linux/poky.git/meta/recipes-connectivity, branch morty

portmaper: checkuri fails.

2018-03-04T11:12:12+00:00

ERROR: portmap-6.0-r9 do_checkuri: Fetcher failure for URL: 'http://www.sourcefiles.org/Networking/Tools/Miscellanenous/portmap-6.0.tgz'. URL http://www.sourcefiles.org/Networking/Tools/Miscellanenous/portmap-6.0.tgz doesn't work change to fossies [ Yocto #12453 ] (From OE-Core rev: 1c98acf52b702a2bc39e20c8a27850c830063bb4) (From OE-Core rev: ae55f908420de9d68426f6e9159c8efa1ba1b337) Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

bluez5.inc: set CVE_PRODUCT to bluez

2018-01-07T17:10:09+00:00

bluez is the product name in NVD database for CVE's like: https://nvd.nist.gov/vuln/detail/CVE-2016-7837 (From OE-Core rev: 3ca903e5305ad2236ecf763e241a26f4df18e278) Signed-off-by: Mikko Rapeli Signed-off-by: Ross Burton (cherry picked from commit aade84aa54bb2f958572623ed6464184efd19862) Signed-off-by: Ruslan Ruslichenko Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

ppp: include netinet/in.h before linux/in.h in pppoe.h

2017-11-21T14:43:56+00:00

The patch ppp-fix-building-with-linux-4.8.patch tries to fix build error with 4.8 or newer linux headers, but it would break building with kernel < 4.8. There is a better solution to fix this issue in upstream. Backport the upstream patch and replace the old one. [YOCTO #10457] (From OE-Core rev: 6e50f316db897c1d64026b3d21acec7712e4cc09) Signed-off-by: Yi Zhao Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

wpa_supplicant: fix WPA2 key replay security bug

2017-10-16T22:47:06+00:00

WPA2 is vulnerable to replay attacks which result in unauthenticated users having access to the network. * CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake * CVE-2017-13078: reinstallation of the group key in the Four-way handshake * CVE-2017-13079: reinstallation of the integrity group key in the Four-way handshake * CVE-2017-13080: reinstallation of the group key in the Group Key handshake * CVE-2017-13081: reinstallation of the integrity group key in the Group Key handshake * CVE-2017-13082: accepting a retransmitted Fast BSS Transition Reassociation Request and reinstalling the pairwise key while processing it * CVE-2017-13086: reinstallation of the Tunneled Direct-Link Setup (TDLS) PeerKey (TPK) key in the TDLS handshake * CVE-2017-13087: reinstallation of the group key (GTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame * CVE-2017-13088: reinstallation of the integrity group key (IGTK) when processing a Wireless Network Management (WNM) Sleep Mode Response frame Backport patches from upstream to resolve these CVEs. (From OE-Core rev: c79b479ab4b129007c6679bb0bdd8e2ec7ecb6ad) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

bluez5: fix out-of-bounds access in SDP server (CVE-2017-1000250)

2017-10-10T16:27:39+00:00

All versions of the SDP server in BlueZ 5.46 and earlier are vulnerable to an information disclosure vulnerability which allows remote attackers to obtain sensitive information from the bluetoothd process memory. This vulnerability lies in the processing of SDP search attribute requests. (From OE-Core rev: 8878d599cbc48b700f393d94657fe39db06fd533) Signed-off-by: Ross Burton Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

neard: Fix parallel build issue

2017-09-11T16:15:55+00:00

This only started showing up now for some reason but it does seem like a legitimate bug in Makefile.am. (From OE-Core rev: f43290f6e302dbacf5581d1fe1c6c991dd387779) (From OE-Core rev: 56eae27b3a7bd938d6959e5b671fc48ea2ab80c7) Signed-off-by: Jussi Kukkonen Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

connman: Fix for CVE-2017-12865

2017-09-04T16:38:09+00:00

dnsproxy: Fix crash on malformed DNS response If the response query string is malformed, we might access memory pass the end of "name" variable in parse_response(). [YOCTO #11959] (From OE-Core rev: fb3e30e45eea2042fdb0b667cbc2c79ae3f5a1a9) (From OE-Core rev: 55a5a609e7c25fa3e62e1975a33a9cc10448165c) Signed-off-by: Sona Sarmadi Signed-off-by: Richard Purdie Signed-off-by: Sona Sarmadi Conflicts: meta/recipes-connectivity/connman/connman_1.33.bb Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

openssl-native: Compile with -fPIC

2017-08-29T15:50:52+00:00

Fixes | /usr/bin/ld: libcrypto.a(sha1-x86_64.o): relocation R_X86_64_PC32 against undefined symbol `OPENSSL_ia32cap_P' can not be used when making a shared object; recompile with -fPIC | /usr/bin/ld: final link failed: Bad value (From OE-Core rev: 9e6a0da06aa832fbce06326622744b2a5ab9c091) Signed-off-by: Khem Raj (cherry picked from commit 0a19e72081771fca8ed94fb2a2a8996fd3dce00c) Signed-off-by: Mirza Krak Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

bind: Security fix CVE-2016-6170

2017-05-18T12:07:34+00:00

CVE-2016-6170: ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server crash) via a large AXFR response, and possibly allows IXFR servers to cause a denial of service (IXFR client crash) via a large IXFR response and allows remote authenticated users to cause a denial of service (primary DNS server crash) via a large UPDATE message. External References: https://nvd.nist.gov/vuln/detail/CVE-2016-6170 Patch from: https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commit;h=1bbcfe2fc84f57b1e4e075fb3bc2a1dd0a3a851f (From OE-Core rev: 14abd767349bc868ca59838f1af3aaf17dfe4350) (From OE-Core rev: 1d7829ce5e125d9c416ebd66e9363e78f8f5ae1c) Signed-off-by: Yi Zhao Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie

bind: Security fix CVE-2016-8864

2017-05-18T12:07:34+00:00

CVE-2016-8864: named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c. External References: https://nvd.nist.gov/vuln/detail/CVE-2016-8864 Patch from: https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commit;h=c1d0599a246f646d1c22018f8fa09459270a44b8 (From OE-Core rev: c06f3a5993c7d63d91840c2a4d5b621e946ef78f) (From OE-Core rev: 6c1969bf82f36650c696c9fd7f0aa35d60dc4214) Signed-off-by: Yi Zhao Signed-off-by: Ross Burton Signed-off-by: Richard Purdie Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie