linux/poky.git/meta/recipes-devtools/ruby/ruby_2.4.1.bb, branch genericarm64

ruby: upgrade to 2.4.2

2017-11-05T22:33:21+00:00

The CVE-2017-14064 patch is already at 2.4.2 as explained on project's commit, so removing from the recipe & repo. commit 83735ba29a0bfdaffa8e9c2a1dc025c3b0b63153 Author: hsbt Date: Wed Apr 12 00:21:18 2017 +0000 Merge json-2.0.4. * https://github.com/flori/json/releases/tag/v2.0.4 * https://github.com/flori/json/blob/09fabeb03e73ed88dc8ce8f19d76ac59e51dae20/CHANGES.md#2017-03-23-204 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@58323 b2dd03c8-39d4-4d8f-98ff-823fe69b080e (From OE-Core rev: 6e37a88af155d5e5453fb0f44bb11d6f8e406438) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: CVE-2017-14064

2017-09-18T10:07:30+00:00

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-14064 Upstream patch: https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85 (From OE-Core rev: 17dbfd967019f9b50a9f6aa3f48cd3658fcccc70) Signed-off-by: Ovidiu Panait Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: fix CVE-2017-922{6-9}

2017-08-19T21:15:39+00:00

CVE-2017-9226 : check too big code point value for single byte CVE-2017-9227 : access to invalid address by reg->dmin value CVE-2017-9228 : invalid state(CCS_VALUE) in parse_char_class() CVE-2017-9229 : access to invalid address by reg->dmax value (From OE-Core rev: f15f01edbaa431829a50053d07ed6d6b333584c7) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie

ruby: fix CVE-2017-9224

2017-08-18T09:40:26+00:00

Use DATA_ENSURE(1) before access. (From OE-Core rev: 9db907a0bd331c47c4882b82f9f1d2a7ef1f6d1f) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie

ruby: upgrade to 2.4.1

2017-05-25T22:59:32+00:00

(From OE-Core rev: 3ff2d0bc7a8e7a7e8c8e953dc0ccf84d891688ef) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie