linux/poky.git/meta/recipes-devtools/dpkg/dpkg_1.17.25.bb, branch master-uninative

dpkg: update to 1.18.2

2015-09-01T10:44:03+00:00

check_snprintf.patch has been dropped, because it seems to fix a problem that doesn't anymore exist, and doesn't have any description of what the problem was and how was it fixed. tarfix.patch has been merged upstream. The rest of the patches have been rebased to the new upstream release (From OE-Core rev: c11b2be13a6d5e34f2baed4b8ee8ccd66438c1de) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie

dpkg: Fix for Fedora22 and new versions of tar

2015-07-13T12:47:28+00:00

They managed to 'break' tar. Again. Sorry, they fixed a regression which broke dpkg-deb. The addition of: http://git.savannah.gnu.org/cgit/tar.git/commit/?id=163e96a0e619a900eab6de827c7c5749ecc9d3f2 ("Bugfix: entries read from the -T file did not get proper matching_flag.") means that the no-recursion option gets lost. This leads to many files getting included multiple times, along with files which shouldn't be there. The commit message is horrendous. The patch actually makes the option positional (as documnted since 2003) and therefore doesn't affect the input from the -T option. Moving the --no-reursion option to earlier in the command avoids the bug. The bug was not present in tar 1.28 however it has been backported in at least Fedora 22 and heading into Fedora 21. Redhat reports of issue: https://bugzilla.redhat.com/show_bug.cgi?id=1230762 [tar] https://bugzilla.redhat.com/show_bug.cgi?id=1241508 [dpkg] Discussion of bug in upstream tar: http://www.mail-archive.com/bug-tar@gnu.org/msg04799.html [YOCTO #7988] (From OE-Core rev: 6be698b7270f73f40d38713ecf13f12aec0ced61) Signed-off-by: Richard Purdie

dpkg: upgrade to 1.17.25

2015-04-30T22:04:15+00:00

upgrade to fix two CVE defects: CVE-2014-8625 and CVE-2015-0840 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8625 Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in dpkg before 1.17.22 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) package or (2) architecture name. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0840 The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc). (From OE-Core rev: 079445990f51f98c8d4f9397dec0ed91ca2490c3) Signed-off-by: Roy Li Signed-off-by: Richard Purdie