linked in

2020-08-04T22:17:38+00:00

Since 010202076760 ("meson.bbclass: avoid unexpected operating-system names"), meson is no longer used with a cross file that appends the used libc to the operating system name, e.g. linux-gnueabi. Prior to that commit, the host_system == 'linux' checks in glib's meson failed, which led to glib being compiled without libmount, mkostemp and selinux even if explicitly requested. As the aforementioned commit affects all recipes built by glib, it might not be a candidate for backporting to current stable branches. To fix just the glib issue, instances of host_system == 'linux' are patched locally. The patch is marked as Upstream-Status: Inappropriate as it is rendered unnecessary for OE releases newer than Dunfell. (From OE-Core rev: 2adcc5ade62fe10715a6c943565f71efe7627229) Signed-off-by: Ahmad Fatoum Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

glibc: CVE-2020-6096

2020-08-04T22:17:38+00:00

Backport the CVE patch from the upstream: git://sourceware.org/git/glibc.git commit 79a4fa341b8a89cb03f84564fd72abaa1a2db394 commit beea361050728138b82c57dda0c4810402d342b9 (From OE-Core rev: 9059f720f00f7b8dfac89d842ad19876eae201d5) Signed-off-by: Zhixiong Chi Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie

nss: Fix CVE-2020-12399

2020-08-04T22:17:38+00:00

Master (nss version 3.54) is not affected by this issue. This is a backport from nss version 3.54. NSS has shown timing differences when performing DSA signatures, which was exploitable and could eventually leak private keys. This vulnerability affects Thunderbird < 68.9.0, Firefox < 77, and Firefox ESR < 68.9. Upstream patch: https://hg.mozilla.org/projects/nss/rev/daa823a4a29bcef0fec33a379ec83857429aea2e (From OE-Core rev: c447b32c1ec0c117748a4be68dda02d375c81b85) Signed-off-by: Ovidiu Panait Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie