linux/poky.git/meta/recipes-devtools/ruby, branch yocto-2.4

ruby: CVE-2017-14064

2017-09-18T10:07:30+00:00

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call. The issues lies in using strdup in ext/json/ext/generator/generator.c, which will stop after encountering a '\0' byte, returning a pointer to a string of length zero, which is not the length stored in space_len. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-14064 Upstream patch: https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85 (From OE-Core rev: 17dbfd967019f9b50a9f6aa3f48cd3658fcccc70) Signed-off-by: Ovidiu Panait Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: fix CVE-2017-922{6-9}

2017-08-19T21:15:39+00:00

CVE-2017-9226 : check too big code point value for single byte CVE-2017-9227 : access to invalid address by reg->dmin value CVE-2017-9228 : invalid state(CCS_VALUE) in parse_char_class() CVE-2017-9229 : access to invalid address by reg->dmax value (From OE-Core rev: f15f01edbaa431829a50053d07ed6d6b333584c7) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie

ruby: fix CVE-2017-9224

2017-08-18T09:40:26+00:00

Use DATA_ENSURE(1) before access. (From OE-Core rev: 9db907a0bd331c47c4882b82f9f1d2a7ef1f6d1f) Signed-off-by: Joe Slater Signed-off-by: Richard Purdie

meta: Add/fix missing Upstream-Status to patches

2017-06-27T09:38:43+00:00

This adds or fixes the Upstream-Status for all remaining patches missing it in OE-Core. (From OE-Core rev: 563cab8e823c3fde8ae4785ceaf4d68a5d3e25df) Signed-off-by: Richard Purdie

ruby: upgrade to 2.4.1

2017-05-25T22:59:32+00:00

(From OE-Core rev: 3ff2d0bc7a8e7a7e8c8e953dc0ccf84d891688ef) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: upgrade 2.3.3 -> 2.4.0

2017-03-01T23:27:11+00:00

Two LIC_FILES_CHKSUM checksums changed (COPYING and LEGAL) but LICENSE remains the same. (From OE-Core rev: 2bbad067b6b928d4615df938d0e41fa84e451c15) Signed-off-by: Leonardo Sandoval Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: fix upstream version check

2017-03-01T23:27:08+00:00

(From OE-Core rev: 0299731f9c11fda2e0a17600f758e0d7ff31fbbe) Signed-off-by: Alexander Kanavin Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

recipes: Make use of the new bb.utils.filter() function

2017-03-01T11:17:45+00:00

(From OE-Core rev: 0a1427bf9aeeda6bee2cc0af8da4ea5fd90aef6f) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

ruby: upgrade to 2.3.3

2016-12-22T08:50:16+00:00

(From OE-Core rev: 99000d8bc30fe1eed60499140efa3a4cf0360478) Signed-off-by: Edwin Plauchu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

ruby: upgrade to 2.3.1

2016-11-30T15:48:09+00:00

(From OE-Core rev: 11063a01d4511b2688ea7ba2d7359e4e07328c66) Signed-off-by: Edwin Plauchu Signed-off-by: Ross Burton Signed-off-by: Richard Purdie